Cisco ASA 5505 unable to access the remote network

Hello

I have a Cisco ASA 5505, with 50 basic license, which is connected directly to the Modem cable with a public IP address. I have configured and active VPN on the outside interface. When connect us, we connect well without error, but we are not able to access all the resources on the remote network.

ASA IOS version 8.2 (5)

Remote IP network: 10.0.0.0/24

VPN IP Pool: 192.168.102.10 - 25

I have attached the config: llc.txt

Please let me know if you have any questions.

Thank you!

Hello

Try adding NAT 0 because inside subnet--> subnet distance

NAT (inside) 0 access-list TEST

TEST access ip 10.0.0.0 scope list allow 255.255.255.0 192.168.102.10 255.255.255.224

HTH

MS

Tags: Cisco Security

Similar Questions

  • remote VPN and vpn site to site vpn remote users unable to access the local network

    As per below config remote vpn and vpn site to site vpn remote users unable to access the local network please suggest me a required config

    The local 192.168.215.4 not able ping server IP this server connectivity remote vpn works fine but not able to ping to the local network vpn users.

    ASA Version 8.2 (2)
    !
    host name
    domain kunchevrolet
    activate r8xwsBuKsSP7kABz encrypted password
    r8xwsBuKsSP7kABz encrypted passwd
    names of
    !
    interface Ethernet0/0
    nameif outside
    security-level 0
    PPPoE client vpdn group dataone
    IP address pppoe
    !
    interface Ethernet0/1
    nameif inside
    security-level 50
    IP 192.168.215.2 255.255.255.0
    !
    interface Ethernet0/2
    nameif Internet
    security-level 0
    IP address dhcp setroute
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    Shutdown
    No nameif
    no level of security
    no ip address
    management only
    !
    passive FTP mode
    clock timezone IST 5 30
    DNS server-group DefaultDNS
    domain kunchevrolet
    permit same-security-traffic intra-interface
    object-group network GM-DC-VPN-Gateway
    object-group, net-LAN
    access extensive list ip 192.168.215.0 sptnl allow 255.255.255.0 192.168.2.0 255.255.255.0
    192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0
    tunnel of splitting allowed access list standard 192.168.215.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    MTU 1500 Internet
    IP local pool VPN_Users 192.168.2.1 - 192.168.2.250 mask 255.255.255.0
    ICMP unreachable rate-limit 1 burst-size 1
    enable ASDM history
    ARP timeout 14400
    NAT-control
    Global 1 interface (outside)
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Route outside 0.0.0.0 0.0.0.0 59.90.214.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    the ssh LOCAL console AAA authentication
    AAA authentication LOCAL telnet console
    AAA authentication http LOCAL console
    AAA authentication enable LOCAL console
    LOCAL AAA authentication serial console
    Enable http server
    x.x.x.x 255.255.255.252 out http
    http 192.168.215.0 255.255.255.252 inside
    http 192.168.215.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Crypto-map dynamic dynmap 65500 transform-set RIGHT
    card crypto 10 VPN ipsec-isakmp dynamic dynmap
    card crypto VPN outside interface
    card crypto 10 ASA-01 set peer 221.135.138.130
    card crypto 10 ASA - 01 the transform-set RIGHT value
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    crypto ISAKMP policy 65535
    preshared authentication
    the Encryption
    sha hash
    Group 2
    lifetime 28800
    Telnet 192.168.215.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 5
    Console timeout 0
    management-access inside
    VPDN group dataone request dialout pppoe
    VPDN group dataone localname bb4027654187_scdrid
    VPDN group dataone ppp authentication chap
    VPDN username bb4027654187_scdrid password * local store
    interface for identifying DHCP-client Internet customer
    dhcpd dns 218.248.255.141 218.248.245.1
    !
    dhcpd address 192.168.215.11 - 192.168.215.254 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    Des-sha1 encryption SSL
    WebVPN
    allow outside
    tunnel-group-list activate
    internal kun group policy
    kun group policy attributes
    VPN - connections 8
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    Split-tunnel-network-list value split tunnel
    kunchevrolet value by default-field
    test P4ttSyrm33SV8TYp encrypted password username
    username kunauto password bSHrKTGl8PUbvus / encrypted privilege 15
    username kunauto attributes
    Strategy Group-VPN-kun
    Protocol-tunnel-VPN IPSec
    tunnel-group vpngroup type remote access
    tunnel-group vpngroup General attributes
    address pool VPN_Users
    Group Policy - by default-kun
    tunnel-group vpngroup webvpn-attributes
    the vpngroup group alias activation
    vpngroup group tunnel ipsec-attributes
    pre-shared key *.
    type tunnel-group test remote access
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group ipsec-attributes x.x.x.x
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    Review the ip options
    inspect the netbios
    inspect the rsh
    inspect the rtsp
    inspect the skinny
    inspect esmtp
    inspect sqlnet
    inspect sunrpc
    inspect the tftp
    inspect the sip
    inspect xdmcp
    inspect the icmp
    !
    global service-policy global_policy
    context of prompt hostname
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:0d2497e1280e41ab3875e77c6b184cf8
    : end
    kunauto #.

    Hello

    Looking at the configuration, there is an access list this nat exemption: -.

    192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0

    But it is not applied in the States of nat.

    Send the following command to the nat exemption to apply: -.

    NAT (inside) 0 access-list sheep

    Kind regards

    Dinesh Moudgil

    P.S. Please mark this message as 'Responded' If you find this information useful so that it brings goodness to other users of the community

  • Cisco Asa 5505 and level 3 with remote access VPN switch

    Today I had a new CISCO LAYER 3 switch... So here's my scenrio

    Cisco Asa 5505

    I have

    Outside of the == 155.155.155.x

    Inside = 192.168.7.1

    Address POOL VPN = 10.10.10.1 - 10.10.10.20

    3 layer switch configuration

    VLAN 2

    ip address of the interface = 192.168.1.1

    VLAN 2

    ip address of the interface = 192.168.2.1

    VLAN 2

    ip address of 192.168.3.1 = interface

    VLAN 2

    ip address of the interface = 192.168.4.1

    VLAN 2

    ip address of the interface = 192.168.5.1

    IP Routing

    So I want the customers of my remote access VPN to access all that these networks. So please can you give me a useful tip or a link to set up the rest of my trip

    Thanks to you all

    Al ready has responded

    Sent by Cisco Support technique iPad App

  • Unable to access the remote VPN LAN

    My VPN ends very well, but cannot access the local network. The warning is the LAN is a public good 24 subnet.  I'm not sure how to NAT the LAN to access the VPN subnet and not to disturb any other functionality.  I have attached the configuration.

