Double firewall, config VPN design question?

Similar Questions

• ISE design question

  I have a few design questions about ISE v.1.0.4.573

  1. The ISE 3395 gigabit ports are supported on the aggregation of links?  How can I use all 4 ports uplink?
  2. When you perform an installation of 2 x 3395 HA, is there a connection of heart rate between the two ISE or they will use the same link to the network of pulsing and synchronization?
  3. I'm designing ISE with WLC. My setup WLC (5508) looks like 5 floors with different VLAN but same SSID. How can I do ISE authenticate in this scenario because WGB AP is not supported in ISE v.1.0. Is there a work around for this type of WiFi to the ISE configuration?
  4. Continuous configuration above, roaming from one floor to another floor after changing of Vlan, the user will be re - authenticate or use the same session?

  Thanks for the help.

  Kind regards

  Zohaib

  1. the current version does not support the aggregation of links...

  2. they use the same link to the network of pulsing and synchronization.

  3. my suggestion is to assign your SSID, a group of interfaces, containing all interfaces belonging to your VLAN, on your WLC and set AAA replacement. And then, at ISE, create authorization profiles include the appropriate VLAN. Use the Called-Station-ID RADIUS attribute with your MAC address of the AP as a condition.

  4. they use the same session.

• NSX firewall Configs

  This should be a little easy.

  How firewall configs can be saved within the GUI 6.1.4?  I can't find this info anywhere.

  Thanks, Jake

  Page 60 of the NSX 6.0.2 administration guide, NSX can record up to 100 setups.  "Once this limit is exceeded, marked with to preserve Configuration saved configurations are preserved while the old configurations not preserved are removed to make room for preserved configurations."

  It seems that the same is true in 6.1.

• Error al instalar Lightroom CC 2015, "no to ha could connect con los servidores adobe.» "It check the coneccion a internet, the firewall config e intentelo nuevo".

  Hola una consulta: quiero descargar Lightroom a mi pc pero me Québec sale UN error dice: "no to ha could connect con los servidores adobe." "It check the coneccion a internet, the firewall config e intentelo nuevo". Don't me antes salia y tengo instalados correctamente Illustrator, first, After media y. Lo raro encoder are if tengo conexion a internet. If por favor alguien sabe are y como is soluciona este problema is lo agradeceria. Gracias Saludos!

  Please see the suggestions in this document: sign activation, or connection errors. CS5.5 and later

  Guinot

• modem router VPN hardware firewall - config possible?

  We have 2 remote employees having difficulties with their VPN client software turn off/on.  We were preparing to spread the VoIP phones up to them and won't open our internal PBX network.  I would like to make 1 stone 2 strokes by providing a hardware VPN to each employee to establish a gateway 2 IP Sec VPN gateway between their home and the main office.  This should provide a more reliable connection and throughput high, all allowing the VoIP phone to connect through the VPN tunnel, thus keeping our secure internal PBX.  So far so good.  From what I can tell the rv120w, rv220w or cisco asa 5505 would do the trick.  Now the difficulty - I don't want any personal traffic (Netflix streaming, whatever) from home, traveling through the VPN tunnel.  So I would like to allow the employee maintain their own network staff, and within the personal network the hardware VPN device providing a secondary network would use the VPN tunnel.

  It would look like this:

  Web:

  wireless router: (dynamic public IP 192.168.1.x private subnet)

  personal computer

  laptop

  television network, etc.

  hardware VPN device: (192.168.1.1 IP WAN, private subnet 192.168.2.x), IPSec VPN tunnel to the main office (must use internal DNS main office)

  Phone VoIP (192.168.2.1)

  Desktop computer (192.168.2.2)

  Seems simple to me, but concerned about through two NAT.  Looks like this would be preferred for a desktop home configuration that shares a single internet connection.  Found an old Cisco product that was aligned to this specific scenario - the Cisco VPN 3002; but it is the end of life.

  I'm also a bit wary of different routers Cisco RV line poor consumer reviews.  Whereas the Zyxel Zywall USG 20 as an alternative.

  The split of RV120 and RV220W site-to-site VPN tunnel support, so all traffic "cluttered" would remain local for home networks while the VPN traffic that's exactly right.

  You can consider installing one of the routers listed above in areas home to avoid the double-NAT or additional purchases. The VPN device does not practice given that the expense of a gateway to gateway VPN router is fairly inexpensive.

