Clarification of NAT statistics

We have a NAT router running with a release of NAT stats as below (change of information of ip address for security reasons). Cisco docs say that's the last stat of 68064 misses

'Number of failed allocations of the pool.'.

I would be correct in thinking that this means

the reserve is exhausted and if a session was impossible

created, as opposed to a failure of translation, where a

translation is not in the table and so is created?

Either the unique ip address for NAT isn't enough?

Rgds

Martyn Beck

Statistics of nat ip RTR-0 #sho

Total active translations: 67 (static, dynamic 36 31; 31 wide)

External interfaces:

FastEthernet1/0

Interfaces in reverse:

FastEthernet0/0, FastEthernet0/1, GigabitEthernet2/0

Hits: lack of - 1951802804: 204526

Expiry of the translations: 305447

Dynamic mappings:

-Source inside

access-list 1 pool pool1 refcount 25

pool pool1: netmask 255.255.255.0

beginning 1.2.3.4 end 1.2.3.4

generic type, total covers 1, allocated 1 (100%), Miss 68064

You would be correct. young: (with small m) is failed from a pool of such allowances only when all the addresses in a pool are already assigned.

Scott

Tags: Cisco Security

Similar Questions

NAT problem? Large amount of NAT translations.

I have a client with a particular site who complains constantly of performance.

They have a 871 at the location remote with 4 tunnels IPsec, built over WAN connections to their provider hosting the database and software.

There are about 50 people who work at this place, but I show 3410 current connections with a peak of 14703. I don't see how that's possible with only 50 people and starts to lean towards the NAT config which can be the cause of the poor performance that users encounter.

Auffen_Washington #show ip nat statistics
Total active translations: 3410 (static, dynamic 0 3410; 3410 extended)
Translations of crete: 14703, took place there is 2d05h
External interfaces:
FastEthernet4, Tunnel401, Tunnel0, Tunnel11, Vlan3, Tunnel101, Tunnel201
Tunnel301
Interfaces in reverse:
Vlan1, Vlan2
Hits: 574573468 Misses: 0
CEF translated packages: 566630850, CEF punted packets: 45186206
Expiry of the translations: 10381404
Dynamic mappings:
-Source inside
[Id: 1] access-list interface Loopback1 refcount NAT_Wireless_DMS 0
[Id: 2] NAT_Failover interface Vlan3 refcount route map 0
[Id: 3] NAT_Primary interface FastEthernet4 refcount 3410 route map
Doors appl: 0
Normal doors: 0
Queuing of packets: 0

Any help would be greatly appreciated.

Thank you

Russell Stamey

NAT translations, by default, remain active for a very long time. If I remember correctly, is 24 hours, but I have to what to look for to be sure. They don't take a lot of memory, so this isn't normally a problem, but if you encounter conditions that you think may be due to this, it is quite easy to limit the wait time.
```
 ip nat translation timeout 1800
```
This will set the timeout for new connections to half an hour. Existing connections will always keep the original deadlines, then you might want to wait a period of slow to change and the issue a "clear the ip nat translation *" right then to clear existing translations.

Clarification of the ASA NAT

Hi all

Please I need to be clear on one point:

is

static (Inside, Outside) 10.10.10.1 11.11.11.1 netmask 255.255.255.0

the same thing that

static (Outside, Inside) 11.11.11.1 10.10.10.1 netmask 255.255.255.0?

No, they are not same. The order of a static NAT device is:

static (real_interface,mapped_interface) mapped_ip real_ip netmask mask

What you do is: static (network more secure, less secure network). If you can do one of these:

static (DMZ, Outside) etc.

static (Inside, DMZ) etc.

static (Inside, Outside) etc.

If your case you should do: static (inside address, external) 100.100.100.100 192.168.10.1 netmask 255.255.255.255

This external address 100.100.100.100 inside NAT will address 192.168.10.1.

HTH

Clarification of the NAT rules

Hi all

I understand the notion of NAT and why it is used. However, I am a little confused given the following command:
```
object network obj-internal
```
```
nat (inside,outside) dynamic interface
```
Please correct me if I'm wrong, but until now, I understand that this command creates a network called "obj-internal" object and creates a rule for traffic from the interface inside of the external interface. However, I'm confused with the dynamic interface part. Could someone please elaborate more on the meaning and usage of this part? Any help is greatly appreciated.

To create an object you also a definition of what is this object. You also need somethng as a host or a subnet statement.

For this object that you want to specify how to resolve the internal IP address (inside the network) are translated when communicating with the external network. The NAT command in your example uses a dynamic conversion (unlike the static NAT which is generally used for outside - inside the traffic, or when an inside host should always get the same IP address to the outside) who always uses external IP of the SAA. So no matter what internal host communicates with the outside world, they all appear with a single IP address on the destination system.

--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni

Clarification of authentication PIX NAT and BGP

Hi all

I did some tests on PIX and crossing this area of BGP traffic.

When I configure the PIX to do no config NAT (NAT 0) and configure a BGP session between two routers (one inside) and the other on the outside net everything works fine.

When I configure BGP authentication, I may add the keyword "norandomseq" NAT and STATIC commands cause BGP auth embedded TCP header for authentication information. It's OK.

But when I reconfigure the PIX to make real NAT between the inside and the outside network and reconfigure my routers, BGP session doesn't happen if BGP authentication has been disabled. If I enable authentication BGP, I had errors of MD5 authentication on routers. (Note "norandomseq" is enabled for NAT and STATIC instructions)

Now my question is BGP unsupported for NAT on PIX sessions? (for my tests, it has worked for NAT 0 config, also all the examples that I always found working with NAT 0 config)

I think the problem is that the TCP pseudo-header changes to the NAT device and therefore it will never work right? Or is there any correction internal bgp which should fix this? I think it's almost impossible that this is known with the password simple bgp, right?

Concerning

Michael

Your reasoning is dead the. BGP authentication works like this: the sending peer BGP takes and MD5 hash of the TCP header before sending the package and includes this hash in the TCP header option. The BGP receiver receives the packet and also did a MD5 hash of the TCP header. Then, it compares its value to the value sent by the sender of BGP. If they match, all right. If they fail, the packet is ignored and you get error messages, did you see.

Because the NAT will change the address source TCP, the TCP header will be changed which should bring a different MD5 hash for the receiver that the sender originally sent.

BGP peer by a PIX authtenticatio is supported only in a Nat 0 or static identity with the norandomseq option is enabled.

Make sense?

Scott

Clarification on the collection of statistics

Hello
My very slow query performns and it contains the tables of partitions and uses parallel and index.
Last_analysed columns shows that he is 11 - July (2 weeks)
What statistics to be gathered every day?
What will be the timeduration?
S

Also check the STALE_STATS column in the views of the statistical dictionary (ALL_TAB_STATISTICS, ALL_IND_STATISTICS).

The optimizer statistics management

This indicates when there was enough DML operations on the subject to warrant an update of statistics. The auto night stats collection work should give priority to update statistics on these objects.

Seeking clarification on the SFD in AKM Brushless Servo Drives

Dear members,

I'm looking for clarification on the smart feedback device (SFD) installed in the series of servomotors AKM. There is little information available on this subject in the specifications. It appeared that it offers a very high resolution, information on the position of the rotor high precision signals.

1. how exactly is the PCG provides the position of the rotor?

2. is there a provision to contract low resolution effect Hall of EPD type feedback?

Thank you.

Ansari07

Hi Ansari07,

I don't think that this level of control is possible with the AKD. The reader is supposed to close its own current loop on board for the control of switching and outputs of phase. The AKD offer couple, speed or modes of control position, and you can talk to it by Ethernet on the service port, via a field such as EtherCAT or CANOpen bus, or with an analogue signal +-10V or step/dir commands.

I don't think you can get around all of the internal firmware in the AKD and get direct control of how current passes through the phases.

Best regards

Nate

Static Nat issue unable to resolve everything tried.

Hello

I have a cisco asa 5515 with asa worm 9.4.1 and asdm 7.4

I have problem with configuring static nat, I have a server inside which ip is 172.16.1.85 and

my external interface is configured with a static ip address.

Internet works fine but cannot configure static nat...

Here's my config running if please check and let me know what Miss me...

Thank you

ASA release 9.4 (1)
!
ciscoasa hostname

names of
!
interface GigabitEthernet0/0
nameif outside
security-level 0
IP 151.253.97.182 255.255.255.248
!
interface GigabitEthernet0/1
nameif inside
security-level 100
IP 172.16.1.1 255.255.255.0
!
interface GigabitEthernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/4
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/5
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
management only
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
!
boot system Disk0: / asa941-smp - k8.bin
passive FTP mode
object remote desktop service
source eq 3389 destination eq 3389 tcp service
Description remote desktop
network of the RDP_SERVER object
Home 172.16.1.85
outside_access_in list extended access allow desktop remotely any4 object RDP_SERVER
pager lines 24
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
management of MTU 1500
no failover
no monitor-service-interface module of
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 743.bin
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
!
network of the RDP_SERVER object
NAT (inside, outside) interface static service tcp 3389 3389
!
NAT source auto after (indoor, outdoor) dynamic one interface
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 151.253.97.177 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
identity of the user by default-domain LOCAL
Enable http server
http server idle-timeout 50
http 192.168.1.0 255.255.255.0 management

Telnet 192.168.1.0 255.255.255.0 management
Telnet timeout 5
SSH stricthostkeycheck
SSH 192.168.1.0 255.255.255.0 management
SSH timeout 5
SSH group dh-Group1-sha1 key exchange
Console timeout 0
VPDN username bricks12 password * local store
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
dynamic-access-policy-registration DfltAccessPolicy
username, password imran guVrfhrJftPA/rQZ encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname
anonymous reporting remote call

ciscoasa #.

