Configuration of the tunnel of split on an ASA

Similar Questions

• Tunnel of Split VPN Setup ASA to force inside the tunnel for single address

  Hi all

  We have an ASA with IPSec VPN facility to addresses Internet of Tunnel from Split.  We have an Internet address that must come from the external interface of the ASA.  I have added this address to the list of split tunnel and confirmed on the client that is the road to the tunnel, but I'm not able to get to this address via the VPN.

  How the ASA to allow this unique Internet address to come via the VPN and route back on the same interface to the Internet and the return traffic to back up in the client VPN tunnel.

  I need to get to the address is 213.92.42.118. Here's the config relavent (let me know if I left anything):

  interface GigabitEthernet0/0
  nameif outside
  IP 1.1.1.1 255.255.255.0
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  name 10.80.177.0 VPN_Pool
  Outbound_Ports tcp service object-group
  port-object eq www
  access-list extended sheep allowed any ip VPN_Pool 255.255.255.0
  access-list extended users allow icmp a whole
  access-list extended users enable a tcp
  access-list extended users allow udp a whole
  users_splitTunnelAcl list standard access allowed 10.0.0.0 255.0.0.0
  standard access list users_splitTunnelAcl allow 192.168.43.0 255.255.255.0
  users_splitTunnelAcl list standard access allowed 192.168.40.0 255.255.255.0
  users_splitTunnelAcl list standard access allowed host 213.92.42.118

  FWOB list extended access permit tcp any any Outbound_Ports object-group

  Global (LUXCVGASA01e) 2 1.1.1.1

  NAT (LUXCVGASA01i) 2 10.0.0.0 255.0.0.0
  NAT 0 access-list sheep (LUXCVGASA01i)

  Any help is appreciated.

  -Jeff

  Hi Jeff,

  Just had a chance to look through the Setup and I guess that configured nat is incorrect.

  access-list extended sheep allowed any ip VPN_Pool 255.255.255.0
  NAT 0 access-list sheep (LUXCVGASA01i)
  NAT (LUXCVGASA01i) 2 10.0.0.0 255.0.0.0

  Global (LUXCVGASA01e) 2 1.1.1.1

  The access-list says sheep that ALL traffic goes to the pool of the VPN to go UN-natted. So, when you try to access the public ip address via the tunnel VPN, the traffic the ASA, ASA then performs a search destination NAT and matches the nat command "nat (LUXCVGASA01i) 0 access-list sheep." If the ASA detects a destination NAT translation, it will bypass route search and uses the destination NAT translation to determine the output interface (in this scenario, the output interface is LUXCVGASA01i.

  So, to resolve this problem, change the acl sheep from "any to VPN_Pool 255.255.255.0" inside"to the network VPN_Pool 255.255.255.0.

  clear xlate and re-initialization of the tunnel, and this should solve the problem.

  Let me know if that answers your query.

  Kind regards

  Manisha masseur

• VPN - Tunnel of Split

  -Start ciscomoderator note - the following message has been changed to remove potentially sensitive information. Please refrain from publishing confidential information about the site to reduce the risk to the security of your network. -end of the note ciscomoderator-

  Hello

  Can someone please help me because my VPN access works fine without the Tunnel from Split. But when I put the Split Tunnel it stops working... Here's the configuration... my PIX is behind a Checkpoint F/W and NAT work on CheckPoint, that's why I wana donot configure NAT on PIX... I really applicate that help you... Thanks in advance :-)

  PIX Version 6.1 (4)

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  nameif ethernet2 security10 intf2

  nameif ethernet3 intf3 security15

  nameif ethernet4 security20 intf4

  ethernet5 intf5 security25 nameif

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 1720

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  access list 101 ip allow a whole

  access-list 120 permit tcp 10.200.125.0 255.255.255.0 host 10.200.124.1 eq www

  access-list 120 permit tcp 10.200.119.0 255.255.255.0 host 10.200.124.1 eq www

  access-list 152 allow ip 10.200.124.0 255.255.255.0 10.200.125.0 255.255.255.0

  access-list 152 allow ip 10.200.125.0 255.255.255.0 10.200.124.0 255.255.255.0

  pager lines 24

  interface ethernet0 car

  Auto interface ethernet1

  Automatic stop of interface ethernet2

  Automatic stop of interface ethernet3

  Automatic stop of interface ethernet4

  Automatic stop of interface ethernet5

  Outside 1500 MTU

  Within 1500 MTU

  intf2 MTU 1500

  intf3 MTU 1500

  intf4 MTU 1500

  intf5 MTU 1500

  external IP 10.200.123.253 255.255.255.0

  IP address inside 10.200.124.254 255.255.255.0

  intf2 IP address 127.0.0.1 255.255.255.255

  intf3 IP address 127.0.0.1 255.255.255.255

  intf4 IP address 127.0.0.1 255.255.255.255

  intf5 IP address 127.0.0.1 255.255.255.255

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool ippool 10.200.125.1 - 10.200.125.254

  history of PDM activate

  ARP timeout 14400

  (Inside) NAT 0-list of access 101

  Access-group 120 in external interface

  Route outside 0.0.0.0 0.0.0.0 10.200.123.254 1

  Timeout xlate 03:00

  Timeout conn 0 half-closed 01:00:10: 00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 TR

  p 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  RADIUS protocol AAA-server AuthInbound

