Configure VPN site to site with CCP

Hello

I have several VPN site to site of small offices, at Headquarters.

Is possible to make a single configuration for all virtual private networks on the "vpn server"(ISR 1801) or I still need to add an entry for each VPN subnet? ". If Yes, is possible with the CCP?

Kind regards

Nuno

You can then configure the VPN using CCP.

I prefer the command line, and if there are many VPN from Site to Site, you can have a model, and what's happening to one VPN to another is interesting traffic, the INVESTIGATION period by peers and the pre-shared key.

It depends on the policy.

Federico.

Tags: Cisco Security

Similar Questions

  • Please give index on configuring vpn site to site on 881 to ASA 5505 cisco router

    Earlier my boss asked me to prepare to implement the VPN site-to site on router Cisco 881 Integrated Services to ASA 5505 router, which is now running on the side of HQ. Someone please give me a hint. I am now learning the pdf file from Cisco that mention how to configure VPN site to site between 1812 Cisco IOS router and router of the ASA 5505 using ASDM V6.1 and SDM V2.5. Cannot find the book for the Cisco 881 device.

    Someone please please suggest me something as soon as POSSIBLE.

    Thank you

    CLI version:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00807ea936.shtml

    ASDM and SDM Version:

    http://www.Cisco.com/en/us/partner/products/ps5855/products_configuration_example09186a0080a9a7a3.shtml

  • Configure the Cisco VPN client to pass through the VPN site-to-site (GUI)

    Hello

    I say hat the chain and responses I've seen to achieve this goal have been great...

    https://supportforums.Cisco.com/discussion/12234631/Cisco-ASA-5505-VPN-p...

    and

    https://supportforums.Cisco.com/document/12191196/AnyConnect-client-site...

    My question is "we will get this configuration by using the graphical user interface for someone who is not notified about the command line?"

    Thank you

    Of course, all this can be configured via ASDM.

    Looking at the second example you posted above, they point you first change:

    ACL split of the tunnel for the AnyConnect customer

    This Configuration > remote access VPN > network (Client) access > AnyConnect connection profile > (chose the profile and select Edit) > (choose "Manage" next to group policy) > Edit > advanced > Split Tunneling > ensure that the policy does not "Inherit" but rather "Tunnel network list below" > Unselect "Inherit" next to the network list, then 'manage '. Enter your networks you want in the GUI in this dialog box. Click OK all the way back to the main window ASDM and click on apply.

    You then change:

    Crypto ACL for the tunnel from Site to Site

    To do this, go to Configuration > VPN Site-to_site > connection profiles > (choose your profile and select edit) > add the VPN client address pool to the list of local network between protect networks. Yet once, click OK all the way back to the main window ASDM and click on apply.

    Then, allow the

    ASA to redirect back on the same interface traffic it receives

    .. is defined under Configuration > Device Setup > Interfaces. (check the box at the bottom of this screen). Click on apply

    Finally, there is the NAT exemption. For which go to Configuration > firewall > rules NAT. Add a NAT device rule before rules network object with Interface Source out, Source address your address pool VPN, the Destination address to include remote subnets and Action is Static Source NAT type source address and destination address remaining as original (i.e. without NAT). Once on OK all the way back to the main window ASDM and click on apply. Save and test.

    Good luck. Don't forget to note the brand and posts useful when your question is answered.

  • VPN site to site by using the host name on cisco asa 5540 - dyndns

    Can someone help me configure VPN site to site on cisco asa 5540. The other end is seen configured dyndns and so should set up her counterpart with the host name.

    If the other end is a dynamic IP address, you must configure a dynamic map and then use in the encryption card

    See the following example.

    http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a00805733df.shtml

  • VPN site to site ASA and SSL VPN

    Hello

    Already configured vpn site to site for both sites. Now, I try to configure vpn remote access to one site.

    But I'm starting to config some command like below to access remote vpn, the existing site-to-site vpn disconnected auto.

    No crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

    outside_map interface card crypto outside

    Please, help me to check.

    Thank you

    Ko Htwe

    Hello

    You can have a single card encryption for an interface, you must configure both tunnels (access site to & remote) in a single card with number of different sequesnce encryption. Please make sure that the sequence number for the remote access is higher than for the site to site.