  -Tom

• Router WAN double with SSL VPN inaccessible for customers

  I have a configured in a Dual WAN setup Cisco 888. There is an ADSL link connected to the VLAN 100 and a SDSL link associated with the Dialer0. The customer wishes to use the ADSL link to the normal navigation and external SSL VPN users to complete on the SDSL connection. I tried to configure the link failover for the ADSL SDSL.

  What works:

  -Access to the Internet for clients the

  What does not work:

  -The ADSL SDSL connection failover.

  -Access SSL VPN for customers. Surf to the external IP address will cause only a page by default HTTP. Specification webvpn.html results in a 404 not found error.

  Here is my configuration:

  version 15.0

  no service button

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  host name x

  !

  boot-start-marker

  boot-end-marker

  !

  logging buffered 51200 warnings

  enable secret 5 x

  !

  AAA new-model

  !

  !

  AAA authentication login local sslvpn

  !

  !

  !

  !

  !

  AAA - the id of the joint session

  iomem 10 memory size

  !

  Crypto pki trustpoint TP-self-signed-3964912732

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 3964912732

  revocation checking no

  rsakeypair TP-self-signed-3964912732

  !

  !

  TP-self-signed-3964912732 crypto pki certificate chain

  self-signed certificate 03

  x

  quit smoking

  IP source-route

  !

  !

  IP dhcp excluded-address 192.168.10.254

  DHCP excluded-address IP 192.168.10.10 192.168.10.20

  !

  DHCP IP CCP-pool

  import all

  network 192.168.10.0 255.255.255.0

  default router 192.168.10.254

  DNS-server 213.75.63.36 213.75.63.70

  Rental 2 0

  !

  !

  IP cef

  no ip domain search

  property intellectual name x

  No ipv6 cef

  !

  !

  udi pid CISCO888-K9 sn x license

  !

  !

  username secret privilege 15 ciscoadmin 5 x

  username password vpnuser 0 x

  !

  !

  LAN controller 0

  atm mode

  Annex symmetrical shdsl DSL-mode B

  !

  interface Loopback1

  Gateway SSL dhcp pool address description

  IP 192.168.250.1 255.255.255.0

  !

  interface Loopback2

  Description address IP VPN SSL

  IP 10.10.10.1 255.255.255.0

  route PBR_SSL card intellectual property policy

  !

  interface BRI0

  no ip address

  encapsulation hdlc

  Shutdown

  Multidrop ISDN endpoint

  !

  ATM0 interface

  no ip address

  load-interval 30

  No atm ilmi-keepalive

  PVC KPN 2/32

  aal5mux encapsulation ppp Dialer

  Dialer pool-member 1

  !

  !

  interface FastEthernet0

  switchport access vlan 100

  !

  interface FastEthernet1

  !

  interface FastEthernet2

  !

  interface FastEthernet3

  !

  interface Vlan1

  LAN description

  IP address 192.168.10.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly

  IP tcp adjust-mss 1300

  !

  interface Vlan100

  Description KPN ADSL 20/1

  DHCP IP address

  NAT outside IP

  IP virtual-reassembly

  !

  interface Dialer0

  Description KPN SDSL 2/2

  the negotiated IP address

  IP access-group INTERNET_ACL in

  NAT outside IP

  IP virtual-reassembly

  encapsulation ppp

  Dialer pool 1

  Dialer-Group 1

  PPP pap sent-username password 0 x x

  No cdp enable

  !

  IP local pool sslvpnpool 192.168.250.2 192.168.250.100

  IP forward-Protocol ND

  IP http server

  local IP http authentication

  IP http secure server

  IP http timeout policy slowed down 60 life 86400 request 10000

  !

  pool nat SSLVPN SDSL 10.10.10.1 IP 10.10.10.1 netmask 255.255.255.0

  IP nat inside source static tcp 10.10.10.1 443 interface Dialer0 443

  IP nat inside source static tcp 10.10.10.1 80 Dialer0 80 interface

  IP nat inside source overload map route NAT_ADSL Vlan100 interface

  IP nat inside source overload map route NAT_SDSL pool SSLVPN SDSL

  IP route 0.0.0.0 0.0.0.0 x.x.x.x

  IP route 0.0.0.0 0.0.0.0 Dialer0 10

  !