  AAA-server AuthInbound (inside) host 10.200.124.1 xxxxxxxxxxxxx timeout 10

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  map mymap 10-isakmp ipsec crypto dynamic dynmap

  client configuration address map mymap crypto initiate

  client configuration address map mymap crypto answer

  client authentication card crypto mymap AuthInbound

  mymap outside crypto map interface

  ISAKMP allows outside

  ISAKMP identity address

  ISAKMP client configuration address pool local ippool outside

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 3des encryption

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup address ippool pool test

  vpngroup split tunnel 152 test

  vpngroup test 1800 idle time

  vpngroup password xxxxxxxxxxxxxxxxxxxx test

  vpngroup idle time 1800 group

  Telnet timeout 5

  SSH timeout 5

  Terminal width 80

  Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

  for this ACL

  access-list 152 allow ip 10.200.124.0 255.255.255.0 10.200.125.0 255.255.255.0

  access-list 152 allow ip 10.200.125.0 255.255.255.0 10.200.124.0 255.255.255.0

  to take

  access-list 152 allow ip 10.200.124.0 255.255.254.0 everything

  split tunnel uses the part 'source' from the ACL to see what the networks are internal to the pix... then everything else, the customer will be able to divide tunnel...

  Chris

• Cannot SSH in ASA after EZVPN configuration and do not specify "split-tunnel-political tunnelspecified.

  Even after the "split-tunnel-policy tunnelspecified" specification with "split-tunnel-network-list value TUNNEL of SPLITTING" and denying all traffic to the public IP address of the ASA, I'm still not able to SSH in the firewall. Everything else seems to work OK, but I have to be able to handle the ASA from the public interface. In fact, I expect little given the mean one sa is the installer for the tunnel, and it would seem that a deny statement would be ignored, but perhaps there is a way around this. Thank you.

  If you want to connect to your home IP through the tunnel, you must specify 'inside access management:

  http://www.Cisco.com/en/us/docs/security/ASA/asa82/configuration/guide/a...

  Best regards, Karsten

  Sent by Cisco Support technique iPad App

• Site VPN to IPsec with PAT through the tunnel configuration example

  Hello

  as I read a lot about vpn connections site-2-site
  and pass by PAT through it I still haven't found an example configuration for it on e ASA 55xx.

  now, I got suite facility with two locations A and B.

  192.168.0.0/24 Site has - ipsec - Site B 192.168.200.0/24
  172.16.16.0/24 Site has

  ---------------------------------------------------------------------------

  Host--> participated in IP 192.168.0.4: 192.168.0.3-> to 192.168.200.20
  Host 192.168.0.127--> participated in IP: 192.168.0.3-> to 192.168.200.20
  Host 192.168.0.129--> participated in IP: 192.168.0.3-> to 192.168.200.20
  Host 192.168.0.253--> participated in IP: 192.168.0.3-> to 192.168.200.20

  Host 172.16.16.127--> participated in IP: 192.168.0.3-> to 192.168.200.20
  Host 172.16.16.253--> participated in IP: 192.168.0.3-> to 192.168.200.20

  ---------------------------------------------------------------------------

  Now that I have guests autour within networks 172.16.16.0 like 192.168.0.0,
  witch need to access a server terminal server on the SITE b.

  As I have no influence on where and when guests pop up in my Site.
  I would like to hide them behind a single ip address to SITE B.

  If in the event that a new hosts need access, or old hosts can be deleted,
  its as simple as the ACL or conviniently inlet remove the object from the network.

  so I guess that the acl looks like this:

  ---------------------------------------------------------------------------

  access VPN-PARTICIPATED-HOSTS list allow ip 192.168.0.4 host 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 192.168.0.127 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 192.168.0.129 192.168.200.20
  access VPN-PARTICIPATED-HOSTS list allow ip 192.168.0.253 host 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 172.16.16.127 192.168.200.20
  VPN-PARTICIPATED-HOSTS access list permit ip host 172.16.16.253 192.168.200.20

  ---------------------------------------------------------------------------

  But, now, my big question is, how do I said the asa to use: 192.168.0.3 as the
  address for the translation of PAT?

  something like this he will say, it must be treated according to the policy:

  NAT (1-access VPN INVOLVED-HOST internal list)

  Now how do I do that?
  The rest of the config, I guess that will be quite normal as follows:

  card crypto outside_map 1 match address outside_1_cryptomap
  card crypto outside_map 1 set of AA peers. ABM CC. DD
  card crypto outside_map 1 set of transformation-ESP-AES-256-SHA
  outside_map card crypto 1 lifetime of security set association, 3600 seconds

  permit access list extended ip 192.168.0.3 outside_1_cryptomap host 192.168.200.20

  ---------------------------------------------------------------------------

  On SITE B

  the config is pretty simple:

  card crypto outside_map 1 match address outside_1_cryptomap
  card crypto outside_map 1 set of peer SITE has IP
  card crypto outside_map 1 set of transformation-ESP-AES-256-SHA
  outside_map card crypto 1 lifetime of security set association, 3600 seconds

  outside_1_cryptomap list extended access allowed host host 192.168.200.20 IP 192.168.0.3

  inside_nat0_outbound list extended access allowed host host 192.168.200.20 IP 192.168.0.3

  ---------------------------------------------------------------------------

  Thank you for you're extra eyes and precious time!