Hello

Change this ACL: -.

outside_access_in list extended access allow desktop remotely any4 object RDP_SERVER

TO

outside_access_in list extended access allowed object RDP_SERVER eq any4 tcp 3389

Thank you and best regards,

Maryse Amrodia

VPN on ASA 5506 without internet access, help with NAT?

Hello

I have upgraded to a Cisco ASA 5505 to a 5506 X and as such have climbed to ASA 9.5

For this reason, I'm a bit stuck on how to implement the VPN. I followed the wizard and I can now establish inbound connections, but when connected (all traffic is tunnel) there is no internet connectivity.

Our offices internal (inside) network is 192.168.2.0/24

Our VPN pool is 192.168.4.0/24

I guess that I'm missing a NAT rule, but in all honesty, I'm a user ASDM and as everything is changed, I am struggling to recreate it?

Here is my config:

Result of the command: "sh run"

: Saved

:
: Serial Number: JAD194306H5
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.5(1)
!
hostname ciscoasanew
domain-name work.internal
enable password ... encrypted
names
ip local pool RemoteVPNPool 192.168.4.1-192.168.4.254 mask 255.255.255.0
!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address 192.168.3.4 255.255.255.0
!
interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.2.197 255.255.255.0
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management1/1
 management-only
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
ftp mode passive
clock timezone GMT 0
dns domain-lookup inside
dns domain-lookup management
dns server-group DefaultDNS
 name-server 192.168.2.199
 domain-name work.internal
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network 173.0.82.0
 host 173.0.82.0
object network 173.0.82.1
 subnet 66.211.0.0 255.255.255.0
object network 216.113.0.0
 subnet 216.113.0.0 255.255.255.0
object network 64.4.0.0
 subnet 64.4.0.0 255.255.255.0
object network 66.135.0.0
 subnet 66.135.0.0 255.255.255.0
object network a
 host 192.168.7.7
object network devweb
 host 192.168.2.205
object network DevwebSSH
 host 192.168.2.205
object network DEV-WEB-SSH
 host 192.168.2.205
object network DEVWEB-SSH
 host 192.168.2.205
object network vpn-network
 subnet 192.168.4.0 255.255.255.0
object network NETWORK_OBJ_192.168.4.0_24
 subnet 192.168.4.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_24
 subnet 192.168.2.0 255.255.255.0
object-group network EC2ExternalIPs
 network-object host 52.18.73.220
 network-object host 54.154.134.173
 network-object host 54.194.224.47
 network-object host 54.194.224.48
 network-object host 54.76.189.66
 network-object host 54.76.5.79
object-group network PayPal
 network-object object 173.0.82.0
 network-object object 173.0.82.1
 network-object object 216.113.0.0
 network-object object 64.4.0.0
 network-object object 66.135.0.0
object-group service DM_INLINE_SERVICE_1
 service-object icmp
 service-object icmp6
 service-object icmp alternate-address
 service-object icmp conversion-error
 service-object icmp echo
 service-object icmp information-reply
 service-object icmp information-request
access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object DEVWEB-SSH eq ssh
access-list outside_access_in remark AWS Servers
access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object devweb eq ssh log debugging inactive
access-list outside_access_in extended permit ip any any inactive
access-list outside_access_in remark Ping reply
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any interface outside
access-list outside_access_in remark Alarm
access-list outside_access_in extended permit tcp any interface outside eq 10001
access-list outside_access_in remark CCTV
access-list outside_access_in extended permit tcp any interface outside eq 7443
access-list outside_access_in extended deny ip any any
access-list workvpn_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.255.0
access-list workvpn_splitTunnelAcl_1 standard permit 162.13.130.12 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 162.13.133.72 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 164.177.128.200 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.16 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.72 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 212.64.147.184 255.255.255.248
access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.116 255.255.255.254
access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.118 255.255.255.254
access-list workvpn_splitTunnelAcl_1 standard permit host 95.138.147.118
access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.120 255.255.255.254
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list workvpn2_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
access-list workVPN2016_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 16000
logging asdm-buffer-size 512
logging asdm warnings
logging flash-bufferwrap
mtu outside 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 7200
no arp permit-nonconnected
nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup
!
object network obj_any
 nat (any,outside) dynamic interface
object network DEVWEB-SSH
 nat (inside,outside) static interface service tcp ssh ssh
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.3.3 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.2.197,CN=ciscoasanew
 keypair ASDM_LAUNCHER
 crl configure

snip

dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
no threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ssl-client
group-policy workVPN2016 internal
group-policy workVPN2016 attributes
 dns-server value 192.168.2.199
 vpn-tunnel-protocol ikev1
 split-tunnel-policy tunnelall
 ipv6-split-tunnel-policy tunnelall
 default-domain value work.internal
 split-dns value work.internal
 split-tunnel-all-dns enable
dynamic-access-policy-record DfltAccessPolicy

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous
hpm topN enable
Cryptochecksum:
: end

Hi Ben-

What you are trying to accomplish is called VPN crossed. Depending on your initial configuration, you have 2 NAT problems. The first has to do with the NAT you place your order. In the code later that we are dealing with two NAT ASA 8.3 times and who are ranked 2 sections going on before and after the device NAT. object

My general rule for control of NAT is like this:

Twice NAT (front) - use this section for exemptions from NAT or unusual configurations that have to go first
Purpose of NAT - Use this section to the static NAT instructions for servers
Twice NAT (after) - use this section to your global declarations of NAT, basically a catch-all

Then, never use 'all' as an interface for all training of NAT. This may seem like a good idea, but it will bite you. Remember, it is more the notion of control NAT, then 'all' interface is bit VPN configurations and similar DMZ. Always be specific about your interface for NAT pairs.

To this end, here is what I suggest that your NAT configuration should resemble:

nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup!object network DEVWEB-SSH nat (inside,outside) static interface service tcp ssh ssh !nat (inside,outside) after-auto source dynamic any interfacenat (outside,outside) after-auto source dynamic any interface

The key is that you need a NAT device explicitly reflecting the VPN traffic. PSC

ASA 5505 as internet gateway (must reverse NAT)

Hi all the Cisco guru

I have this diet:

Office-> Cisco 877-> Internet-> ASA 5505-> remote network

Office network: 192.168.10.0/24

Cisco 877 IP internal: 192.168.10.200

Cisco 877 external IP: a.a.a.a

ASA 5505 external IP: b.b.b.b

ASA 5505 internal IP: 192.168.1.3 and 192.168.17.3

Remote network: 192.168.17.0/24 and 192.168.1.0/24

VPN tunnel is OK and more. I have the Office Access to the remote network and the remote network access to the bureau by the tunnel.

But when I try to access the network remotely (there are 2 VLANS: management and OLD-private) to the internet, ASA answer me:

305013 *. * NAT rules asymetrique.64.9 matched 53 for flows forward and backward; Connection for udp src OLD-Private:192.168.17.138/59949 dst WAN:*.*.64.9/53 refused due to path failure reverse that of NAT

Ping of OLD-private interface to google result:

110003 192.168.17.2 0 66.102.7.104 0 routing cannot locate the next hop for icmp NP identity Ifc:192.168.17.2/0 to OLD-Private:66.102.7.104/0

Result of traceroute

How can I fix reverse NAT and make ASA as internet gateway?

