Can VPN site-to-site with just 1 static IP address in PIX?

Hi all

Can I use pix for VPN with just 1 static IP address as follows:

LAN-A---PIX1---INTERNET---PIX2---LAN-B

Just PIX1 has static IP, PIX2 use DHCP from ISP. I have the config this type of VPN with another brand equipment. But the use of PIX, I just VPN config with both ends have a static IP and I can't find any information in the web site. Because when config VPN site-to-site I have to use the command 'same game '.

Can someone tell me how can I do with PIX? Thank you!

Best regards

Teru Lei

You just need to set up a dynamic encryption on PIX 1 card and a card standard encryption with a peer 'set' on 2 PIX. Here is an example configuration:

http://www.Cisco.com/warp/public/110/dynamicpix.html

Note that it also has VPN connection clients in 1 PIX (Lion), so forget all orders of "vpngroup" that you see in his configuration cause, they are not necessary for your scenario.

Tags: Cisco Security

Similar Questions

  • How you can follow an ipod 6 with just the serial code

    How you follow an ipod with just the serial number 6

    You do not have

    No application on the iOS device is necessary.

    -If you have previously enabled FIndMyiPod/iPhone/iPad on iOS device in settings > iCloud and wifi is on and cellular data or connected are turned on and connected on a desktop browser to iCloud: find my iPhone, login and go to FIndMyiPhone. If the iPod has been restored it will never appear or continue to show offline.

    -You can also wipe/erase the iOS device and have the device beep via iCloud.

    If your iPhone, iPad or iPod touch is lost or stolen

    iCloud: erase your device

    iCloud: use lost Mode

    -If this is indicated, then you will need to use the old-fashioned, way as if you lost a wallet or purse.

    -Change the passwords for all accounts used on the unit and the police report and carrier if iPad iPhone or cell

    -There is no way to prevent someone from restoring the clear operation (it erases it) use it except if you have iOS 7 or later version on the device. With iOS 7 or later version, you must enter the Apple ID and password to restore the device.

    -Apple won't do anything without a court order

    Declaration of a lost or stolen Apple product

    - iOS: how to find the number of serial number, IMEI, ICCID MEID and CDN

  • I'll buy a first ASUS Tablet soon and want to know if I can sync with my PC at home. If I don't have a wireless connection, can I still do it with just the effect wireless.

    Looks like the Firefox Sync is just for PCs and phones. If I buy a tablet that has a wireless capability but I'm not going to buy a phone plan, e.g. with AT & T, I'll still be able to synchronize my information from tablet with my home PC? It works like McCloud?

    Sync can work with any instance of Firefox 4 or more. It synchronizes your bookmarks, history and passwords to another instance of Firefox. https://support.Mozilla.com/en-us/KB/how-do-i-set-up-Firefox-sync

  • How can I make it work with just an Apple TV, AirPort Express and iPod/iPad/iPhone?

    Hello people of Apple, I have some questions about a new "setup" of Apple products that I hope I can get to work between them. In other words, I need to know if what I am wanting to do in fact is possible with this new configuration.

    Current set up:

    • mini iMac (a former member of 2010, but fully updated for OSX El Capitan)
    • drive external HARD as the Time Capsule disk and with tons of music not purchased through the iTunes store (from my CD collection)
    • Old Airport Express connected to the modem (which received the fiber of my ISP)
    • 3rd Gen iPad
    • iPhone 6 more (work phone)
    • iPod Classic 5th Gen with close to 30 GB of my library and plugged on my car stereo to
    • iPod Shuffle 4th Gen for gym

    I want my setup to be:

    • Apple TV
    • Airport Extreme with external HARD disk * even from above * (my library backup iTunes music around, videos and photos) connected via USB
    • iPad Pro
    • iPhone 6 Plus
    • iPod Classic 5th Gen that I want to stay plugged into my car stereo to
    • iPod Shuffle 4th Gen for gym

    So my questions are: can I continue to sync my iPod Classic and my iPod Shuffle without a computer (I guess maybe not), and if so, HOW? I'll be able to sync the iPad and iPhone via wifi without computer as well? Also, I'll be able to play my library directly from the drive external HARD using the Apple TV?

    I'm guessing / hoping that the new Apple TV from the music/iTunes app and the pictures/iPhoto app, I can connect my iPod to the airport and synchronize them via the app AND connect Apple TV directly on the HARD disk via the airport. And perhaps also to synchronize the iPad and the iPhone on wifi in all Apple TV apps or something or maybe I just need any Uploader in iCloud and will not even need the HARD drive more except as a backup. Help!

