Cisco VPN client + VPN site-to-site

Similar Questions

• Cisco VPN Site to Site with a static and dynamic does not

  Hello

  I have ASA 5510 in Headquarters with static, IP and ASA 5505 in the remote site behind ADSL router trying to establish VPN, but its failure in phase 1

  Config of the headquarters

  interface Ethernet0/0

  Description link to router LeaseLine

  nameif outside

  security-level 0

  IP x.x.x.x 255.255.255.248

  !

  interface Ethernet0/1

  Description link to LAN internal

  nameif inside

  security-level 100

  IP 172.17.1.15 255.255.255.0

  access extensive list ip 172.17.1.0 inside_nat0_outbound_1 allow 255.255.255.0 172.20.1.0 255.255.255.0

  access extensive list ip 172.17.1.0 inside_nat0_outbound_1 allow 255.255.255.0 172.19.1.0 255.255.255.0

  access extensive list ip 172.17.1.0 vpn_to_remote allow 255.255.255.0 172.19.1.0 255.255.255.0

  extended VPN ip 172.17.1.0 access list allow 255.255.255.0 172.20.1.0 255.255.255.0

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound_1

  NAT (inside) 1 0.0.0.0 0.0.0.0

  Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

  Crypto ipsec transform-set esp-aes-256-md5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  correspondence address 1 crypto dynamic-map cisco VPN

  Crypto dynamic-map cisco 1 set of transformation-ESP-AES-256-SHA

  card crypto outside_map 10 correspondence address vpn_to_remote

  card crypto outside_map 10 set pfs

  card crypto outside_map 10 peers set y.y.y.y

  card crypto outside_map 10 transform-set esp-aes-256-md5

  outside_map crypto 10 card value reverse-road

  dynamic outside_map 30-isakmp ipsec crypto map Cisco

  outside_map interface card crypto outside

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  aes-256 encryption

  md5 hash

  Group 5

  life 86400

  crypto ISAKMP policy 20

  preshared authentication

  aes encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 30

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  Crypto isakmp nat-traversal 20

  tunnel-group y.y.y.y type ipsec-l2l

  tunnel-group ipsec-attributes y.y.y.y

  pre-shared-key *.

  tunnel-group parkplace type ipsec-l2l

  tunnel-group ipsec-attributes parkplace

  pre-shared-key *.

  The Remote Site configuration

  interface Vlan1

  nameif inside

  security-level 100

  address 172.20.1.1 IP 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 192.168.1.2 255.255.255.0

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  ICMP list extended access permit icmp any one

  access-list SHEEP extended ip 172.20.1.0 allow 255.255.255.0 172.17.1.0 255.255.255.0

  extended VPN 172.20.1.0 ip access list allow 255.255.255.0 172.17.1.0 255.255.255.0

  Global 1 interface (outside)

  NAT (inside) 0 access-list SHEEP

  NAT (inside) 1 0.0.0.0 0.0.0.0 outdoors

  Access-group ICMP in interface outside

  Route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  crypto map outside_map 1 is the VPN address

  peer set card crypto outside_map 1 83.111.252.242

  card crypto outside_map 1 set of transformation-ESP-AES-256-SHA

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  Crypto isakmp nat-traversal 20

  tunnel-group fairmount type ipsec-l2l

  tunnel-group fairmount ipsec-attributes

  pre-shared-key *.

  Best regards / Asfar

  Hello

  Have you tried to replace the names of 'tunnel-group' entry with Ip address on both ends... ?

  Thank you

  MS

• Cisco VPN Site to Site - Interesting traffic required to put in place a VPN or not?

  A really quick and easy for the guru there VPN...

  Essentially, I am setting up a VPN for backup, but there is NO interesting traffic unfortunately and we need VPN upward.

  So... is this possible?

  Thanks in advance

  Arnoult

  I would also like to add to David's response. Some persistent according to which firewall and configuration, you use either have phase 1 KeepAlive, or full end-to-end KeepAlive 2 phase.

  I do not know the equivalent of Cisco or if they even have one. Example of this with Juniper dead-peer-detection (DPD) sends only persistent IKEv1/2, while the monitoring of VPN sends ICMP echo requests to follow the VPN / or says he's dead.

  With DPD, it isn't exactly a traffic interesting survey, it's just the IKE "Hello you're here" messages. After awhile, the vpn can go down due to lack of interesting traffic or having to re - negotiate the phase 2. However, to create interesting traffic, you can assign an sla for icmp ip end-to-end.

  You may have noticed in the past that VPN will just down after a while (if you have this configuration)

  There are three modes of RE how actually starts in the negotiations on the SAA

  One answer: Specifies that this peer does respond to incoming connections from IKE first during the exchange of the original owner to determine the appropriate peer to connect to.

  Bidirectional (default): Specifies that this peer can accept and come from the connections based on this crypto map entry. This is the type of default login for Site-to-Site connections. [Only if interesting traffic is put in correspondence]

  Originate only: Specifies that this peer is launching the first Exchange of industrial property to determine the appropriate peer to connect to.

  For the ASA Experts out there, please correct me if I'm wrong.

  Hope this helps

  Bilal

• PIX-Sonicwall Site-to-Site and Cisco VPN Client

  I have a firewall 506th PIX with a VPN site-to site for a firewall Sonicwall 330 Pro which works perfectly. I would like to add the functionality of remote users connecting to the network using the client VPN from Cisco PIX. I'm under the question of having only a single card encryption applied to the external interface. I need the feature to have the tunnel between the site to site VPN can be undertaken on other, so I can't use a dynamic encryption card. Does anyone have suggestions or knowledge on how to achieve this?

  Thank you.

  You don't need to add another card encryption to the external interface. You simply add customer information to your existing card for example:

  Crypto ipsec transform-set esp-3des esp-sha-hmac YOURSET

  YOURMAP 10 ipsec-isakmp crypto map

  card crypto YOURMAP 10 corresponds to 100 address

  card crypto YOURMAP 10 set counterpart x.x.x.x

  crypto YOURMAP 10 the transform-set YOURSET value card

  set of 10 CUSTOMERS crypto dynamic-map transform-set YOURSET

  card crypto YOURMAP 90-isakmp dynamic ipsec CLIENTS

• Using Cisco Client to site VPN on a behind a NAT ASA 5520

  I apologize if this has been asked and we answered in the forums.  I looked, and while I found a large number of entries that were dancing all around this question, I never found nothing which addressed this specific issue.   We currently use an ASA 5520 as the head end of a relatively large customer to site IPSEC VPN (approximately 240 users, not consecutively).   This ASA is currently sitting behind a Checkpoint firewall with a real publicly addressable IP address on its public interface.  All of our customers use the legacy Cisco VPN (not the one anyconnect) client.  We plan to a few controllers F5 link set up between ISPS and firewalls.   For VPN connectivity F5 recommends that we NAT IP address (called a broad IP) to point back to a private IP address on the ASA and F5.  My question is, will this work?   I've always heard say that the head of line needed to have a public IP address on this subject because this is what will be placed in packages for the client to respond to.

  For further information, here's what we have now and what we are invited to attend.

  Current

  ISP - router - firewall-fire - ASA (public IP address as endpoint)

  Proposed

  ISP - router - F5 (public IP address as endpoint using a NAT to ASA) - Firewall - ASA (10.X.X.X as its external interface)

  Proposed alternative

  ISP - router - F5 (public IP address as endpoint using a NAT to ASA) - ASA (10.X.X.X as its external interface)

  All thoughts at this moment would be greatly appreciated.   Thank you!