  Colin

  You want to PAT the traffic that goes through the tunnel?

  list of access allowed PAT ip 192.168.0.0 255.255.255.0 192.168.200.0 255.255.255.0

  PAT 172.16.16.0 permit ip access list 255.255.255.0 192.168.200.0 255.255.255.0

  NAT (inside) 1 access list PAT

  Global (outside) 1 192.168.0.3 255.255.255.255

  Then, the VPN ACL applied to the card encryption:

  list of access allowed vpn host ip 192.168.0.3 192.168.200.0 255.255.255.0

  Thus, all traffic from Site A will be PATed when you remotely 192.168.200.0/24

  The interesting thing is that traffic can only be activated from your end.

  The remote end cannot initialize traffic to 192.168.0.3 if there is not a version of dynamic translation on your side.

  Is that what you are looking for?

  Federico.

• Tunnel of splitting with the keyword «exclude...» »

  Client (remote site) = cloud = ASA (HQ) Internet

  Objective, Clinet visit some (blocked on the remote FW) website on the internet through HQ ASA, all other web sites through the

  directly at a distance.

  what I want is to divide the tunnel. and I prefer to use "excluding" an ACL. I have it set to the ASDM. It seems that it does not work. all traffic are always being in the tunnel at the ASA and slitted.

  Also, should I check "Allow Local LAN access" on the Transport tab on the client side?

  newgroup group policy attributes

  value of server DNS X.X.X.X

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy excludespecified

  value of Split-tunnel-network-list ExcludedIP

  Split-dns no

  !!!! some entries in the ACL

  ...

  ExcludedIP standard access list permit 48.14.0.0 255.254.0.0

  Standard access list ExcludedIP allow 48.16.0.0 255.255.0.0

  ....

  When network trace the 48.14.0.0.0 client user, he went to the ASA first...

  Any idea?

  Thank you

  Han

  HI Han,.

  I'm sorry for any delay.

  I duplicated it and that's what you can expect:

  type RA tunnel-group remote access

  tunnel-group RA-global attributes

  address VPN_POOL pool

  Group Policy - by default-RA

  tunnel-group ipsec-attributes

  IKEv1 pre-shared-key *.

  !

  Group RA internal policy

  attributes of RA-group policy

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy excludespecified

  value of Split-tunnel-network-list RA_EXCLUDE

  !

  RA_EXCLUDE list standard access allowed host 4.2.2.2

  RA_EXCLUDE list standard access allowed host 0.0.0.0

  Standard access list RA_EXCLUDE allow 10.198.12.0 255.255.255.0

  Standard access list RA_EXCLUDE allow 10.198.16.0 255.255.255.0

  

  

  Now, I have tested with the latest VPN client available on CCO running on a Windows 7 x 86 computer.

  You don't encounter any problems.

  As agreed before, please test from another machine and let me know.

  Thank you.

  Portu.

  Please note all useful posts

• ASA 5505 VPN works great but can't access internet via the tunnel to customers

  We have an ASA 5505 ASA 8.2.1 running and using IPSec for Remote access clients in the main office.  Remote access is a lot of work, with full access to network resources in the main office and the only thing I can't get to work is access to internet through the tunnel.  I don't want to use split tunneling.  I use ASDM 6.2.1 for configuration.  Any help is appreciated.  I'm probably missing something simple and it looked so much, I'm probably looking at right beyond the error.  Thanks in advance for your time and help!    Jim

  Add a statement of nat for your segment of customer on the external interface

  NAT (outside) - access list

  then allow traffic routing back on the same interface, it is entered in the

  permit same-security-traffic intra-interface

  *

  *

  * more than information can be found here:

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807...

  On Wednesday, 27 January 2010, at 23:12, jimcanova

• divide the tunnel pptp vpn router 7200

  I have cisco 7200 running Cisco IOS Software, software 7200 (C7200-ADVENTERPRISEK9-M), Version 12.4 (24) T2, VERSION of the SOFTWARE (fc2). I want that connects to the pptp VPN in order to access the internet at the same time. I think that this can be achieved by implementing split VPN tunnel. However I can't understand how to implement this on my 7200. All the documentation I found only tell how to do it on a cisco ASA. I've been watching this article to help me to http://www.cisco.com/en/US/tech/tk59/technologies_configuration_example09186a00800a393b.shtml#con4VPN clients will assign an ip address in the range of 172.16.10.0/24 to access the network remote fo 17.16.0.0/24Looking to the article posted above, I created the list 102 permit ip 172.16.0.0 ACLaccess 0.0.0.255 172.16.10.0 is 0.0.0.255What I can not understand how to apply this to my activation of VPDN PPTP groupvpdn
  !
  VPDN-Group 1
  !  PPTP by default VPDN group
  accept-dialin
  Pptp Protocol
  virtual-model 1
  ! interface virtual-Template1
  IP unnumbered GigabitEthernet0/2
  peer default ip address pool-pptp pool
  PPP encryption mppe auto
  PPP ms-chap for authentication ms-chap-v2
  ! access-list 102 permit ip 172.16.0.0 0.0.0.255 172.16.10.0 0.0.0.255
  Local IP pool pptp 172.16.10.1 172.16.10.254Any help is appreciatedThanks

  Split PPTP tunnel must be configured on the client. Unlike the IPSec tunnel split which is performed on the head end, split PPTP tunnel is configured on the client itself.