    You have need of computer-Mac or PC. You can sync the iPhone/iPad wireless, but only via a computer in iTunes, I'm not sure about the capacity of wifi iPod.  Not to mention the iTunes, the software is required to manage the devices and media.  Important note: you must always back up your purchases - just because you buy a book, movie, TV show, song today does not necessarily mean that the media will be available from Apple servers for eternity.  The Studios retain rights and may, at any time, sign an exclusive agreement with a network, streaming provider etc which would then remove this file to be available on Apple servers.  You must download and save purchases - that would need a computer running iTunes software. You could buy storage for all your media, but then additional personal iCloud yet you would need a computer to manage. In addition, with respect to the Apple TV, you cannot connect all readers.  The USB port is only for the restaurant and full-service.  The Apple TV is a streaming device, but for the local media, he uses homeshare, which requires a computer iTunes rather than be connected directly to a storage device.  Although there are other applications like plex or infusion but they would require a NAS configuration rather than the HARD disk, and you would want / need a computer to manage the NAS server...

    the only thing you want to eliminate is the only thing that is required for all...

  • Can I block all emails with a place in their address. I have outlook express 6.

    I recently started to receive SPAM wiith square instead of alphanumeric in my emails in their area of the object. Can I block all e-mails with squares in the subject.

    Not directly, but you can block a message without letters or numbers in the subject.

    Box 1 - where the subject contains specific words
    Box 2 - remove server, or remove it and stop processing more rules to send to deleted items.
    Box 3 - Click on the blue "Contains specific words" and add * one at a time *.
    a, e, i, o, u, y, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,
    Click: Options and implement: does not contain a...

    {This is how it has been suggested to create the rule for a long time. {I understand the whole alphabet so an email with a subject like XP will not be rejected}.

  • VPN site-to-site dynamic-to-static

    Dear

    I have a few sites already connected with ASA 5505 VPN site to site with both ending static IP address.  Normally, all traffic can be found without any problems.  Even, I used 'inside access management' for the two ASA.

    Now I have a new office with only the ADSL pppoe.  I used to install between Site B:remote the site dynamic IP and IP SiteA:static with a similar example of this easy VPN: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

    All my ASA 5505 run 1 8.4 (4)

    Site A - Static IP

    Site B - Dynamic IP with pppoe connection.

    After EasyVPN connected, I don't know how I remote manangment of the site a lan at the ASA 5505 B site?

    Best regards

    Alan.

    If you're ok with or the other solution, it is probably easier to use dynamic to static lan-to-lan, so, at least, that your solution is consistent and fair use lan-to-lan tunnel instead of customer vpn solution mixture and lan-to-lan.

  • Tunnel VPN site to Site with DDNS

    I have a hub site that has a static ip address and a remote site with DDNS.  I am building a Site to Site tunnel between them, I can do this with the static ip address, but when he changes the tunnel breaks down, so I need a way to the ASA to know when this ip address changes.  How can I do this?

    Thank you

    To my knowledge, DDNS for VPN is supported only on router IOS not on ASA.

    If you use ASA on the head of network, you may need to use EasyVPN

    http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a0080912cfd.shtml

    EasyVPN VPN must be started from the remote site.

  • Cisco 877 + VPN Site to Site

    Hello

    I'm new im this forum.
    I've set up a Site VPN site with 2 Cisco 877.

    SITE A:

    Address IP Adreess public: static
    Internal IP Adrees: 192.168.0.XXX
    Mask: 255.255.255.0

    SITE B:

    IP address public Adreess: Dynamics
    Internal IP address: 192.168.2.XXX
    Mask: 255.255.255.0

    I managed to do a ping on both sides, but I can't access file shares, and could rdp on any server in site A, by the internal IP address.

    Fix, is the SITES A and B SITE startup configs.

    Could you please someone help me?

    Hi Marcos,

    Really happy to know that the problem is solved. There is no need to apologize. Please mark this message as answered if there is nothing more.

    Rregards,

    Assia

  • I can't watch videos on some Web sites with firefox. They all work with Internet Explorer. This just started happening a few days ago.

    When I go on youTube and click on a video, I get a black screen with controls and an arrow of beginning in the middle. When I click on the arrow to start, no video only comes up... just the statement: "year error occurred." Please try again later. "Same thing on other sites with videos. They will not play. Another site with videos, he says that the player will not load.
    I cleared the cache, cookies, downloaded the new 14 beta version of firefox, tried to download an old version of Adobe Flash Player (11). I had Firefox v13.
    Nothing has changed so far. I hope someone can help with this. All these sites and videos work fine when I use Internet Explorer.