  Hello

  If there is a static NAT one by one on F5 to the external interface of the ASA, then I don't think they would be any problems.
  Because when the client will attempt to connect to IKE to the translated public IP, F5 will redirect the request to ASA outside interface that is configured for the VPN.

  In addition, to ensure the udp500, 4500 and esp is allowed and then you should be good to go.

  HTH

  Concerning
  Mohit

• Configure the Cisco VPN client to pass through the VPN site-to-site (GUI)

  Hello

  I say hat the chain and responses I've seen to achieve this goal have been great...

  https://supportforums.Cisco.com/discussion/12234631/Cisco-ASA-5505-VPN-p...

  and

  https://supportforums.Cisco.com/document/12191196/AnyConnect-client-site...

  My question is "we will get this configuration by using the graphical user interface for someone who is not notified about the command line?"

  Thank you

  Of course, all this can be configured via ASDM.

  Looking at the second example you posted above, they point you first change:

  ACL split of the tunnel for the AnyConnect customer

  This Configuration > remote access VPN > network (Client) access > AnyConnect connection profile > (chose the profile and select Edit) > (choose "Manage" next to group policy) > Edit > advanced > Split Tunneling > ensure that the policy does not "Inherit" but rather "Tunnel network list below" > Unselect "Inherit" next to the network list, then 'manage '. Enter your networks you want in the GUI in this dialog box. Click OK all the way back to the main window ASDM and click on apply.

  You then change:

  Crypto ACL for the tunnel from Site to Site

  To do this, go to Configuration > VPN Site-to_site > connection profiles > (choose your profile and select edit) > add the VPN client address pool to the list of local network between protect networks. Yet once, click OK all the way back to the main window ASDM and click on apply.

  Then, allow the

  ASA to redirect back on the same interface traffic it receives

  .. is defined under Configuration > Device Setup > Interfaces. (check the box at the bottom of this screen). Click on apply

  Finally, there is the NAT exemption. For which go to Configuration > firewall > rules NAT. Add a NAT device rule before rules network object with Interface Source out, Source address your address pool VPN, the Destination address to include remote subnets and Action is Static Source NAT type source address and destination address remaining as original (i.e. without NAT). Once on OK all the way back to the main window ASDM and click on apply. Save and test.

  Good luck. Don't forget to note the brand and posts useful when your question is answered.

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Client Vpn Cisco vpn remote site inaccessible (one site to another)

  Hello

  I configured two vpn with pix 515 cisco connection. One using a cisco vpn client and another another site to site vpn connectin with other pix.

  I have my local network with 192.168.149.0 network, vpn clinet pool with 192.168.17.0 network and a remote site with 192.168.145.0.

  Client vpn local network accessible and always remote site, but 192.168.17.0 (vpn client) 192.168.145.0 not accessible (remote site).

  Plese help me!

  Thank you

  This scenario is possible with no v6.x, v7.x

  the link below is an example of configuration:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

• % 7-ASA-710005: request TCP thrown error in the Client VPN Site to CISCO ASA 5510

  Hi friends,

  I am trying to built customer to site VPN CISCO ASA 5510 8.4 (4) and get error below when connecting to a cisco VPN client software. Also, I'm below ASA, log. Please help me to reslove.

  Error in CISCO VPN Client software:

  Secure VPN connection terminated locally by the client.

  Reason: 414: unable to establish a TCP connection.

  Error in CISCO ASA 5510

  7-ASA-710005%: TCP request and eliminated from 49276 outward: 10000

  The ASA configuration:

  XYZ # sh run
  : Saved
  :
  ASA Version 8.4 (4)
  !
  hostname XYZ
  domain XYZ
  activate the password encrypted 3uLkVc9JwRA1/OXb N3
  activate the encrypted password of R/x90UjisGVJVlh2
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  !
  interface Ethernet0/0
  nameif outside_rim
  security-level 0
  IP 1.1.1.1 255.255.255.252
  !
  interface Ethernet0/1
  full duplex
  nameif XYZ_DMZ
  security-level 50
  IP 172.1.1.1 255.255.255.248
  !
  interface Ethernet0/2
  Speed 100
  full duplex
  nameif outside
  security-level 0
  IP address 2.2.2.2 255.255.255.252
  !
  interface Ethernet0/3
  Speed 100
  full duplex
  nameif inside
  security-level 100
  IP 3.3.3.3 255.255.255.224
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  boot system Disk0: / asa844 - k8.bin
  passive FTP mode
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  Server name xx.xx.xx.xx
  Server name xx.xx.xx.xx
  Server name xx.xx.xx.xx
  Server name xx.xx.xx.xx
  domain XYZ
  network object obj - 172.17.10.3
  Home 172.17.10.3
  network object obj - 10.1.134.0
  10.1.134.0 subnet 255.255.255.0
  network object obj - 208.75.237.0
  208.75.237.0 subnet 255.255.255.0
  network object obj - 10.7.0.0
  10.7.0.0 subnet 255.255.0.0
  network object obj - 172.17.2.0
  172.17.2.0 subnet 255.255.255.0
  network object obj - 172.17.3.0
  172.17.3.0 subnet 255.255.255.0
  network object obj - 172.19.2.0
  172.19.2.0 subnet 255.255.255.0
  network object obj - 172.19.3.0
  172.19.3.0 subnet 255.255.255.0
  network object obj - 172.19.7.0
  172.19.7.0 subnet 255.255.255.0
  network object obj - 10.1.0.0
  10.1.0.0 subnet 255.255.0.0
  network object obj - 10.2.0.0
  10.2.0.0 subnet 255.255.0.0
  network object obj - 10.3.0.0
  10.3.0.0 subnet 255.255.0.0
  network object obj - 10.4.0.0
  10.4.0.0 subnet 255.255.0.0
  network object obj - 10.6.0.0
  10.6.0.0 subnet 255.255.0.0
  network object obj - 10.9.0.0
  10.9.0.0 subnet 255.255.0.0
  network object obj - 10.11.0.0
  10.11.0.0 subnet 255.255.0.0
  network object obj - 10.12.0.0
  10.12.0.0 subnet 255.255.0.0
  network object obj - 172.19.1.0
  172.19.1.0 subnet 255.255.255.0
  network object obj - 172.21.2.0
  172.21.2.0 subnet 255.255.255.0
  network object obj - 172.16.2.0
  172.16.2.0 subnet 255.255.255.0
  network object obj - 10.19.130.201
  Home 10.19.130.201
  network object obj - 172.30.2.0
  172.30.2.0 subnet 255.255.255.0
  network object obj - 172.30.3.0
  172.30.3.0 subnet 255.255.255.0
  network object obj - 172.30.7.0
  172.30.7.0 subnet 255.255.255.0
  network object obj - 10.10.1.0
  10.10.1.0 subnet 255.255.255.0
  network object obj - 10.19.130.0
  10.19.130.0 subnet 255.255.255.0
  network of object obj-XXXXXXXX
  host XXXXXXXX
  network object obj - 145.248.194.0
  145.248.194.0 subnet 255.255.255.0
  network object obj - 10.1.134.100
  Home 10.1.134.100
  network object obj - 10.9.124.100
  Home 10.9.124.100
  network object obj - 10.1.134.101
  Home 10.1.134.101
  network object obj - 10.9.124.101
  Home 10.9.124.101
  network object obj - 10.1.134.102
  Home 10.1.134.102
  network object obj - 10.9.124.102
  Home 10.9.124.102
  network object obj - 115.111.99.133
  Home 115.111.99.133
  network object obj - 10.8.108.0
  10.8.108.0 subnet 255.255.255.0
  network object obj - 115.111.99.129
  Home 115.111.99.129
  network object obj - 195.254.159.133
  Home 195.254.159.133
  network object obj - 195.254.158.136
  Home 195.254.158.136
  network object obj - 209.164.192.0
  subnet 209.164.192.0 255.255.224.0
  network object obj - 209.164.208.19
  Home 209.164.208.19
  network object obj - 209.164.192.126
  Home 209.164.192.126
  network object obj - 10.8.100.128
  subnet 10.8.100.128 255.255.255.128
  network object obj - 115.111.99.130
  Home 115.111.99.130
  network object obj - 10.10.0.0
  subnet 10.10.0.0 255.255.0.0
  network object obj - 115.111.99.132
  Home 115.111.99.132
  network object obj - 10.10.1.45
  Home 10.10.1.45
  network object obj - 10.99.132.0
  10.99.132.0 subnet 255.255.255.0
  the Serversubnet object-group network
  object-network 10.10.1.0 255.255.255.0
  network-object 10.10.5.0 255.255.255.192
  the XYZ_destinations object-group network
  object-network 10.1.0.0 255.255.0.0
  object-network 10.2.0.0 255.255.0.0
  network-object 10.3.0.0 255.255.0.0
  network-object 10.4.0.0 255.255.0.0
  network-object 10.6.0.0 255.255.0.0
  network-object 10.7.0.0 255.255.0.0
  network-object 10.11.0.0 255.255.0.0
  object-network 10.12.0.0 255.255.0.0
  object-network 172.19.1.0 255.255.255.0
  object-network 172.19.2.0 255.255.255.0
  object-network 172.19.3.0 255.255.255.0
  object-network 172.19.7.0 255.255.255.0
  object-network 172.17.2.0 255.255.255.0
  object-network 172.17.3.0 255.255.255.0
  object-network 172.16.2.0 255.255.255.0
  object-network 172.16.3.0 255.255.255.0
  host of the object-Network 10.50.2.206
  the XYZ_us_admin object-group network
  network-object 10.3.1.245 255.255.255.255
  network-object 10.5.33.7 255.255.255.255
  network-object 10.211.5.7 255.255.255.255
  network-object 10.3.33.7 255.255.255.255
  network-object 10.211.3.7 255.255.255.255
  the XYZ_blr_networkdevices object-group network
  object-network 10.200.10.0 255.255.255.0
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 145.248.194.0 255.255.255.0
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host 172.16.2.21
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host 172.16.2.22
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host XXXXXXXX
  Access extensive list ip 10.19.130.0 XYZ_PAT allow 255.255.255.0 any
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 195.254.159.133
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 195.254.158.136
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 any
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 209.164.192.0 255.255.224.0
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 209.164.208.19
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 209.164.192.126
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 208.75.237.0 255.255.255.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.7.0.0 255.255.0.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.17.2.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.17.3.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.2.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.3.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.7.0 255.255.255.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.1.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.2.0.0 255.255.0.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.3.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.4.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.6.0.0 255.255.0.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.9.0.0 255.255.0.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.11.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.12.0.0 255.255.0.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.1.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.21.2.0 255.255.255.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 172.16.2.0 255.255.255.0
  access-list extended sheep allowed host ip 10.19.130.201 172.30.2.0 255.255.255.0
  access-list extended sheep allowed host ip 10.19.130.201 172.30.3.0 255.255.255.0
  access-list extended sheep allowed host ip 10.19.130.201 172.30.7.0 255.255.255.0
  access-list extended sheep allowed ip object-group Serversubnet-group of objects XYZ_destinations
  10.10.1.0 IP Access-list extended sheep 255.255.255.0 allow 10.2.0.0 255.255.0.0
  10.19.130.0 IP Access-list extended sheep 255.255.255.0 allow host XXXXXXXX
  IP 10.19.130.0 allow Access-list extended sheep 255.255.255.0 145.248.194.0 255.255.255.0
  Access extensive list ip 10.8.108.0 Guest_PAT allow 255.255.255.0 any
  CACIB list extended access permitted ip 10.8.100.128 255.255.255.128 145.248.194.0 255.255.255.0
  Access extensive list ip 10.8.100.128 Cacib_PAT allow 255.255.255.128 all
  Access extensive list ip 10.1.134.0 New_Edge allow 255.255.255.0 208.75.237.0 255.255.255.0
  Allow XYZ_global to access extended list ip 10.7.0.0 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.7.0.0 255.255.0.0
  Access extensive list ip 172.17.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.17.3.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.3.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.7.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.0.0 XYZ_global allow 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list 10.2.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Allow XYZ_global to access extended list ip 10.3.0.0 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list 10.4.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Access extensive list 10.6.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Access extensive list ip 10.9.0.0 XYZ_global allow 255.255.0.0 10.1.134.0 255.255.255.0
  Allow XYZ_global to access extended list ip 10.11.0.0 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list 10.12.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.1.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.21.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.17.2.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.17.3.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.2.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.3.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.7.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.1.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.2.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.3.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.4.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.6.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.9.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.11.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.12.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.1.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.21.2.0 255.255.255.0
  XYZ_global to access extended list ip 172.16.2.0 allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.16.2.0 255.255.255.0
  Access extensive list ip 172.30.2.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
  XYZ_global list extended access allowed host ip 10.19.130.201 172.30.2.0 255.255.255.0
  Access extensive list ip 172.30.3.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
  XYZ_global list extended access allowed host ip 10.19.130.201 172.30.3.0 255.255.255.0
  Access extensive list ip 172.30.7.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
  XYZ_global list extended access allowed host ip 10.19.130.201 172.30.7.0 255.255.255.0
  XYZ_global list extended access permitted ip object-group Serversubnet-group of objects XYZ_destinations
  XYZ_global list extended access permitted ip object-group XYZ_destinations-group of objects Serversubnet
  ML_VPN list extended access allowed host ip 115.111.99.129 209.164.192.0 255.255.224.0
  permit access list extended ip host 115.111.99.129 ML_VPN 209.164.208.19
  permit access list extended ip host 115.111.99.129 ML_VPN 209.164.192.126
  permit access list extended ip host 10.9.124.100 Da_VPN 10.125.81.88