    Thank you in advance.

    ciscoasa # sh run
    : Saved
    :
    ASA Version 8.2 (2)
    !
    ciscoasa hostname
    activate the encrypted Anuj/1RTcTy/SmZO password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP address .149.200 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address *.165.37.131 255.255.255.248
    !
    interface Vlan5
    No nameif
    security-level 50
    IP 10.10.10.1 255.255.255.0
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    switchport access vlan 5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passive FTP mode
    clock timezone GMT 0
    standard permit access list MASTERPWRTRANS_splitTunnelAcl *. . 149.0 255.255.255.0
    allow inside_nat0_outbound to access extensive ip list *. . 149.0 255.255.255.0 172.30.110.0 255.255.255.224
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    local pool POOL1 172.30.110.1 - 172.30.110.30 IP 255.255.255.224 mask
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    Global (outside) 2 *.165.37.132
    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 2 *. .149.199 255.255.255.255
    NAT (inside) 1 0.0.0.0 0.0.0.0
    static (exterior, Interior) *. .149.199 *.165.37.132 netmask 255.255.255.255
    Route outside 0.0.0.0 0.0.0.0 * 1.165.37.134
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    RADIUS protocol Server AAA MPT
    AAA server MPT (inside) host .149.210
    Timeout 5
    key *.
    AAA authentication enable LOCAL console
    the ssh LOCAL console AAA authentication
    Enable http server
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outdoors
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    outside_map interface card crypto outside
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    md5 hash
    Group 2
    life 86400
    Telnet *. . 149.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 5
    Console timeout 0
    management-access inside

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    internal MASTERPWRTRANS group policy
    MASTERPWRTRANS group policy attributes
    value of DNS server *. . 149.10 *. . 149.11
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list MASTERPWRTRANS_splitTunnelAcl
    MCI.local value by default-field
    ptiadmin encrypted BtOLil2gR0VaUjfX privilege 15 password username
    mptadmin U2T.1fmOIe772zE username password / encrypted
    type tunnel-group MASTERPWRTRANS remote access
    attributes global-tunnel-group MASTERPWRTRANS
    POOL1 address pool
    TPM authentication server group
    Group Policy - by default-MASTERPWRTRANS
    IPSec-attributes tunnel-group MASTERPWRTRANS
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    Cryptochecksum:820529ed70de923a8375694004b2544c
    : end
    ciscoasa #.

    The 2821 should have a route pointing to the ASA for the VPN address pool (because the ASA is not the default gateway for the LAN).

    That should do it.

    Federico.

  • Cisco linksys router and cannot access the wireless network

    We have cisco linksys wireless router.  When we installed everything first, we could connect our wireless laptops to the network.  Now, however, the network is detected, but there is no access to the internet.  We have even a guy from ATT were out and he said that the wireless router has been installed backwards?  He installed a dsl fast access on our laptop icon, and now we can access the wireless network but only if we connect as the first.  We can also connect iPod to the wireless network.  They detect the network, but when we enter the password cannot connect.

    Hi JC_3094,

    Welcome to the Microsoft Community and thanks for posting the question.

    According to the description, it looks like you aren't able to access the Internet.

    The likely causes of this problem is if the router is not configured properly.

    Here are some steps that should help you to solve this problem.

    Method 1:

    Check if the router is configured properly to get access to the Internet.

    Method 2:

    Try the steps mentioned in this link and check:

    This tutorial is designed to help you identify and solve problems with a wired (Ethernet) and wireless (Wi - Fi) network connections in Windows.

    Wireless and wired network problems
     
    Method 3:
     
    If there is a frequent disconnection try to update the firmware on the router and check.
     
    In addition, visit these links for more information:
     
    Why can't I connect to the Internet?
     
    Hope this information helps. Respond us if you have any questions with windows and we will be happy to help.

  • Unable to access the remote host

    Here is the configuration of pix of my client, the problem, here is... whenever it uses a Cisco VPN dialier, it can connect to the VPN, but cannot access any host on the distance, but with the same vpn Dialer & VPN pcf file, when it is used with a connection high speed which is not route with this PIX (or not behind the PIX) It works very well. Yet one thing I noticed, it's only when I give a static NAT, it is able to access on the remote & not through a NAT GLOBAL PC when the PC is behind the PIX.

    6.3 (3) version PIX

    interface ethernet0 car

    Auto interface ethernet1

    Auto interface ethernet2

    ethernet0 nameif outside security0

    nameif ethernet1 inside the security100

    nameif dmz security50 ethernet2

    enable encrypted password xxx

    enable encrypted password xxx

    TA.qizy4R//ChqQH encrypted passwd

    fixup protocol dns-maximum length 1024

    fixup protocol ftp 21

    fixup protocol h323 h225 1720

    fixup protocol h323 ras 1718-1719

    fixup protocol http 80

    fixup protocol pptp 1723

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol sip 5060

    No fixup protocol sip udp 5060

    fixup protocol 2000 skinny

    No fixup not protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol tftp 69

    access ip-list 110 permit a whole

    access-list 120 allow icmp a whole

    access-list 120 allow esp a whole

    logging console warnings

    Monitor logging warnings

    logging buffered stored notifications

    recording of debug trap

    the logging queue 0

    Outside 1500 MTU

    Within 1500 MTU

    MTU 1500 dmz

    IP address outside x.x.x.x 255.255.255.240

    IP address inside 192.168.0.1 255.255.0.0

    no ip address address dmz

    alarm action IP verification of information

    alarm action attack IP audit

    IP local pool homeuser_vpn 192.168.1.1 - 192.168.1.254

    location of PDM 192.168.0.80 255.255.255.255 inside

    location of PDM 192.168.0.207 255.255.255.255 inside

    location of PDM 0.0.0.0 0.0.0.0 outdoors

    forest warnings of PDM 100

    history of PDM activate

    ARP timeout 14400

    Global 1 x.x.x.66 (outside)

    NAT (inside) 0-list of access 123nonat

    NAT (inside) 1 192.168.0.0 255.255.0.0 0 0

    public static x.x.x.70 (Interior, exterior) 192.168.3.1 netmask 255.255.255.255 0 0

    public static x.x.x.76 (Interior, exterior) 192.168.3.2 netmask 255.255.255.255 0 0

    static (inside, outside) x.x.x.77 192.168.3.3 netmask 255.255.255.255 0 0

    Access-group 120 in external interface

    Access-group 110 in the interface inside

    Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

    H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    RADIUS Protocol RADIUS AAA server

    AAA-server local LOCAL Protocol

    the ssh LOCAL console AAA authentication

    source of x.x.x.x server NTP outside prefer

    Enable http server

    http 0.0.0.0 0.0.0.0 outdoors

    http 192.168.0.207 255.255.255.255 inside

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    No trap to activate snmp Server

    enable floodguard

    Telnet 192.168.0.197 255.255.255.255 inside

    Telnet 192.168.0.80 255.255.255.255 inside

    Telnet timeout 5

    SSH 0.0.0.0 0.0.0.0 outdoors

    SSH 192.168.0.0 255.255.0.0 inside

    SSH timeout 60

    Console timeout 0

    dhcpd lease 3600

    dhcpd ping_timeout 750

    username admin password encrypted xxxx privilege 15

    username password encrypted xxx privilege 2 admin1

    Terminal width 80

    Cryptochecksum:xxx

    : end

    # 123

    Anand,

    I would check to make sure that the N - NAT has something like: -.

