Between asa 5510 and router VPN

Similar Questions

• Help with a VPN tunnel between ASA 5510 and Juniper SSG20

  Hello

  We have a customer wanting to configure a VPN Site to Site tunnel between a new purchased 5510 of ASA located in his direction with its Juniper SSG20 Office, located in the main office. We contacted HP and they send us a Cisco professional to do the job.

  After 2 days from 16:00 to 22:00 and error and countless hours of research online and nunerous calls, we are still unable to get traffic from the network of agencies to enter the tunnel.

  Main branch
  1.1.1.2                                 1.1.1.1
  -----                                               -----------
  192.168.8.0/24 | ASA|-----------------------------------| Juniper |    192.168.1.0/24
  -----                                               -----------
  192.168.8.254 192.168.1.254

  According to Cisco professionals, the tunnel is now in place but no traffic through. We are unable to ping anything on the network on the other side (192.168.1.0/24). We receive timeout ping all the time. The Cisco professional told us it's a routing or NAT problem and he's working on a solution!

  Through research, I came across a post on Experts-Exchange (here) [the 1st comment on the original post] which States "...". that both sides of the VPN must have a different class of LAN for the VPN to work... " Would that be our problem?

  It has become a critical issue to the point that he had to replace the Cisco ASA with a temporary Juniper SSG5 on another subnet (192.168.7.0/24) to get the tunnel upward and through traffic until the ASA VPN issue is resolved and I didn't need to say that the client is killing us!

  Help is very appreciated.

  Thank you

  1. Yes, ping package from the interface of the ASA is considered valuable traffic to the LAN of Juniper.

  SAA, need you traffic from the interface source ASA's private, because interesting to determine by crypto ACL MYLIST traffic between 192.168.8.0/24 and 192.168.1.0/24.

  You will also need to add the following configuration to be able to get the ping of the interface of the ASA:

  management-private access

  To initiate the ping of the private interface ASA:

  ping 192.168.1.254 private

  2. the default time before the next generation of new key is normally 28800 seconds, and if there is no interesting traffic flowing between 2 subnets, he'll tear the VPN tunnel down. As soon as there is interesting traffic, the VPN tunnel will be built automatically into the next generation of new key. However, if there is traffic before generating a new key, the new tunnel will be established, and VPN tunnel will remain standing and continue encrypt and decrypt traffic.

  Currently, your configuration has been defined with ITS lifetime of 3600 seconds GOLD / 4608000 kilobytes of traffic before the next generate a new key (it will be either 3600 seconds, or 4608000 kilobytes period expires first). You can certainly change it by default to 28800 seconds without configuring kilobytes. SA life is negotiated between the ASA and Juniper, and whatever is the lowest value will be used.

  Hope that helps.

• VPN site to Site ASA 5510 and 871 w / dynamic IP

  What is the best method of creating a VPN site-to site between an ASA 5510 and a router 871 where the 5510 has a static IP address and has 871, a dynamic IP address?

  My ASA is running ASA software version 7.0 (5) and I can't find how to create a tunnel for a dynamic IP address via the ASDM. I have currently a tunnel between these two arrangements in place, but it was done by specifying the remote IP address, even if it is dynamic.

  Any suggestions or pointers would be * very * appreciated.

  -Adam

  This can help but it does not show ASDM.

  http://Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

• Split tunnel with ASA 5510 and PIX506.

  Hello

  I have the production between Asa 5510 (main office) and Pix 506 VPN tunnel. It is configured so that all traffic is encrypted and moves through the tunnel. This includes remote users behind Pix Internet traffic. I would like to use split tunnel and direct Internet traffic hitting the web directly from Pix instead of going through the tunnel. How can I do this safely? Please see current config Pix below:

  :
  6.3 (5) PIX version
  interface ethernet0 car
  interface ethernet1 10baset
  ethernet0 nameif outside security0
  nameif ethernet1 inside the security100