  permit access list extended ip host 10.9.124.101 Da_VPN 10.125.81.88
  permit access list extended ip host 10.9.124.102 Da_VPN 10.125.81.88
  Da_VPN list extended access allowed host ip 10.9.124.100 10.125.81.0 255.255.255.0
  Da_VPN list extended access allowed host ip 10.9.124.101 10.125.81.0 255.255.255.0
  Da_VPN list extended access allowed host ip 10.9.124.102 10.125.81.0 255.255.255.0
  Sr_PAT to access extended list ip 10.10.0.0 allow 255.255.0.0 any
  Da_Pd_VPN list extended access allowed host ip 10.9.124.100 10.125.80.64 255.255.255.192
  Da_Pd_VPN list extended access allowed host ip 10.9.124.100 10.125.64.0 255.255.240.0
  permit access list extended ip host 10.9.124.100 Da_Pd_VPN 10.125.85.46
  permit access list extended ip host 10.9.124.100 Da_Pd_VPN 10.125.86.46
  Da_Pd_VPN list extended access allowed host ip 10.9.124.101 10.125.80.64 255.255.255.192
  Da_Pd_VPN list extended access allowed host ip 10.9.124.101 10.125.64.0 255.255.240.0
  permit access list extended ip host 10.9.124.101 Da_Pd_VPN 10.125.85.46
  permit access list extended ip host 10.9.124.101 Da_Pd_VPN 10.125.86.46
  Da_Pd_VPN list extended access allowed host ip 10.9.124.102 10.125.80.64 255.255.255.192
  Da_Pd_VPN list extended access allowed host ip 10.9.124.102 10.125.64.0 255.255.240.0
  permit access list extended ip host 10.9.124.102 Da_Pd_VPN 10.125.85.46
  permit access list extended ip host 10.9.124.102 Da_Pd_VPN 10.125.86.46
  Access extensive list ip 10.19.130.0 XYZ_reliance allow 255.255.255.0 145.248.194.0 255.255.255.0
  access-list coextended permit ip host 2.2.2.2 XXXXXXXX
  access-list coextended allow the host ip XXXXXXXXhost 2.2.2.2
  permitted this access list extended ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
  permitted this access list extended ip 208.75.237.0 255.255.255.0 10.1.134.0 255.255.255.0
  access list acl-outside extended permit ip host 57.66.81.159 172.17.10.3
  access list acl-outside extended permit ip host 80.169.223.179 172.17.10.3
  access list acl-outside scope permit ip any host 172.17.10.3
  access list acl-outside extended permitted tcp any host 10.10.1.45 eq https
  access list acl-outside extended permit tcp any any eq 10000
  access list acl-outside extended deny ip any any newspaper
  pager lines 10
  Enable logging
  debug logging in buffered memory
  outside_rim MTU 1500
  MTU 1500 XYZ_DMZ
  Outside 1500 MTU
  Within 1500 MTU
  IP pool local XYZ_c2s_vpn_pool 172.30.10.51 - 172.30.10.254
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow all outside
  ICMP allow any inside
  don't allow no asdm history
  ARP timeout 14400
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 208.75.237.0 obj - 208.75.237.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.7.0.0 obj - 10.7.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.17.2.0 obj - 172.17.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.17.3.0 obj - 172.17.3.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.2.0 obj - 172.19.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.3.0 obj - 172.19.3.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.7.0 obj - 172.19.7.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.1.0.0 obj - 10.1.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.2.0.0 obj - 10.2.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.3.0.0 obj - 10.3.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.4.0.0 obj - 10.4.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.6.0.0 obj - 10.6.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.9.0.0 obj - 10.9.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.11.0.0 obj - 10.11.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.12.0.0 obj - 10.12.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.1.0 obj - 172.19.1.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.21.2.0 obj - 172.21.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.16.2.0 obj - 172.16.2.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.2.0 obj - 172.30.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.3.0 obj - 172.30.3.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.7.0 obj - 172.30.7.0 no-proxy-arp-search to itinerary
  NAT (inside, all) static source Serversubnet Serversubnet XYZ_destinations XYZ_destinations non-proxy-arp-search of route static destination
  NAT (inside, all) source static obj - 10.10.1.0 obj - 10.10.1.0 destination static obj - 10.2.0.0 obj - 10.2.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.0 obj - 10.19.130.0 destination static obj-XXXXXXXX XXXXXXXX - obj non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.0 obj - 10.19.130.0 destination static obj - 145.248.194.0 obj - 145.248.194.0 no-proxy-arp-search to itinerary
  NAT source (indoor, outdoor), obj static obj - 10.1.134.100 - 10.9.124.100
  NAT source (indoor, outdoor), obj static obj - 10.1.134.101 - 10.9.124.101
  NAT source (indoor, outdoor), obj static obj - 10.1.134.102 - 10.9.124.102
  NAT interface dynamic obj - 10.8.108.0 source (indoor, outdoor)
  NAT (inside, outside) source dynamic obj - 10.19.130.0 obj - 115.111.99.129
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 195.254.159.133 obj - 195.254.159.133
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 195.254.158.136 obj - 195.254.158.136
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.192.0 obj - 209.164.192.0
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.208.19 obj - 209.164.208.19
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.192.126 obj - 209.164.192.126
  NAT (inside, outside) source dynamic obj - 10.8.100.128 obj - 115.111.99.130
  NAT (inside, outside) source dynamic obj - 10.10.0.0 obj - 115.111.99.132
  NAT source (indoor, outdoor), obj static obj - 10.10.1.45 - 115.111.99.133
  NAT (inside, outside) source dynamic obj - 10.99.132.0 obj - 115.111.99.129
  !
  network object obj - 172.17.10.3
  NAT (XYZ_DMZ, outside) static 115.111.99.134
  Access-group acl-outside in external interface
  Route outside 0.0.0.0 0.0.0.0 115.111.23.129 1
  Route outside 0.0.0.0 0.0.0.0 115.254.127.130 10
  Route inside 10.10.0.0 255.255.0.0 10.8.100.1 1
  Route inside 10.10.1.0 255.255.255.0 10.8.100.1 1
  Route inside 10.10.5.0 255.255.255.192 10.8.100.1 1
  Route inside 10.8.100.128 255.255.255.128 10.8.100.1 1
  Route inside 10.8.108.0 255.255.255.0 10.8.100.1 1
  Route inside 10.19.130.0 255.255.255.0 10.8.100.1 1
  Route inside 10.99.4.0 255.255.255.0 10.99.130.254 1
  Route inside 10.99.132.0 255.255.255.0 10.8.100.1 1
  Route inside 10.1.134.0 255.255.255.0 10.8.100.1 1
  Route outside 208.75.237.0 255.255.255.0 115.111.23.129 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication LOCAL telnet console
  LOCAL AAA authorization command
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn2
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-md5-hmac vpn6
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn5
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-md5-hmac vpn7
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn4
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn1
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn_reliance
  Crypto ipsec transform-set esp-3des esp-md5-hmac ikev1 c2s_vpn
  86400 seconds, duration of life crypto ipsec security association
  Crypto-map dynamic dyn1 ikev1 transform-set c2s_vpn 1 set
  Crypto-map dynamic dyn1 1jeu reverse-road
  card crypto vpn 1 corresponds to the address XYZ
  card 1 set of peer XYZ Peer IP vpn crypto
  1 set transform-set vpn1 ikev1 vpn crypto card
  card crypto vpn 1 lifetime of security set association, 3600 seconds
  card crypto vpn 1 set security-association life kilobytes 4608000
  correspondence vpn crypto card address 2 DON'T
  2 peer NE_Peer IP vpn crypto card game
  2 set transform-set vpn2 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 2 set security-association
  card crypto vpn 2 set security-association life kilobytes 4608000
  card crypto vpn 4 corresponds to the address ML_VPN
  card crypto vpn 4 set pfs
  vpn crypto card game 4 peers ML_Peer IP
  4 set transform-set vpn4 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 4 set - the security association
  card crypto vpn 4 set security-association life kilobytes 4608000
  vpn crypto card 5 corresponds to the address XYZ_global
  vpn crypto card game 5 peers XYZ_globa_Peer IP
  5 set transform-set vpn5 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 5 set - the security association
  card 5 security-association life set vpn crypto kilobytes 4608000
  vpn crypto card 6 corresponds to the address Da_VPN
  vpn crypto card game 6 peers Da_VPN_Peer IP
  6 set transform-set vpn6 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 6 set - the security association
  card crypto vpn 6 set security-association life kilobytes 4608000
  vpn crypto card 7 corresponds to the address Da_Pd_VPN
  7 peer Da_Pd_VPN_Peer IP vpn crypto card game
  7 set transform-set vpn6 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 7 set - the security association
  card crypto vpn 7 set security-association life kilobytes 4608000
  vpn outside crypto map interface
  crypto map vpn_reliance 1 corresponds to the address XYZ_rim
  card crypto vpn_reliance 1 set of peer XYZ_rim_Peer IP
  card crypto 1 ikev1 transform-set vpn_reliance set vpn_reliance
  vpn_reliance card crypto 1 lifetime of security set association, 3600 seconds
  card crypto vpn_reliance 1 set security-association life kilobytes 4608000
  card crypto vpn_reliance interface outside_rim
  dynamic mymap 1 dyn1 ipsec-isakmp crypto map
  crypto isakmp identity address
  No encryption isakmp nat-traversal
  Crypto ikev1 enable outside_rim
  Crypto ikev1 allow outside
  IKEv1 crypto policy 1
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  lifetime 28800
  IKEv1 crypto policy 2
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  life 86400
  IKEv1 crypto policy 4
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  life 28000
  IKEv1 crypto policy 5
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 43200
  IKEv1 crypto policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 10.8.100.0 255.255.255.224 inside
  Telnet timeout 5
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  no basic threat threat detection
  no statistical access list - a threat detection
  no statistical threat detection tcp-interception
  internal XYZ_c2s_vpn group strategy
  username testadmin encrypted password oFJjANE3QKoA206w
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXXtype ipsec-l2l
  tunnel-group XXXXXXXXipsec-attributes
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  type tunnel-group XYZ_c2s_vpn remote access
  attributes global-tunnel-group XYZ_c2s_vpn
  address pool XYZ_c2s_vpn_pool
  IPSec-attributes tunnel-group XYZ_c2s_vpn
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  Review the ip options
  !
  global service-policy global_policy
  level 3 privilege see the running-config command exec mode
  logging of orders privilege see the level 3 exec mode
  privilege see the level 3 exec mode command crypto
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:caa7476cd348ed89b95d37d4e3c9e1d8
  : end