There is my full config

!
ASA Version 8.2 (2)
!
hostname ASA2
domain default.domain.invalid
activate the encrypted password password
encrypted passwd password
names of
!
interface Vlan1
Description INTERNET
1234.5678.0002 Mac address
nameif WAN
security-level 100
IP address b.b.b.b 255.255.248.0
OSPF cost 10
!
interface Vlan2
OLD-PRIVATE description
1234.5678.0202 Mac address
nameif OLD-private
security-level 0
IP 192.168.17.3 255.255.255.0
OSPF cost 10
!
interface Vlan6
Description MANAGEMENT
1234.5678.0206 Mac address
nameif management
security-level 0
192.168.1.3 IP address 255.255.255.0
OSPF cost 10
!
interface Ethernet0/0
!
interface Ethernet0/1
Shutdown
!
interface Ethernet0/2
Shutdown
!
interface Ethernet0/3
Shutdown
!
interface Ethernet0/4
Shutdown
!
interface Ethernet0/5
Shutdown
!
interface Ethernet0/6
switchport trunk allowed vlan 2.6
switchport mode trunk
!
interface Ethernet0/7
Shutdown
!
connection of the banner * W A R N I N G *.
banner connect unauthorized access prohibited. All access is
connection banner monitored, and intruders will be prosecuted
connection banner to the extent of the law.
Banner motd * W A R N I N G *.
Banner motd unauthorised access prohibited. All access is
Banner motd monitored and trespassers will be prosecuted
Banner motd to the extent of the law.
boot system Disk0: / asa822 - k8.bin
passive FTP mode
DNS domain-lookup WAN
DNS server-group DefaultDNS
Server name dns.dns.dns.dns
domain default.domain.invalid
permit same-security-traffic intra-interface
object-group Protocol TCPUDP
object-protocol udp
object-tcp protocol
object-group service RDP - tcp
RDP description
EQ port 3389 object
Access extensive list ip 192.168.17.0 LAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Standard access list LAN_IP allow 192.168.17.0 255.255.255.0
WAN_access_in list of allowed ip extended access all any debug log
WAN_access_in list extended access permitted ip OLD-private interface WAN newspaper inactive debugging interface
WAN_access_in list extended access permit tcp any object-group RDP any RDP log debugging object-group
MANAGEMENT_access_in list of allowed ip extended access all any debug log
access-list extended OLD-PRIVATE_access_in any allowed ip no matter what debug log
access-list OLD-PRIVATE_access_in extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 inactive debug log
OLD-PRIVATE_access_in allowed extended object-group TCPUDP host 192.168.10.7 access-list no matter how inactive debug log
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.10.254 interface private OLD newspaper inactive debugging
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.17.155 interface private OLD newspaper debugging
access-list 101 extended allow host tcp 192.168.10.7 any eq 3389 debug log
Access extensive list ip 192.168.17.0 WAN_1_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_cryptomap_2 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
Capin list extended access permit ip host 192.18.17.155 192.168.10.7
Capin list extended access permit ip host 192.168.10.7 192.168.17.155
LAN_access_in list of allowed ip extended access all any debug log
Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Access extensive list ip 192.168.17.0 WAN_2_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0

permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0
pager lines 24
Enable logging
recording of debug trap
logging of debug asdm
Debugging trace record
Debug class auth record trap
MTU 1500 WAN
MTU 1500 OLD-private
MTU 1500 management
mask 192.168.1.150 - 192.168.1.199 255.255.255.0 IP local pool VPN_Admin_IP
no failover
ICMP unreachable rate-limit 1 burst-size 1
ICMP permitted host a.a.a.a WAN
ICMP deny any WAN
ICMP permitted host 192.168.10.7 WAN
ICMP permitted host b.b.b.b WAN
ASDM image disk0: / asdm - 631.bin
don't allow no asdm history
ARP timeout 14400
Global (OLD-private) 1 interface
Global interface (management) 1
NAT (WAN) 1 0.0.0.0 0.0.0.0

inside_nat0_outbound (WAN) NAT 0 access list
WAN_access_in access to the WAN interface group
Access-group interface private-OLD OLD-PRIVATE_access_in
Access-group MANAGEMENT_access_in in the management interface
Route WAN 0.0.0.0 0.0.0.0 b.b.b.185 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
local AAA authentication attempts 10 max in case of failure
Enable http server
http 192.168.1.0 255.255.255.0 WAN
http 0.0.0.0 0.0.0.0 WAN
http b.b.b.b 255.255.255.255 WAN
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Service resetoutside
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto WAN_map 1 corresponds to the address WAN_1_cryptomap
card crypto WAN_map 1 set peer a.a.a.a
WAN_map 1 transform-set ESP-DES-SHA crypto card game
card crypto WAN_map WAN interface
ISAKMP crypto enable WAN
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
the Encryption
sha hash
Group 1
life 86400
Telnet timeout 5
SSH a.a.a.a 255.255.255.255 WAN
SSH timeout 30
SSH version 2
Console timeout 0
dhcpd auto_config management
!

a basic threat threat detection
host of statistical threat detection
Statistics-list of access threat detection
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
NTP server 129.6.15.28 source WAN prefer
WebVPN
attributes of Group Policy DfltGrpPolicy
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
internal admin group strategy
group admin policy attributes
DNS.DNS.DNS.DNS value of DNS server
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list LAN_IP
privilege of encrypted password password username administrator 15
type tunnel-group admin remote access
tunnel-group admin general attributes
address pool VPN_Admin_IP
strategy-group-by default admin
tunnel-group a.a.a.a type ipsec-l2l
tunnel-group a.a.a.a general-attributes
strategy-group-by default admin
a.a.a.a group of tunnel ipsec-attributes
pre-shared-key *.
NOCHECK Peer-id-validate
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!

Thank you for your time and help

Why you use this NAT type?

Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 any
NAT (OLD-private) 0-list of access WAN_nat0_outbound

You are basically saying the ASA not NAT traffic. This private IP address range is not routed on the Internet. This traffic is destined to be sent over the Internet? If so, that LAC should then not be there.

If you want NAT traffic to one IP public outside the ASA, you must remove this line and let the NAT and GLOBAL work:

NAT (OLD-private) 1 0.0.0.0 0.0.0.0

Global (WAN) 1 interface

Cannot ping inside the vpn client hosts. It's a NAT problem

Hello everyone, I'm running into what seems to be a cause of exclusion with an IOS IPSEC VPN NAT/nat. I can connect to the VPN with cisco IPSEC VPN client, and I am able to authenticate. Once I have authenticate, I'm not able to reach one of the guests inside. Below is my relevant config. Any help would be greatly appreciated.

AAA new-model

!

!

AAA authentication login default local

radius of group AAA authentication login userauthen

AAA authorization exec default local

AAA authorization groupauthor LAN

crypto ISAKMP policy 3

BA 3des

preshared authentication

Group 2

!

ISAKMP crypto client configuration group businessVPN

key xxxxxx

DNS 192.168.10.2

business.local field

pool vpnpool

ACL 108

Crypto isakmp VPNclient profile

businessVPN group identity match

client authentication list userauthen

ISAKMP authorization list groupauthor

client configuration address respond

!

!

Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

!

Crypto-map dynamic dynmap 10

Set transform-set RIGHT

Define VPNclient isakmp-profile

market arriere-route

!

!

10 ipsec-isakmp crypto map clientmap Dynamics dynmap

interface Loopback0

IP 10.1.10.2 255.255.255.252

no ip redirection

no ip unreachable

no ip proxy-arp

IP virtual-reassembly

!

Null0 interface

no ip unreachable

!

interface FastEthernet0/0

IP 111.111.111.138 255.255.255.252

IP access-group outside_in in

no ip redirection

no ip unreachable

no ip proxy-arp

NAT outside IP

inspect the outgoing IP outside

IP virtual-reassembly

automatic duplex

automatic speed

clientmap card crypto

!

the integrated-Service-Engine0/0 interface

description Locator is initialized with default IMAP group

IP unnumbered Loopback0

no ip redirection

no ip unreachable

no ip proxy-arp

IP virtual-reassembly

ip address of service-module 10.1.10.1 255.255.255.252

Service-module ip default gateway - 10.1.10.2

interface BVI1

IP 192.168.10.1 255.255.255.0

no ip redirection

no ip unreachable

no ip proxy-arp

IP nat inside

IP virtual-reassembly

IP nat inside source static tcp 192.168.10.2 25 interface FastEthernet0/0 25

IP nat inside source static tcp 192.168.10.2 443 interface FastEthernet0/0 443

IP nat inside source static tcp 192.168.10.2 3389 interface FastEthernet0/0 3389

IP nat inside source map route nat interface FastEthernet0/0 overload

nat extended IP access list

deny ip 192.168.10.0 0.0.0.255 192.168.109.0 0.0.0.255

refuse the 10.1.1.0 ip 0.0.0.255 192.168.109.0 0.0.0.255

ip licensing 10.1.1.0 0.0.0.255 any

permit ip 192.168.10.0 0.0.0.255 any

sheep extended IP access list

permit ip 192.168.10.0 0.0.0.255 192.168.109.0 0.0.0.255

ip permit 10.1.10.0 0.0.0.255 192.168.109.0 0.0.0.255

ip licensing 10.1.1.0 0.0.0.255 192.168.109.0 0.0.0.255

outside_in extended IP access list

permit tcp object-group Yes_SMTP host 111.111.111.138 eq smtp

permit any any eq 443 tcp

permit tcp 20.20.20.96 0.0.0.31 host 111.111.111.138 eq 3389

permit tcp 20.20.20.96 0.0.0.31 host 111.111.111.138 eq 22

allow any host 111.111.111.138 esp

allow any host 111.111.111.138 eq isakmp udp

allow any host 111.111.111.138 eq non500-isakmp udp

allow any host 111.111.111.138 ahp

allow accord any host 111.111.111.138

access-list 108 allow ip 192.168.109.0 0.0.0.255 192.168.10.0 0.0.0.255

access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.1.0 0.0.0.255

access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.10.0 0.0.0.255

!