  clock timezone EDT - 5
  clock to summer time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 02:00
  No fixup protocol dns
  fixup protocol ftp 21
  fixup protocol h323 h225 1720
  fixup protocol h323 ras 1718-1719
  fixup protocol http 80
  fixup protocol they 389
  fixup protocol rsh 514
  fixup protocol rtsp 554
  fixup protocol sip 5060
  No fixup protocol sip udp 5060
  fixup protocol 2000 skinny
  fixup protocol smtp 25
  fixup protocol sqlnet 1521
  no correction protocol tftp 69
  names of
  allow VPN 192.x.x.x 255.255.255.0 ip access list one
  LocalNet ip access list allow a whole
  pager lines 20
  opening of session
  monitor debug logging
  logging warnings put in buffered memory
  logging trap warnings
  Outside 1500 MTU
  Within 1500 MTU
  IP address outside 24.x.x.x 255.255.255.0
  IP address inside192.x.x.x 255.255.255.0
  IP audit name Outside_Attack attack action alarm down reset
  IP audit name Outside_Recon info action alarm down reset
  interface IP outside the Outside_Recon check
  interface IP outside the Outside_Attack check
  alarm action IP verification of information
  reset the IP audit attack alarm drop action
  disable signing verification IP 2000
  disable signing verification IP 2001
  disable signing verification IP 2004
  disable signing verification IP 2005
  disable signing verification IP 2150
  PDM logging 100 information
  history of PDM activate
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0 access-list LocalNet
  Route outside 0.0.0.0 0.0.0.0 24.x.x.x
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225
  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00
  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00
  Timeout, uauth 0:05:00 absolute
  GANYMEDE + Protocol Ganymede + AAA-server
  AAA-server GANYMEDE + 3 max-failed-attempts
  AAA-server GANYMEDE + deadtime 10
  RADIUS Protocol RADIUS AAA server
  AAA-server RADIUS 3 max-failed-attempts
  AAA-RADIUS deadtime 10 Server
  AAA-server local LOCAL Protocol
  Enable http server
  enable floodguard
  Permitted connection ipsec sysopt
  Crypto ipsec transform-set esp-3des esp-md5-hmac AMC
  map UrgentCare 10 ipsec-isakmp crypto
  card crypto UrgentCare 10 corresponds to the VPN address
  card crypto UrgentCare 10 set counterpart x.x.x.x
  card crypto UrgentCare 10 value transform-set AMC
  UrgentCare interface card crypto outside
  ISAKMP allows outside
  ISAKMP key * address x.x.x.x 255.255.255.255 netmask
  ISAKMP identity address
  part of pre authentication ISAKMP policy 20
  ISAKMP policy 20 3des encryption
  ISAKMP policy 20 md5 hash
  20 2 ISAKMP policy group
  ISAKMP duration strategy of life 20 86400
  SSH timeout 15
  Console timeout 0
  Terminal width 80
  Cryptochecksum:9701c306b05151471c437f29695ffdbd
  : end

  I would do something by changing the acl that applies to your crypto card. You want to know what you want to support above the tunnel and then deny other networks.

  If you have:

  192.168.3.0/24

  192.168.4.0/24

  10.10.10.0/24

  172.16.0.0/16

  Do something like:

  VPN access list allow 192.x.x.x ip 255.255.255.0 192.168.3.0 255.255.255.0

  VPN access list allow 192.x.x.x ip 255.255.255.0 192.168.4.0 255.255.255.0

  VPN access list allow 192.x.x.x ip 255.255.255.0 10.10.10.0 255.255.255.0

  VPN access list allow 192.x.x.x 255.255.255.0 ip 172.16.0.0 255.255.0.0

  Then when the traffic is destined for something other than these networks, it will go not to the ISP instead of the tunnel.

  HTH,

  John

• Site to Site VPN - ASA 5510 / 851 router - no Sas?

  We have installed an ASA 5510, version 1.0000 software running.  In a remote area, we have a Cisco router to 851 with tunneling IPSec VPN for a PIX 515e.  I try to open a backup between the 851 and ASA connection new, and I have a problem.  I used ASDM on the side of the ASA and CCP on the side 851 and created a new VPN site to site on both, with PSK encryption algorithms, etc..  I checked the connectivity between the external interfaces of the two devices, and the associated ACLs are simple, because they allow all IP traffic on the internal side of the two devices to talk with each other.

  When I do a "crypto isakmp to show his" on the SAA, I get "there is no its isakmp.  When I do the same on the 851 router, I see only the existing connection to the PIX.  It seems that the tunnel does not run again.  I turned on debug various crypto and sent a series of pings, and I don't see any tunnel initiaion even be attempted.

  CCP has a VPN to test the tool built in to the router.  ASDM has a similar feature?  Here's the relevant configs (at least I think... the SAA is enough Greek to me):

  ASA 5510 (within the network of 10.20.0.0/16.  The perfectly functional PIX is also on this network, with a different public IP address)

   access-list ATTOutside_2_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 10.192.0.0 255.255.0.0 ! 
  nat (Inside,ATTOutside) source static NETWORK_OBJ_10.20.0.0_16 NETWORK_OBJ_10.20.0.0_16 destination static NETWORK_OBJ_10.192.0.0_16 NETWORK_OBJ_10.192.0.0_16 
  !
  crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map ATTOutside_map 2 match address ATTOutside_2_cryptomap crypto map ATTOutside_map 2 set peer 24.140.152.144 crypto map ATTOutside_map 2 set transform-set ESP-3DES-MD5 crypto map ATTOutside_map interface ATTOutside 
  !
  crypto isakmp enable ATTOutside crypto isakmp enable Inside crypto isakmp policy 10 authentication crack encryption aes-256 hash sha group 2 lifetime 86400 crypto isakmp policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto isakmp policy 40 authentication crack encryption aes-192 hash sha group 2 lifetime 86400 crypto isakmp policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto isakmp policy 60 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto isakmp policy 70 authentication crack encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 90 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 100 authentication crack encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 130 authentication crack encryption des hash sha group 2 lifetime 86400 crypto isakmp policy 140 authentication rsa-sig encryption des hash sha group 2 lifetime 86400 crypto isakmp policy 150 authentication pre-share encryption des hash sha group 2 lifetime 86400 crypto isakmp policy 170 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 
  !
  tunnel-group 24.140.152.144 type ipsec-l2l tunnel-group 24.140.152.144 ipsec-attributes 
  !
  