  Here is the configuration guide for document Q & A (last question):

  http://www.Cisco.com/en/us/Partner/Tech/tk827/tk369/technologies_q_and_a_item09186a00800946ef.shtml

  Here is an article from Microsoft that takes in charge who:

  http://TechNet.Microsoft.com/en-us/library/cc779919%28WS.10%29.aspx#w2k3tr_vpn_how_dkma

  Hope that helps.

• Tunnel work Split... but only for a single IP address.

  Hi all

  Dealing with a really frustrating problem. Our facility, roughly speaking, is as follows:

  -We have a remote VPN access that users connect to any Connect; in turn, they receive a local LAN address: 10.1.11.192 - 10.1.11.200

  -We have a VPN site-to site that connects to Amazon AWS Access 10.0.249.0 and other subnets and now some hosts on the Amazon * public * network (for example, 54.1.2.3). This is done via a tunnel from split.

  What we see is the following:

  -Users to connect to the VPN and are assigned to one of the addresses above. We use 10.1.11.192 for this example.

  -They can then access anything in the 10.0.249.0 subnet (by the split tunnel) very well. It goes through two ASA devices.

  -They can then access anything in the public network from Amazon (by the split tunnel) very well. This should use Remoting ASA.

  So, it seemed that everything was working. When connected to the VPN, Amazon hosts in 10.x.x.x networks and public IPs I had precisely in tunnel (we plan make the transition to a VPC soon) were accessible, and access came through the VPN IP remote access (IE, when connecting to 54.1.2.3, it showed the user being logged from the address of the gateway from the Cisco IP (, as opposed to the local client IP).

  Now, here's where things are weird: * public * hosts on Amazon in tunnel only works with the first address in the pool, 10.1.11.192. No other addresses don't work. 10.0.249.x is always available, regardless of the assigned IP. 54.x.y.z is only available avec.192.

  I used the same computer with different assigned IPs (10.1.11.193 - 10.1.11.200), and none work. I connected using different computers... they work si.192, but not no matter what other addresses assigned. Other users report the same problem.

  Transfer TCP protocol is a failure

  I'll use our IRC server (and sometimes ssh server) for testing. I can see my laptop the customer with a SYN_SENT on this specific topic. I can see the IRC with a SYN_RECV and shows Server ASA a SYN timeout after 30 seconds. So, it seems that the IRC server packages cannot make their way through the ASA for my laptop the customer.

  I suspect it has something to do with the dynamic static vs NAT, etc, but I've fiddled with every setting I can and come in white.

  I am also puzzled as to pourquoi.192 works, but no other addresses don't.

  I have attached our configuration, less keys and passwords and addresses IP/hostname. It's a little ugly because there some poor attempts to solve this, things will probably remove once it works, but... It might have something to do with randomization of TCP sequence?

  Thanks in advance for any help.

  Hello

  I also enough to explain everything in detail. Even if sometimes it is just too much for my head when I'm tired

  Have you managed to fix the problem that arised to change settings?

  The output of "package Tracker" for the failed connection would be important.

  But now that I look at your original configurations and consider your need for VPN Clients to access a selection of public IP addresses through the ASA it seems to me that perhaps your problem is lack of NAT configuration for this traffic. (which may indicate the "packet-tracer" )

  You need a dynamic PAT from the 'outside' to 'outside' for users VPN be PATed to the external IP address of ASA

  Something like this for example

  network of the VPN-CLIENT-AMAZON-AWS-PAT object

  10.1.12.0 subnet 255.255.255.0

  dynamic NAT interface (outdoors, outdoor)

  Or if your original pool of VPN is used, change the network above.

  Dynamic provisioning PAT above essentially aims to intercept coming from behind 'external' VPN traffic that goes through the 'outside' interface and the dynamic application of PAT for the public IP address of the ASA. For the moment, that seems to me that address network-10 crosses the ASA without NAT essentially leading to SYN timeout newspapers.

  But if I understand you are saying that one of the pool reached VPN address IP address of public destination that does not really correspond with the situation described above. However, I don't see any NAT/PAT configuration for VPN traffic to the public IP address. Look at your log messages. They mention the same IP VPN address pool twice (the other inside the () ) which means there is no NAT for the source address and the ISP traffic naturally declines.