!

!

!

route nat allowed 10 map

match ip address nat

1 channel ip bridge

In my view, the acl applied to customer is back. It must allow traffic from the internal network to the pool of customers.

To confirm, you can open the Cisco VPN client statistics (after login) then go in the route Details tab. We should see the networks you should be able to reach the customer. Make sure that the good ones are here.

Kind regards

ASA VPN Site to Site (WITH the NAT) ICMP problem

Hi all!

I need traffic PAT 192.168.1.0/24 (via VPN) contact remote 151.1.1.0/24, through 192.168.123.9 router in the DMZ (see diagram)

It works with this configuration, with the exception of the ICMP.

This is the error: Deny icmp src dmz:151.1.1.1 dst foreign entrants: 192.168.123.229 (type 0, code 0)

Is there a way to do this?

Thank you all!

Marco

------------------------------------------------------------------------------------

ASA Version 8.2 (2)
!
ciscoasa hostname
domain default.domain.invalid
activate 8Ry2YjIyt7RRXU24 encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
name 192.168.1.0 network-remote control
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.200.199 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
the IP 10.0.0.2 255.255.255.0
!
interface Vlan3
prior to interface Vlan1
nameif dmz
security-level 0
192.168.123.1 IP address 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 3
!
passive FTP mode
DNS server-group DefaultDNS
domain default.domain.invalid
the DM_INLINE_NETWORK_1 object-group network
object-network 151.1.1.0 255.255.255.0
object-network 192.168.200.0 255.255.255.0
outside_1_cryptomap list extended access allowed object-group DM_INLINE_NETWORK_1 remote ip 255.255.255.0 network
inside_nat0_outbound to access extended list ip 192.168.200.0 allow 255.255.255.0 255.255.255.0 network-remote control
VPN_NAT list extended access allow remote-network ip 255.255.255.0 151.1.1.0 255.255.255.0
dmz_access_in list extended access permit icmp any one
outside_access_in list extended access permit icmp any one
pager lines 24
Enable logging
notifications of logging asdm
Within 1500 MTU
Outside 1500 MTU
MTU 1500 dmz
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow all dmz
ASDM image disk0: / asdm - 625.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
Global (dmz) 5 192.168.123.229
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 192.168.200.0 255.255.255.0
NAT (outside) 5 VPN_NAT list of outdoor access
Access-group outside_access_in in interface outside
Access-group dmz_access_in in dmz interface
Route outside 0.0.0.0 0.0.0.0 10.0.0.100 1
Dmz route 151.1.1.0 255.255.255.0 192.168.123.9 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 0.0.0.0 0.0.0.0 inside
remote control-network http 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto outside_map 1 match address outside_1_cryptomap
card crypto outside_map 1 set pfs Group1
card crypto outside_map 1 set peer 10.0.0.1
card crypto outside_map 1 set of transformation-ESP-3DES-SHA
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
dhcpd outside auto_config
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
tunnel-group 10.0.0.1 type ipsec-l2l
tunnel-group 10.0.0.1 ipsec-attributes
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
------------------------------------------------------------------------------------

Review the link, you have two ways to leave outgoing icmp, good acl or icmp inspection

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

NAT-XLATE-FAILURE on the VPN from Site to site connection.

I had configured a VPN of Site to new site on my network, once I created Tunnel appears, but there is no traffic when I made trace packet its gave me error "(NAT-XLATE-FAILED), NAT has failed."

Here is the configuration runing.

ASA 9.1 Version 2
!
ciscoasa hostname
activate 2KFQnbNIdI.2KYOU encrypted password
names of
IP local pool kecdr 10.100.1.1 - 10.100.1.50 mask 255.255.255.0
local pool KECVPN 10.2.1.200 - 10.2.1.225 255.255.255.0 IP mask
!
interface GigabitEthernet0/0
nameif outside
security-level 0
IP 168.187.199.66 255.255.255.252
!
interface GigabitEthernet0/1
nameif inside
security-level 100
10.2.1.1 IP address 255.255.255.0
!
interface GigabitEthernet0/2
nameif DMZ
security-level 50
IP 10.60.1.2 255.255.255.0
!
interface GigabitEthernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/4
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/5
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
management only
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
!
passive FTP mode
DNS domain-lookup outside
DNS lookup field inside
management of the DNS domain-lookup service
DNS server-group DefaultDNS
Name-Server 8.8.8.8
permit same-security-traffic intra-interface
network of the NETWORK_OBJ_10.100.1.0_26 object
255.255.255.192 subnet 10.100.1.0
network of the NETWORK_OBJ_10.2.1.192_26 object
255.255.255.192 subnet 10.2.1.192
network of the NETWORK_OBJ_10.13.0.0 object
Home 10.13.0.0
network of the NETWORK_OBJ_10.2.0.0 object
host 10.2.0.0
network of the NETWORK_OBJ_10.3.0.0 object
Home 10.3.0.0
the DM_INLINE_NETWORK_1 object-group network
host object-network 10.2.0.0
object-network 10.60.1.0 255.255.255.0
inside_access_in list extended access permitted ip any4 any4
inside_access_in list of allowed ip extended access all 10.60.1.0 255.255.255.0
outside_access_in list extended access permitted ip any4 any4
allow global_access to access extensive ip list a whole
DMZ_access_in of access allowed any ip an extended list
DMZ_access_in list extended access permit ip any interface inside
outside_cryptomap list extended access allowed host ip DM_INLINE_NETWORK_1 10.3.0.0 object-group
permit access ip host 10.2.0.0 extended list outside_cryptomap_1 10.11.0.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
management of MTU 1500
MTU 1500 DMZ
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow any response echo inside
ICMP allow any echo inside
ICMP allow all DMZ
ICMP allow any echo DMZ
ICMP allow any response to echo DMZ
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
NAT (inside, outside) static source any any static destination NETWORK_OBJ_10.2.1.192_26 NETWORK_OBJ_10.2.1.192_26 non-proxy-arp-search to itinerary
NAT (inside, outside) static source any any static destination NETWORK_OBJ_10.100.1.0_26 NETWORK_OBJ_10.100.1.0_26 non-proxy-arp-search to itinerary
NAT (inside DMZ) static source a whole
NAT (inside, outside) static source NETWORK_OBJ_10.2.0.0 NETWORK_OBJ_10.2.0.0 NETWORK_OBJ_10.13.0.0 NETWORK_OBJ_10.13.0.0 non-proxy-arp-search of route static destination
NAT (inside, outside) static source DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 NETWORK_OBJ_10.3.0.0 NETWORK_OBJ_10.3.0.0 non-proxy-arp-search of route static destination
!
NAT source auto after (indoor, outdoor) dynamic one interface
Access-group outside_access_in in interface outside
inside_access_in access to the interface inside group
Access-group DMZ_access_in in DMZ interface
Access-Group global global_access
Route outside 0.0.0.0 0.0.0.0 168.187.199.65 1
Route DMZ 10.1.0.0 255.255.0.0 10.60.1.1 1
Route DMZ 10.2.0.0 255.255.0.0 10.60.1.1 1
Route DMZ 10.60.0.0 255.255.0.0 10.60.1.1 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
AAA authentication LOCAL telnet console
the ssh LOCAL console AAA authentication
Enable http server
http 192.168.1.0 255.255.255.0 management
http 10.0.0.0 255.0.0.0 inside
http 0.0.0.0 0.0.0.0 outdoors
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
Crypto ipsec ikev2 ipsec-proposal OF
encryption protocol esp
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 proposal ipsec 3DES
Esp 3des encryption protocol
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal AES
Esp aes encryption protocol
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 ipsec-proposal AES192
Protocol esp encryption aes-192
Esp integrity sha - 1, md5 Protocol
Crypto ipsec ikev2 AES256 ipsec-proposal
Protocol esp encryption aes-256
Esp integrity sha - 1, md5 Protocol
Crypto ipsec pmtu aging infinite - the security association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
card crypto outside_map 1 match address outside_cryptomap
card crypto outside_map 1 set pfs Group1
peer set card crypto outside_map 1 196.219.202.197
card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
card crypto outside_map 2 match address outside_cryptomap_1
peer set card crypto outside_map 2 185.52.118.67
card crypto outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
Crypto ca trustpoint _SmartCallHome_ServerCA
Configure CRL
trustpool crypto ca policy
Crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018
481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
6c2527b9 deb78458 c61f381e a4c4cb66
quit smoking
IKEv2 crypto policy 1
aes-256 encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 10
aes-192 encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 20
aes encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 30
3des encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
IKEv2 crypto policy 40
the Encryption
integrity sha
Group 2 of 5
FRP sha
second life 86400
Crypto ikev2 allow outside
Crypto ikev1 allow outside
IKEv1 crypto policy 10
authentication crack
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 20
authentication rsa - sig
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 40
authentication crack
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 50
authentication rsa - sig
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 60
preshared authentication
aes-192 encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 70
authentication crack
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 80
authentication rsa - sig
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 90
preshared authentication
aes encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 100
authentication crack
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 110
authentication rsa - sig
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 120
preshared authentication
3des encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 130
authentication crack
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 140
authentication rsa - sig
the Encryption
sha hash
Group 2
life 86400
IKEv1 crypto policy 150
preshared authentication
the Encryption
sha hash
Group 2
life 86400
Telnet 0.0.0.0 0.0.0.0 outdoors
Telnet 10.0.0.0 255.0.0.0 inside
Telnet 10.2.0.0 255.255.0.0 inside
Telnet 10.1.0.0 255.255.0.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH 10.0.0.0 255.0.0.0 inside
SSH 10.2.0.0 255.255.0.0 inside
SSH 10.1.0.0 255.255.0.0 inside
SSH timeout 5
SSH group dh-Group1-sha1 key exchange
Console timeout 0
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
statistical threat detection port
Statistical threat detection Protocol
Statistics-list of access threat detection
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
internal GroupPolicy_185.52.118.67 group strategy
attributes of Group Policy GroupPolicy_185.52.118.67
Ikev1 VPN-tunnel-Protocol
internal GroupPolicy_196.219.202.197 group strategy
attributes of Group Policy GroupPolicy_196.219.202.197
Ikev1 VPN-tunnel-Protocol
internal kecdr group policy
attributes of the strategy of group kecdr
value of server DNS 8.8.8.8
Ikev1 VPN-tunnel-Protocol
internal KECCISCO group policy
KECCISCO group policy attributes
value of server DNS 8.8.8.8
Ikev1 VPN-tunnel-Protocol
internal KECVPN group policy
KECVPN group policy attributes
value of server DNS 8.8.8.8
Ikev1 VPN-tunnel-Protocol
Split-tunnel-policy tunnelspecified
username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
cisco 3USUcOPFUiMCO4Jk encrypted password username
username privilege 15 encrypted password 3ofqMXhysxFRHhoQ keccisco
type tunnel-group kecdr remote access
tunnel-group kecdr General-attributes
address kecdr pool
Group Policy - by default-kecdr
kecdr group of tunnel ipsec-attributes
IKEv1 pre-shared-key *.
type tunnel-group KECVPN remote access
attributes global-tunnel-group KECVPN
address kecdr pool
Group Policy - by default-KECVPN
IPSec-attributes tunnel-group KECVPN
IKEv1 pre-shared-key *.
type tunnel-group KECCISCO remote access
attributes global-tunnel-group KECCISCO
address KECVPN pool
Group Policy - by default-KECCISCO
IPSec-attributes tunnel-group KECCISCO
IKEv1 pre-shared-key *.
tunnel-group 196.219.202.197 type ipsec-l2l
tunnel-group 196.219.202.197 General-attributes
Group - default policy - GroupPolicy_196.219.202.197
IPSec-attributes tunnel-group 196.219.202.197
IKEv1 pre-shared-key *.
remote control-IKEv2 pre-shared-key authentication *.
pre-shared-key authentication local IKEv2 *.
tunnel-group 185.52.118.67 type ipsec-l2l
tunnel-group 185.52.118.67 General-attributes
Group - default policy - GroupPolicy_185.52.118.67
IPSec-attributes tunnel-group 185.52.118.67
IKEv1 pre-shared-key *.
remote control-IKEv2 pre-shared-key authentication *.
pre-shared-key authentication local IKEv2 *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname
anonymous reporting remote call
HPM topN enable
Cryptochecksum:8156993fef96da73dedfaacd7a14e767
: end