  851 router (within the 10.192.4.0/24 network)
  
  
  crypto isakmp policy 1
  encr 3des
  authentication pre-share
  group 2
  !
  crypto isakmp policy 2
  encr 3des
  authentication pre-share
  group 2
  !
  crypto isakmp policy 3
  encr 3des
  hash md5
  authentication pre-share
  group 2
  crypto isakmp key si9bw1u8woaz address 65.42.15.142
  crypto isakmp key 123 address 12.49.251.3
  !
  !
  crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
  crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac
  crypto ipsec transform-set ESP_3DES_MD5 esp-3des esp-md5-hmac
  !
  crypto map SDM_CMAP_1 1 ipsec-isakmp
  description Tunnel to65.42.15.142
  set peer 65.42.15.142
  set transform-set ESP-3DES-SHA1
  match address 102
  crypto map SDM_CMAP_1 2 ipsec-isakmp
  description Tunnel to12.49.251.3
  set peer 12.49.251.3
  set transform-set ESP_3DES_MD5
  match address 102
  !
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.20.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.1.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.10.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.11.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.12.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.13.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.14.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.18.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.19.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.22.0.0 0.0.255.255
  access-list 102 permit ip 10.192.4.0 0.0.0.255 10.23.0.0 0.0.255.255
  			 
  Michael,
  Since you are using the same ACL, subnets, even and even while on your router to your VPN 1 tunnels config and 2, your second VPN tunnel will not succeed because the router already has a tunnel with the PIX for the same traffic.
  If you want to configure the ASA as peer backup scratch the second card encryption and instead, add the public IP ASA as a second peer under the original crypto configuration.
  Like this:
  crypto map SDM_CMAP_1 1 ipsec-isakmp
  description Tunnel to65.42.15.142
  set peer 65.42.15.142
  set peer 12.49.251.3
  game of transformation-ESP-3DES-SHA1
  
  match address 102
  
  The router will attempt to connect to the PIX and if this fails (which means that the PIX has never responded) then it will try to connect to the ASA.
  To test it, you could do either of two things: 1. taking the internet conection low PIX will make the router try to connect to the secondary host. 2: change (temporarily) on the router address peer of the PIX to a bogus IP that won't respond, when only one omits the router must try to negotiate with the ASA.
  I hope this helps.
  Raga
  		   

• site-to-site between ASA 5510 (8.4 (2)) w / static IP and Dlink DIR130 w / dynamic IP.

  I'm trying to implement a VPN site link to site between the ASA5510 we use exclusively as a VPN endpoint on campus and a D-Link DIR130 router off campus, to a local company with a dynamically assigned IP address.  We currently use the ASA to remote access users who use the Cisco VPN client on mobile devices, as well as a link to site-to-site unique in our telecommunications provider for the purposes of remote monitoring telecoms equipment.

  We are looking for a way to deploy at a lower cost of VPN connections for local businesses to allow them to use the devices for sale which connect to systems on campus, so students can use their meal in local restaurants cards, similar to the way they use them in the cafeteria on campus.

  I have experience setting up Cisco switches, routers and APs, but ASA appliance absolutely baffles me.  I futzed with the AMPS 6.4 config autour gui and tried to match the configurations between the DIR130 and the ASA, but I can never get a VPN to come.  Anyone who can point me to an example, or provide me with help on this would be appreciated.  I have google searched and found very little, with my limited experience in setting up ASA, I ask to my script.

  You must configure the static route on the 6509 for 192.168.5.0/24 to ASA inside the interface:

  IP route 192.168.5.0 255.255.255.0 131.162.160.2

  Assuming that 131.162.160.1 is your 6509

• VPN site-to-site between ASA 5505 and 2911

  Hi all

  I'm trying to setup VPN S2S. A.a.a.a of ip for the router 2911 office, remote office ASA 5505 8.4 (3) with ip b.b.b.b, but no luck.

  2911 config:

  !

  version 15.2

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  encryption password service

  !

  host name 2911

  !

  boot-start-marker

  Boot system flash c2900-universalk9-mz. Spa. 152 - 2.T.bin

  boot-end-marker

  !

  !

  Min-length 10 Security passwords

  logging buffered 51200 warnings

  !

  No aaa new-model

  !