    There are a few compatibility problems between the latest Flash Player (11.3) and some settings or Firefox Add-ons. Could see you if anything in this article helps you: 11.3 Flash does not load video in Firefox.

  • Im not able to open pages. I have a white screen with just the border sites. Can you help me?

    Im not able to open pages. I have a white screen with just the border sites. Can you help me?

    Hello

    1. did you of recent changes to the system?

    2. what Web browser do you use to navigate the web pages?

    3. do you get an error message?

    Method 1:

    Follow the link below and check if that helps.

    http://support.Microsoft.com/kb/945385

    Method 1: Troubleshoot Internet Explorer.

    http://support.Microsoft.com/kb/956196

    Warning: him reset Internet Explorer settings feature might reset security settings or privacy settings that you have added to the list of Trusted Sites. Reset the Internet Explorer settings can also reset parental control settings. We recommend that you note these sites before you use the reset Internet Explorer settings

    In addition, check out the link below and check if it helps.

    http://support.Microsoft.com/kb/956197/NL

    It will be useful.

  • Problem with the VPN site to site for the two cisco asa 5505

    Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

    Cisco Config asa1

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 172.xxx.xx.4 255.255.240.0
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.60.2 255.255.255.0
    !
    passive FTP mode
    network of the Lan_Outside object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
    network of the Lan_Outside object
    NAT (inside, outside) interface dynamic dns
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.60.0 255.255.255.0 inside
    http 96.xx.xx.222 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 96.88.75.222
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    inside access management

    dhcpd address 192.168.60.50 - 192.168.60.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_96.xx.xx.222 group strategy
    attributes of Group Policy GroupPolicy_96.xx.xx.222
    VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 96.xx.xx.222 type ipsec-l2l
    tunnel-group 96.xx.xx.222 General-attributes
    Group - default policy - GroupPolicy_96.xx.xx.222
    96.XX.XX.222 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error

    ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Cisco ASA 2 config

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 96.xx.xx.222 255.255.255.248
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.1.254 255.255.255.0
    !
    passive FTP mode
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network of the Lan_Outside object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_4
    ip protocol object
    icmp protocol object
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
    !
    network of the Lan_Outside object
    dynamic NAT (all, outside) interface
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    http 172.xxx.xx.4 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 172.110.74.4
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0

    dhcpd address 192.168.1.50 - 192.168.1.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_172.xxx.xx.4 group strategy
    attributes of Group Policy GroupPolicy_172.xxx.xx.4
    L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 172.xxx.xx.4 type ipsec-l2l
    tunnel-group 172.xxx.xx.4 General-attributes
    Group - default policy - GroupPolicy_172.xxx.xx.4
    172.xxx.XX.4 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error
    inspect the http

    For IKEv2 configuration: (example config, you can change to encryption, group,...)

    -You must add the declaration of exemption nat (see previous answer).

    -set your encryption domain ACLs:

    access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

    -Set the Phase 1:

    Crypto ikev2 allow outside
    IKEv2 crypto policy 10
    3des encryption
    the sha md5 integrity
    Group 5
    FRP sha
    second life 86400

    -Set the Phase 2:

    Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
    Esp aes encryption protocol
    Esp integrity sha-1 protocol

    -set the Group of tunnel

    tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
    REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
    IKEv2 authentication remote pre-shared-key cisco123


    IKEv2 authentication local pre-shared-key cisco123

    -Define the encryption card

    address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
    card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
    card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
    CRYPTOMAP interface card crypto outside
    crypto isakmp identity address

    On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

    Thank you

  • local host to access the vpn site to site with nat static configured

    I have two 881 routers with vpn site to site between them. I have a static nat on the router for a Web server that is accessible from the internet. I can't access the Web server through the vpn. All other traffic is fine its VPN. I think that there is a problem with the NAT. Here are the relevant configuration lines.

    IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
    IP nat inside source static 192.168.150.2 bonnefin map route SDM_RMAP_1

    allowed SDM_RMAP_1 1 route map
    corresponds to the IP 100

    access-list 100 deny ip 192.168.150.0 0.0.0.255 192.168.123.0 0.0.0.255
    access-list 100 permit ip 192.168.150.0 0.0.0.255 any

    You should be able to access the web server with its IP private (192.168.150.2) through the VPN connection.