My local IP address: 10.2.X.X

My remote IP address: 10.3.X.X

Can anyone support me for the error

Hello

Your self after dynamic PAT takes the static NAT...

NAT source auto after (indoor, outdoor) dynamic one interface

You must reconfigure you NAT or PAT rule defined in your firewall.

no nat source auto after (indoor, outdoor) dynamic one interface

network local-lan-pat1 object

10.2.0.0 subnet 255.255.255.0

NAT dynamic interface (indoor, outdoor)

!

network local-lan-pat2 object

10.60.1.0 subnet 255.255.255.0

NAT dynamic interface (indoor, outdoor)

!

no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 NETWORK_OBJ_10.3.0.0 NETWORK_OBJ_10.3.0.0 non-proxy-arp-search of route static destination
!

outside_cryptomap to access extended list ip 10.2.0.0 allow 255.255.255.0 host 10.3.0.0 255.255.255.0

No list of extended outside_cryptomap access not allowed host ip DM_INLINE_NETWORK_1 10.3.0.0 object-group

!

We hope that you do this between subnets... not for the host at the other end.

Concerning

Knockaert

identity NAT

Hello

I have a question,

If I want to assign a public ip address @, and do a nat 0,.

but my question is because the inisde ip address is private and pourles differnet from the public, how can they communicate?

is this possible?

thaks a lot.

Thanks for the clarification, now I think I know what you're trying to ask. NAT 0 is normally used when you do not want the PIX to run NATTING to some or all of the hosts, however, you cannot have two ip subnets that are directly connected to an interface of the PIX. You may be able to have a public address somewhere inside the PIX, condition that there is a way to reach this address through a device of next hop (some gateway) on the same subnet as the PIX inside interface. The host in question will require a gateway to be on the same subnet as the host to be able to communicate to the outside world. Appropriate routes will have on the PIX to direct traffic to the host through the gateway.

One last thing I want to say, is that when you want to avoid NAT for a device you want also other for access from a less secure PIX interface, you create usually a translation of static ip address of the device rather than a NAT 0. This is because with NAT 0 traffic must always be started indoors as the PIX fills the table of translation in this way.

I hope I don't end up confusing you.

asa5512 V8.6 nat web server cannot access

Hi all

asa5512 V8.6 nat web server cannot access.

my home pc can access www.cisco.com, but external client cannot access my web server inside...

all of my config, I do not know what is wrong.

Thank youe help.

ciscoasa #.

See the ciscoasa # running

ciscoasa # show running-config

: Saved

:

ASA 1.0000 Version 2

!

ciscoasa hostname

activate 2KFQnbNIdI.2KYOU encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface GigabitEthernet0/0

nameif outside

security-level 0

address IP XXX1 255.255.255.240

!

interface GigabitEthernet0/1

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/2

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/3

Description link to 3560 G0/1

Speed 1000

full duplex

nameif inside

security-level 100

192.168.1.13 IP address 255.255.255.0

!

interface GigabitEthernet0/4

Shutdown

No nameif

no level of security

no ip address

!

interface GigabitEthernet0/5

Shutdown

No nameif

no level of security

no ip address

!

interface Management0/0

nameif management

security-level 100

IP 192.168.100.1 address 255.255.255.0

!

!

time-range k3used

absolute starting 08:00 January 1, 2008

daily periodical 0:00 to 23:59

periodical daily 09:00-18:00

!