  -Jouni

• Dynamic L2L Tunnel - the Tunnel is up, will not pass the LAN traffic

  Hello everyone. I am repurposing an ASA for my business at a remote site and must use a dynamic Configuration of L2L with Split tunneling active. We used these in the past and they work a lot, and I've referenced Cisco official documentation for the implementation. Currently, I am having a problem where I am unable to pass traffic on the local remote network over the VPN tunnel (it does even not raise the tunnel of form). However, if I run the following command in the ASA remote:

  Ping inside the 192.168.9.1

  I receive the ICMP responses. In addition, this traffic causes the VPN Tunnel to be created as indicated by show ISA SA:

  1 peer IKE: xx.xx.xx.xx

  Type: L2L role: initiator

  Generate a new key: no State: MM_ACTIVE

  Here is the IP addressing scheme:

  Network remotely (with the ASA problem): 192.168.12.0/24

  Basic network (Hub): 192.168.9.0/24

  Other rays: 192.168.0.0/16

  Config:

  ASA Version 8.2 (1)
  !
  hostname xxxxxxxxx
  domain xxxxxxxxxxx.local
  activate the xxxxxxxx password
  passwd xxxxxxxxx
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  192.168.12.1 IP address 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS server-group DefaultDNS
  domain xxxxxxxx.local
  permit same-security-traffic intra-interface
  to_hq to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  inside_nat0_outbound to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  pager lines 24
  Within 1500 MTU
  Outside 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto outside_map 10 correspondence address to_hq
  crypto outside_map 10 card game CORE peers. ASA. WAN. INTELLECTUAL PROPERTY
  outside_map crypto 10 card value transform-set ESP-3DES-SHA
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd 192.168.9.2 dns 208.67.222.222
  !
  dhcpd address 192.168.12.101 - 192.168.12.131 inside
  rental contract interface 86400 dhcpd inside
  dhcpd xxxxxxxxx.local area inside interface
  dhcpd ip interface 192.168.9.50 option 66 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  tunnel-group basis. ASA. WAN. Type of IP ipsec-l2l
  tunnel-group basis. ASA. WAN. IPSec-attributes of intellectual property
  pre-shared key xxxxxxxxxxxx
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname

  Once the tunnel is in place, LAN to the Remote Site traffic won't pass through the VPN Tunnel any upward. On the side of ASA Core, I was able to Telnet in the ASA distance very well, but could not ping the Remote Access Point.

  Someone at - it a glimpse of my problem?

  Hello

  Add:

  NAT (inside) 0-list of access inside_nat0_outbound

• Need help with the configuration of the Site with crossed on Cisco ASA5510 8.2 IPSec VPN Client (1)

  Need urgent help in the configuration of the Client VPN IPSec Site with crossed on Cisco ASA5510 - 8.2 (1).

  Here is the presentation:

  

  There are two leased lines for Internet access - a route 1.1.1.1 and 2.2.2.2, the latter being the default Standard, old East for backup.

  I was able to configure the Client VPN IPSec Site

  (1) with access to the outside so that the internal network (172.16.0.0/24) behind the asa

  (2) with Split tunnel with simultaneous assess internal LAN and Internet on the outside.

  But I was not able to make the tradiotional model Hairpinng to work in this scenario.

  I followed every possible suggestions made on this subject in many topics of Discussion but still no luck. Can someone help me here please?

  Here is the race-Conf with Normal Client to Site IPSec VPN configured with no access boarding:

  LIMITATION: Cannot boot into any other image ios for unavoidable reasons, must use 8.2 (1)

  race-conf - Site VPN Customer normal work without internet access/split tunnel

  : ASA Version 8.2 (1) ! ciscoasa hostname domain cisco.campus.com enable the encrypted password xxxxxxxxxxxxxx XXXXXXXXXXXXXX encrypted passwd names of ! interface GigabitEthernet0/0 nameif outside internet1 security-level 0 IP 1.1.1.1 255.255.255.240 ! interface GigabitEthernet0/1 nameif outside internet2 security-level 0 IP address 2.2.2.2 255.255.255.224 ! interface GigabitEthernet0/2 nameif dmz interface security-level 0 IP 10.0.1.1 255.255.255.0 ! interface GigabitEthernet0/3 nameif campus-lan security-level 0 IP 172.16.0.1 255.255.0.0 ! interface Management0/0 nameif CSC-MGMT security-level 100 the IP 10.0.0.4 address 255.255.255.0 ! boot system Disk0: / asa821 - k8.bin boot system Disk0: / asa843 - k8.bin passive FTP mode DNS server-group DefaultDNS domain cisco.campus.com permit same-security-traffic inter-interface permit same-security-traffic intra-interface object-group network cmps-lan the object-group CSC - ip network object-group network www-Interior object-group network www-outside object-group service tcp-80 object-group service udp-53 object-group service https object-group service pop3 object-group service smtp object-group service tcp80 object-group service http-s object-group service pop3-110 object-group service smtp25 object-group service udp53 object-group service ssh object-group service tcp-port port udp-object-group service object-group service ftp object-group service ftp - data object-group network csc1-ip object-group service all-tcp-udp access list INTERNET1-IN extended permit ip host 1.2.2.2 2.2.2.3 access-list extended SCC-OUT permit ip host 10.0.0.5 everything list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq www list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any https eq list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq ssh list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 no matter what eq ftp list of access CAMPUS-LAN extended permitted udp 172.16.0.0 255.255.0.0 no matter what eq field list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq smtp list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq pop3 access CAMPUS-wide LAN ip allowed list a whole access-list CSC - acl note scan web and mail traffic access-list CSC - acl extended permit tcp any any eq smtp access-list CSC - acl extended permit tcp any any eq pop3 access-list CSC - acl note scan web and mail traffic access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 993 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq imap4 access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 465