    You can also get this back to the config command, why did you remove it.

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    If you still have a problem, please let us know the configuration.

    Kind regards

    Mohammad

  • Site to Site with the subnets overlap

    Hi all

    Search for comfirmation on what is / is not possible. In short, we have a requirement of site but our local LAN varies from conflict. I am aware of how this get up and running with the help of a pool of IP addresses that is a basic ASA/IOS device can NAT behind but I wonder if it is possible to NAT behind a single IP address. NAT is also in place for the general internet traffic, but I hope that the image attached best describes our scenario.

    Any help / advice appreciated.

    Kind regards

    Martyn

    Hello

    You will need to do NAT on both ends to get the installation work.

    With these types of configurations, I more often just a 24 natted network to 24 another network on both sites.

    You can configure one of the sites use a PAT address towards the other end, but the other end must have protected by some sort of NAT static between the hosts unique or equal to 24 networks.

    If you would happen to configure both sites with a PAT translation, you couldn't really initiate connections between the site because no real host on networks 192.168.1.0/24 would have their own specific NAT IP to connect to.

    So in short

    • Both sites need NAT network
    • Use 1:1 NAT static is between host addresses or complete networks on both sites
      • The two sites could start the connection to any host on the remote end every single host has its own IP NAT staticly assigned address
    • Use of PAT for site and other NAT static 1:1 with the addresses of host or complete networks on the other site
      • Site with unique PAT IP address can connect to all hosts of remote sites, since they have staticly NAT IP addresses assigned.
      • Homepage is not able to connect to any host at his remote site that the remote site has only a PAT address facing their way.

    If you had 2 ASAs with 8.2 or UNDER software your static NAT configurations could be e.g.

    Basic information

    • Site1: 192.168.1.0/24
    • Site1 NAT: 10.10.1.0/24
    • Site2: 192.168.1.0/24
    • Site2 NAT: 10.10.2.0/24

    Static configuration NAT of policy site1

    permit L2L-VPN-POLICYNAT from the list of access ip 192.168.1.0 255.255.255.0 10.10.2.0 255.255.255.0

    public static (inside, outside) 10.10.1.0 - L2L-VPN-POLICYNAT access list

    Static configuration NAT of policy site2

    permit L2L-VPN-POLICYNAT from the list of access ip 192.168.1.0 255.255.255.0 10.10.1.0 255.255.255.0

    public static (inside, outside) 10.10.2.0 - L2L-VPN-POLICYNAT access list

    PAT configuration at each end

    permit L2L-VPN-POLICYPAT from the list of access ip 192.168.1.0 255.255.255.0 10.10.x.0 255.255.255.0

    Global 10.10.x.1 of xxx (outside)

    NAT (inside) xxx access-list L2L-VPN-POLICYPAT

    If you had 2 ASAs with 8.3 or above software your static NAT configurations could be for example (same information base)

    Static configuration NAT of policy site1

    the object of the LAN network

    subnet 192.168.1.0 255.255.255.0

    network of the LAN - NAT object

    10.10.1.0 subnet 255.255.255.0

    network of the REMOTE object

    255.255.255.0 subnet 10.10.2.0

    static (inside, outside) 1 static source LAN LAN - NAT static destination REMOTE

    Static configuration NAT of policy site2

    the object of the LAN network

    subnet 192.168.1.0 255.255.255.0

    network of the LAN - NAT object

    255.255.255.0 subnet 10.10.2.0

    network of the REMOTE object

    10.10.1.0 subnet 255.255.255.0

    static (inside, outside) 1 static source LAN LAN - NAT static destination REMOTE

    PAT configuration at each end

    the object of the LAN network

    subnet 192.168.1.0 255.255.255.0

    network of the LAN-PAT object

    Home 10.10.x.1

    network of the REMOTE object

    10.10.x.0 subnet 255.255.255.0

    static (inside, outside) 1 dynamic source LAN LAN-PAT destination static REMOTE

    -Jouni

  • IPsec VPN site to site between router problem Cisco ASA. Help, please

    Hello community,

    I'm stuck in configuring VPN site to site between ASA (OS 9.1) and router Cisco IOS (IOS 15, 2 - 4.M4)

    Attachment is router configuration and ASA. I also include the router debug output.