passive FTP mode

clock timezone BeiJing 8

network object obj - 192.168.1.0

subnet 192.168.1.0 255.255.255.0

network object obj - 192.168.200.0

192.168.200.0 subnet 255.255.255.0

network object obj - 192.168.1.2

host 192.168.1.2

network object obj - 192.168.1.2 - 01

host 192.168.1.2

network object obj - 192.168.1.19

Home 192.168.1.19

network object obj - 192.168.1.20

host 192.168.1.20

network object obj - 192.168.1.88

Home 192.168.1.88

network object obj - 192.168.1.1

host 192.168.1.1

network object obj - 192.168.1.2 - 02

host 192.168.1.2

network object obj - 192.168.1.6

host 192.168.1.6

object obj - X.X.X.3 network

Home X.X.X.3

object obj-tcp-source-eq-25 service

tcp source eq smtp service

obj-tcp-source-eq-110 service object

tcp source eq Microsoft pop3 service

object obj - X.X.X.10 network

Home X.X.X.10

obj-tcp-source-eq-8086 service object

tcp source eq 8086 service

obj-tcp-source-eq-80 service object

tcp source eq www service

network object obj - 192.168.1.1 - 01

host 192.168.1.1

obj-tcp-source-eq-3389 service object

source eq 3389 tcp service

obj-tcp-source-eq-9877 service object

tcp source eq 9877 service

obj-tcp-source-eq-21 service object

tcp source eq ftp service

object obj-tcp-source-eq-20 service

tcp source eq ftp service - data

network object obj - 192.168.2.88

Home 192.168.2.88

network object obj - 192.168.2.88 - 01

Home 192.168.2.88

network object obj - 192.168.2.88 - 02

Home 192.168.2.88

network object obj - 192.168.1.19 - 01

Home 192.168.1.19

network object obj - 192.168.2.2

host 192.168.2.2

network object obj - 192.168.2.2 - 01

host 192.168.2.2

network object obj - 192.168.2.2 - 02

host 192.168.2.2

network object obj - 192.168.3.2

host 192.168.3.2

network object obj - 192.168.3.2 - 01

host 192.168.3.2

network object obj - 192.168.3.2 - 02

host 192.168.3.2

object obj - X.X.X.9 network

Home X.X.X.9

obj-tcp-source-eq-8087 service object

tcp source eq 8087 service

network object obj - 192.168.1.200

host 192.168.1.200

network object obj - 192.168.1.200 - 01

host 192.168.1.200

network object obj - 192.168.1.30

host 192.168.1.30

network object obj - 192.168.1.30 - 01

host 192.168.1.30

network object obj - 192.168.1.1 - 02

host 192.168.1.1

object obj - X.X.X.6 network

Home X.X.X.6

obj-tcp-source-eq-8088 service object

tcp source eq 8088 service

network object obj - 192.168.3.5

Home 192.168.3.5

network object obj - 192.168.3.5 - 01

Home 192.168.3.5

network object obj - 192.168.3.5 - 02

Home 192.168.3.5

network object obj - 192.168.3.5 - 03

Home 192.168.3.5

network object obj - 192.168.3.5 - 04

Home 192.168.3.5

network object obj - 192.168.2.0

Subnet 192.168.2.0 255.255.255.0

network object obj - 192.168.3.0

subnet 192.168.3.0 255.255.255.0

network object obj - 192.168.4.0

subnet 192.168.4.0 255.255.255.0

network object obj - 192.168.5.0

192.168.5.0 subnet 255.255.255.0

network object obj - 192.168.6.0

192.168.6.0 subnet 255.255.255.0

network object obj - 192.168.7.0

192.168.7.0 subnet 255.255.255.0

network object obj - 192.168.8.0

192.168.8.0 subnet 255.255.255.0

vpn_list to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.200.0 255.255.255.0

vpn_list to access extended list ip 192.168.200.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