  INTERNET_ACL extended IP access list

  Note: used with CBAC

  allow all all unreachable icmp

  allow icmp all a package-too-big

  allow icmp all once exceed

  allow any host 92.64.32.169 eq 443 tcp www

  deny ip any any newspaper

  Extended access LAN IP-list

  permit ip 192.168.10.0 0.0.0.255 any

  refuse an entire ip

  !

  Dialer-list 1 ip protocol allow

  not run cdp

  !

  !

  !

  !

  NAT_SDSL allowed 10 route map

  match the LAN ip address

  match interface Dialer0

  !

  NAT_ADSL allowed 10 route map

  match the LAN ip address

  match interface Vlan100

  !

  PBR_SSL allowed 10 route map

  set interface Dialer0

  !

  !

  control plan

  !

  !

  Line con 0

  no activation of the modem

  line to 0

  line vty 0 4

  privilege level 15

  transport input telnet ssh

  !

  max-task-time 5000 Planner

  !

  WebVPN MyGateway gateway

  hostname d0c

  IP address 10.10.10.1 port 443

  redirect http port 80

  SSL trustpoint TP-self-signed-3964912732

  development

  !

  WebVPN install svc flash:/webvpn/anyconnect-dart-win-2.5.0217-k9.pkg sequence 1

  !

  WebVPN install svc flash:/webvpn/anyconnect-macosx-i386-2.5.0217-k9.pkg sequence 2

  !

  WebVPN install svc flash:/webvpn/anyconnect-macosx-powerpc-2.5.0217-k9.pkg sequence 3

  !

  WebVPN context SecureMeContext

  title "SSL VPN Service"

  secondary-color #C0C0C0

  title-color #808080

  SSL authentication check all

  !

  login message "VPN".

  !

  Group Policy MyDefaultPolicy

  functions compatible svc

  SVC-pool of addresses "sslvpnpool."

  SVC Dungeon-client-installed

  Group Policy - by default-MyDefaultPolicy

  AAA authentication list sslvpn

  Gateway MyGateway

  development

  !

  end

  Any suggestions on where to look?

  Hello

  It works for me. When the client tries to resolve the fqdn for the domain specified in "svc split dns.." he will contact the DNS server assigned through the Tunnel. For all other questions, he contacts the DNS outside the Tunnel.

  You can run a capture of packets on the physical interface on the Client to see the query DNS leaving?

  Also in some routers, DNS is designated as the router itself (who is usually address 192.168.X.X), if you want to make sure that assigned DNS server doesn't not part of the Split Tunnel.

  Naman

• VPN design tips

  I usually deal with issues of LAN/WAN, but have very little experience with the design of the VPN. I would like to know if I have the right idea or if there is a better solution to target.

  Scenario:

  There is a staff with two remote offices. Remote offices have 10 to 20 people each with little or no planned growth and different firewall solutions. HQ has 40-50 people anticipating exceptional growth and a PIX 515E. The manager would like to remote offices and remote access VPN site to site VPN for the traveler. His biggest concern is the speed through the site to site tunnels.

  My solution:

  Place a hub routers of the 800 series with sets of features VPN and firewalls and VPN 3005 behind the PIX to HQ in remote controls.

  This seems sufficient? Other recommendations?

  No I don't think so. This should be good only for the 515.

• Need help with Config VPN on ASA5505

  Our client has a seller who needs to establish a VPN tunnel to their own router that sits behind our firewall.

  Concentrator VPN (seller) ASA5505 customer (7.2) <------> <------->3750 Switch <------->VPN router (Vendor)

  Here is the implementation of information:

  ASA outside Interface - 208.64.1x.x4 DG - 208.64.1x.x3

  ASA inside the Interface - 172.20.58.13/30

  3750 switch Interface connected to ASA - DG - 172.20.58.13 and 172.20.58.14/30

  3750 switch Interface connected to router VPN - 172.20.58.21

  The Interface of the VPN router connected to the 3750 - 172.20.58.22/30 DG - 172.20.58.21

  I have also attached a Visio for that and the current configuration of execution of ASA and 3750. We have no access to the router VPN TNS.

  Our responsibility is to everything just to make sure that the tunnel rises.

  You kindly help me with this?

  Here is what I intend to do:

  (1) create a static NAT on the ASA Public Private IP Address of the VPN router

  Public - 208.64.1x.x5 / 28

  Private - 172.20.58.21 / 30

  Will be the ASA automatically ARP for this address or do we I have to configure another interface on the ASA with this public IP address?