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq www

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq https

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq smtp

  access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq pop3

  access-list extended INTERNET2-IN permit ip any host 1.1.1.2

  access-list sheep extended ip 172.16.0.0 allow 255.255.0.0 172.16.0.0 255.255.0.0

  access list DNS-inspect extended permit tcp any any eq field

  access list DNS-inspect extended permit udp any any eq field

  access-list extended capin permit ip host 172.16.1.234 all

  access-list extended capin permit ip host 172.16.1.52 all

  access-list extended capin permit ip any host 172.16.1.52

  Capin list extended access permit ip host 172.16.0.82 172.16.0.61

  Capin list extended access permit ip host 172.16.0.61 172.16.0.82

  access-list extended capout permit ip host 2.2.2.2 everything

  access-list extended capout permit ip any host 2.2.2.2

  Access campus-lan_nat0_outbound extended ip 172.16.0.0 list allow 255.255.0.0 192.168.150.0 255.255.255.0

  pager lines 24

  Enable logging

  debug logging in buffered memory

  asdm of logging of information

  Internet1-outside of MTU 1500

  Internet2-outside of MTU 1500

  interface-dmz MTU 1500

  Campus-lan of MTU 1500

  MTU 1500 CSC-MGMT

  IP local pool 192.168.150.2 - 192.168.150.250 mask 255.255.255.0 vpnpool1

  IP check path reverse interface internet2-outside

  IP check path reverse interface interface-dmz

  IP check path opposite campus-lan interface

  IP check path reverse interface CSC-MGMT

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 621.bin

  don't allow no asdm history

  ARP timeout 14400

  interface of global (internet1-outside) 1

  interface of global (internet2-outside) 1

  NAT (campus-lan) 0-campus-lan_nat0_outbound access list

  NAT (campus-lan) 1 0.0.0.0 0.0.0.0

  NAT (CSC-MGMT) 1 10.0.0.5 255.255.255.255

  static (CSC-MGMT, internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255

  Access-group INTERNET2-IN interface internet1-outside

  group-access INTERNET1-IN interface internet2-outside

  group-access CAMPUS-LAN in campus-lan interface

  CSC-OUT access-group in SCC-MGMT interface

  Internet2-outside route 0.0.0.0 0.0.0.0 2.2.2.5 1

  Route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  AAA authentication enable LOCAL console

  Enable http server

  http 10.0.0.2 255.255.255.255 CSC-MGMT

  http 10.0.0.8 255.255.255.255 CSC-MGMT

  HTTP 1.2.2.2 255.255.255.255 internet2-outside

  HTTP 1.2.2.2 255.255.255.255 internet1-outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs set group5

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  Crypto map internet2-outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  crypto internet2-outside_map outside internet2 network interface card

  Crypto ca trustpoint _SmartCallHome_ServerCA

  Configure CRL

  Crypto ca certificate chain _SmartCallHome_ServerCA

  certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

  a67a897as a67a897as a67a897as a67a897as a67a897as

  quit smoking

  ISAKMP crypto enable internet2-outside

  crypto ISAKMP policy 10

  preshared authentication

  aes encryption

  md5 hash

  Group 2

  life 86400

  Telnet 10.0.0.2 255.255.255.255 CSC-MGMT

  Telnet 10.0.0.8 255.255.255.255 CSC-MGMT

  Telnet timeout 5

  SSH 1.2.3.3 255.255.255.240 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet1-outside

  SSH 1.2.2.2 255.255.255.255 internet2-outside

  SSH timeout 5

  Console timeout 0

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal VPN_TG_1 group policy

  VPN_TG_1 group policy attributes

  Protocol-tunnel-VPN IPSec

  username ssochelpdesk encrypted password privilege 15 xxxxxxxxxxxxxx

  privilege of encrypted password username administrator 15 xxxxxxxxxxxxxx

  username vpnuser1 encrypted password privilege 0 xxxxxxxxxxxxxx

  username vpnuser1 attributes

  VPN-group-policy VPN_TG_1

  type tunnel-group VPN_TG_1 remote access

  attributes global-tunnel-group VPN_TG_1

  address vpnpool1 pool

  Group Policy - by default-VPN_TG_1

  IPSec-attributes tunnel-group VPN_TG_1

  pre-shared-key *.

  !

  class-map cmap-DNS

  matches the access list DNS-inspect

  CCS-class class-map

  corresponds to the CSC - acl access list

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  CCS category

  CSC help

  cmap-DNS class

  inspect the preset_dns_map dns

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y

  : end

  Adding dynamic NAT for 192.168.150.0/24 on the external interface works, or works the sysopt connection permit VPN

  Please tell what to do here, to pin all of the traffic Internet from VPN Clients.

  That is, that I need clients connected via VPN tunnel, when connected to the internet, should have their addresses IP NAT'ted against the address of outside internet2 network 2.2.2.2 interface, as it happens for the customers of Campus (172.16.0.0/16)

  I am well aware of all involved in here, so please be elaborative in your answers. Please let me know if you need more information about this configuration to respond to my request.