    "permit access ip 192.168.0.0 list 123nonat 255.255.255.0 192.168.1.0 255.255.255.0.

    And enable NAT - T - she might be his house do not understand/IPSEC passthrough device support:--

    "isakmp nat-traversal 20.

    And add: -.

    "access-list 120 permit udp any any eq 4500.

    HTH.

  • Unable to access the local network with VPN with some ISPS

    Hello

    We have a VPN Remote Access IPSEC with an ASA5505. Install VPN it correctly but can not access the inside or the ASA to my office.

    But at home with another Internet service provider, it works! You can access inside.

    We are trying with other ISP and it works with 2 and does not work with the other 2!

    Office we also have an ASA5505, but we have another VPN other sites that work properly.

    Any ideas?

    Thank you and sorry for my English.

    Add...

    ISAKMP nat-traversal crypto

    That should do the trick! Please rate if this can help.

  • Unable to access the remote PC APEX using url

    Hi all

    I'm under 11g R2 on a desktop computer and that you have configured APEX 4.1. I am able to access all of the pages that I should be able from a browser on localhost.
    But I am trying to remotely access from PC, I Internet Explorer can not display the webpage.

    I have read the documentation and tried everything I could think or find all to nothing does not. It's my first attempt @ APEX, so I'm learning.
    Any suggestions on what to check?

    I use the
    by default the port of * 8080 *.
    Installation shows as valid
    Public_User is unlocked

    Hello.

    Check your settings in firewall Windows/Linux/mac

    Eduardo

  • Pavilion G6-2005ax, unable to access the wifi network

    Hello

    I was on WiFi from the laptop. But it does not check the Wifi Hotspots.

    and even if it is true, it is impossible to connect to this Wifi network please help.

    I use Windows 7 Basic.

    Hello rjrocks,

    Have a look here http://goo.gl/jcCqx and see if these troubleshooting steps will help solve your problem.

    There are several steps here http://goo.gl/CKicD if the first document does not work.

    Please let me know if this can help,

  • Cisco asa 5505 and centos VPN server connection

    Hi all

    Please I want to set up a VPN between Cisco asa 5505 and centos server.

    Here's my senerio

    -------------------------

    ASA 5505

    Public IP 155.155.155.2

    Local NETWORK: 192.168.6.X

    CentOS Server

    ------------------

    Public ip address: 155.155.155.6

    Thank you guys

    Apology, do you mean access remote VPN Client of hundred BONE for Cisco ASA 5505?

    If the remote access, here are the sample configuration:

    http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008060f25c.shtml

  • ASA 5505 VPN cannot access inside the host

    I have access remote VPN configuration on an ASA 5505, but cannot access the host or the AAS when I connect through the VPN. I can connect with the Cisco VPN client and the VPN is on on the SAA and it shows that I am connected. I have the correct Ip address, but I can't ping or you connect to one of the internal addresses. I can't find what I'm missing. I have the VPN without going through the ACL interface. Because I can connect but not going anywhere I'm sure I missed something.

    framework for configuration below

    interface Vlan1

    nameif inside

    security-level 100

    10.1.1.1 IP address 255.255.255.0

    IP local pool xxxx 10.1.1.50 - 10.1.1.55 mask 255.255.255.0

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto-map dynamic outside_dyn_map 20 set pfs

    Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

    PFS set 40 crypto dynamic-map outside_dyn_map

    Crypto-map dynamic outside_dyn_map 40 value transform-set ESP-3DES-SHA

    Crypto-map dynamic inside_dyn_map 20 set pfs

    Crypto-map dynamic inside_dyn_map 20 the value transform-set ESP-3DES-SHA

    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

    outside_map interface card crypto outside

    map inside_map 65535-isakmp ipsec crypto dynamic inside_dyn_map

    inside crypto map inside_map interface

    crypto ISAKMP allow inside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    global service-policy global_policy

    XXXXXXX strategy of Group internal

    attributes of the strategy group xxxxxxx

    banner value xxxxx Site Recovery

    WINS server no

    24.xxx.xxx.xx value of DNS server

    VPN-access-hour no

    VPN - connections 3

    VPN-idle-timeout 30

    VPN-session-timeout no

    VPN-filter no

    Protocol-tunnel-VPN IPSec

    Split-tunnel-policy tunnelall

    by default no

    disable secure authentication unit

    disable authentication of the user

    user-authentication-idle-timeout no

    disable the IP-phone-bypass

    disable the leap-bypass

    disable the NEM

    disable the NAC

    NAC-sq-period 300

    NAC-reval-period 36000

    NAC-by default-acl no

    the address value xxxxxx pools

    enable Smartcard-Removal-disconnect

    the firewall client no

    WebVPN

    url-entry functions

    Free VPN of CNA no

    No vpn-addr-assign aaa

    No dhcp vpn-addr-assign

    tunnel-group xxxx type ipsec-ra

    tunnel-group xxxx general attributes

    xxxx address pool

    Group Policy - by default-xxxx

    blountdr group of tunnel ipsec-attributes

    pre-shared-key *.

    Missing nat exemption for vpn clients. Add the following and you should be good to go.

    inside_nat0_outbound list of allowed ip extended access any 192.168.10.0 255.255.255.0

    NAT (inside) 0-list of access inside_nat0_outbound

  • Cisco ASA 5505 remote VPN access to the local network

    I have installed two ASA 5505 VPN site to site that works perfectly.  Now, I also need to have 1 customer site to remote access VPN with Cisco VPN dialer.  I can get the VPN dialer to connect the VPN and get a VPN IP address, but I do not have access to the remote network.  can someone take a look and see what I'm missing?  I have attached the ASA running config.

    Apologize for the misunderstanding.

    To access the remote vpn client 10.10.100.x subnet, the vpn-filter ACL is the opposite.