access-list 101 extended deny ip any host 58.215.78.113

access-list 101 extended deny ip any host 61.139.126.81

access-list 101 extended deny ip any host 61.152.94.154

access-list 101 extended allow host ip 192.168.4.2 all

access-list 101 extended allow host ip 192.168.4.3 all

access-list 101 extended allow host ip 192.168.4.4 all

access-list 101 extended allow host ip 192.168.4.5 all

access-list 101 extended allow host ip 192.168.4.7 everything

access-list 101 extended permit ip host 192.168.4.8 all

access-list 101 extended permit ip host 192.168.4.9 all

access-list 101 extended permit ip host 192.168.4.10 all

access-list 101 extended allow host ip 192.168.4.11 all

access-list 101 extended allow host ip 192.168.4.12 all

access-list 101 extended allow host ip 192.168.4.13 all

access-list 101 extended allow host ip 192.168.4.14 all

access-list 101 extended allow host ip 192.168.4.15 all

access-list 101 extended allow host ip 192.168.4.16 all

access-list 101 extended allow host 192.168.4.18 ip everything

access-list 101 extended allow host ip 192.168.4.19 all

access-list 101 extended allow host ip 192.168.4.20 all

access-list 101 extended allow host ip 192.168.4.180 all

access-list 101 extended deny ip 192.168.4.0 255.255.255.0 any

access-list 101 extended allow host ip 192.168.2.176 all

access-list 101 extended allow icmp a whole

access-list 101 extended allow host ip 192.168.2.3 everything

access-list 101 extended allow host ip 192.168.2.164 all

access-list 101 extended allow host ip 192.168.2.171 all

access-list 101 extended allow host ip 192.168.2.142 all

access-list 101 extended allow host ip 192.168.2.180 all

access-list 101 extended allow host ip 192.168.2.149 all

access-list 101 extended allow host ip 192.168.2.201 all

access-list 101 extended allow host ip 192.168.2.170 all

access-list 101 extended allow host ip 192.168.2.168 all

access-list 101 extended allow host ip 192.168.2.103 everything

access-list 101 extended allow host ip 192.168.2.34 all

access-list 101 extended allow host ip 192.168.2.174 all

access-list 101 extended allow host ip 192.168.2.199 all

access-list 101 extended allow host ip 192.168.2.253 everything

access-list 101 extended allow host ip 192.168.2.236 all

access-list 101 extended allow host ip 192.168.2.214 all

access-list 101 extended allow host ip 192.168.2.110 everything

access-list 101 extended allow host ip 192.168.2.127 all

access-list 101 extended allow host ip 192.168.2.178 all

access-list 101 extended allow host ip 192.168.2.21 all

access-list 101 extended allow host ip 192.168.2.24 all

access-list 101 extended allow host ip 192.168.2.251 all

access-list 101 extended allow host ip 192.168.2.33 all

access-list 101 extended allow host ip 192.168.2.120 all

access-list 101 extended allow host ip 192.168.2.85 all

access-list 101 extended allow host ip 192.168.2.137 all

access-list 101 extended allow host ip 192.168.2.113 all

access-list 101 extended allow ip 192.168.2.20 host everything

access-list 101 extended allow host ip 192.168.2.101 everything

access-list 101 extended allow host ip 192.168.2.106 all

access-list 101 extended allow host ip 192.168.2.140 all

access-list 101 extended allow host ip 192.168.2.215 all

access-list 101 extended allow host ip 192.168.2.107 all

access-list 101 extended allow host ip 192.168.2.234 all

access-list 101 extended allow host ip 192.168.2.15 all

access-list 101 extended allow host ip 192.168.2.55 all

access-list 101 extended allow host ip 192.168.2.41 all

access-list 101 extended permit ip host 192.168.2.13 all

access-list 101 extended allow host ip 192.168.2.133 everything

access-list 101 extended allow host ip 192.168.2.73 all

access-list 101 extended allow host ip 192.168.2.172 all

access-list 101 extended allow host ip 192.168.2.175 all

access-list 101 extended allow host ip 192.168.2.88 all

access-list 101 extended allow host ip 192.168.2.188 all

access-list 101 extended allow host ip 192.168.2.136 all

access-list 101 extended allow host ip 192.168.2.74 all

access-list 101 extended allow host ip 192.168.2.12 everything

access-list 101 extended allow host ip 192.168.2.100 everything

access-list 101 extended allow host ip of 192.168.2.102 everything

access-list 101 extended allow host ip 192.168.2.152 all

access-list 101 extended allow ip 192.168.2.4 host everything

access-list 101 extended allow host ip 192.168.2.5 everything

access-list 101 extended allow host ip 192.168.2.6 everything

access-list 101 extended allow host ip 192.168.2.14 all

access-list 101 extended allow host ip 192.168.2.19 all

access-list 101 extended permit ip host 192.168.2.16 all

access-list 101 extended allow host ip 192.168.2.17 all

access-list 101 extended allow host ip 192.168.2.18 all

access-list 101 extended allow host ip 192.168.2.22 all

access-list 101 extended allow host ip 192.168.2.23 all

access-list 101 extended allow host ip 192.168.2.115 all

access-list 101 extended allow host ip 192.168.2.116 all

access-list 101 extended allow host ip 192.168.2.117 all

access-list 101 extended allow host ip 192.168.2.118 all

access-list 101 extended allow host ip 192.168.2.119 all

access-list 101 extended allow host ip 192.168.2.150 all

access-list 101 extended allow host ip 192.168.2.128 all

access-list 101 extended deny ip 192.168.2.0 255.255.255.0 any

access-list 101 extended allow ip 192.168.3.2 host everything

access-list 101 extended allow host ip 192.168.3.3 everything

access-list 101 extended permit ip host 192.168.3.4 everything

access-list 101 extended allow host ip 192.168.3.5 all

access-list 101 extended allow host ip 192.168.3.6 all

access-list 101 extended allow host ip 192.168.3.7 all

access-list 101 extended allow host ip 192.168.3.8 all

access-list 101 extended allow host ip 192.168.3.9 all

access-list 101 extended allow host ip 192.168.3.10 everything

access-list 101 extended allow host ip 192.168.3.11 all

access-list 101 extended allow host ip 192.168.3.12 all

access-list 101 extended allow host ip 192.168.3.13 all

access-list 101 extended allow host ip 192.168.3.14 all

access-list 101 extended allow host ip 192.168.3.15 everything

access-list 101 extended allow host ip 192.168.3.16 all

access-list 101 extended allow host ip 192.168.3.17 everything

access-list 101 extended allow host ip 192.168.3.18 all

access-list 101 extended allow host ip 192.168.3.19 all

access-list 101 extended allow host ip 192.168.3.20 everything

access-list 101 extended permit ip host 192.168.3.21 all

access-list 101 extended allow host ip 192.168.3.22 all

access-list 101 extended allow host ip 192.168.3.23 all

access-list 101 extended allow host ip 192.168.3.24 everything

access-list 101 extended allow host ip 192.168.3.25 all

access-list 101 extended allow host ip 192.168.3.26 all

access-list 101 extended allow host ip 192.168.3.27 all

access-list 101 extended allow host ip 192.168.3.28 all

access-list 101 extended allow host ip 192.168.3.29 all

access-list 101 extended allow host ip 192.168.3.30 all

access-list 101 extended allow host ip 192.168.3.31 all

access-list 101 extended allow host ip 192.168.3.32 all

access-list 101 extended allow host ip 192.168.3.33 all

access-list 101 extended allow host ip 192.168.3.34 all

access-list 101 extended allow host ip 192.168.3.35 all

access-list 101 extended allow host ip 192.168.3.36 all

access-list 101 extended allow host ip 192.168.3.37 all

access-list 101 extended allow host ip 192.168.3.38 all

access-list 101 extended allow host ip 192.168.3.39 all

access-list 101 extended allow host ip 192.168.3.40 all

access-list 101 extended allow host ip 192.168.3.41 all

access-list 101 extended allow host ip 192.168.3.42 all

access-list 101 extended allow host ip 192.168.3.43 all

access-list 101 extended allow host ip 192.168.3.86 all

access-list 101 extended allow host ip 192.168.3.88 all

access-list 101 extended allow host ip 192.168.3.89 all

access-list 101 extended allow host ip 192.168.3.56 all

access-list 101 extended allow host ip 192.168.3.55 all

access-list 101 extended allow host ip 192.168.3.96 all

access-list 101 extended allow host ip 192.168.3.97 all

access-list 101 extended allow host ip 192.168.3.98 all

access-list 101 extended allow host ip 192.168.3.116 all

access-list 101 extended allow host ip 192.168.3.111 all

access-list 101 extended allow host ip 192.168.3.175 all

access-list 101 extended allow host ip 192.168.3.176 all

access-list 101 extended allow host ip 192.168.3.201 all

access-list 101 extended allow host ip 192.168.3.202 all

access-list 101 extended allow host ip 192.168.3.203 all

access-list 101 extended allow host ip 192.168.3.204 all

access-list 101 extended allow host ip 192.168.3.205 all

access-list 101 extended allow host ip 192.168.3.206 all

access-list 101 extended allow host ip 192.168.3.207 all

access-list 101 extended allow host ip 192.168.3.208 all

access-list 101 extended allow host ip 192.168.3.209 all

access-list 101 extended allow host ip 192.168.3.210 all

access-list 101 extended allow host ip 192.168.3.213 all

access-list 101 extended allow host ip 192.168.3.214 all

access-list 101 extended allow host ip 192.168.3.215 all

access-list 101 extended allow host ip 192.168.3.101 all

access-list 101 extended allow host ip 192.168.3.102 all

access-list 101 extended allow host ip 192.168.3.103 all

access-list 101 extended allow host ip 192.168.3.106 all

access-list 101 extended allow host ip 192.168.3.107 all

access-list 101 extended allow host ip 192.168.3.152 all

access-list 101 extended allow host ip 192.168.3.151 all

access-list 101 extended allow host ip 192.168.3.153 all

access-list 101 extended allow host ip 192.168.3.195 all

access-list 101 extended allow host ip 192.168.3.45 all

access-list 101 extended allow host ip 192.168.3.46 all

access-list 101 extended allow host ip 192.168.3.199 all

access-list 101 extended allow host ip 192.168.3.157 all

access-list 101 extended refuse 192.168.3.0 ip 255.255.255.0 any

access-list 101 extended allow tcp a whole

access list 101 scope ip allow a whole

vpnclient_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0

2 extended access-list permit ip 192.168.2.0 255.255.255.0 any

3 extended access-list allow ip 192.168.3.0 255.255.255.0 any

4 extended access-list allow ip 192.168.4.0 255.255.255.0 any

access-list extended 500 k permit ip host XXX1 everything

access-list extended 500 k allow icmp host XXX1 everything

access-list 102 extended allow host ip 192.168.1.6 everything

access-list extended 100 permit tcp any host 192.168.1.1 eq www

access-list extended 100 permit tcp any host 192.168.1.1 eq 8080

access-list extended 100 permit tcp any host X.X.X.4

access-list extended 100 permit ip any host X.X.X.4

access-list extended 100 permit icmp any host X.X.X.4

access-list extended 100 permit tcp any host 192.168.1.6 eq smtp

access-list extended 100 permit tcp any host 192.168.1.6 eq pop3

access-list extended 100 permit tcp any host 192.168.1.6 eq www

access-list extended 100 permit tcp any host 192.168.1.6

access-list 100 scope ip allow any host 192.168.1.6

access-list extended 100 permit icmp any host 192.168.1.6

access-list extended 100 permit tcp any host 192.168.1.19 eq 3389

access-list extended 100 permit tcp any host 192.168.1.20 eq 3389

access-list extended 100 permit tcp any host 192.168.1.88 eq 3389

access-list extended 100 permit tcp any host X.X.X.12

access-list extended 100 permit ip any host X.X.X.12

access-list extended 100 permit icmp any host X.X.X.12

access-list extended 100 permit tcp any host 192.168.1.6 eq 8086

access-list extended 100 permit tcp any host 192.168.1.1 eq 3389

access-list extended 100 permit tcp any host 192.168.1.6 eq 3389

access-list extended 100 permit tcp any host 192.168.1.6 eq ftp

access-list extended 100 permit tcp any host 192.168.1.6 eq ftp - data

access-list extended 100 permit tcp any host 192.168.2.88 eq 3389

access-list extended 100 permit tcp any host 192.168.2.88 eq 12172

access-list extended 100 permit tcp any host 192.168.2.2 eq 3389

access-list extended 100 permit tcp any host 192.168.2.2 eq 9116

access-list extended 100 permit tcp any host 192.168.3.2 eq 25243

access-list extended 100 permit tcp any host 192.168.3.2 eq 3389

access-list extended 100 permit tcp any host 192.168.1.200 eq www

access-list extended 100 permit tcp any host 192.168.1.200 eq 12001

access-list extended 100 permit tcp any host 192.168.1.30 eq 3389

access-list extended 100 permit tcp any host 192.168.3.5 eq 4160

access-list extended 100 permit tcp any host 192.168.3.5 eq 11111

access-list extended 100 permit tcp any host 192.168.3.5 eq 3389

access-list extended 100 permit tcp any host X.X.X.10

access-list extended 100 permit udp any host 192.168.2.88 eq 12172

access-list extended 100 permit udp any host 192.168.2.2 eq 9116

access-list extended 100 permit udp any host 192.168.3.2 eq 25243

access-list extended 100 permit udp any host 192.168.3.5 eq 4170

access-list extended 100 permit udp any host 192.168.3.5 eq 11111

access-list extended 100 permit ip any host X.X.X.10

access-list extended 100 permit tcp any host 192.168.1.6 eq 8087

access-list extended 100 permit tcp any host X.X.X.9

access-list extended 100 permit ip any host X.X.X.9

access-list extended 100 permit tcp any host 192.168.1.30 eq www

access-list extended 100 permit tcp any host X.X.X.5

access-list extended 100 permit ip any host X.X.X.5

access-list extended 100 permit icmp a whole

access-list extended 100 permit tcp any host 192.168.1.6 eq 8088

access-list extended 100 permit ip any host X.X.X.6

access-list extended 100 permit tcp any host X.X.X.6

access list extended 100 permit tcp host 61.186.169.129 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 61.186.169.129 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 61.186.169.129 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 61.186.169.129 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 61.186.169.129 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 61.186.169.130 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 61.186.169.130 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 61.186.169.130 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 61.186.169.130 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 61.186.169.130 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 61.186.169.131 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 61.186.169.131 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 61.186.169.131 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 61.186.169.131 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 61.186.169.131 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 61.186.169.132 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 61.186.169.132 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 61.186.169.132 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 61.186.169.132 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 61.186.169.132 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 61.186.169.133 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 61.186.169.133 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 61.186.169.133 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 61.186.169.133 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 61.186.169.133 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 61.186.169.129 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 61.186.169.130 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 61.186.169.131 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 61.186.169.132 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 61.186.169.133 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 61.186.169.129 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 61.186.169.130 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 61.186.169.131 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 61.186.169.132 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 61.186.169.133 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 183.64.106.194 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 183.64.106.194 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 183.64.106.194 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 183.64.106.194 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 183.64.106.194 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 183.64.106.194 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 183.64.106.194 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 183.64.106.195 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 183.64.106.195 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 183.64.106.195 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 183.64.106.195 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 183.64.106.195 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 183.64.106.195 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 183.64.106.195 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 14.107.162.32 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 14.107.162.32 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 14.107.162.32 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 14.107.162.32 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 14.107.162.32 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 14.107.162.32 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 14.107.162.32 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 14.107.247.121 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 14.107.247.121 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 14.107.247.121 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 14.107.247.121 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 14.107.247.121 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 14.107.247.121 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 14.107.247.121 X.X.X.2 time-range k3used

access list extended 100 permit tcp host 61.128.208.106 host 192.168.1.2 eq 5872 times-range k3used

access list extended 100 permit tcp host 61.128.208.106 host 192.168.1.2 eq 8088 times-range k3used

access list extended 100 permit tcp host 61.128.208.106 host 192.168.1.2 eq 3389 times-range k3used

allowed extended access list 100 tcp host 61.128.208.106 host 192.168.1.19 eq www time-range k3used

access-list extended 100 permit tcp host 61.128.208.106 X.X.X.2 time-range k3used

access-list extended 100 permit ip host 61.128.208.106 X.X.X.2 time-range k3used

access-list extended 100 permit icmp host 61.128.208.106 X.X.X.2 time-range k3used

access-list 100 extended tcp refuse any host 192.168.1.2 eq 5872

access-list 100 extended tcp refuse any host 192.168.1.2 eq 8088

access-list 100 extended tcp refuse any host 192.168.1.2 eq 3389

access-list 100 extended tcp refuse any host 192.168.1.19 eq www

access-list 100 extended tcp refuse any host X.X.X.2

access-list extended 100 deny ip any host X.X.X.2

access-list extended 100 refuse icmp any host X.X.X.2

pager lines 24

Outside 1500 MTU

Within 1500 MTU

management of MTU 1500

IP local pool 192.168.200.1 - 192.168.200.20 mask 255.255.255.0 vpn_pool

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

NAT (inside, all) source static obj - obj - 192.168.1.0 destination 192.168.1.0 static obj - 192.168.200.0 obj - 192.168.200.0 non-proxy-arp