  Thank you & best regards

  MAXS

  
  

  Hello

  If possible, I'd like to see that a TCP connection attempt (e.g. http://www.google.com) in the ASDM logging of the VPN Client when you set up the dynamic NAT for the VPN Pool also.

  I'll try also the command "packet - trace" on the SAA, while the VPN Client is connected to the ASA.

  The command format is

  packet-tracer intput tcp

  That should tell what the SAA for this kind of package entering its "input" interface

  Still can not see something wrong with the configuration (other than the statement of "nat" missing Dynamics PAT)

  -Jouni

• Tunnel of splitting, essentials, and vpn-sessiondb

  Hello

  I'm looking to clarify a few things related to anyconnect vpn.  Here is my setup, I have a portal page custom that users log in which authenticates with RADIUS.  Anyconnect then automatically downloads to the client. Apart from that I use all the features of the portal (clientless SSL was previously used, but not more).  I am preparing a device that will serve as a cold spare and because I no longer need without client I prefer to put everything just licensed Essentials on this, I'll try to find confirmation on a number of things and have not found anything definitive.  Here are the questions:

  1. I can tunnel of splitting with essentials license?  The documentation all said "complete tunnel" is the same as the tunnel of all?

  2. in the execution of a "show vpn-sessiondb svc" the session is shown as a SSL without client, it is ASA 8.2, I lab tested to confirm the default group policy is configured to only allows svc webvpn not as Protocol "vpn-tunnel-Protocol svc", which is the policy applied to the session.  Is this some sort of error 8.2 display?

  3. because I only use the portal for authentication and then page by downloading the client anyconnect this should always work with most of what I read, correct?

  Thanks for taking a peek.

  1. you can probably split tunnel. "full-tunnel" here means "not without customer", everything works exactly as with ordinary vpn cisco client.

  2 al ' 8.4 it shows this:

  Protocol: AnyConnect-Parent-Tunnel SSL

  3. it will work for authentication and the client download, but nothing more.

• allow icmpv6 in ipv4-access list in the tunnel

  Hello

  I have a little problem with an access list ipv4 blocking my ipv6 tunnel.

  My tunnel works and is as follows:

  interface Tunnel0

  no ip address

  IPv6 address

  enable IPv6

  source of tunnel

  ipv6ip tunnel mode

  tunnel destination

  So when I apply the below, access list to the WAN interface on the sense IN, IPV6 stops working (everything works on IPV4 when the access list is applied). I mean, I cannot ping ipv6.google.com or ipv6.google.coms IP. I can still ping the IP ipv6 remote tunnel ().

  Access list that I apply is the following:

  allow tcp any a Workbench

  allowed UDP any eq field all

  allowed any EQ 67 udp no matter what eq 68

  allowed UDP any eq 123 everything

  allowed UDP any eq 3740 everything

  allowed UDP any eq 41 everything

  allowed UDP any eq 5072 everything

  allow icmp a whole

  deny ip any any newspaper

  Here are the requirements to the supplier of tunnel, and one of the entries is ICMPv6. Is it possible to allow icmp v6 on a Cisco access list?

  TCP 3874	TIC.sixxs.net	IPv4	ICT (Information Tunnel & Control Protocol)	Used to retrieve the information of tunnel (for instance AICCU)	Uses the TCP protocol and should work without problems
  UDP 3740	PoP	IPv4	Heartbeat Protocol	Used for signalling where is the endpoint current IPv4 of the tunnel and he's alive	the user only to pop out
  Protocol 41	PoP	IPv4	IPv6 over IPv4 (6 in 4 tunnel)	Used for tunneling IPv6 over IPv4 (static tunnels + heartbeat)	We have to appoint the internal host as the DMZ host that leaves usually passes the NAT
  UDP 5072	PoP	IPv4	AYIYA (anything in anything)	Used for tunneling IPv6 over IPv4 (AYIYA tunnels)	Must cross most NAT and even firewalls without any problem
  ICMPv6 echo response.	Tunnel endpoints	IPv6	Internet Control Message Protocol for IPv6	Used to test if a tunnel is alive in scathing tunnel endpoint (tunnel: 2) on the side PoP of the tunnel (tunnel: 1) on the tunnel	No, because it is happening inside the tunnel

  I missed something?

  sidequestion: I added the "deny ip any any newspaper" in the access list, but it adds no registration entry in the log (show log). I'm sure it hits because when I run "display lists access": 110 deny ip any any newspaper (2210 matches).

  Hope someone can help me.

  Hello

  In the ACL above you are atleast specifying source and destination UDP and 41 SOURCE ports

  If you specify IPv6 over an IPv4 ACL I guess that the format would be to "allow 41 a whole" for example.

  Although I have barely touched IPv6 myself yet. Wouldn't it be possible to configure ACL Ipv4 and IPv6 ACL and attach them to the same interface?

  But looking at my own router it does not support these commands so that other devices to make. Maybe something related model/software I guess.

  -Jouni

• The configuration of the coast DMVPN speaks with higher bandwidth for traffic shaping

  Dear all,

  We have the unusual situation that on our sites talking DMVPN has a higher bandwidth (33 Mbps) that our

  DMVPN Hub Site.