  XYZ #.

  Good news

  Follow these steps:

  network object obj - 172.30.10.0_24

  172.30.10.0 subnet 255.255.255.0

  !

  the LOCAL_NETWORKS_VPN object-group network

  object-network 1.1.1.0 255.255.255.0

  !

  NAT (inside, outside) 1 static source LOCAL_NETWORKS_VPN destination LOCAL_NETWORKS_VPN static obj - 172.30.10.0_24 obj - 172.30.10.0_24 - route search

  * Where 1.1.1.0/24 is the internal network that you want to reach through the tunnel.

  Keep me posted.

  Thank you.

  Please note all messages that will be useful.

• multi-site VPN with just the cisco vpn client

  Hello everyone

  Please I need your help.

  We have a headquarters office and up to 60 is BranchOffice, we want to create VPN network between its. so let's deploy 2 router cisco esy vpn server with HA (HSRP) at the Headquarters Office and all branches have Connection ADSL and they will use just the cisco vpn client to connect to the Headquarters Office.

  My question is: is it possible to do it just with the client vpn cisco without purchased for any exercise bracnh a cisco router to create an ipsec tunnel because it is so expensive?

  It depends on if the routers to offices can handle NAT with several internal VPN clients to 1 IP address. Most of the new material should be fine. Keep in mind the maximum limit of the VPN client, with 60 agencies and 5 people each of whom you are above the limit.

  Michael

  Please note all useful posts

• Cisco ASA 5505 VPN Site to Site

  Hi all

  First post on the forums. I have worked with Cisco ASA 5505 for a few months and I recently bought a 2nd ASA to implement tunnel VPN Site to Site. It seems so simple in the number of videos watched on the internet. But when I did he surprise it did work for me... I've removed the tunnels, a number of times and tried to recreate. I use the VPN Wizard in the SMA to create the tunnel. Both the asa 5505 of are and have the same firmware even etc..

  I'd appreciate any help that can be directed to this problem please.  Slowly losing my mind

  Please see details below:

  Two ADMS are 7.1

  IOS

  ASA 1

  Nadia

  :

  ASA Version 9.0 (1)

  !

  hostname PAYBACK

  activate the encrypted password of HSMurh79NVmatjY0

  volatile xlate deny tcp any4 any4

  volatile xlate deny tcp any4 any6

  volatile xlate deny tcp any6 any4

  volatile xlate deny tcp any6 any6

  volatile xlate deny udp any4 any4 eq field

  volatile xlate deny udp any4 any6 eq field

  volatile xlate deny udp any6 any4 eq field

  volatile xlate deny udp any6 any6 eq field

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  local pool VPN1 192.168.50.1 - 192.168.50.254 255.255.255.0 IP mask

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  link Trunk Description of SW1

  switchport trunk allowed vlan 1,10,20,30,40

  switchport trunk vlan 1 native

  switchport mode trunk

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  No nameif

  no level of security

  no ip address

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 92.51.193.158 255.255.255.252

  !

  interface Vlan10

  nameif inside

  security-level 100

  IP 192.168.10.1 255.255.255.0

  !

  interface Vlan20

  nameif servers

  security-level 100

  address 192.168.20.1 255.255.255.0

  !

  Vlan30 interface

  nameif printers

  security-level 100

  192.168.30.1 IP address 255.255.255.0

  !

  interface Vlan40

  nameif wireless

  security-level 100

  192.168.40.1 IP address 255.255.255.0

  !

  connection line banner welcome to the Payback loyalty systems

  boot system Disk0: / asa901 - k8.bin

  passive FTP mode

  summer time clock GMT/IDT recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS lookup field inside

  domain-lookup DNS servers

  DNS lookup domain printers

  DNS domain-lookup wireless

  DNS server-group DefaultDNS

  Server name 83.147.160.2

  Server name 83.147.160.130

  permit same-security-traffic inter-interface

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  ftp_server network object

  network of the Internal_Report_Server object

  Home 192.168.20.21

  Description address internal automated report server

  network of the Report_Server object

  Home 89.234.126.9

  Description of server automated reports

  service object RDP

  service destination tcp 3389 eq

  Description RDP to the server

  network of the Host_QA_Server object

  Home 89.234.126.10

  Description QA host external address

  network of the Internal_Host_QA object

  Home 192.168.20.22

  host of computer virtual Description for QA

  network of the Internal_QA_Web_Server object

  Home 192.168.20.23

  Description Web Server in the QA environment

  network of the Web_Server_QA_VM object

  Home 89.234.126.11

  Server Web Description in the QA environment

  service object SQL_Server

  destination eq 1433 tcp service

  network of the Demo_Server object

  Home 89.234.126.12

  Description server set up for the product demo

  network of the Internal_Demo_Server object

  Home 192.168.20.24

  Internal description of the demo server IP address

  network of the NETWORK_OBJ_192.168.20.0_24 object

  subnet 192.168.20.0 255.255.255.0

  network of the NETWORK_OBJ_192.168.50.0_26 object

  255.255.255.192 subnet 192.168.50.0

  network of the NETWORK_OBJ_192.168.0.0_16 object

  Subnet 192.168.0.0 255.255.0.0

  service object MSSQL

  destination eq 1434 tcp service

  MSSQL port description

  VPN network object

  192.168.50.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_192.168.50.0_24 object

  192.168.50.0 subnet 255.255.255.0

  service object TS

  tcp destination eq 4400 service

  service of the TS_Return object

  tcp source eq 4400 service

  network of the External_QA_3 object

  Home 89.234.126.13

  network of the Internal_QA_3 object

  Home 192.168.20.25

  network of the Dev_WebServer object

  Home 192.168.20.27

  network of the External_Dev_Web object

  Home 89.234.126.14

  network of the CIX_Subnet object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.10.0_24 object

  192.168.10.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_84.39.233.50 object

  Home 84.39.233.50

  network of the NETWORK_OBJ_92.51.193.158 object

  Home 92.51.193.158

  network of the NETWORK_OBJ_192.168.100.0_24 object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.1.0_24 object

  subnet 192.168.1.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_1

  the tcp destination eq ftp service object

  the purpose of the tcp destination eq netbios-ssn service

  the purpose of the tcp destination eq smtp service

  service-object TS

  the Payback_Internal object-group network

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.20.0 255.255.255.0

  object-network 192.168.40.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_3

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  service-object TS

  service-object, object TS_Return

  object-group service DM_INLINE_SERVICE_4

  service-object RDP

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  object-group service DM_INLINE_SERVICE_5

  purpose purpose of the MSSQL service

  service-object RDP

  service-object TS

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  object-group service DM_INLINE_SERVICE_6

  service-object TS

  service-object, object TS_Return

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  Note to outside_access_in to access list that this rule allows Internet the interal server.