  !

  min-threshold queue spd IPv6 62

  Max-threshold queue spd IPv6 63

  No ipv6 cef

  the 5 IP auth-proxy max-login-attempts

  max-login-attempts of the IP 5 admission

  !

  !

  !

  DHCP excluded-address IP 192.168.10.1 192.168.10.99

  DHCP excluded-address IP 192.168.22.1 192.168.22.99

  DHCP excluded-address IP 192.168.33.1 192.168.33.99

  DHCP excluded-address IP 192.168.44.1 192.168.44.99

  DHCP excluded-address IP 192.168.55.1 192.168.55.99

  192.168.10.240 IP dhcp excluded-address 192.168.10.254

  DHCP excluded-address IP 192.168.22.240 192.168.22.254

  DHCP excluded-address IP 192.168.33.240 192.168.33.254

  DHCP excluded-address IP 192.168.44.240 192.168.44.254

  DHCP excluded-address IP 192.168.55.240 192.168.55.254

  !

  desktop IP dhcp pool

  import all

  network 192.168.33.0 255.255.255.0

  router by default - 192.168.33.254

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  wi - fi IP dhcp pool

  import all

  network 192.168.44.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.44.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  DMZ IP dhcp pool

  import all

  network 192.168.55.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.55.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  IP dhcp pool voip

  import all

  network 192.168.22.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.22.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  IP dhcp pool servers

  import all

  network 192.168.10.0 255.255.255.0

  default router 192.168.10.254

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  !

  IP domain name of domain

  name-server IP 192.168.10.10

  IP cef

  connection-for block 180 tent 3-180

  Timeout 10

  VLAN ifdescr detail

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki token removal timeout default 0

  !

  Crypto pki trustpoint TP-self-signed-3956567439

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 3956567439

  revocation checking no

  rsakeypair TP-self-signed-3956567439

  !

  !

  TP-self-signed-3956567439 crypto pki certificate chain

  certificate self-signed 01 nvram:IOS - Self-Sig #1.cer

  license udi pid sn CISCO2911/K9

  !

  !

  the FULL_NET object-group network

  full range of the network Description

  192.168.10.0 255.255.255.0

  192.168.11.0 255.255.255.0

  192.168.22.0 255.255.255.0

  192.168.33.0 255.255.255.0

  192.168.44.0 255.255.255.0

  !

  object-group network limited

  description without servers and router network

  192.168.22.0 255.255.255.0

  192.168.33.0 255.255.255.0

  192.168.44.0 255.255.255.0

  !

  VTP version 2

  password username admin privilege 0 password 7

  !

  redundancy

  !

  !

  !

  !

  !

  no passive ftp ip

  !

  !

  crypto ISAKMP policy 10

  BA aes 256

  sha512 hash

  preshared authentication

  ISAKMP crypto key admin address b.b.b.b

  invalid-spi-recovery crypto ISAKMP

  !

  !

  Crypto ipsec transform-set esp - aes esp-sha-hmac SET

  !

  !

  !

  10 map ipsec-isakmp crypto map

  the value of b.b.b.b peer

  Set transform-set

  match address 160

  !

  !

  !

  !

  !

  Interface Port - Channel 1

  no ip address

  waiting-150 to

  !

  Interface Port - channel1.1

  encapsulation dot1Q 1 native

  IP 192.168.11.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.10

  encapsulation dot1Q 10

  IP address 192.168.10.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.22

  encapsulation dot1Q 22

  IP 192.168.22.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.33

  encapsulation dot1Q 33

  IP 192.168.33.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.44

  encapsulation dot1Q 44

  IP 192.168.44.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.55

  encapsulation dot1Q 55

  IP 192.168.55.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  the Embedded-Service-Engine0/0 interface

  no ip address

  Shutdown

  !

  interface GigabitEthernet0/0

  Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE $ 0/0

  no ip address

  Shutdown

  automatic duplex

  automatic speed

  !

  interface GigabitEthernet0/1

  no ip address

  automatic duplex

  automatic speed

  channel-group 1

  !

  interface GigabitEthernet0/2

  Description $ES_LAN$

  no ip address

  automatic duplex

  automatic speed

  channel-group 1

  !

  interface GigabitEthernet0/0/0

  IP address a.a.a.a 255.255.255.224

  NAT outside IP

  IP virtual-reassembly in

  automatic duplex

  automatic speed

  crypto map

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  23 class IP http access

  local IP http authentication

  IP http secure server

  IP http timeout policy slowed down 60 life 86400 request 10000

  !

  overload of IP nat inside source list NAT_INTERNET interface GigabitEthernet0/0/0

  IP nat inside source udp 500 interface GigabitEthernet0/0/0 500 a.a.a.a static

  IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx

  !