    If you just add the VPN and the road map, try to clear the existing translation and see if you can access it via its private of the Remote LAN VPN ip address.

  • VPN Site to Site Secret shared and can co-exist RADIUS authenticated VPN?

    Hello

    I have a setup VPN site to site between two offices on 515Es PIX (v.6.2 software) and has recently added a vpngroup/shared secret based VPN remote access to one of the offices. Given that just forced me to add a number of different policies to my existing crypto card, it was a plant direct and easily implemented. For more security, I want to use a RADIUS server to give to each remote user their own connections and profiles rather than a group on all password is configured. To do this, however, it seems that I have to add the following additional commands to my existing crypto card:

    client configuration address map mymap crypto initiate

    client card crypto mymap RADIUS authentication

    These do not correspond to the policy number (my site-to-site is 10, and remote access policy is political 20), so I don't know what the effect would be if I added the. It would cause my connection from site to site for authentication RADIUS request (a very bad thing)? If so, do I need another interface to bind a new encryption card to? The answer to this would be greatly appreciated!

    Also, if anyone knows an example configuration for a similar configuration, I can look at, please let me know! Thank you.

    -A.Hsu

    For the site to site connection, you change line isakmp keys and add the parameters of "No.-xauth No.-config-mode" at the end of this one, which tells the PIX not to do the auth RADIUS or assign an IP address, etc. for the specific site-to-site tunnel.

    Example of config is here:

    http://www.Cisco.com/warp/public/110/37.html

    Note that there is no command options I have just said, I just sent an email to the web guys to fix this. Basically, your config will look with the options "No.-xauth No.-config-mode" on the line «isakmp x.x.x.x key...» "for LAN-to-LAN tunnel.

  • problem with users to access remote vpn site to site vpn network

    I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

    execution of the configuration of my asa 5510 is

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.4(2)
    
    !
    
    hostname asa5510
    
    domain-name dri.local
    
    enable password 8Ry2YjIyt7RRXU24 encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    !
    
    interface Ethernet0/0
    
    nameif outside
    
    security-level 0
    
    ip address x.x.x.178 255.255.255.248
    
    !
    
    interface Ethernet0/1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.10 255.255.255.0
    
    !
    
    interface Ethernet0/2
    
    description Mreza za virtualne masine- mail server, wsus....
    
    nameif DMZ
    
    security-level 50
    
    ip address 172.16.20.1 255.255.255.0
    
    !
    
    interface Ethernet0/3
    
    shutdown
    
    no nameif
    
    no security-level
    
    no ip address
    
    !
    
    interface Management0/0
    
    nameif management
    
    security-level 100
    
    ip address 192.168.1.1 255.255.255.0
    
    management-only
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    dns server-group DefaultDNS
    
    domain-name dri.local
    
    object network VPN-POOL
    
    subnet 192.168.50.0 255.255.255.0
    
    description VPN Client pool
    
    object network LAN-NETWORK
    
    subnet 192.168.0.0 255.255.255.0
    
    description LAN Network
    
    object network NETWORK_OBJ_192.168.0.0_24
    
    subnet 192.168.0.0 255.255.255.0
    
    object network 192.168.0.10
    
    host 192.168.0.10
    
    object service ssl
    
    service tcp destination eq 465
    
    object service tls
    
    service tcp destination eq 995
    
    object network mail_server
    
    host 172.16.20.201
    
    object service StartTLS
    
    service tcp destination eq 587
    
    object service admin_port
    
    service tcp destination eq 444
    
    object service ODMR
    
    service tcp destination eq 366
    
    object service SSL-IMAP
    
    service tcp destination eq 993
    
    object network remote
    
    host 172.16.20.200
    
    object network test
    
    host 192.168.0.22
    
    object network mail
    
    host 172.16.20.200
    
    object network DMZ
    
    host 172.16.20.200
    
    object network Inside_DMZ
    
    host 192.168.0.20
    
    object service rdp
    
    service tcp destination eq 3389
    
    object network DRI_PS99
    
    host 192.168.0.54
    
    object service microsoft_dc
    
    service tcp destination eq 445
    
    object service https448
    
    service tcp destination eq 448
    
    object network mail_server_internal
    
    host 172.16.20.201
    
    object service Acronis_remote
    
    service tcp destination eq 9876
    
    object service Acronis_25001
    
    service tcp destination eq 25001
    
    object service HTTP3000
    
    service tcp destination eq 3000
    
    object network VPNPOOL
    
    subnet 192.168.50.0 255.255.255.0
    
    object-group network PAT-SOURCE-NETWORKS
    
    description Source networks for PAT
    
    network-object 192.168.0.0 255.255.255.0
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object object admin_port
    