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-list of FTP access

  Comment from outside_access_in-RDP access list

  Comment from outside_access_in-list of SMTP access

  Note to outside_access_in to access list Net Bios

  Comment from outside_access_in-SQL access list

  Comment from outside_access_in-list to access TS - 4400

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_1 any4 Internal_Report_Server

  access host access-list outside_access_in note rule internal QA

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-HTTP access list

  Comment from outside_access_in-RDP access list

  outside_access_in list extended access permitted tcp any4 object Internal_Host_QA eq www

  Notice on the outside_access_in of the access-list access to the internal Web server:

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-HTTP access list

  Comment from outside_access_in-RDP access list

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_3 any4 Internal_QA_Web_Server

  Note to outside_access_in to access list rule allowing access to the demo server

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-RDP access list

  Comment from outside_access_in-list to access MSSQL

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_4 any4 Internal_Demo_Server

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_5 any object Internal_QA_3

  Note to outside_access_in access to the development Web server access list

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_6 any object Dev_WebServer

  AnyConnect_Client_Local_Print deny any4 any4 ip extended access list

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq lpd

  Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 631

  print the access-list AnyConnect_Client_Local_Print Note Windows port

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 9100

  access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

  AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.251 any4 eq 5353

  AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

  AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.252 any4 eq 5355

  Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 EQ. 137

  AnyConnect_Client_Local_Print list extended access permitted udp any4 any4 eq netbios-ns

  Payback_VPN_splitTunnelAcl list standard access allowed 192.168.20.0 255.255.255.0

  permit outside_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0

  pager lines 24

  Enable logging

  information recording console

  asdm of logging of information

  address record

  [email protected] / * /.

  the journaling recipient

  [email protected] / * /.

  level alerts

  Outside 1500 MTU

  Within 1500 MTU

  MTU 1500 servers

  MTU 1500 printers

  MTU 1500 wireless

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm-711 - 52.bin

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) source Dynamics one interface

  NAT (wireless, outdoors) source Dynamics one interface

  NAT (servers, outside) no matter what source dynamic interface

  NAT (servers, external) static source Internal_Report_Server Report_Server

  NAT (servers, external) static source Internal_Host_QA Host_QA_Server

  NAT (servers, external) static source Internal_QA_Web_Server Web_Server_QA_VM

  NAT (servers, external) static source Internal_Demo_Server Demo_Server

  NAT (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

  NAT (servers, external) static source Internal_QA_3 External_QA_3

  NAT (servers, external) static source Dev_WebServer External_Dev_Web

  NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 92.51.193.157 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL
  the ssh LOCAL console AAA authentication
  Enable http server
  http 192.168.10.0 255.255.255.0 inside
  http 192.168.40.0 255.255.255.0 wireless
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto outside_map 1 match address outside_cryptomap
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 84.39.233.50
  card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  Crypto ikev2 activate out of service the customer port 443
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH 77.75.100.208 255.255.255.240 outside
  SSH 192.168.10.0 255.255.255.0 inside
  SSH 192.168.40.0 255.255.255.0 wireless
  SSH timeout 5
  Console timeout 0

  dhcpd 192.168.0.1 dns
  dhcpd outside auto_config
  !
  dhcpd address 192.168.10.21 - 192.168.10.240 inside
  dhcpd dns 192.168.20.21 83.147.160.2 interface inside
  paybackloyalty.com dhcpd option 15 inside ascii interface
  dhcpd allow inside
  !
  dhcpd address 192.168.40.21 - 192.168.40.240 Wireless
  dhcpd dns 192.168.20.21 83.147.160.2 wireless interface
  dhcpd update dns of the wireless interface
  dhcpd option 15 ascii paybackloyalty.com wireless interface
  dhcpd activate wireless
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal Payback_VPN group strategy
  attributes of Group Policy Payback_VPN
  VPN - 10 concurrent connections
  Ikev1 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list Payback_VPN_splitTunnelAcl
  attributes of Group Policy DfltGrpPolicy
  value of 83.147.160.2 DNS server 83.147.160.130
  VPN-tunnel-Protocol ikev1, ikev2 clientless ssl
  internal GroupPolicy_84.39.233.50 group strategy
  attributes of Group Policy GroupPolicy_84.39.233.50
  VPN-tunnel-Protocol ikev1, ikev2
  Noelle XB/IpvYaATP.2QYm username encrypted password
  Noelle username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username Éanna encrypted password privilege 0 vXILR9ZZQIsd1Naw
  Éanna attributes username
  VPN-group-policy Payback_VPN
  type of remote access service
  Michael qpbleUqUEchRrgQX of encrypted password username
  user name Michael attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username, password from Danny .7fEXdzESUk6S/cC encrypted privilege 0
  user name Danny attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Aileen tytrelqvV5VRX2pz encrypted password privilege 0 username
  user name Aileen attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Aidan aDu6YH0V5XaxpEPg encrypted password privilege 0 username
  Aidan username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
  shane.c iqGMoWOnfO6YKXbw encrypted password username
  username shane.c attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Shane uYePLcrFadO9pBZx of encrypted password username
  user name Shane attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username, encrypted James TdYPv1pvld/hPM0d password
  user name James attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Mark yruxpddqfyNb.qFn of encrypted password username
  user name brand attributes
  type of service admin
  username password of Mary XND5FTEiyu1L1zFD encrypted
  user name Mary attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Massimo vs65MMo4rM0l4rVu encrypted password privilege 0 username
  Massimo username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  type tunnel-group Payback_VPN remote access
  attributes global-tunnel-group Payback_VPN
  VPN1 address pool
  Group Policy - by default-Payback_VPN
  IPSec-attributes tunnel-group Payback_VPN
  IKEv1 pre-shared-key *.
  tunnel-group 84.39.233.50 type ipsec-l2l
  tunnel-group 84.39.233.50 General-attributes
  Group - default policy - GroupPolicy_84.39.233.50
  IPSec-attributes tunnel-group 84.39.233.50
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  Global class-card class
  match default-inspection-traffic
  !
  !
  World-Policy policy-map
  Global category
  inspect the dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the pptp
  inspect the rsh
  inspect the rtsp
  inspect the sip
  inspect the snmp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect xdmcp
  inspect the icmp error
  inspect the icmp
  !
  service-policy-international policy global
  192.168.20.21 SMTP server
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1

  ASA 2

  ASA Version 9.0 (1)

  !