  NAT_INTERNET extended IP access list

  refuse the object-group ip FULL_NET 192.168.17.0 0.0.0.255

  refuse the object-group ip FULL_NET 192.168.1.0 0.0.0.255

  permit ip FULL_NET object-group everything

  !

  access-list 1 permit 192.168.44.100

  access-list 23 allow 192.168.10.7

  access-list 23 permit 192.168.44.0 0.0.0.255

  access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

  access-list 160 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  password password 7

  opening of session

  line to 0

  line 2

  no activation-character

  No exec

  preferred no transport

  transport of entry all

  transport output pad rlogin lapb - your MOP v120 udptn ssh telnet

  StopBits 1

  line vty 0 4

  access-class 23 in

  privilege level 15

  local connection

  entry ssh transport

  line vty 5 15

  access-class 23 in

  privilege level 15

  local connection

  entry ssh transport

  !

  Scheduler allocate 20000 1000

  !

  end

  The ASA config:

  : Saved : ASA Version 8.4(3) ! hostname C domain-name domain enable password password encrypted passwd passwd encrypted names ! interface Ethernet0/0 ! interface Ethernet0/1 shutdown ! interface Ethernet0/2 shutdown ! interface Ethernet0/3 shutdown ! interface Ethernet0/4 shutdown ! interface Ethernet0/5 switchport access vlan 100 ! interface Ethernet0/6 switchport trunk allowed vlan 2,6 switchport mode trunk ! interface Ethernet0/7 shutdown ! interface Vlan1 description INTERNET mac-address 1234.5678.0001 nameif WAN security-level 0 ip address b.b.b.b 255.255.255.248 standby c.c.c.c ospf cost 10 ! interface Vlan2 description OLD-PRIVATE mac-address 1234.5678.0102 nameif OLD-Private security-level 100 ip address 192.168.17.2 255.255.255.0 standby 192.168.17.3 ospf cost 10 ! interface Vlan6 description MANAGEMENT mac-address 1234.5678.0106 nameif Management security-level 100 ip address 192.168.1.2 255.255.255.0 standby 192.168.1.3 ospf cost 10 ! interface Vlan100 description LAN Failover Interface ! boot system disk0:/asa843-k8.bin ftp mode passive clock timezone NZST 12 clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 2:00 dns domain-lookup WAN dns server-group DefaultDNS name-server 208.67.222.222 domain-name domain same-security-traffic permit intra-interface object network obj-192.168.17.0 subnet 192.168.17.0 255.255.255.0 object network obj-192.168.10.0 subnet 192.168.10.0 255.255.255.0 object network obj-192.168.2.0 subnet 192.168.2.0 255.255.255.0 object network obj-192.168.9.0 subnet 192.168.9.0 255.255.255.0 object network obj-192.168.33.0 subnet 192.168.33.0 255.255.255.0 object network obj-192.168.44.0 subnet 192.168.44.0 255.255.255.0 object network obj_any object network obj_any-01 object network NETWORK_OBJ_192.168.10.0_24 subnet 192.168.10.0 255.255.255.0 object network NETWORK_OBJ_192.168.17.0_24 subnet 192.168.17.0 255.255.255.0 object network subnet-00 subnet 0.0.0.0 0.0.0.0 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service RDP tcp description RDP port-object eq 3389 object-group network DM_INLINE_NETWORK_1 network-object 192.168.17.0 255.255.255.0 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network DM_INLINE_NETWORK_2 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network subnet-17 network-object 192.168.17.0 255.255.255.0 object-group network subnet-2 network-object 192.168.2.0 255.255.255.0 object-group network subnet-9 network-object 192.168.9.0 255.255.255.0 object-group network subnet-10 network-object 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP standard permit 192.168.17.0 255.255.255.0 access-list WAN_access_in extended permit ip any any log debugging access-list WAN_access_in extended permit tcp any object-group RDP any object-group RDP log debugging access-list WAN_access_in extended permit icmp x.x.x.x 255.255.255.248 192.168.10.0 255.255.255.0 access-list MANAGEMENT_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit icmp any object-group DM_INLINE_NETWORK_1 access-list 101 extended permit tcp host 192.168.10.7 any eq 3389 log debugging access-list WAN_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_1_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list CiscoVPNClient_splitTunnelAcl standard permit 192.168.17.0 255.255.255.0 access-list LAN_access_in extended permit ip any any log debugging access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP_inbound standard permit 192.168.10.