    It seems that the two parties must isakmp missmatch configuration, but I have already disabled the KeepAlive parameters. I also turn off PFS setting on both sides. But it does not work. I have no idea on this problem.

    Please help me. Any help appreciated.

    Thank you

     
     

    I didn't look any further, but this may be a reason:

     crypto map mymap 1 ipsec-isakmp dynamic dyn1

    The dynamic CM must always be the last sequence in a card encryption:

     no crypto map mymap 1 ipsec-isakmp dynamic dyn1 crypto map mymap 65000 ipsec-isakmp dynamic dyn1

    Try this first, then we can look further.

  • VPN site to Site on both ends using Cisco 871

    I would like to configure VPN Site to Site using the Cisco 871 templates at both ends, but a hard time to set it up. Can someone tell me how to do or if you know of a link that may help me set up as soon as possible?

    I can learn it, but it's time that banned me in the implementation. The other end is already configured to provide Internet access to all users.

    Tom,

    ########################################################################################

    Router 1 VPN config:

    Internal = 10.0.0.0/24
    Public = 196.1.161.65

    access-list 101 permit ip 10.0.0.0 0.0.0.255 10.193.12.0 0.0.3.255

    access-list 102 deny ip 10.0.0.0 0.0.0.255 10.193.12.0 0.0.3.255
    access-list 102 permit ip 10.0.0.0 0.0.0.255 any

    IP nat inside source list 102 in interface (check the name of the external interface) overload

    crypto ISAKMP policy 10
    3des encryption
    sha hash
    Group 2

    ISAKMP crypto key cisco123 address 196.1.161.66

    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

    MYmap 10 ipsec-isakmp crypto map
    defined by peer 196.1.161.66
    Set transform-set RIGHT
    match address 101

    interface (check the name of the interface inside)
    IP nat inside

    interface (check the name of the external interface)
    NAT outside IP
    crypto mymap map

    ########################################################################################

    Router 2 VPN config:

    Internal = 10.193.12.0/22
    Public = 196.1.161.66

    access-list 101 permit ip 10.193.12.0 0.0.3.255 10.0.0.0 0.0.0.255

    access-list 102 deny ip 10.193.12.0 0.0.3.255 10.0.0.0 0.0.0.255
    access-list 102 permit ip 10.193.12.0 0.0.3.255 all

    IP nat inside source list 102 in the fast4 interface overload

    crypto ISAKMP policy 10
    3des encryption
    sha hash
    Group 2

    ISAKMP crypto key cisco123 address 196.1.161.65

    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

    MYmap 10 ipsec-isakmp crypto map
    defined by peer 196.1.161.65
    Set transform-set RIGHT
    match address 101

    interface vlan1
    IP nat inside

    fast4 interface
    NAT outside IP
    crypto mymap map

    ########################################################################################

    The above is an example of configuration.
    It is always recommended to change the pre shared key to something else.

    Federico.

  • Cisco 877 + VPN Site to Site

    Hello

    I'm new im this forum.
    I've set up a Site VPN site with 2 Cisco 877.

    SITE A:

    Address IP Adreess public: static
    Internal IP Adrees: 192.168.0.XXX
    Mask: 255.255.255.0

    SITE B:

    IP address public Adreess: Dynamics
    Internal IP address: 192.168.2.XXX
    Mask: 255.255.255.0

    I managed to do a ping on both sides, but I can't access file shares, and could rdp on any server in site A, by the internal IP address.

    Fix, is the SITES A and B SITE startup configs.

    Could you please someone help me?

    Hi Marcos,

    Really happy to know that the problem is solved. There is no need to apologize. Please mark this message as answered if there is nothing more.

    Rregards,

    Assia

  • VPN site to site of simple laboratory works no - pix to pix

    Hi all I have a lab at home configuring vpn site to site between 2 cisco pix 501 devices, but it does not work. Can anyone help, I have attached the followign run configs. Thank you