  Payback-CIX hostname

  activate the encrypted password of HSMurh79NVmatjY0

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  Description this port connects to the local network VIRTUAL 100

  switchport access vlan 100

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  switchport access vlan 100

  !

  interface Ethernet0/4

  switchport access vlan 100

  !

  interface Ethernet0/5

  switchport access vlan 100

  !

  interface Ethernet0/6

  switchport access vlan 100

  !

  interface Ethernet0/7

  switchport access vlan 100

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 84.39.233.50 255.255.255.240

  !

  interface Vlan100

  nameif inside

  security-level 100

  IP 192.168.100.1 address 255.255.255.0

  !

  banner welcome to Payback loyalty - CIX connection line

  passive FTP mode

  summer time clock gmt/idt recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS lookup field inside

  DNS server-group defaultDNS

  Name-Server 8.8.8.8

  Server name 8.8.4.4

  permit same-security-traffic inter-interface

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  network of the host-CIX-1 object

  host 192.168.100.2

  Description This is the VM server host machine

  network object host-External_CIX-1

  Home 84.39.233.51

  Description This is the external IP address of the server the server VM host

  service object RDP

  source between 1-65535 destination eq 3389 tcp service

  network of the Payback_Office object

  Home 92.51.193.158

  service object MSQL

  destination eq 1433 tcp service

  network of the Development_OLTP object

  Home 192.168.100.10

  Description for Eiresoft VM

  network of the External_Development_OLTP object

  Home 84.39.233.52

  Description This is the external IP address for the virtual machine for Eiresoft

  network of the Eiresoft object

  Home 146.66.160.70

  Contractor s/n description

  network of the External_TMC_Web object

  Home 84.39.233.53

  Description Public address to the TMC Web server

  network of the TMC_Webserver object

  Home 192.168.100.19

  Internal description address TMC Webserver

  network of the External_TMC_OLTP object

  Home 84.39.233.54

  External targets OLTP IP description

  network of the TMC_OLTP object

  Home 192.168.100.18

  description of the interal target IP address

  network of the External_OLTP_Failover object

  Home 84.39.233.55

  IP failover of the OLTP Public description

  network of the OLTP_Failover object

  Home 192.168.100.60

  Server failover OLTP description

  network of the servers object

  subnet 192.168.20.0 255.255.255.0

  being Wired network

  192.168.10.0 subnet 255.255.255.0

  the subject wireless network

  192.168.40.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_192.168.100.0_24 object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.10.0_24 object

  192.168.10.0 subnet 255.255.255.0

  network of the Eiresoft_2nd object

  Home 137.117.217.29

  Description 2nd Eiresoft IP

  network of the Dev_Test_Webserver object

  Home 192.168.100.12

  Description address internal to the Test Server Web Dev

  network of the External_Dev_Test_Webserver object

  Home 84.39.233.56

  Description This is the PB Dev Test Webserver

  network of the NETWORK_OBJ_192.168.1.0_24 object

  subnet 192.168.1.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_1

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_2

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_3

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_4

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_5

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_6

  service-object MSQL

  service-object RDP

  the Payback_Intrernal object-group network

  object-network servers

  Wired network-object

  wireless network object

  object-group service DM_INLINE_SERVICE_7

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_8

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_9

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_10

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_11

  service-object RDP

  the tcp destination eq ftp service object

  outside_access_in list extended access allow object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-host-1

  Note to access list OLTP Development Office of recovery outside_access_in

  outside_access_in list extended access allow DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP object-group

  Comment from outside_access_in-access Eiresoft access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver object-group

  Note to outside_access_in access to OLTP for target recovery Office Access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover object-group

  Note to outside_access_in access-list that's allowing access of the Eiresoft on the failover OLTP server

  outside_access_in list extended access allow DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover object-group

  Comment from outside_access_in-access list access for the 2nd period of INVESTIGATION of Eiresoft

  outside_access_in list extended access allow DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP object-group

  Note to outside_access_in access from the 2nd IP Eiresoft access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP object-group

  outside_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) source Dynamics one interface

  NAT (inside, outside) static source CIX-host-1 External_CIX-host-1

  NAT (inside, outside) static source Development_OLTP External_Development_OLTP

  NAT (inside, outside) static source TMC_Webserver External_TMC_Web

  NAT (inside, outside) static source TMC_OLTP External_TMC_OLTP

  NAT (inside, outside) static source OLTP_Failover External_OLTP_Failover

  NAT (inside, outside) static source Dev_Test_Webserver External_Dev_Test_Webserver

  NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 84.39.233.49 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  the ssh LOCAL console AAA authentication

  Enable http server

  http 92.51.193.156 255.255.255.252 outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit

  Crypto ipsec ikev2 ipsec-proposal OF

  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto outside_map 1 match address outside_cryptomap
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 92.51.193.158
  card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 1jeu ikev2 AES AES192 AES256 3DES ipsec-proposal
  outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH 77.75.100.208 255.255.255.240 outside
  SSH 92.51.193.156 255.255.255.252 outside
  SSH timeout 5
  Console timeout 0

  dhcpd outside auto_config
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal GroupPolicy_92.51.193.158 group strategy
  attributes of Group Policy GroupPolicy_92.51.193.158
  VPN-tunnel-Protocol ikev1, ikev2
  username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
  tunnel-group 92.51.193.158 type ipsec-l2l
  tunnel-group 92.51.193.158 General-attributes
  Group - default policy - GroupPolicy_92.51.193.158
  IPSec-attributes tunnel-group 92.51.193.158
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
  : end

  Hello

  There are some clear problems I see on a quick glance. These are not related to the actual VPN configuration but rather the NAT configurations.

  All your configuration of NAT CLI format above are configured as manual NAT / double NAT in Section 1. This means that the appliance NAT configurations have been added to the same section of the NAT configurations and scheduling of the NAT inside this Section rules is the cause of the problem for the L2L VPN connection for some.

  Here are a few suggestions on what to change

  ASA1

  Minimal changes

  the object of the LAN network

  192.168.10.0 subnet 255.255.255.0

  being REMOTE-LAN network

  255.255.255.0 subnet 192.168.100.0

  NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

  That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

  Finally, we remove the old rule that generated the ASDM. It would do the same thing if it has been moved to the top, but I generally find the creation of the 'object' with descriptive names easier on the eyes in the long term.

  Other suggestions

  These changes are not necessary with regard to the VPN L2L. Here are some suggestions how to clean a part of NAT configurations.

  PAT-SOURCE network object-group

  source networks internal PAT Description

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.20.0 255.255.255.0

  object-network 192.168.40.0 255.255.255.0

  NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

  No source (indoor, outdoor) nat Dynamics one interface

  no nat (wireless, outdoors) source Dynamics one interface

  no nat (servers, outside) no matter what source dynamic interface

  The above configuration creates a "object-group" that lists all internal networks that you have dynamic PAT configured so far. It then uses the ' object-group ' in a command unique 'nat' to manage the dynamic PAT for all internal networks (with the exception of printers who had nothing at first). Then we remove the old PAT dynamic configurations.

  Contains the command "nat" "car after" because it moving this "nat" configuration to the bottom of the NAT rules. For this reason its less likely to cause problems in the future.

  network of the SERVERS object

  subnet 192.168.20.0 255.255.255.0

  network of the VPN-POOL object

  192.168.50.0 subnet 255.255.255.0

  NAT (servers, external) 2 static static source of destination of SERVERS SERVERS VPN-VPN-POOL

  no nat (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

  The above configuration is supposed to create a NAT0 configuration for traffic between the network and the pool of Client VPN server. To my knowledge the old configuration that remove us is not used because the traffic would have matched PAT rule dynamic server yet rather than this rule which is later in the NAT configurations and would not be addressed.