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 access-list vpnusers_splitTunnelAcl extended permit ip 192.168.17.0 255.255.255.0 any access-list nonat-in extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 52000 logging monitor informational logging trap informational logging asdm informational logging from-address syslog logging recipient-address admin level errors logging host OLD-Private 192.168.17.110 format emblem logging debug-trace logging permit-hostdown mtu WAN 1500 mtu OLD-Private 1500 mtu Management 1500 ip local pool VPN_Admin_IP 192.168.1.150-192.168.1.199 mask 255.255.255.0 ip local pool vpnclient 192.168.2.1-192.168.2.5 mask 255.255.255.0 failover failover lan unit primary failover lan interface failover Vlan100 failover polltime interface 15 holdtime 75 failover key ***** failover interface ip failover 192.168.100.1 255.255.255.0 standby 192.168.100.2 icmp unreachable rate-limit 1 burst-size 1 icmp permit 192.168.10.0 255.255.255.0 WAN icmp permit host x.x.x.x WAN icmp permit 192.168.17.0 255.255.255.0 WAN icmp permit host c.c.c.c WAN icmp permit host a.a.a.a WAN icmp deny any WAN icmp permit 192.168.10.0 255.255.255.0 OLD-Private icmp permit 192.168.17.0 255.255.255.0 OLD-Private icmp permit host a.a.a.a OLD-Private icmp permit host 192.168.10.0 Management icmp permit host 192.168.17.138 Management icmp permit 192.168.1.0 255.255.255.0 Management icmp permit host 192.168.1.26 Management icmp permit host a.a.a.a Management asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-10 subnet-10 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-2 subnet-2 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-9 subnet-9 no-proxy-arp nat (Management,WAN) source static NETWORK_OBJ_192.168.17.0_24 NETWORK_OBJ_192.168.17.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup ! object network subnet-00 nat (OLD-Private,WAN) dynamic interface access-group WAN_access_in in interface WAN access-group OLD-PRIVATE_access_in in interface OLD-Private access-group MANAGEMENT_access_in in interface Management route WAN 0.0.0.0 0.0.0.0 x.x.x.x 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa local authentication attempts max-fail 10 http server enable http b.b.b.b 255.255.255.255 WAN http 0.0.0.0 0.0.0.0 WAN no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart service resetoutside crypto ipsec ikev1 transform-set OFFICE esp-aes esp-sha-hmac crypto map WAN_map 1 match address WAN_1_cryptomap crypto map WAN_map 1 set pfs crypto map WAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map Office 2 match address WAN_1_cryptomap crypto map Office 2 set peer a.a.a.a crypto map Office interface WAN crypto map MAP 10 set peer a.a.a.a crypto map MAP 10 set ikev1 transform-set OFFICE crypto ikev2 enable WAN crypto ikev1 enable WAN crypto ikev1 policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption des hash sha group 1 lifetime 86400 telnet timeout 5 ssh a.a.a.a 255.255.255.255 WAN ssh timeout 30 ssh version 2 console timeout 0 dhcpd auto_config OLD-Private ! threat-detection basic-threat threat-detection statistics host threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 129.6.15.28 source WAN prefer webvpn group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ssl-client ssl-clientless group-policy admin internal group-policy admin attributes dns-server value 208.67.222.222 156.154.70.1 vpn-tunnel-protocol ikev1 group-policy GroupPolicy_a.a.a.a internal group-policy GroupPolicy_a.a.a.a attributes vpn-tunnel-protocol ikev1 ikev2 group-policy CiscoVPNClient internal group-policy CiscoVPNClient attributes vpn-idle-timeout 30 vpn-session-timeout none vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value CiscoVPNClient_splitTunnelAcl username admin password password encrypted privilege 15 tunnel-group admin type remote-access tunnel-group admin general-attributes address-pool vpnclient authorization-server-group LOCAL default-group-policy admin tunnel-group a.a.a.a type ipsec-l2l tunnel-group a.a.a.a general-attributes default-group-policy GroupPolicy_a.a.a.a tunnel-group a.a.a.a ipsec-attributes ikev1 pre-shared-key ***** ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** tunnel-group CiscoVPNClient type remote-access tunnel-group CiscoVPNClient general-attributes address-pool vpnclient default-group-policy CiscoVPNClient tunnel-group CiscoVPNClient ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp ! service-policy global_policy global smtp-server 192.168.17.10 prompt hostname context no call-home reporting anonymous call-home contact-email-addr admin contact-name admin profile CiscoTAC-1   no active : end asdm image disk0:/asdm-647.bin asdm location c.c.c.c 255.255.255.255 WAN asdm location 192.168.17.2 255.255.255.255 WAN asdm location a.a.a.a 255.255.255.255 OLD-Private no asdm history enable 

  ASA:

  # show crypto ipsec his

  There is no ipsec security associations

  # show crypto isakmp his

  There are no SAs IKEv1

  There are no SAs IKEv2

  2911:

  #show crypto ipsec his

  Interface: GigabitEthernet0/0/0

  Tag crypto map: map, addr a.a.a.a local

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.17.0/255.255.255.0/0/0)

  current_peer b.b.b.b port 500

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0

  #pkts not unpacked: 0, #pkts decompress failed: 0

  Errors of #send 4, #recv errors 0

  local crypto endpt. : a.a.a.a, remote Start crypto. : b.b.b.b

  Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0/0

  current outbound SPI: 0x0 (0)

  PFS (Y/N): N, Diffie-Hellman group: no

  SAS of the esp on arrival:

  -Other - arrival ah sas:

  -More-

  -More - CFP sas on arrival:

  -More-

  -More - outgoing esp sas:

  -More-

  -More - out ah sas:

  -More-

  -More - out CFP sas:

  Thanks for your time,

  Nick

  Please add

  map Office 2 set transform-set OFFICE ikev1 crypto

  If it is not helpful, please enable debug crypto ipsec 255 and paste here.
  