    PIX Version 6.2 (1)

    ethernet0 nameif outside security0

    nameif ethernet1 inside the security100

    activate the encrypted password of NuLKvvWGg.x9HEKO

    2KFQnbNIdI.2KYOU encrypted passwd

    hostname CiscoPix2

    domain ciscopix.com

    fixup protocol ftp 21

    fixup protocol http 80

    fixup protocol h323 h225 1720

    fixup protocol h323 ras 1718-1719

    fixup protocol they 389

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol sip 5060

    fixup protocol 2000 skinny

    names of

    access-list ping_acl allow icmp a whole

    access-list 90 allow ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

    access-list 100 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

    pager lines 24

    interface ethernet0 10baset

    interface ethernet1 10full

    Outside 1500 MTU

    Within 1500 MTU

    IP 10.0.0.2 255.255.255.0 outside

    IP address 192.168.1.100 within 255.255.255.0

    alarm action IP verification of information

    alarm action attack IP audit

    history of PDM activate

    ARP timeout 14400

    NAT (inside) - 0-90 access list

    Access-group ping_acl in interface outside

    ping_acl access to the interface inside group

    Route outside 0.0.0.0 0.0.0.0 10.0.0.1 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    RADIUS Protocol RADIUS AAA server

    AAA-server local LOCAL Protocol

    Enable http server

    http 0.0.0.0 0.0.0.0 inside

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    No trap to activate snmp Server

    enable floodguard

    Permitted connection ipsec sysopt

    No sysopt route dnat

    Crypto ipsec transform-set strong esp-3des esp-sha-hmac

    20 topix1 of ipsec-isakmp crypto map

    correspondence address 20 card crypto topix1 100

    crypto topix1 20 card set peer 10.0.0.1

    20 strong crypto topix1 transform-set card game

    topix1 interface card crypto outside

    ISAKMP allows outside

    ISAKMP key * address 10.0.0.1 netmask 255.255.255.255

    part of pre authentication ISAKMP policy 8

    encryption of ISAKMP strategy 8

    ISAKMP strategy 8 sha hash

    8 1 ISAKMP policy group

    ISAKMP life duration strategy 8 the 86400

    Telnet timeout 5

    SSH timeout 5

    Terminal width 80

    Cryptochecksum:81f37c16401555abe7299b5a95e69d3d

    : end

    //////////////////////////////////////////////////////////////

    6.3 (3) version PIX

    interface ethernet0 car

    interface ethernet1 100full

    ethernet0 nameif outside security0

    nameif ethernet1 inside the security100

    activate the encrypted password of NuLKvvWGg.x9HEKO

    NuLKvvWGg.x9HEKO encrypted passwd

    pixfirewall hostname

    domain ciscopix.com

    fixup protocol dns-length maximum 512

    fixup protocol ftp 21

    fixup protocol h323 h225 1720

    fixup protocol h323 ras 1718-1719

    fixup protocol http 80

    fixup protocol rsh 514

    fixup protocol rtsp 554

    fixup protocol sip 5060

    fixup protocol sip udp 5060

    fixup protocol 2000 skinny

    fixup protocol smtp 25

    fixup protocol sqlnet 1521

    fixup protocol tftp 69

    names of

    access-list ping_acl allow icmp a whole

    access-list 90 allow ip 192.168.0.0 255.255.255.0 10.0.0.0 255.255.255.0

    access-list 100 permit ip 192.168.0.0 255.255.255.0 10.0.0.0 255.255.255.0

    pager lines 24

    Outside 1500 MTU

    Within 1500 MTU

    IP 10.0.0.1 255.255.255.0 outside

    IP address inside 192.168.0.100 255.255.255.0

    alarm action IP verification of information

    alarm action attack IP audit

    history of PDM activate

    ARP timeout 14400

    NAT (inside) - 0-90 access list

    Access-group ping_acl in interface outside

    ping_acl access to the interface inside group

    Route outside 0.0.0.0 0.0.0.0 10.0.0.2 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

    H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

    Timeout, uauth 0:05:00 absolute

    GANYMEDE + Protocol Ganymede + AAA-server

    RADIUS Protocol RADIUS AAA server

    AAA-server local LOCAL Protocol

    Enable http server

    http 0.0.0.0 0.0.0.0 outdoors

    http 0.0.0.0 0.0.0.0 inside

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    No trap to activate snmp Server