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

  ASA2

  Minimal changes

  the object of the LAN network

  255.255.255.0 subnet 192.168.100.0

  being REMOTE-LAN network

  192.168.10.0 subnet 255.255.255.0

  NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

  That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

  Finally, we remove the old rule that generated the ASDM.

  Other suggestions

  PAT-SOURCE network object-group

  object-network 192.168.100.0 255.255.255.0

  NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

  No source (indoor, outdoor) nat Dynamics one interface

  The above configuration is supposed to do the same thing with the other ASA. Although given that this network contains only a single subnet it cleans the "nat" configurations exist that much. But the order of the "nat" configurations is changed to avoid further problems with the NAT order.

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

  I suggest trying the changes related to VPN L2L first NAT0 configurations and test traffic. So who gets the work of connectivity, then you could consider changing other NAT configurations. There are other things that could be changed also in what concerns THAT static NAT servers but that probably better left for another time.

  Hope this makes any sense and has helped

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• Loopback Interface client endpoint VPN Site

  My project consists of 871 router connected to the router soho 3845 network head on the MPLS network unencrypted for data communication. For the Client PC behind router 871 on remote site, they need activate the Cisco VPN client and connect to headend 3845 so that they can access information behind the main switch 6506.

  To reduce to a minimum the installation, I would like to prepare a unique VPN profile for all remote controls. So, I plan on using lo0 int for the VPN endpoint. However, I have found that when the VPN connection is in place on the int lo0, the remote client computer can 'ping' lo0 only, but can not 'ping' all other IP addresses. However, when I set up the connection to the IP address on router 3845, the connection is ok.

  I have attached my config for the VPN and the diagram. Can anyone help?

  Hello

  You need to change your ACL split tunnel:

  FEHD_VPN extended IP access list

  Note * outbound VPN client traffic *.

  IP 10.0.0.0 allow 0.255.255.255 10.65.215.0 0.0.0.255

  Note: Do not know what is the purpose of "allowed host ip host 0.0.0.0 0.0.0.0.

• T61, Vista Business with Cisco VPN problem since the last update on the Lenovo site.

  Hello

  I use a T61, Vista Business, Cisco VPN Client v.5.0.02.0090.  Since my last update, October 2, 2008 on the Lenovo ThinkVantage Productivity Center site, I can't connect to my VPN Office. It was working perfectly before this software update. The only thing I remember is the update of the driver for Intel 4965AGN card v.12.x. I went to v.11.5 but it's not better.

  When I try to connect, I get the message "secure VPN connection terminated by a peer. "433 reason: (reason unspecified peer). I did a test with 'ping' IP address of the VPN and the response of the address.

  Usually, when the VPN Client is able to make the connection in the network connection window, I see "connection to the network space 2 (the Cisco VPN system map)" enabling / disabling Disable to activate the State. But there in my case, turn it off.

  I can connect with another PC using Windows XP. Thus, the VPN works.

  Any ideas?

  Thank you

  I met a very similar problem with my X61s. I was able to fix this by removing the print reading software for which an update was also installed on 2 Oct. As I barely use the fingerprint reader, it wasn't a problem for me. The Cisco VPN worked never better...

• CLIENT-TO-SITE VPN

  Hi all

  I need a big favor, I configured a cisco 1841 for a VPN Client-to-site, but I can't get a connection with a client of Linux (Ubuntu). I don't understand where is the problem if on the router or the customer. Now I have reported setting up, is there anybody can check whether or not it is fair? Thank you very much for your support.

  The plan of the network is the following

  REMOTE LAN (192.168.1.0/24) <->ROUTER-A (X.X.X.X) <->VPN <->SOHO NETWORKING <->CLIENT UBUNTU (192.168.2.1/24)

  and the Conference is the following

  username username password 0 USER12345

  !

  crypto ISAKMP policy 3

  BA 3des-md5 hash

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group to remote vpn client

  banner ^ C * you are connected to the IOS router with VPN Client-to-Site * ^ C

  key 54321

  netmask 255.255.255.0

  masociete.com field

  remote control-vpn-pool

  10 Max-users

  Max-connections 10

  ACL 150

  !

  Crypto ipsec transform-set VPN - SET esp-3des esp-md5-hmac

  !

  Crypto-map dynamic dynmap 10

  Description * Client to users VPN Site *.

  transformation-VPN-SET game

  market arriere-route

  !

  map clientmap 65535-isakmp ipsec crypto dynamic dynmap

  !

  interface FastEthernet0/0

  Description * ROUTER - has--> LAN *.

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  No keepalive

  !

  interface Serial0/0/0

  no ip address

  frame relay IETF encapsulation

  event logging subif-link-status

  dlci-change of status event logging

  IP access-group 103 to

  load-interval 30

  no fair queue

  frame-relay lmi-type ansi

  !

  point-to-point interface Serial0/0/0.1

  Description * ROUTER - has--> WAN *.

  address IP X.X.X.X 255.255.255.252

  NAT outside IP

  IP virtual-reassembly

  SNMP trap-the link status

  No cdp enable

  No frame relay frames arp

  interface-dlci 100 IETF

  clientmap card crypto

  !

  Local IP 192.168.1.1 to remote vpn-pool pool 192.168.1.10

  !

  IP route 0.0.0.0 0.0.0.0 Serial0/0/0.1

  !

  IP nat inside source map route VPN - NAT interface overloading Serial0/0/0.1

  !

  Access-list 100 * ACL NAT note *.

  access-list 100 deny ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 100 permit ip 10.10.10.0 0.0.0.255 any

  !

  Note access-list 103 * OPEN THE PORTS for SSH/TELNET SERVICES ON THE ROUTER *.

  access list 103 permit tcp any any eq 22

  access list 103 permit tcp any any eq telnet

  access list 103 permit tcp any any eq 443

  Note access-list 103 *.

  Note access-list 103 * CLOSE THE PORTS to BLOCK THE REST OF THE ACCESS *.

  access-list 103 deny ip any any newspaper

  Note access-list 103 *.

  !

  Note access-list 150 * ACL VPN SITE-to-SITE *.

  access-list 150 permit ip 10.10.10.0 0.0.0.255 192.168.1.0 0.0.0.255

  Note access-list 150 *.

  !

  route VPN - NAT allowed 10 map

  corresponds to the IP 100

  I think that the configuration is correct, but there is no need to specify a subnet mask to "crypto isakmp configuration group to remote vpn client." customer In addition, you must change your 103 ACL. Add the following statements before refusing:

  permit udp and host X.X.X.X eq 500

  permit udp and host X.X.X.X eq 4500

  esp permits and host X.X.X.X

  ---

  HTH. Please rate this post if this has been helpful. If it solves your problem, please mark this message as "right answer".

• IP common in client IPSec VPN and VPN site to site

  Hello

  We have a scenario where the Cisco ASA 5505 will be one of the ends of a site to site VPN. The same ASA 5505 also allows the Client VPN connection. The issue is around the pooling of intellectual property.

  If I assign a pool of IP addresses (192.168.1.20 - 192.168.1.30) for connections VPN Client - do I need to be sure that these same IP are not used across the site to site VPN?

  There may be a PC / servers running 192.168.1.0/24 on the other side of the site to site VPN. This would lead to an address conflict?

  "

  I have attached a diagram of the scenario. I would like to know if the 'orange' PC would cause an IP conflict if they get the same IP that PC "blue color" - even if one of them is the VPN client and the other is VPN site-to-site

  Thank you.

  Altogether. The pool of the VPN Client must be single subnet which is not anywhere within your network.