  HTH. Please rate if it was helpful. "Correct answer" will be also pleasant.

• LAN to Lan tunnel between ASA 5505 and 3030.

  I am unable to build a tunnel vpn site-to-site between an ASA 5505 and our Cisco 3030.  I tried all possible combinations except one that will work.  I am able to ping each peer on the other site.  Someone at - it a config between two tunnels of Lan to Lan to work between a 5505 and 3030 that works.  Thank you

  Hello

  Please visit this link using config:

  http://www.Cisco.com/c/en/us/support/docs/security/VPN-3000-series-conce...

  Kind regards

  Aditya

  Please evaluate the useful messages.

• Cisco ASA 5510 - restrictions of VPN (AnyConnect) based on the AD user or IP address

  Hello

  I want to test how to restrict access user on an ASA 5510 AnyConnect. In politics, I can define what networks will go through the VPN tunnel and which not (split tunneling). The ASA has a LDAP connection and only AD users with a special security group can connect over AnyConnect.
  On the other hand I would like to restrict access for special users within a VPN policy.

  So my question:
  What are your recommendations to implement this szenario?

  My two ideas would be:
  1. the access rules based on the user of the AD.
  2. special reserve IP addresses in the pool of addresses AnyConnect for some users, so I can limit access to the normal firewall rules base based on the source IP address.

  What are your recommendations and is it possible to realize my ideas (and how)?

  Thanks in advance

  Best regards

  Hello

  I will suggest that you configure a second ad group in the server and another group strategy in the ASA, you can configure certain access on each group policy "the installer of the filters, assign different split political tunnel, different ACL' and in the ad server, you can assign users for example to the AD Group A and AD Group B based on the access you want to give them now , you must configure LDAP mapping to assign the user specific group policy that you want based on the AD group that they belong.

  You can follow this documentation that will help you configure the LDAP Mapping:

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

  Best regards, please rate.

• Unable to pass traffic between ASA Site to Site VPN Tunnel

  Hello

  I have problems passing traffic between two ASA firewall. The VPN tunnel is up with a dynamic IP and static IP address. I have attached a diagram of the VPN connection. I'm not sure where the problem lies and what to check next. I think I have all the roads and in the access lists are needed.

  I've also attached the ASA5505 config and the ASA5510.

  This is the first time that I've set up a VPN connection any guidance would be greatly appreciated.

  Thank you

  Adam

  Hello

  Regarding your opinion of configuration Remote Site ASA that you have not added the internal networks of the Central Site VPN L2L configurations at all so the traffic does not pass through the VPN.

   access-list outside_1_cryptomap extended permit ip 10.1.1.0 255.255.255.128 10.182.226.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 10.182.226.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 10.182.0.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 192.168.170.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 192.168.172.0 255.255.*.* access-list exempt extended permit ip 10.1.1.0 255.255.255.128 140.15.0.0 255.255.*.* 

  Take a look at ACL configurations above. The 'exempt' ACL is used in configurations NAT0 and tells the ASA what traffic of exempting from NAT. "outside_1_cryptomap" ACL is used to tell the traffic between the subnets should be using the L2L VPN connection.

  So in short on the Remote Site ASA these ACLs should be identical. Make additions to the LIST of VPN L2L, then try again.

  I would also like to point out that to ensure that the Central ASAs L2L VPN ACL Site contains the same networks. The ACL on the Central Site will, of course, its internal subnets as the source and the site LAN remote destination.

  THW out of ' crypto ipsec to show his " shows you that only the SA between binding Site Central network and the Remote Site LAN was established. Others have not formed as the configuration is lacking at LEAST on the Remote Site ASA. Can also be the Central Site.

  -Jouni

• QoS and routing VPN IPSEC protocols

  Hello world

  You must confirm if the QOS is usable on IPSEC Site to site VPN?

  IPSEC VPN it can also participate in routing protocols.

  Example of

  An address 192.168.10.1 site source

  B Source 192.168.10.2 site address

  Now for Site A to Site B IPSEC to join a way is that we can use our ISP as static IP address

  Site has

  192.168.10.2 255.255.255.0 address 10.x.x.x ISP

  Using routing protocols

  Is it possible to use OSPF between two sites and advertise routes in OSPF?

  Will they see each other as ospf neis?