    enable floodguard

    Permitted connection ipsec sysopt

    Crypto ipsec transform-set strong esp-3des esp-sha-hmac

    20 topix2 of ipsec-isakmp crypto map

    correspondence address 20 card crypto topix2 100

    crypto topix2 20 card set peer 10.0.0.2

    20 strong crypto topix2 transform-set card game

    topix2 interface card crypto outside

    ISAKMP allows outside

    ISAKMP key * address 10.0.0.2 netmask 255.255.255.255

    part of pre authentication ISAKMP policy 8

    encryption of ISAKMP strategy 8

    ISAKMP strategy 8 sha hash

    8 1 ISAKMP policy group

    ISAKMP life duration strategy 8 the 86400

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    Terminal width 80

    Cryptochecksum:4558d14bca52c36021eeab79729ee63b

    : end

    The first problem I see is that the access list that is used to identify the VPN traffic allows traffic from your home subnet for the external subnet of the peer but not inside the subnet of the peer.

    HTH

    Rick

  • Is it possible to set up a site with a read-only ftp access

    I have a production server and a development server and work on a project with the non - DW users. Often, I need to download files from the production server, but never need to download to it (it's someone other responsibility).

    I have two FTP accounts for the production server, one with unlimited access with read-only. I would like to implement a DW site that uses the read-only account to get the files from the server. It would also prevent me from accidentally upload on this server.

    Unfortunately, I get permission denied errors when accessing the account read-only. I guess that's because the account does not write permission. I checked that the credentials work by FTPing the site using FileZilla and uploading a file.

    The DW FTP requires write to a GET operation on a file?

    Nevermind, answered this myself. It is possible, but the user must configure the site with the correct host directory.

  • local host to access the vpn site to site with nat static configured

    I have two 881 routers with vpn site to site between them. I have a static nat on the router for a Web server that is accessible from the internet. I can't access the Web server through the vpn. All other traffic is fine its VPN. I think that there is a problem with the NAT. Here are the relevant configuration lines.

    IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
    IP nat inside source static 192.168.150.2 bonnefin map route SDM_RMAP_1

    allowed SDM_RMAP_1 1 route map
    corresponds to the IP 100

    access-list 100 deny ip 192.168.150.0 0.0.0.255 192.168.123.0 0.0.0.255
    access-list 100 permit ip 192.168.150.0 0.0.0.255 any

    You should be able to access the web server with its IP private (192.168.150.2) through the VPN connection.

    If you just add the VPN and the road map, try to clear the existing translation and see if you can access it via its private of the Remote LAN VPN ip address.

  • Need help with the configuration of the Site with crossed on Cisco ASA5510 8.2 IPSec VPN Client (1)

    Need urgent help in the configuration of the Client VPN IPSec Site with crossed on Cisco ASA5510 - 8.2 (1).

    Here is the presentation:

    There are two leased lines for Internet access - a route 1.1.1.1 and 2.2.2.2, the latter being the default Standard, old East for backup.

    I was able to configure the Client VPN IPSec Site

    (1) with access to the outside so that the internal network (172.16.0.0/24) behind the asa

    (2) with Split tunnel with simultaneous assess internal LAN and Internet on the outside.

    But I was not able to make the tradiotional model Hairpinng to work in this scenario.

    I followed every possible suggestions made on this subject in many topics of Discussion but still no luck. Can someone help me here please?

    Here is the race-Conf with Normal Client to Site IPSec VPN configured with no access boarding:

    LIMITATION: Cannot boot into any other image ios for unavoidable reasons, must use 8.2 (1)

    race-conf - Site VPN Customer normal work without internet access/split tunnel

    :

    ASA Version 8.2 (1)

    !

    ciscoasa hostname

    domain cisco.campus.com

    enable the encrypted password xxxxxxxxxxxxxx

    XXXXXXXXXXXXXX encrypted passwd

    names of

    !

    interface GigabitEthernet0/0

    nameif outside internet1

    security-level 0

    IP 1.1.1.1 255.255.255.240

    !

    interface GigabitEthernet0/1

    nameif outside internet2

    security-level 0

    IP address 2.2.2.2 255.255.255.224

    !

    interface GigabitEthernet0/2

    nameif dmz interface

    security-level 0

    IP 10.0.1.1 255.255.255.0

    !

    interface GigabitEthernet0/3

    nameif campus-lan

    security-level 0

    IP 172.16.0.1 255.255.0.0

    !

    interface Management0/0

    nameif CSC-MGMT

    security-level 100

    the IP 10.0.0.4 address 255.255.255.0

    !