    Please please share the following ACL:

    FROM: / * Style Definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-marge-haut : 0 cm ; mso-para-marge-droit : 0 cm ; mso-para-marge-bas : 10.0pt ; mso-para-marge-gauche : 0 cm ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

    outside_cryptomapVPN list of allowed ip extended access any 10.10.20.0 255.255.255.224

    TO:

    / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-marge-haut : 0 cm ; mso-para-marge-droit : 0 cm ; mso-para-marge-bas : 10.0pt ; mso-para-marge-gauche : 0 cm ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

    outside_cryptomapVPN to access extended list ip 10.10.20.0 allow 255.255.255.224 all

    Hope that helps.

  • Cisco ASA 5505 VPN L2TP cannot access the internal network

    Hello

    I'm trying to configure Cisco VPN L2TP to my office. After a successful login, I can't access the internal network.

    Can you jhelp me to find the problem?

    I have Cisco ASA:

    within the network - 192.168.1.0

    VPN - 192.168.168.0 network

    I have the router to 192.168.1.2 and I cannot ping or access this router.

    Here is my config:

    ASA Version 8.4 (3)

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.1.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP 198.X.X.A 255.255.255.248

    !

    passive FTP mode

    permit same-security-traffic intra-interface

    the net-all purpose network

    subnet 0.0.0.0 0.0.0.0

    network vpn_local object

    192.168.168.0 subnet 255.255.255.0

    network inside_nw object

    subnet 192.168.1.0 255.255.255.0

    outside_access_in list extended access permit icmp any any echo response

    outside_access_in list extended access deny ip any any newspaper

    pager lines 24

    Enable logging

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    IP local pool sales_addresses 192.168.168.1 - 192.168.168.254

    ICMP unreachable rate-limit 1 burst-size 1

    don't allow no asdm history

    ARP timeout 14400

    NAT dynamic interface of net-all source (indoor, outdoor)

    NAT (inside, outside) source inside_nw destination inside_nw static static vpn_local vpn_local

    NAT (exterior, Interior) source vpn_local destination vpn_local static static inside_nw inside_nw-route search

    !

    network vpn_local object

    dynamic NAT interface (outdoors, outdoor)

    network inside_nw object

    NAT dynamic interface (indoor, outdoor)

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 198.X.X.B 1

    Timeout xlate 03:00

    Pat-xlate timeout 0:00:30

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    identity of the user by default-domain LOCAL

    AAA authentication enable LOCAL console

    the ssh LOCAL console AAA authentication

    AAA authentication http LOCAL console

    Enable http server

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

    IKEv1 crypto ipsec transform-set my-transform-set-ikev1 esp-3des esp-sha-hmac

    transport in transform-set my-transform-set-ikev1 ikev1 crypto ipsec mode

    Crypto-map Dynamics dyno 10 set transform-set my-transformation-set-ikev1 ikev1

    card crypto 20-isakmp ipsec vpn Dynamics dyno

    vpn outside crypto map interface

    Crypto isakmp nat-traversal 3600

    Crypto ikev1 allow outside

    IKEv1 crypto policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet timeout 5

    SSH 192.168.1.0 255.255.255.0 inside

    SSH timeout 30

    Console timeout 0

    management-access inside

    dhcpd address 192.168.1.5 - 192.168.1.132 inside

    dhcpd dns 75.75.75.75 76.76.76.76 interface inside

    dhcpd allow inside

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    internal sales_policy group policy

    attributes of the strategy of group sales_policy

    Server DNS 75.75.75.75 value 76.76.76.76

    Protocol-tunnel-VPN l2tp ipsec

    user name-

    user name-

    attributes global-tunnel-group DefaultRAGroup

    address sales_addresses pool

    Group Policy - by default-sales_policy

    IPSec-attributes tunnel-group DefaultRAGroup

    IKEv1 pre-shared-key *.

    tunnel-group DefaultRAGroup ppp-attributes

    ms-chap-v2 authentication

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    no remote anonymous reporting call

    Cryptochecksum:5d1fc9409c87ecdc1e06f06980de6c13

    : end

    Thanks for your help.

    You must test with 'real' traffic on 192.168.1.2 and if you use ping, you must add icmp-inspection:

    Policy-map global_policy

    class inspection_default

    inspect the icmp

    --

    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • Cisco ASA 5505 site for multiple subnet of the site.

    Hello. I need help to configure my cisco asa 5505.

    I set up a VPN between two ASA 5505 tunnel

    Site 1:

    Subnet 192.168.77.0

    Site 2:

    Have multiple VLANs and now the tunnel goes to vlan400 - 192.168.1.0

    What I need help:

    Site 1, I need to be able to reach a different virtual LAN on site 2. vlan480 - 192.168.20.0

    And 1 site I have to reach 192.168.77.0 subnet of vlan480 - 192.168.20.0

    Vlan480 is used for phones. In vlan480, we have a PABX.

    Is this possible to do?

    Any help would be much appreciated!

    Config site 2:

    : Saved

    :

    ASA Version 7.2 (2)

    !

    ciscoasa hostname

    domain default.domain.invalid

    activate the password encrypted x

    names of

    name 192.168.1.250 DomeneServer

    name of 192.168.1.10 NotesServer

    name 192.168.1.90 Steadyily

    name 192.168.1.97 TerminalServer

    name 192.168.1.98 eyeshare w8

    name 192.168.50.10 w8-print

    name 192.168.1.94 w8 - app

    name 192.168.1.89 FonnaFlyMedia

    !

    interface Vlan1

    nameif Vlan1

    security-level 100

    IP 192.168.200.100 255.255.255.0

    OSPF cost 10

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP address 79.x.x.226 255.255.255.224

    OSPF cost 10

    !

    interface Vlan400

    nameif vlan400

    security-level 100

    IP 192.168.1.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan450

    nameif Vlan450

    security-level 100

    IP 192.168.210.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan460

    nameif Vlan460-SuldalHotell

    security-level 100

    IP 192.168.2.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan461

    nameif Vlan461-SuldalHotellGjest

    security-level 100

    address 192.168.3.1 IP 255.255.255.0

    OSPF cost 10

    !

    interface Vlan462

    Vlan462-Suldalsposten nameif

    security-level 100

    192.168.4.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Vlan470

    nameif vlan470-Kyrkjekontoret

    security-level 100

    IP 192.168.202.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan480

    nameif vlan480 Telefoni

    security-level 100

    address 192.168.20.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan490

    nameif Vlan490-QNapBackup

    security-level 100

    IP 192.168.10.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan500

    nameif Vlan500-HellandBadlands

    security-level 100

    192.168.30.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Vlan510

    Vlan510-IsTak nameif

    security-level 100

    192.168.40.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Vlan600

    nameif Vlan600-SafeQ

    security-level 100

    192.168.50.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    switchport access vlan 500

    switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610

    switchport mode trunk

    !