  (2) what would the access on the ASA list?

  (3) the customer gave us some config to copy the stuff on the SAA so that they can create the tunnel but I couldn't put these commands in the SAA. How this would apply and which interface?

  Access to firewall: the information below is about access between the VPN router and the

  VPN concentrator. If a firewall/router is present in front of the VPN services must be

  permit:

  allow a host 208.224.x.x esp

  allow a host 208.224.x.x gre

  permit any isakmp udp host 208.224.x.x eq

  permit any eq non500-isakmp udp host 208.224.x.x

  allow a host 204.8.x.x esp

  allow a host 204.8.x.x gre

  permit any isakmp udp host 204.8.x.x eq

  permit any eq non500-isakmp udp host 204.8.x.x

  permit tcp 206.x.x.0 0.0.0.255 any eq 22

  permit tcp 206.x.x.0 0.0.0.255 any eq telnet

  allow a udp host 208.224.x.x

  allow a udp host 208.224.x.x

  Can someone help me with the commands I need to run it on the ASA? The 5505 running 7.2 code (4).

  Thanks in advance.

  HS

  Your steps are correct, you need to configure static NAT and the list of access to allow access.

  Static NAT would be as follows:

  static (inside, outside) 208.64.1x.x5 172.20.58.21 netmask 255.255.255.255

  You also need a road inside interface-oriented join 172.20.58.21:

  Route inside 172.20.58.21 255.255.255.255 172.20.58.14

  You have already access list on the external interface? If you have, then just add in the existing access list, if you don't have it, and then add the following:

  access list outside-acl permit udp any host 208.64.1x.x5 eq 500

  access list outside-acl permit udp any host 208.64.1x.x5 eq 4500

  access list outside-acl allow esp any host 208.64.1x.x5

  Access-group acl outside in external interface

  If you also have an inside interface access list, you must also allow passing traffic by as follows:

  access-list allow host 172.20.58.21 udp any eq 500

  access-list allow host 172.20.58.21 udp any eq 4500

  access-list allow host esp 172.20.58.21 all

  If you have not had any access inside the interface list, then you don't need to configure it.

  Hope that helps.

• vSphere 5.0 and 5.5 SSO design question

  Hi all

  Currently we have a configuration with two virtual center servers installed.  One at our Production site and one on our site of Dr.  Our site of Production and the location of the DR are in a different location in the city, they are currently on a dish network, but this is subject to change to treat us like a totally different place.  We also currently do not use vCenter Linked Mode because we don't have two vCenters and like separation, however if its requried we can install it.

  The plan is to upgrade the DR site first to iron out everything before the upgrade of the production, with that said we where thinking about install SSO as such:

  http://www.VMware.com/files/PDF/vCenter/VMware-vCenter-Server-5.5-technical-whitepaper.PDF

  Page 11: I joined the design image

  We think where to install the first SSO on the site of DR and when completely modernize us our production site install an another SSO as another site to keep the replcatio SSO in place aka option:

  vCenter Single Sign-On for an additional vCenter server with a new site

  The end config looks like the second ssoconfig2 of attachment

  I wanted to just a few oppinons on this choice and if this is the best way to go with what we design.

  
  Any help is greatly appricated,

  
  Thank you

  Hello

  I mean, this is Option 3 will be necessary if you want to use related modes.

  With regard to your questions:

  1. Yes, you can keep the two separate vCenter and a simple installation or see option 1 install both

  2 linked Mode requires option 3 works. But you can still use Option 3 without related modes if you want to have the replication of single-domain SSO (means that if you create a user in SSO VC1, it is replicated to the other SSO).

  Let's say you do not use option 3 for your second vCenter, subsequently if you decide to use bound mode, you must uninstall and reinstall SSO for your second vCenter to shape Option 1 to 3 Option replication of your first vCenter

• Fashion design question (several sites)

  Hello

  I test View5 to vSphere5 and I have a question of design across multiple locations. See the image below. We have two locations, each has its own data center. Unfortunately, these two specific locations are currently connected only via an internet VDSL 20/20 Mbit connection and it is now improving.

  The LOCATION 2 is actually an office with many clients and also its own small data center (also based in vSphere5). The primary data center is in LOCATION 1 and is where I would put all my workstations virtual (not only for LOCATION 2, but for all the other places as well) and where the view connection manager will be. The problem is that on the LOCATION 2 (office) there are some servers of files users on this site using heavily.
  