    boot system Disk0: / asa821 - k8.bin

    boot system Disk0: / asa843 - k8.bin

    passive FTP mode

    DNS server-group DefaultDNS

    domain cisco.campus.com

    permit same-security-traffic inter-interface

    permit same-security-traffic intra-interface

    object-group network cmps-lan

    the object-group CSC - ip network

    object-group network www-Interior

    object-group network www-outside

    object-group service tcp-80

    object-group service udp-53

    object-group service https

    object-group service pop3

    object-group service smtp

    object-group service tcp80

    object-group service http-s

    object-group service pop3-110

    object-group service smtp25

    object-group service udp53

    object-group service ssh

    object-group service tcp-port

    port udp-object-group service

    object-group service ftp

    object-group service ftp - data

    object-group network csc1-ip

    object-group service all-tcp-udp

    access list INTERNET1-IN extended permit ip host 1.2.2.2 2.2.2.3

    access-list extended SCC-OUT permit ip host 10.0.0.5 everything

    list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq www

    list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any https eq

    list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq ssh

    list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 no matter what eq ftp

    list of access CAMPUS-LAN extended permitted udp 172.16.0.0 255.255.0.0 no matter what eq field

    list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq smtp

    list of access CAMPUS-LAN extended permitted tcp 172.16.0.0 255.255.0.0 any eq pop3

    access CAMPUS-wide LAN ip allowed list a whole

    access-list CSC - acl note scan web and mail traffic

    access-list CSC - acl extended permit tcp any any eq smtp

    access-list CSC - acl extended permit tcp any any eq pop3

    access-list CSC - acl note scan web and mail traffic

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 993

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq imap4

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq 465

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq www

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq https

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq smtp

    access-list extended INTERNET2-IN permit tcp any host 1.1.1.2 eq pop3

    access-list extended INTERNET2-IN permit ip any host 1.1.1.2

    access-list sheep extended ip 172.16.0.0 allow 255.255.0.0 172.16.0.0 255.255.0.0

    access list DNS-inspect extended permit tcp any any eq field

    access list DNS-inspect extended permit udp any any eq field

    access-list extended capin permit ip host 172.16.1.234 all

    access-list extended capin permit ip host 172.16.1.52 all

    access-list extended capin permit ip any host 172.16.1.52

    Capin list extended access permit ip host 172.16.0.82 172.16.0.61

    Capin list extended access permit ip host 172.16.0.61 172.16.0.82

    access-list extended capout permit ip host 2.2.2.2 everything

    access-list extended capout permit ip any host 2.2.2.2

    Access campus-lan_nat0_outbound extended ip 172.16.0.0 list allow 255.255.0.0 192.168.150.0 255.255.255.0

    pager lines 24

    Enable logging

    debug logging in buffered memory

    asdm of logging of information

    Internet1-outside of MTU 1500

    Internet2-outside of MTU 1500

    interface-dmz MTU 1500

    Campus-lan of MTU 1500

    MTU 1500 CSC-MGMT

    IP local pool 192.168.150.2 - 192.168.150.250 mask 255.255.255.0 vpnpool1

    IP check path reverse interface internet2-outside

    IP check path reverse interface interface-dmz

    IP check path opposite campus-lan interface

    IP check path reverse interface CSC-MGMT

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 621.bin

    don't allow no asdm history

    ARP timeout 14400

    interface of global (internet1-outside) 1

    interface of global (internet2-outside) 1

    NAT (campus-lan) 0-campus-lan_nat0_outbound access list

    NAT (campus-lan) 1 0.0.0.0 0.0.0.0

    NAT (CSC-MGMT) 1 10.0.0.5 255.255.255.255

    static (CSC-MGMT, internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255

    Access-group INTERNET2-IN interface internet1-outside

    group-access INTERNET1-IN interface internet2-outside

    group-access CAMPUS-LAN in campus-lan interface

    CSC-OUT access-group in SCC-MGMT interface

    Internet2-outside route 0.0.0.0 0.0.0.0 2.2.2.5 1

    Route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-registration DfltAccessPolicy

    the ssh LOCAL console AAA authentication

    AAA authentication enable LOCAL console

    Enable http server

    http 10.0.0.2 255.255.255.255 CSC-MGMT

    http 10.0.0.8 255.255.255.255 CSC-MGMT

    HTTP 1.2.2.2 255.255.255.255 internet2-outside

    HTTP 1.2.2.2 255.255.255.255 internet1-outside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs set group5