    service-object object ssl
    
    service-object object tls
    
    service-object object https448
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object object tls
    
    service-object tcp destination eq pop3
    
    service-object tcp destination eq smtp
    
    object-group service DM_INLINE_SERVICE_3
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object tcp destination eq smtp
    
    service-object object tls
    
    service-object object Acronis_remote
    
    service-object tcp destination eq www
    
    service-object object Acronis_25001
    
    service-object object microsoft_dc
    
    object-group protocol DM_INLINE_PROTOCOL_1
    
    protocol-object ip
    
    protocol-object tcp
    
    object-group service DM_INLINE_SERVICE_4
    
    service-object object Acronis_25001
    
    service-object object Acronis_remote
    
    service-object object microsoft_dc
    
    service-object tcp destination eq www
    
    service-object tcp
    
    service-object ip
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
    
    access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
    
    access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
    
    access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
    
    access-list DMZ extended deny tcp any any eq smtp
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    mtu outside 1500
    
    mtu inside 1500
    
    mtu DMZ 1500
    
    mtu management 1500
    
    ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
    
    !
    
    object network mail_server
    
    nat (DMZ,outside) static x.x.x.179
    
    object network mail
    
    nat (DMZ,outside) static x.x.x.180
    
    access-group outside_access_in in interface outside
    
    access-group DMZ in interface DMZ
    
    route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    timeout floating-conn 0:00:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    action terminate
    
    dynamic-access-policy-record dripolisa
    
    aaa-server DRI protocol ldap
    
    aaa-server DRI (inside) host 192.168.0.20
    
    ldap-base-dn DC=dri,DC=local
    
    ldap-scope subtree
    
    ldap-naming-attribute sAMAccountName
    
    ldap-login-password *****
    
    ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
    
    server-type microsoft
    
    user-identity default-domain LOCAL
    
    aaa authentication enable console LOCAL
    
    aaa authentication http console LOCAL
    
    aaa authentication serial console LOCAL
    
    aaa authentication telnet console LOCAL
    
    aaa authorization command LOCAL
    
    http server enable
    
    http 192.168.1.0 255.255.255.0 management
    
    http 192.168.0.0 255.255.255.0 inside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    
    virtual telnet 192.168.1.12
    
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    
    crypto ipsec ikev2 ipsec-proposal DES
    
    protocol esp encryption des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal 3DES
    
    protocol esp encryption 3des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES
    
    protocol esp encryption aes
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES192
    
    protocol esp encryption aes-192
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES256
    
    protocol esp encryption aes-256
    
    protocol esp integrity sha-1 md5
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 match address outside_cryptomap
    
    crypto map outside_map 1 set peer 195.222.96.223
    
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    
    crypto map outside_map interface outside
    
    crypto ikev2 policy 1
    
    encryption aes-256
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 10
    
    encryption aes-192
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 20
    
    encryption aes
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 30
    
    encryption 3des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 40
    
    encryption des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 enable outside
    
    crypto ikev1 enable outside
    
    crypto ikev1 policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    
    dhcpd address 192.168.0.14-192.168.0.45 inside
    
    !
    
    dhcpd address 172.16.20.2-172.16.20.150 DMZ
    
    dhcpd dns x.x.x.177 interface DMZ
    
    dhcpd auto_config outside interface DMZ
    
    dhcpd option 6 ip x.x.x.177 interface DMZ
    
    dhcpd enable DMZ
    
    !
    
    dhcpd address 192.168.1.2-192.168.1.254 management
    
    dhcpd enable management
    
    !
    
    threat-detection basic-threat
    
    threat-detection statistics port
    
    threat-detection statistics protocol
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    group-policy GroupPolicy_x.x.x.223 internal
    
    group-policy GroupPolicy_x.x.x.223 attributes
    
    vpn-tunnel-protocol ikev1 ikev2
    
    group-policy drivpn internal
    
    group-policy drivpn attributes
    
    dns-server value 192.168.0.20 192.168.0.254
    
    vpn-simultaneous-logins 10
    
    vpn-idle-timeout 30
    
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    
    split-tunnel-network-list value Split_Tunnel_List
    
    default-domain value dri.local
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group drivpn type remote-access
    
    tunnel-group drivpn general-attributes
    
    address-pool vpnadrese
    
    authentication-server-group DRI
    
    default-group-policy drivpn
    
    tunnel-group drivpn ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    tunnel-group x.x.x.223 type ipsec-l2l
    
    tunnel-group x.x.x.223 general-attributes
    
    default-group-policy GroupPolicy_x.x.x.223
    
    tunnel-group x.x.x.223 ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    ikev2 remote-authentication pre-shared-key *****
    
    ikev2 local-authentication pre-shared-key *****
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum client auto
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect tftp
    
      inspect ip-options
    
      inspect netbios
    
      inspect icmp
    
      inspect http
    
    !
    