  

  Question No. 1:

  (a) selling virtual offices on LOCATION 1-> in this case PCoIP will provide me with a pretty good connection, the problem is to access the file is used on 1 LOCATION of virtual desktops (it's GREEN Lane).

  (b) selling virtual desktops on the LOCATION 2-> in this case will have to go through the Manager connections, then the Virtual Office on the 2 LOCATION and to the customer... no idea no how this work (it's the PURPLE path)... it seems like a heavy network load? However, that could result in a quick access to files on the LOCATION 2 servers.

  Another solution is to put the Connection Manager view also in LOCATION 2, but that would make me administer another system, and I want to keep things simple.

  What do you suggest me?

  Question No. 2:

  I have to route traffic to LOCATION 2 to 1 of the LOCATION where the view connection manager lives by VPN or is the PCoIP traffic encrypted by itself and is OK to put it in the DMZ (controlled)?

  Thanks for the help!

  

  The Orange path in the attached picture would be more precise if secure tunneling has been disabled?

• VPN connection question

  In my workplace, there are two networks is the local LAN that connect other computers to the internet and the wireless network which my computer connect to and is directly to the internet, my question is that is it possible to connect to the LAN over the internet using the connection V P N if yes how? Please help me because whenever I want to read my emails, I have to put the UTP cable which will be sometimes annoying.
  Please indicate all the measures that are needed to establish the VPN connection.

  Ask it professionals about your place of work.  They know what is possible and what is not.

  Where I work, there is an available VPN that allows connections to the LAN from outside work.  If I use a laptop computer provided by the company, access the LAN just as if I'm at work.  If I use my PC, I get a link that allows me to access a limited number of resources, such as the email of the company.  I can, however, DRC to my desktop at work PC and can get access to the local network.

• Config VPN concentrator

  We have an existing VPN 3000 Concentrator series. We are the migration of a hosted solution that uses an ASA 5510. The people who will manage the ASA asking all our old hub configurations. From what I see the hub uses a Menu system in function that will take me hours to compile all the information on. Is there an easier way to show the config? Perhaps something like a "show execution" on a router?

  Thomas

  Indeed, there are several options that are easier and better:

  -in the section of the administration, under the direction of file option is a choice for TFTP transfer. You can use this to TFTP configuration file from the hub to a TFTP server.

  - or in the administration section, the file management option contains an option where you can view the config file. and from there you could copy and paste it in a file on your PC. (this is essentially the show run the option)

  HTH

  Rick

• Cisco ASA 5515 two asa firewall ipsec vpn tunnel is not coming

  HelloW everyone.

  I configured ipsec vpn tunnel between Singapore and Malaysia with asa firewall.

  but the vpn does not come to the top. can someone tell me what can be the root cause?

  Here is the configuration of twa asa: (I changed the ip address all the)

  Singapore:

  See the race
  ASA 2.0000 Version 4
  !
  ASA5515-SSG520M hostname
  activate the encrypted password of PVSASRJovmamnVkD
  names of
  !
  interface GigabitEthernet0/0
  nameif inside
  security-level 100
  IP 192.168.15.4 255.255.255.0
  !
  interface GigabitEthernet0/1
  nameif DMZ
  security-level 50
  IP 192.168.5.3 255.255.255.0
  !
  interface GigabitEthernet0/2
  nameif outside
  security-level 0
  IP 160.83.172.8 255.255.255.224
  <--- more="" ---="">
                
  !
  <--- more="" ---="">
                
  interface GigabitEthernet0/3
  <--- more="" ---="">
                
  Shutdown
  <--- more="" ---="">
                
  No nameif
  <--- more="" ---="">
                
  no level of security
  <--- more="" ---="">
                
  no ip address
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  nameif test
  security-level 100
  IP 192.168.168.219 255.255.255.0
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  connection of the banner ^ C please disconnect if you are unauthorized access ^ C
  connection of the banner please disconnect if you are unauthorized access
  boot system Disk0: / asa922-4-smp - k8.bin
  passive FTP mode
  network of the SG object
  <--- more="" ---="">
                