  Thank you

  MAhesh

  Hello Manu,

  Yes, we can do,

  Let me provide you with the following information:

  On the quality of service

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008080dfa7.shtml

  On OSPF

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00804acfea.shtm

• Cisco asa 5505 and centos VPN server connection

  Hi all

  Please I want to set up a VPN between Cisco asa 5505 and centos server.

  Here's my senerio

  -------------------------

  ASA 5505

  Public IP 155.155.155.2

  Local NETWORK: 192.168.6.X

  CentOS Server

  ------------------

  Public ip address: 155.155.155.6

  Thank you guys

  Apology, do you mean access remote VPN Client of hundred BONE for Cisco ASA 5505?

  If the remote access, here are the sample configuration:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008060f25c.shtml

• between my computer and router wireless connection (vista, premiem windows 7, 64 bit)

  Hey I recently had problems with my connection Wireless between my computer and the router.
  Normally off during the night is not connected to my router or on the internet the next day.

  I have been in close contact to my isp provider and have received a new router and reset my wireless Internet services provider site but I'm still having problems. I have also updated my drivers for my wireless on my laptop Hp G62 and have found that it will not cut when I do not shut down or sleep during the night.

  When you try to solve the problem, it will come back with "problem with the adapter or wireless access point and then asked to disconnect the power to the router. After doing this it will be fine all day.
  I do also to turn a blackberry 9000 "BOLD" and see first thing in the morning if the wireless is connected or not.

  ask for help, here is my last option I have been through everything and had an expert look at my computer where he found nothing wrong with my computer or wireless set up settings.

  any help or advice would be great

  Hello

  1. do you have problems connecting with Windows 7 or Vista?
  2. you remember of any change to your computer before the problem?

  Make sure that there is no interference between your router and your computer. For example. Mobile phones, like the mobile signals could conflict with your router signals and therefore no connection to your computer.

  You can uninstall and reinstall the Device Manager wireless network card.
   
  To uninstall the wireless device manager,
   
  a. Click Start, type device manager in the search box of start and press ENTER.
  b. Locate the network adapters and expand the same.
  c. Select the wireless connection, right click and choose uninstall.
  d. restart the computer, if prompted.
   
  Pilots should settle automatically after the computer restarts.

   

  Now you can install the latest wireless drivers and check if this solves the problem.

• Log each ASA connection and router

  Hello

  I have a Cisco ASA 5520 and a Cisco 3825 router in my network. I want to log every connection to these devices. There are a few users who have different levels of access to these devices in n/w. I would like to connect all these users and what they actually change and to implement in the devices. Is this possible using a RADIUS server or any other method pls. I also have access to reading / writing to these devices. Thank you very much

  You can do it too.

  You can use auth-proxy (router) passage proxy (ASA) to have the user to authenticate to the connections he and do accounting of GBA. But I don't think you need to do this for all connections, for those who require the intervention of the user.

  Let us know if that answers the question.

  PK

• VPN between a PIX and a VPN 3000

  I'm trying to set up a VPN between PIX and a VPN 3000. All configurations are complete, but the tunnel has not been established. On the PIX, to 'see the crypto engine' and ' show isakmp his ' orders, I do not see the tunnel. Of "show ipsec his ' command, I can see the mistakes"#send"continues to increase when I try to connect to the remote network. Here is the copy - paste command:

  Tag crypto map: myvpnmap, local addr. 10.70.24.2

  local ident (addr, mask, prot, port): (10.70.24.128/255.255.255.128/0/0)

  Remote ident (addr, mask, prot, port): (10.96.0.0/255.224.0.0/0/0)

  current_peer: 10.70.16.5:0

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts 0 digest

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0, #pkts decompress failed:

  #send 12, #recv errors 0

  local crypto endpt. : 10.70.24.2, remote Start crypto. : 10.70.16.5

  Path mtu 1500, fresh ipsec generals 0, media, mtu 1500

  current outbound SPI: 0

  SAS of the esp on arrival:

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  outgoing ah sas:

  outgoing CFP sas:

  Obviously, the PIX identifies protected traffic but failed to establish the tunnel. I was wondering what could be the reason for these kind of mistakes? That means them growing '#send errors?

  Thank you very much!

  Sending error mean simply the PIX is grateful to encrypt this traffic, but there is no built tunnel and so it must drop the package.

  you will need to look at why the tunnel is not under construction however, "sending error" are just a byproduct of some other configuration issue. On the PIX, it looks like you would have something like:

  Crypto ip 10.70.24.128 access list allow 255.255.255.128 10.96.0.0 255.224.0.0

  On the 3000 under the L2L section and the Local and remote network, you need the exact opposite of the latter, then it would be:

  / Local network mask = 10.96.0.0/0.31.255.255

  / Remote network mask = 10.70.24.128/0.0.0.127

  If you have something else the tunnel will fail to come. Otherwise, we see that the Cryptography debugs the PIX and the trunk of the 3000 when the tunnel is built.