  Therefore, we must apply to 10 Mbps on the interface of tunnel on the radius of traffic shaping.

  The following link describes only how to make an application in the form at the end of the hub, but not on the site of end spoke:

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_per_tunnel_qos.PDF

  How to proceed with this on the router spoke?

  Creating a service policy and applying then to the tunnel interface will do the job? Put in shape will be before or after encrypting the traffic?

  And then we would need to increase the buffer size of 1024 to something more replay window?

  The following example would work? We would apply the outbound policy to the Tunnel interface:

  class-map match-any CLASS_ANY

   match any 

  policy-map POLICY_SHAPE10MEG

   class CLASS_ANY

    shape average 10000000

  
  
  interface Tunnel 0
  
  service-policy output POLICY_SHAPE10MEG
  
  

  Thanks for your help,

  Thorsten

  I see on the hub strategy is applied successfully on the tunnel. The political POL_SHAPE10MEG is applied on the tunnel you wanted, this way the rays won't be able to consume even if the bandwidth of the hub it has higher bandwidth.

• Cisco 1921 - how to configure VPN multiple Tunnels to AWS

  I have a router VPN Cisco 1921. I managed to create tunnel VPN Site to Site with AWS VPN Tunnel 1. AWS offers 2 tunnels, so I created another card Crypto and attaches to the existing policy. But the 2nd tunnel won't come. I don't know what I'm missing... is there a special setup that needs to be done to allow multiple IPsec vpn tunnels on the same physical interface? I have attached a picture and included the configuration of my router, if it helps.

  VPN - 1.jpg

  

  C1921 #sh run
  Building configuration...

  Current configuration: 2720 bytes
  !
  ! Last configuration change at 02:12:54 UTC Friday, may 6, 2016, by admin
  !
  version 15.5
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  encryption password service
  !
  hostname C1921
  !
  boot-start-marker
  boot-end-marker
  !
  !
  logging buffered 52000
  enable secret 5 $1$ jc6L$ uHH55qNhplouO/N5793oW.
  !
  No aaa new-model
  Ethernet lmi this
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  Research of IP source-interface GigabitEthernet0/1 domain
  IP cef
  No ipv6 cef
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  license udi pid CISCO1921/K9 sn FTX1845F03F
  !
  !
  username admin privilege 15 password 7 121A0C041104
  paul privilege 0 7 password username 14141B180F0B
  !
  redundancy
  !
  !
  !
  !
  !
  !
  !
  crypto ISAKMP policy 10
  BA aes
  preshared authentication
  Group 2
  lifetime 28800
  ISAKMP crypto keys secret1 address 52.35.42.787
  ISAKMP crypto keys secret2 address 52.36.15.787
  !
  !
  Crypto ipsec transform-set AWS - VPN aes - esp esp-sha-hmac
  tunnel mode
  !
  !
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel 1 to 52.35.42.787
  defined by peer 52.35.42.787
  game of transformation-AWS-VPN
  PFS group2 Set
  match address 100
  map SDM_CMAP_1 2 ipsec-isakmp crypto
  Description 2 to 52.36.15.787 Tunnel
  defined by peer 52.36.15.787
  game of transformation-AWS-VPN
  PFS group2 Set
  match address 100
  !
  !
  !
  !
  !
  the Embedded-Service-Engine0/0 interface
  no ip address
  Shutdown
  !
  interface GigabitEthernet0/0
  Description connection Wan WAN - ETH$
  IP address 192.168.1.252 255.255.255.0
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto
  !
  interface GigabitEthernet0/1
  Description of the connection to the local network
  IP 192.168.0.252 255.255.255.0
  automatic duplex
  automatic speed
  !
  IP forward-Protocol ND
  !
  IP http server
  local IP http authentication
  no ip http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  IP route 0.0.0.0 0.0.0.0 192.168.1.254 permanent

  !
  recording of debug trap
  host 192.168.0.3 record
  host 192.168.0.47 record
  !
  !
  Note access-list 100 permit to AWS Tunnel 1
  Access-list 100 CCP_ACL category = 20 note
  access-list 100 permit ip 192.168.0.0 0.0.0.255 any what newspaper
  Note access-list 101 permit to AWS Tunnel 2
  Note access-list 101 category CCP_ACL = 4
  access-list 101 permit ip 192.168.0.0 0.0.0.255 any logexit
  !
  control plan
  !
  !
  alias con exec conf t
  SIB exec show int short ip alias
  alias exec srb see the race | b
  sri alias exec show run int
  !
  Line con 0
  exec-timeout 0 0
  Synchronous recording
  line to 0
  line 2
  no activation-character
  No exec
  preferred no transport
  transport output pad rlogin lapb - your MOP v120 udptn ssh telnet
  StopBits 1
  line vty 0 4
  privilege level 15
  local connection
  transport of entry all
  transportation out all
  !
  Scheduler allocate 20000 1000
  !
  end

  There should be no second tunnel.

  I use either a peer or the other, but not both at the same time.

  To display both at the same time, you need to use the Tunnel interfaces.  Amazon would have you sent pretty much the exact commands to copy and paste into.