    interface Ethernet0/3

    switchport access vlan 490

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    passwd encrypted x

    passive FTP mode

    clock timezone WAT 1

    DNS server-group DefaultDNS

    domain default.domain.invalid

    permit same-security-traffic inter-interface

    permit same-security-traffic intra-interface

    Lotus_Notes_Utgaaande tcp service object-group

    UT og Frim Notes Description til alle

    area of port-object eq

    port-object eq ftp

    port-object eq www

    EQ object of the https port

    port-object eq lotusnotes

    EQ Port pop3 object

    EQ pptp Port object

    EQ smtp port object

    Lotus_Notes_inn tcp service object-group

    Description of the inn og alle til Notes

    port-object eq www

    port-object eq lotusnotes

    EQ Port pop3 object

    EQ smtp port object

    object-group service Reisebyraa tcp - udp

    3702 3702 object-port Beach

    5500 5500 object-port Beach

    range of object-port 9876 9876

    object-group service Remote_Desktop tcp - udp

    Description Tilgang til Remote Desktop

    3389 3389 port-object range

    object-group service Sand_Servicenter_50000 tcp - udp

    Description program tilgang til sand service AS

    object-port range 50000 50000

    VNC_Remote_Admin tcp service object-group

    Description Fra ¥ oss til alle

    5900 5900 port-object range

    object-group service Printer_Accept tcp - udp

    9100 9100 port-object range

    port-object eq echo

    ICMP-type of object-group Echo_Ping

    echo ICMP-object

    response to echo ICMP-object

    object-group service Print tcp

    9100 9100 port-object range

    FTP_NADA tcp service object-group

    Suldalsposten NADA tilgang description

    port-object eq ftp

    port-object eq ftp - data

    Telefonsentral tcp service object-group

    Hoftun description

    port-object eq ftp

    port-object eq ftp - data

    port-object eq www

    EQ object of the https port

    port-object eq telnet

    Printer_inn_800 tcp service object-group

    Fra 800 thought-out og inn til 400 port 7777 description

    range of object-port 7777 7777

    Suldalsposten tcp service object-group

    Description send av mail hav Mac Mail at - Ã ¥ nrep smtp

    EQ Port pop3 object

    EQ smtp port object

    http2 tcp service object-group

    Beach of port-object 81 81

    object-group service DMZ_FTP_PASSIVE tcp - udp

    55536 56559 object-port Beach

    object-group service DMZ_FTP tcp - udp

    20 21 object-port Beach

    object-group service DMZ_HTTPS tcp - udp

    Beach of port-object 443 443

    object-group service DMZ_HTTP tcp - udp

    8080 8080 port-object range

    DNS_Query tcp service object-group

    of domain object from the beach

    object-group service DUETT_SQL_PORT tcp - udp

    Description for a mellom andre og duett Server nett

    54659 54659 object-port Beach

    outside_access_in of access allowed any ip an extended list

    outside_access_out of access allowed any ip an extended list

    vlan400_access_in list extended access deny ip any host 149.20.56.34

    vlan400_access_in list extended access deny ip any host 149.20.56.32

    vlan400_access_in of access allowed any ip an extended list

    Vlan450_access_in list extended access deny ip any host 149.20.56.34

    Vlan450_access_in list extended access deny ip any host 149.20.56.32

    Vlan450_access_in of access allowed any ip an extended list

    Vlan460_access_in list extended access deny ip any host 149.20.56.34

    Vlan460_access_in list extended access deny ip any host 149.20.56.32

    Vlan460_access_in of access allowed any ip an extended list

    vlan400_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande

    vlan400_access_out list extended access permit tcp any host DomeneServer object-group Remote_Desktop

    vlan400_access_out list extended access permit tcp any host TerminalServer object-group Remote_Desktop

    vlan400_access_out list extended access permit tcp any host http2 object-group Steadyily

    vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_inn

    vlan400_access_out list extended access permit tcp any host NotesServer object-group Remote_Desktop

    vlan400_access_out allowed extended access list tcp any host w8-eyeshare object-group Remote_Desktop

    vlan400_access_out allowed extended access list tcp any host w8 - app object-group Remote_Desktop

    vlan400_access_out list extended access permit tcp any host FonnaFlyMedia range 8400-8600

    vlan400_access_out list extended access permit udp any host FonnaFlyMedia 9000 9001 range

    vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host DomeneServer

    vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host w8 - app object-group DUETT_SQL_PORT

    Vlan500_access_in list extended access deny ip any host 149.20.56.34

    Vlan500_access_in list extended access deny ip any host 149.20.56.32

    Vlan500_access_in of access allowed any ip an extended list

    vlan470_access_in list extended access deny ip any host 149.20.56.34

    vlan470_access_in list extended access deny ip any host 149.20.56.32

    vlan470_access_in of access allowed any ip an extended list

    Vlan490_access_in list extended access deny ip any host 149.20.56.34

    Vlan490_access_in list extended access deny ip any host 149.20.56.32

    Vlan490_access_in of access allowed any ip an extended list

    Vlan450_access_out list extended access permit icmp any any Echo_Ping object-group

    Vlan1_access_out of access allowed any ip an extended list

    Vlan1_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

    Vlan1_access_out deny ip extended access list a whole

    Vlan1_access_out list extended access permit icmp any any echo response

    Vlan460_access_out list extended access permit icmp any any Echo_Ping object-group

    Vlan490_access_out list extended access permit icmp any any Echo_Ping object-group

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTPS

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTP

    Vlan500_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan470_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan470_access_out list extended access permit tcp any host 192.168.202.10 - group Remote_Desktop object

    Vlan510_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan480_access_out of access allowed any ip an extended list

    Vlan510_access_in of access allowed any ip an extended list

    Vlan600_access_in of access allowed any ip an extended list

    Vlan600_access_out list extended access permit icmp any one

    Vlan600_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

    Vlan600_access_out list extended access permitted tcp 192.168.1.0 255.255.255.0 host w8-printing eq www

    Vlan600_access_out list extended access permitted tcp 192.168.202.0 255.255.255.0 host w8-printing eq www

    Vlan600_access_out list extended access permitted tcp 192.168.210.0 255.255.255.0 host w8-printing eq www