    service-policy global_policy global
    
    prompt hostname context
    
    no call-home reporting anonymous
    
    Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
    
    : end

    running config asa 5505

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.2(1)
    
    !
    
    hostname ciscoasa
    
    enable password csq7sfr0bQJqMGET encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    name 192.168.5.0 PALATA
    
    !
    
    interface Vlan1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.17 255.255.255.0
    
    !
    
    interface Vlan2
    
    nameif outside
    
    security-level 0
    
    ip address 10.13.74.33 255.255.255.0
    
    !
    
    interface Ethernet0/0
    
    switchport access vlan 2
    
    !
    
    interface Ethernet0/1
    
    !
    
    interface Ethernet0/2
    
    !
    
    interface Ethernet0/3
    
    !
    
    interface Ethernet0/4
    
    !
    
    interface Ethernet0/5
    
    !
    
    interface Ethernet0/6
    
    !
    
    interface Ethernet0/7
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object ip
    
    service-object tcp
    
    service-object icmp echo
    
    service-object icmp echo-reply
    
    service-object tcp eq domain
    
    service-object tcp eq ldap
    
    service-object tcp eq smtp
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object ip
    
    service-object tcp eq domain
    
    service-object tcp eq www
    
    service-object tcp eq https
    
    service-object tcp eq smtp
    
    object-group service Sharepoint8080 tcp
    
    port-object eq 8080
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
    
    access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
    
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    logging mail errors
    
    logging from-address
    
    logging recipient-address  level debugging
    
    mtu inside 1500
    
    mtu outside 1500
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    global (outside) 1 interface
    
    nat (inside) 0 access-list inside_nat0_outbound_1
    
    nat (inside) 1 192.168.0.0 255.255.255.0
    
    static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
    
    static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
    
    access-group inside_access_in in interface inside
    
    access-group outside_access_in in interface outside
    
    route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
    
    route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    aaa authentication telnet console LOCAL
    
    http server enable
    
    http 10.13.74.0 255.255.255.0 outside
    
    http 192.168.0.0 255.255.255.0 inside
    
    http 10.15.100.0 255.255.255.0 outside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    
    virtual telnet 192.168.0.53
    
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec security-association lifetime seconds 28800
    
    crypto ipsec security-association lifetime kilobytes 4608000
    
    crypto map outside_map 1 match address outside_2_cryptomap
    
    crypto map outside_map 1 set pfs
    
    crypto map outside_map 1 set peer 10.15.100.15
    
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    
    crypto map outside_map interface outside
    
    crypto isakmp enable outside
    
    crypto isakmp policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    

    threat-detection basic-threat
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group 10.15.100.15 type ipsec-l2l
    
    tunnel-group 10.15.100.15 ipsec-attributes
    
    pre-shared-key *
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect esmtp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect netbios
    
      inspect tftp
    
      inspect icmp
    
    !
    
    service-policy global_policy global
    
    smtp-server 173.194.79.109
    
    prompt hostname context
    
    Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
    
    : end

    Thank you

    Hello

    I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

    EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

    So you don't really have any of those.

    Please mark the question answers and/or assess response

    Ask more if necessary

    -Jouni

  • VPN site to Site with tunnel GRE on SAA

    Hi all

    I have a firewall of series ASA5500 and built a vpn site-to site on it with my counterpart. Now that my side wishes to receive messages of multicast on the other side through the tunnel WILL on the VPN Site to Site built.

    I know that the ASA5500 series cannot act as a GRE tunnel endpoint. Do we need to add a cisco firewall the router to receive multicast messages? Or can we just do the free WILL pass through the firewall on a computer or server?

    Thank you

    You are right that the ASA cannot put an end to the GRE Tunnel. You need a second device behind the ASA to complete that. Usually a router is used for this. But it doesn't matter what type of device, it's that the GRE tunnel long is supported. So it could be also a Linux-box or something like that. Personally, I'd use a router IOS for this.

    Sent by Cisco Support technique iPad App

Maybe you are looking for