NAT (inside, all) source static obj - 192.168.200.0 obj - 192.168.200.0 destination static obj - 192.168.1.0 obj - 192.168.1.0 non-proxy-arp

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.3 service obj-tcp-source-eq-25 obj-tcp-source-eq-25

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.3 service obj-tcp-source-eq-110 obj-tcp-source-eq-110

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.10 service obj-tcp-source-eq-8086 obj-tcp-source-eq-80

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.10 service obj-tcp-source-eq-3389 obj-tcp-source-eq-9877

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.10 service obj-tcp-source-eq-21 obj-tcp-source-eq-21

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.10 service obj-tcp-source-eq-20 obj-tcp-source-eq-20

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.9 service obj-tcp-source-eq-8087 obj-tcp-source-eq-80

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.6 service obj-tcp-source-eq-8088 obj-tcp-source-eq-80

NAT (inside, outside) source static obj - 192.168.1.6 obj - X.X.X.3 service obj-tcp-source-eq-80 obj-tcp-source-eq-80

NAT (inside, outside) source dynamic obj - 192.168.1.6 obj - X.X.X.3

!

network object obj - 192.168.1.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.200.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.1.2

NAT (inside, outside) Static X.X.X.2 5872 5872 tcp service

network object obj - 192.168.1.2 - 01

NAT (inside, outside) Static X.X.X.2 8088 8088 tcp service

network object obj - 192.168.1.19

NAT (inside, outside) Static X.X.X.12 tcp 3389 8001 service

network object obj - 192.168.1.20

NAT (inside, outside) Static X.X.X.12 tcp 3389 8002 service

network object obj - 192.168.1.88

NAT (inside, outside) Static X.X.X.12 tcp 3389 12345 service

network object obj - 192.168.1.1

NAT (inside, outside) Static X.X.X.4 tcp www www service

network object obj - 192.168.1.2 - 02

NAT (inside, outside) Static X.X.X.2 service tcp 3389 8005

network object obj - 192.168.1.1 - 01

NAT (inside, outside) Static X.X.X.10 tcp 3389 9876 service

network object obj - 192.168.2.88

NAT (inside, outside) Static X.X.X.10 tcp 3389 3129 service

network object obj - 192.168.2.88 - 01

NAT (inside, outside) Static X.X.X.10 12172 12172 tcp service

network object obj - 192.168.2.88 - 02

NAT (inside, outside) Static X.X.X.10 service udp 12172 12172

network object obj - 192.168.1.19 - 01

NAT (inside, outside) Static X.X.X.2 service tcp www 8056

network object obj - 192.168.2.2

NAT (inside, outside) Static X.X.X.10 3389 3128 tcp service

network object obj - 192.168.2.2 - 01

NAT (inside, outside) Static X.X.X.10 9116 9116 tcp service

network object obj - 192.168.2.2 - 02

NAT (inside, outside) Static X.X.X.10 service udp 9116 9116

network object obj - 192.168.3.2

NAT (inside, outside) Static X.X.X.10 25243 25243 tcp service

network object obj - 192.168.3.2 - 01

NAT (inside, outside) Static X.X.X.10 service udp 25243 25243

network object obj - 192.168.3.2 - 02

NAT (inside, outside) Static X.X.X.10 tcp 3389 3130 service

network object obj - 192.168.1.200

NAT (inside, outside) Static X.X.X.10 service tcp www 1114

network object obj - 192.168.1.200 - 01

NAT (inside, outside) Static X.X.X.10 12001 12001 tcp service

network object obj - 192.168.1.30

NAT (inside, outside) Static X.X.X.5 tcp www www service

network object obj - 192.168.1.30 - 01

NAT (inside, outside) Static X.X.X.10 tcp 3389 9878 service

network object obj - 192.168.1.1 - 02

NAT (inside, outside) Static X.X.X.4 8080 8080 tcp service

network object obj - 192.168.3.5

NAT (inside, outside) Static X.X.X.10 4160 4160 tcp service

network object obj - 192.168.3.5 - 01

NAT (inside, outside) Static X.X.X.10 service udp 4170 4170

network object obj - 192.168.3.5 - 02

NAT (inside, outside) Static X.X.X.10 11111 11111 tcp service

network object obj - 192.168.3.5 - 03

NAT (inside, outside) Static X.X.X.10 tcp 3389 3127 service

network object obj - 192.168.3.5 - 04

NAT (inside, outside) Static X.X.X.10 11111 11111 udp service

network object obj - 192.168.2.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.3.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.4.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.5.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.6.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.7.0

NAT dynamic interface (indoor, outdoor)

network object obj - 192.168.8.0

NAT dynamic interface (indoor, outdoor)

Access-group 100 in external interface

Access-group 101 in the interface inside

Route outside 0.0.0.0 0.0.0.0 X.X.X.14 1

Route inside 192.168.2.0 255.255.255.0 192.168.1.12 1

Route inside 192.168.3.0 255.255.255.0 192.168.1.12 1

Route inside 192.168.4.0 255.255.255.0 192.168.1.12 1

Route inside 192.168.5.0 255.255.255.0 192.168.1.12 1

Route inside 192.168.6.0 255.255.255.0 192.168.1.12 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

identity of the user by default-domain LOCAL

Enable http server

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

Crypto ipsec transform-set esp - esp-md5-hmac ikev1 vpn_set

Crypto-map dynamic vpn_map 10 set transform-set vpn_set ikev1

Crypto-map dynamic vpn_map 10 the value reverse-road

vpnmap 10 card crypto ipsec-isakmp dynamic vpn_map

vpnmap interface card crypto outside

Crypto ikev1 allow outside

IKEv1 crypto policy 1

preshared authentication

the Encryption

md5 hash

Group 2

life 86400

IKEv1 crypto policy 65535

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet 0.0.0.0 0.0.0.0 inside

Telnet 192.168.1.0 255.255.255.0 inside

Telnet timeout 5

SSH 0.0.0.0 0.0.0.0 outdoors

SSH timeout 30

SSH version 1

Console timeout 0

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

Server NTP 192.43.244.18

internal group vpnclient strategy

vpnclient group policy attributes

value of server DNS 61.128.128.68

Ikev1 VPN-tunnel-Protocol

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list vpnclient_splitTunnelAcl

cisco 3USUcOPFUiMCO4Jk encrypted password username

type tunnel-group vpn_group remote access

tunnel-group vpn_group General-attributes

address vpn_pool pool

Group Policy - by default-vpnclient

vpn_group group of tunnel ipsec-attributes

IKEv1 pre-shared-key *.

!

class-map 500 k

matches the access list 500 k

class-map inspection_default

match default-inspection-traffic

class-map 2

matches the access list 2

PAM-class 3

matches the access list 3

class-map 4

corresponds to the list of access-4

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

Review the ip options

inspect the netbios

inspect the rsh

inspect the rtsp

inspect the skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect the tftp

inspect the sip

inspect xdmcp

Policy-map 500 k

500 k class

Policy-map 2

class 2

class 3

class 4

!

global service-policy global_policy

context of prompt hostname

remote anonymous reporting call invites 2

call-home

Profile of CiscoTAC-1

no active account

http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

email address of destination [email protected] / * /

destination-mode http transport

Subscribe to alert-group diagnosis

Subscribe to alert-group environment

Subscribe to alert-Group 13 monthly periodic inventory

Subscribe to alert-group configuration periodic monthly 13

daily periodic subscribe to alert-group telemetry

Cryptochecksum:ecead54d7c85807eb47c7cdaf7d7e82a

: end

ciscoasa# $

ciscoasa #.

ciscoasa #.

Hello

You have changed the source IP address of the order I suggested?

There is no reason to use the 192.168.1.1 IP address as the source of this command "packet - trace" that the source will NEVER be this IP address, because it is a private IP not routable on the public Internet.

Then you can try with the order I suggested.

entry Packet-trace out tcp 1.1.1.1 12345 61.186.236.4 80

I guess that the above command / test failed because you were using the real server IP address as the IP source for the test.

-Jouni

Clarification of NAT statistics

Similar Questions

Maybe you are looking for