    Vlan600_access_in_1 of access allowed any ip an extended list

    Vlan461_access_in of access allowed any ip an extended list

    Vlan461_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan400_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

    outside_20_cryptomap_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

    outside_20_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

    access-list Vlan462-Suldalsposten_access_in extended ip allowed any one

    access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo response

    access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo response

    access-list Vlan462-Suldalsposten_access_in_1 extended ip allowed any one

    pager lines 24

    Enable logging

    asdm of logging of information

    MTU 1500 Vlan1

    Outside 1500 MTU

    vlan400 MTU 1500

    MTU 1500 Vlan450

    MTU 1500 Vlan460-SuldalHotell

    MTU 1500 Vlan461-SuldalHotellGjest

    vlan470-Kyrkjekontoret MTU 1500

    MTU 1500 vlan480-Telefoni

    MTU 1500 Vlan490-QNapBackup

    MTU 1500 Vlan500-HellandBadlands

    MTU 1500 Vlan510-IsTak

    MTU 1500 Vlan600-SafeQ

    MTU 1500 Vlan462-Suldalsposten

    no failover

    Monitor-interface Vlan1

    interface of the monitor to the outside

    the interface of the monitor vlan400

    the interface of the monitor Vlan450

    the interface of the Vlan460-SuldalHotell monitor

    the interface of the Vlan461-SuldalHotellGjest monitor

    the interface of the vlan470-Kyrkjekontoret monitor

    Monitor-interface vlan480-Telefoni

    the interface of the Vlan490-QNapBackup monitor

    the interface of the Vlan500-HellandBadlands monitor

    Monitor-interface Vlan510-IsTak

    Monitor-interface Vlan600-SafeQ

    the interface of the monitor Vlan462-Suldalsposten

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 522.bin

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    vlan400_nat0_outbound (vlan400) NAT 0 access list

    NAT (vlan400) 1 0.0.0.0 0.0.0.0 dns

    NAT (Vlan450) 1 0.0.0.0 0.0.0.0 dns

    NAT (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0

    NAT (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0

    NAT (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0

    NAT (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns

    NAT (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0

    NAT (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0

    NAT (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0

    NAT (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0

    static (vlan400, external) 79.x.x.x DomeneServer netmask 255.255.255.255

    static (vlan470-Kyrkjekontoret, external) 79.x.x.x 192.168.202.10 netmask 255.255.255.255

    static (vlan400, external) 79.x.x.x NotesServer netmask 255.255.255.255 dns

    static (vlan400, external) 79.x.x.231 netmask 255.255.255.255 TerminalServer

    static (vlan400, external) 79.x.x.234 Steadyily netmask 255.255.255.255

    static (vlan400, outside) w8-eyeshare netmask 255.255.255.255 79.x.x.232

    static (Vlan490-QNapBackup, external) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns

    static (Vlan600-SafeQ, external) 79.x.x.235 w8 - print subnet mask 255.255.255.255

    static (vlan400, outside) w8 - app netmask 255.255.255.255 79.x.x.236

    static (Vlan450, vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

    (Vlan500-HellandBadlands, vlan400) static 192.168.30.0 192.168.30.0 netmask 255.255.255.0

    (vlan400, Vlan500-HellandBadlands) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    (vlan400, Vlan450) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    static (vlan400, external) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255

    static (Vlan462-Suldalsposten, vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0

    static (vlan400, Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    static (vlan400, Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    static (Vlan600-SafeQ, vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

    static (Vlan600-SafeQ, Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

    static (Vlan600-SafeQ, vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

    static (Vlan450, Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

    static (vlan470-Kyrkjekontoret, Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0

    Access-group interface Vlan1 Vlan1_access_out

    Access-group outside_access_in in interface outside

    Access-group outside_access_out outside interface

    Access-group vlan400_access_in in the vlan400 interface

    vlan400_access_out group access to the interface vlan400

    Access-group Vlan450_access_in in the Vlan450 interface

    Access-group interface Vlan450 Vlan450_access_out

    Access-group interface Vlan460-SuldalHotell Vlan460_access_in

    Access-group interface Vlan460-SuldalHotell Vlan460_access_out

    Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_in

    Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_out

    Access-group vlan470_access_in in interface vlan470-Kyrkjekontoret

    vlan470_access_out access to the interface vlan470-Kyrkjekontoret group

    access to the interface vlan480-Telefoni, vlan480_access_out group

    Access-group interface Vlan490-QNapBackup Vlan490_access_in

    Access-group interface Vlan490-QNapBackup Vlan490_access_out

    Access-group interface Vlan500-HellandBadlands Vlan500_access_in

    Access-group interface Vlan500-HellandBadlands Vlan500_access_out

    Access-group interface Vlan510-IsTak Vlan510_access_in

    Access-group interface Vlan510-IsTak Vlan510_access_out

    Access-group Vlan600_access_in_1 interface Vlan600-SafeQ

    Access-group Vlan600_access_out interface Vlan600-SafeQ

    Access-group Vlan462-Suldalsposten_access_in_1 Vlan462-Suldalsposten interface

    Access-group Vlan462-Suldalsposten_access_out_1 Vlan462-Suldalsposten interface

    Route outside 0.0.0.0 0.0.0.0 79.x.x.225 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout, uauth 0:05:00 absolute

    x x encrypted privilege 15 password username

    the ssh LOCAL console AAA authentication

    Enable http server

    http 192.168.210.0 255.255.255.0 Vlan450

    http 192.168.200.0 255.255.255.0 Vlan1

    http 192.168.1.0 255.255.255.0 vlan400

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    card crypto outside_map 20 match address outside_20_cryptomap_1

    card crypto outside_map 20 set pfs

    peer set card crypto outside_map 20 62.92.159.137

    outside_map crypto 20 card value transform-set ESP-3DES-SHA

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    ISAKMP crypto enable vlan400

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    tunnel-group 62.92.159.137 type ipsec-l2l

    IPSec-attributes tunnel-group 62.92.159.137

    pre-shared-key *.

    Telnet 192.168.200.0 255.255.255.0 Vlan1

    Telnet 192.168.1.0 255.255.255.0 vlan400

    Telnet timeout 5

    SSH 171.68.225.216 255.255.255.255 outside

    SSH timeout 5

    Console timeout 0

    dhcpd update dns both

    !

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1

    !