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    Crypto map internet2-outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    crypto internet2-outside_map outside internet2 network interface card

    Crypto ca trustpoint _SmartCallHome_ServerCA

    Configure CRL

    Crypto ca certificate chain _SmartCallHome_ServerCA

    certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as

    a67a897as a67a897as a67a897as a67a897as a67a897as

    quit smoking

    ISAKMP crypto enable internet2-outside

    crypto ISAKMP policy 10

    preshared authentication

    aes encryption

    md5 hash

    Group 2

    life 86400

    Telnet 10.0.0.2 255.255.255.255 CSC-MGMT

    Telnet 10.0.0.8 255.255.255.255 CSC-MGMT

    Telnet timeout 5

    SSH 1.2.3.3 255.255.255.240 internet1-outside

    SSH 1.2.2.2 255.255.255.255 internet1-outside

    SSH 1.2.2.2 255.255.255.255 internet2-outside

    SSH timeout 5

    Console timeout 0

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    internal VPN_TG_1 group policy

    VPN_TG_1 group policy attributes

    Protocol-tunnel-VPN IPSec

    username ssochelpdesk encrypted password privilege 15 xxxxxxxxxxxxxx

    privilege of encrypted password username administrator 15 xxxxxxxxxxxxxx

    username vpnuser1 encrypted password privilege 0 xxxxxxxxxxxxxx

    username vpnuser1 attributes

    VPN-group-policy VPN_TG_1

    type tunnel-group VPN_TG_1 remote access

    attributes global-tunnel-group VPN_TG_1

    address vpnpool1 pool

    Group Policy - by default-VPN_TG_1

    IPSec-attributes tunnel-group VPN_TG_1

    pre-shared-key *.

    !

    class-map cmap-DNS

    matches the access list DNS-inspect

    CCS-class class-map

    corresponds to the CSC - acl access list

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    Policy-map global_policy

    CCS category

    CSC help

    cmap-DNS class

    inspect the preset_dns_map dns

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y

    : end

    Adding dynamic NAT for 192.168.150.0/24 on the external interface works, or works the sysopt connection permit VPN

    Please tell what to do here, to pin all of the traffic Internet from VPN Clients.

    That is, that I need clients connected via VPN tunnel, when connected to the internet, should have their addresses IP NAT'ted against the address of outside internet2 network 2.2.2.2 interface, as it happens for the customers of Campus (172.16.0.0/16)

    I am well aware of all involved in here, so please be elaborative in your answers. Please let me know if you need more information about this configuration to respond to my request.

    Thank you & best regards

    MAXS


    Hello

    If possible, I'd like to see that a TCP connection attempt (e.g. http://www.google.com) in the ASDM logging of the VPN Client when you set up the dynamic NAT for the VPN Pool also.

    I'll try also the command "packet - trace" on the SAA, while the VPN Client is connected to the ASA.

    The command format is

    packet-tracer intput tcp

    That should tell what the SAA for this kind of package entering its "input" interface

    Still can not see something wrong with the configuration (other than the statement of "nat" missing Dynamics PAT)

    -Jouni

  • Problem with the VPN site to site for the two cisco asa 5505

    Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

    Cisco Config asa1

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 172.xxx.xx.4 255.255.240.0
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.60.2 255.255.255.0
    !
    passive FTP mode
    network of the Lan_Outside object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
    network of the Lan_Outside object
    NAT (inside, outside) interface dynamic dns
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.60.0 255.255.255.0 inside
    http 96.xx.xx.222 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 96.88.75.222
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    inside access management

    dhcpd address 192.168.60.50 - 192.168.60.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_96.xx.xx.222 group strategy
    attributes of Group Policy GroupPolicy_96.xx.xx.222
    VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 96.xx.xx.222 type ipsec-l2l
    tunnel-group 96.xx.xx.222 General-attributes
    Group - default policy - GroupPolicy_96.xx.xx.222
    96.XX.XX.222 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error

    ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Cisco ASA 2 config

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 96.xx.xx.222 255.255.255.248
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.1.254 255.255.255.0
    !
    passive FTP mode
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network of the Lan_Outside object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_4
    ip protocol object
    icmp protocol object
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
    !
    network of the Lan_Outside object
    dynamic NAT (all, outside) interface
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    http 172.xxx.xx.4 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 172.110.74.4
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0

    dhcpd address 192.168.1.50 - 192.168.1.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_172.xxx.xx.4 group strategy
    attributes of Group Policy GroupPolicy_172.xxx.xx.4
    L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 172.xxx.xx.4 type ipsec-l2l
    tunnel-group 172.xxx.xx.4 General-attributes
    Group - default policy - GroupPolicy_172.xxx.xx.4
    172.xxx.XX.4 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error
    inspect the http

    For IKEv2 configuration: (example config, you can change to encryption, group,...)

    -You must add the declaration of exemption nat (see previous answer).

    -set your encryption domain ACLs:

    access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

    -Set the Phase 1:

    Crypto ikev2 allow outside
    IKEv2 crypto policy 10
    3des encryption
    the sha md5 integrity
    Group 5
    FRP sha
    second life 86400

    -Set the Phase 2:

    Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
    Esp aes encryption protocol
    Esp integrity sha-1 protocol

    -set the Group of tunnel

    tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
    REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
    IKEv2 authentication remote pre-shared-key cisco123


    IKEv2 authentication local pre-shared-key cisco123

    -Define the encryption card

    address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
    card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
    card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
    CRYPTOMAP interface card crypto outside
    crypto isakmp identity address

    On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

    Thank you

  • Problem with VPN Site-to-Site between RV215W and ASA5510

    The RV215W is intended to connect a new branch via 3G, but fail.

    But when connected to the internet via a cable modem VPN works.

    I have set up with the FULL domain name and remote ip address.

    Please help me soon as soon as you can.

    Thaks a lot.

    Henriux2412.

    Dear Henry;

    Thank you to the small community of Support Business.

    I doubt that this VPN site-to-site is compatible with the USB modem broadband Mobile 3 G, but I have when even suggest to verify that the Status field of the map will show your mobile card is connected (status > Mobile network). I've seen a similar problem with a Verizon USB modem where the solution was to change a few settings in their access Manager software ("NDIS Mode - connect manually" has been selected and change this option to "Modem Mode - connect manually fixed), but if this is not your case then I suggest you to check with your service provider about supported VPN site to site on the WAN configuration.

    Except that I advise you to contact the Small Business Support Center for more information on this subject, although I don't think they will support

    https://supportforums.Cisco.com/community/NetPro/small-business/sbcountrysupport

    Do not hesitate to contact me if there is anything I can help you with in the meantime.

    Kind regards

    Jeffrey Rodriguez S... : | :. : | :.
    Support Engineer Cisco client

    * Please rate the Post so other will know when an answer has been found.

Maybe you are looking for

  • Why aon address iMessage his own?

    Wife Mu and I have iPhones with different phone numbers.  We share a single iTunes account.  We have implemented this way for many years.  On her phone under settings - Messages - send / receive, she chooses her number, and mine is grayed out.  On my

  • Some problems of software on the Satellite C850D

    Hello I had some type of problem. The DVD does not work so I thought it was a creator of disc, AMD, USB driver again, I installed but it does not work. After that I tried to install the laptop (Satellite-C850D-107) but the DVD still does not work. Wh

  • Re: How to burn HDD Recovery?

    Hello! I have a copy of the HDDRecovery consisting of: ODDFiles, OriSetenv; Swing, HDDRecovery.tag, ReadMe,and the TOSHIBA logo in an external disck. but after formatting, I've lost the utility to burn. So, how can I burn it to DVD to avoid losing th

  • Overheating of the satellite A300 - 1 k 8

    Hello world last night, the phone turns itself off without warning, I hit rock bottom and was very hot. This morning I disassembled, cleaned and changed the thermal paste to the microprocessor to better dissipate the temperature. Well, the laptop run

  • Laptop HP 15-af122no: crash at startup after update driver AMD

    I bought my computer on February 2016, so it is quite new. There are 10 Windows ready and recently it has been upgraded. My internet connection LAN, no problems with that. Yesterday an automatic detection of AMD system informed me that my drivers nee