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 outside interface

    !

    dhcpd address 192.168.1.100 - 192.168.1.225 vlan400

    dhcpd option ip 6 DomeneServer 81.167.36.11 interface vlan400

    dhcpd option 3 ip 192.168.1.1 interface vlan400

    vlan400 enable dhcpd

    !

    dhcpd address 192.168.210.100 - 192.168.210.200 Vlan450

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450

    dhcpd ip interface 192.168.210.1 option 3 Vlan450

    enable Vlan450 dhcpd

    !

    dhcpd address 192.168.2.100 - 192.168.2.150 Vlan460-SuldalHotell

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell

    dhcpd 192.168.2.1 ip interface option 3 Vlan460-SuldalHotell

    dhcpd enable Vlan460-SuldalHotell

    !

    dhcpd address 192.168.3.100 - 192.168.3.200 Vlan461-SuldalHotellGjest

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest

    dhcpd ip interface 192.168.3.1 option 3 Vlan461-SuldalHotellGjest

    dhcpd enable Vlan461-SuldalHotellGjest

    !

    dhcpd address 192.168.202.100 - 192.168.202.199 vlan470-Kyrkjekontoret

    interface of dhcpd option 3 ip 192.168.202.1 vlan470-Kyrkjekontoret

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret

    dhcpd enable vlan470-Kyrkjekontoret

    !

    dhcpd option 3 192.168.20.1 ip interface vlan480-Telefoni

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni

    !

    dhcpd address 192.168.10.80 - 192.168.10.90 Vlan490-QNapBackup

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup

    dhcpd 192.168.10.1 ip interface option 3 Vlan490-QNapBackup

    !

    dhcpd address 192.168.30.100 - 192.168.30.199 Vlan500-HellandBadlands

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands

    dhcpd ip interface 192.168.30.1 option 3 Vlan500-HellandBadlands

    dhcpd enable Vlan500-HellandBadlands

    !

    dhcpd address 192.168.40.100 - 192.168.40.150 Vlan510-IsTak

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak

    dhcpd 3 ip Vlan510-IsTak 192.168.40.1 option interface

    Vlan510-IsTak enable dhcpd

    !

    dhcpd address 192.168.50.150 - 192.168.50.199 Vlan600-SafeQ

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ

    Vlan600-SafeQ enable dhcpd

    !

    dhcpd address 192.168.4.100 - 192.168.4.150 Vlan462-Suldalsposten

    interface option 6 ip DomeneServer 81.167.36.11 Vlan462-Suldalsposten dhcpd

    interface ip dhcpd option 3 Vlan462-Suldalsposten 192.168.4.1

    Vlan462-Suldalsposten enable dhcpd

    !

    !

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    !

    context of prompt hostname

    Cryptochecksum:x

    : end

    Site 1 config:

    : Saved

    :

    ASA Version 7.2 (4)

    !

    ciscoasa hostname

    domain default.domain.invalid

    activate the password encrypted x

    passwd encrypted x

    names of

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.77.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    PPPoE Telenor customer vpdn group

    IP address pppoe setroute

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    switchport access vlan 15

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    passive FTP mode

    DNS server-group DefaultDNS

    domain default.domain.invalid

    outside_access_in list extended access permit icmp any any disable log echo-reply

    access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0

    access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.1.0 255.255.255.0

    pager lines 24

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 524.bin

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    Access-group outside_access_in in interface outside

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    Enable http server

    http 192.168.77.0 255.255.255.0 inside

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set pfs

    peer set card crypto outside_map 1 79.160.252.226

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    outside_map interface card crypto outside

    crypto ISAKMP allow inside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet 192.168.77.0 255.255.255.0 inside

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    VPDN group Telenor request dialout pppoe

    VPDN group Telenor localname x

    VPDN group Telenor ppp authentication chap

    VPDN x x local store password username

    dhcpd outside auto_config

    !

    dhcpd address 192.168.77.100 - 192.168.77.130 inside

    dhcpd dns 192.168.77.1 on the inside interface

    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside

    dhcpd allow inside

    !

    dhcpd option 6 ip 130.67.15.198 193.213.112.4 outside interface

    !

    tunnel-group 79.160.252.226 type ipsec-l2l

    IPSec-attributes tunnel-group 79.160.252.226

    pre-shared-key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:x

    : end

    Hello

    The addition of a new network to the existing VPN L2L should be a fairly simple process.

    Essentially, you need to add the network of the Crypto present ACL configurations "crypto map" . You also need to configure the NAT0 configuration for it in the appropriate interfaces of the SAA. These configurations are all made on both ends of the VPN L2L connection.

    Looking at your configurations above it would appear that you need to the following configurations

    SITE 1

    • We add the new network at the same time the crypto ACL and ACL NAT0

    access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.20.0 255.255.255.0

    access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.20.0 255.255.255.0

    SITE 2

    • We add new ACL crypto network
    • We create a new NAT0 configuration for interface Vlan480 because there is no previous NAT0 configuration

    outside_20_cryptomap_1 to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

    Comment by VLAN480-NAT0 NAT0 for VPN access-list

    access-list VLAN480-NAT0 ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

    NAT 0 access-list VLAN480-NAT0 (vlan480-Telefoni)

    These configurations should pretty much do the trick.

    Let me know if it worked

    -Jouni

  • ASA 5505 IPSEC VPN connected but cannot access the local network

    ASA: 8.2.5

    ASDM: 6.4.5

    LAN: 10.1.0.0/22

    Pool VPN: 172.16.10.0/24

    Hi, we purcahsed a new ASA 5505 and try to configure IPSEC VPN via ASDM; I simply run the wizards, installation vpnpool, split tunnelling, etc.

    I can connect to the ASA using the cisco VPN client and internet works fine on the local PC, but it can not access the local network (can not impossible. ping remote desktop). I tried the same thing on our Production ASA(those have both Remote VPN and Site-to-site VPN working), the new profile, I created worked very well.

    Here is my setup, wrong set up anything?

    ASA Version 8.2 (5)

    !

    hostname asatest

    domain XXX.com

    activate 8Fw1QFqthX2n4uD3 encrypted password

    g9NiG6oUPjkYrHNt encrypted passwd

    names of

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 10.1.1.253 255.255.252.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    address IP XXX.XXX.XXX.XXX 255.255.255.240

    !

    passive FTP mode

    clock timezone PST - 8

    clock summer-time recurring PDT

    DNS server-group DefaultDNS

    domain vff.com

    vpntest_splitTunnelAcl list standard access allowed 10.1.0.0 255.255.252.0

    access extensive list ip 10.1.0.0 inside_nat0_outbound allow 255.255.252.0 172.16.10.0 255.255.255.0

    pager lines 24

    Enable logging

    timestamp of the record

    logging trap warnings

    asdm of logging of information

    logging - the id of the device hostname

    host of logging inside the 10.1.1.230

    Within 1500 MTU

    Outside 1500 MTU

    IP local pool 172.16.10.1 - 172.16.10.254 mask 255.255.255.0 vpnpool

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    Route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    AAA-server protocol nt AD

    AAA-server host 10.1.1.108 AD (inside)

    NT-auth-domain controller 10.1.1.108

    Enable http server

    http 10.1.0.0 255.255.252.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet timeout 5

    SSH 10.1.0.0 255.255.252.0 inside

    SSH timeout 20

    Console timeout 0

    dhcpd outside auto_config

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    internal group vpntest strategy

    Group vpntest policy attributes

    value of 10.1.1.108 WINS server

    Server DNS 10.1.1.108 value

    Protocol-tunnel-VPN IPSec l2tp ipsec

    disable the password-storage

    disable the IP-comp

    Re-xauth disable

    disable the PFS

    IPSec-udp disable

    IPSec-udp-port 10000

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list vpntest_splitTunnelAcl

    value by default-domain XXX.com

    disable the split-tunnel-all dns

    Dungeon-client-config backup servers

    the address value vpnpool pools

    admin WeiepwREwT66BhE9 encrypted privilege 15 password username

    username user5 encrypted password privilege 5 yIWniWfceAUz1sUb

    the encrypted password privilege 3 umNHhJnO7McrLxNQ util_3 username

    tunnel-group vpntest type remote access

    tunnel-group vpntest General attributes

    address vpnpool pool

    authentication-server-group AD

    authentication-server-group (inside) AD

    Group Policy - by default-vpntest

    band-Kingdom

    vpntest group tunnel ipsec-attributes

    pre-shared-key BEKey123456

    NOCHECK Peer-id-validate

    !

    !

    privilege level 3 mode exec cmd command perfmon

    privilege level 3 mode exec cmd ping command

    mode privileged exec command cmd level 3

    logging of the privilege level 3 mode exec cmd commands

    privilege level 3 exec command failover mode cmd

    privilege level 3 mode exec command packet cmd - draw

    privilege show import at the level 5 exec mode command

    privilege level 5 see fashion exec running-config command

    order of privilege show level 3 exec mode reload

    privilege level 3 exec mode control fashion show

    privilege see the level 3 exec firewall command mode

    privilege see the level 3 exec mode command ASP.

    processor mode privileged exec command to see the level 3

    privilege command shell see the level 3 exec mode

    privilege show level 3 exec command clock mode

    privilege exec mode level 3 dns-hosts command show

    privilege see the level 3 exec command access-list mode

    logging of orders privilege see the level 3 exec mode

    privilege, level 3 see the exec command mode vlan

    privilege show level 3 exec command ip mode

    privilege, level 3 see fashion exec command ipv6

    privilege, level 3 see the exec command failover mode

    privilege, level 3 see fashion exec command asdm

    exec mode privilege see the level 3 command arp

    command routing privilege see the level 3 exec mode

    privilege, level 3 see fashion exec command ospf

    privilege, level 3 see the exec command in aaa-server mode

    AAA mode privileged exec command to see the level 3

    privilege, level 3 see fashion exec command eigrp

    privilege see the level 3 exec mode command crypto

    privilege, level 3 see fashion exec command vpn-sessiondb

    privilege level 3 exec mode command ssh show

    privilege, level 3 see fashion exec command dhcpd

    privilege, level 3 see the vpnclient command exec mode

    privilege, level 3 see fashion exec command vpn

    privilege level see the 3 blocks from exec mode command

    privilege, level 3 see fashion exec command wccp

    privilege see the level 3 exec command mode dynamic filters

    privilege, level 3 see the exec command in webvpn mode

    privilege control module see the level 3 exec mode

    privilege, level 3 see fashion exec command uauth

    privilege see the level 3 exec command compression mode

    level 3 for the show privilege mode configure the command interface

    level 3 for the show privilege mode set clock command

    level 3 for the show privilege mode configure the access-list command

    level 3 for the show privilege mode set up the registration of the order

    level 3 for the show privilege mode configure ip command

    level 3 for the show privilege mode configure command failover

    level 5 mode see the privilege set up command asdm

    level 3 for the show privilege mode configure arp command

    level 3 for the show privilege mode configure the command routing

    level 3 for the show privilege mode configure aaa-order server

    level mode 3 privilege see the command configure aaa

    level 3 for the show privilege mode configure command crypto

    level 3 for the show privilege mode configure ssh command

    level 3 for the show privilege mode configure command dhcpd

    level 5 mode see the privilege set privilege to command

    privilege level clear 3 mode exec command dns host

    logging of the privilege clear level 3 exec mode commands

    clear level 3 arp command mode privileged exec

    AAA-server of privilege clear level 3 exec mode command

    privilege clear level 3 exec mode command crypto

    privilege clear level 3 exec command mode dynamic filters

    level 3 for the privilege cmd mode configure command failover

    clear level 3 privilege mode set the logging of command

    privilege mode clear level 3 Configure arp command

    clear level 3 privilege mode configure command crypto

    clear level 3 privilege mode configure aaa-order server

    context of prompt hostname

    no remote anonymous reporting call

    Cryptochecksum:447bbbc60fc01e9f83b32b1e0304c6b4

    : end

    Captures we can see packets going from the pool to the internal LAN, but we do not reply back packages.

    The routing must be such that for 172.16.10.0/24 packages should reach the inside interface of the ASA.

    On client machines or your internal LAN switch, you need to add route for 172.16.10.0/24 pointing to the inside interface of the ASA.

Maybe you are looking for

  • Recover files accidentally deleted after use RM - RF

    Hello. 6 days there, I'm trying to clean my trash, but an error pops up "the operation cannot be completed because the item is in use. After trying a few method, I found a solution using the: cd ~ /. Trash; rm - rf *. instead of cleaning my trash can

  • Pavilion 27 N020: Keyboard does not

    Hello I just bought a 27 N020 Pavilion all-in-one.  I followed all the instructions on the screen. Typed in the address, e-mail etc. BUT... when I get to the main screen of windows keyboard stops working! The mouse works fine... the work of volume co

  • problem with font size (LV2011SP1) scheme?

    Hello I just found "interesting behaviour" using LV2011SP1: I try to set the font size of the elements of the FP like this: The upper graph is selected and I choose the font size = 18 in drop-down list of font settings menu. So, what do you expect? T

  • Update and check Blackberry Z10 Z10 blackBerry

    I have a Z10 (STL100-2) and I bought it outright and without brand. I now use Vodafone at THE and I was not able to find an update for mine. My OS is 10.0.10.261. I did some research online and found massive articles about it being leaked to Dev-Alph

  • Series "the product key you entered cannot be used to activate Windows on this computer" in Windows 7

    A while ago, me and my family bought a Windows 7 Home Premium with serial number good for use for 3 computers, we used on two and I just tried to install it on the third today (after all at least a year to have the disc sitting in a closet in the mea