  192.168.15.0 subnet 255.255.255.0
  network of the MK object
  192.168.6.0 subnet 255.255.255.0
  service of the TCP_5938 object
  Service tcp destination eq 5938
  Team Viewer description
  service tcp_3306 object
  Service tcp destination eq 3306
  service tcp_465 object
  tcp destination eq 465 service
  service tcp_587 object
  Service tcp destination eq 587
  service tcp_995 object
  tcp destination eq 995 service
  service of the TCP_9000 object
  tcp destination eq 9000 service
  network of the Inside_host object
  Home 192.168.15.202
  service tcp_1111 object
  Service tcp destination eq 1111
  service tcp_7878 object
  Service tcp destination eq 7878
  service tcp_5060 object
  SIP, service tcp destination eq
  <--- more="" ---="">
                
  service tcp_5080 object
  Service tcp destination eq 5080
  network of the NETWORK_OBJ_192.168.15.0_24 object
  192.168.15.0 subnet 255.255.255.0
  inside_access_in list extended access allowed object SG ip everything
  OUTSIDE_IN list extended access permit tcp any newspaper EQ 9000 Inside_host object
  access extensive list ip 192.168.15.0 outside_cryptomap allow 255.255.255.0 object MK
  pager lines 24
  Enable logging
  timestamp of the record
  exploitation forest-size of the buffer of 30000
  debug logging in buffered memory
  recording of debug trap
  debugging in the history record
  asdm of logging of information
  host test 192.168.168.231 record
  host test 192.168.168.203 record
  Within 1500 MTU
  MTU 1500 DMZ
  Outside 1500 MTU
  test MTU 1500
  management of MTU 1500
  no failover
  <--- more="" ---="">
                
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 7221.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source SG SG static destination MK MK non-proxy-arp-search to itinerary
  !
  network of the SG object
  NAT dynamic interface (indoor, outdoor)
  network of the Inside_host object
  NAT (inside, outside) interface static 9000 9000 tcp service
  inside_access_in access to the interface inside group
  Access-group OUTSIDE_IN in interface outside
  Route outside 0.0.0.0 0.0.0.0 160.83.172.x 1
  Route inside 10.0.1.0 255.255.255.0 192.168.15.199 1
  Route inside 10.0.2.0 255.255.255.0 192.168.15.199 1
  Route inside 10.0.11.0 255.255.255.0 192.168.15.199 1
  Route inside 10.1.0.0 255.255.0.0 192.168.15.199 1
  Route inside 10.8.0.0 255.255.0.0 192.168.15.199 1
  Route inside 10.104.0.0 255.255.0.0 192.168.15.199 1
  Route inside 192.168.8.0 255.255.255.0 192.168.15.199 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  <--- more="" ---="">
                
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  the ssh LOCAL console AAA authentication
  Enable http server

  Community trap SNMP-server host test 192.168.168.231 *.
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps syslog
  Crypto ipsec transform-set ikev1 VPN-TRANSFORM esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  <--- more="" ---="">
                
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  <--- more="" ---="">
                
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  crypto CRYPTO - map 2 map corresponds to the address outside_cryptomap
  card crypto CRYPTO-map 2 set peer 103.246.3.54
  card crypto CRYPTO-map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto CRYPTO-map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  CRYPTO-card interface card crypto outside
  trustpool crypto ca policy
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400

  Console timeout 0
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
  internal GroupPolicy1 group strategy
  attributes of Group Policy GroupPolicy1
  Ikev1 VPN-tunnel-Protocol
  username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
  username gmsadmin password HS/VyK0jtJ/PANQT encrypted privilege 15
  tunnel-group 143.216.30.7 type ipsec-l2l
  tunnel-group 143.216.30.7 General-attributes
  Group Policy - by default-GroupPolicy1
  <--- more="" ---="">
                
  IPSec-attributes tunnel-group 143.216.30.7
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  Overall description
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  <--- more="" ---="">
                
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:ccce9a600b491c8db30143590825c01d
  : end

  Malaysia:

  :
  ASA 2.0000 Version 4
  !
  hostname ASA5515-SSG5-MK
  activate the encrypted password of PVSASRJovmamnVkD
  names of
  !
  interface GigabitEthernet0/0
  nameif inside
  security-level 100
  IP 192.168.6.70 255.255.255.0
  !
  interface GigabitEthernet0/1
  nameif DMZ
  security-level 50
  IP 192.168.12.2 255.255.255.0
  !
  interface GigabitEthernet0/2
  nameif outside
  security-level 0
  IP 143.216.30.7 255.255.255.248
  <--- more="" ---="">
                
  !
  interface GigabitEthernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  nameif test
  security-level 100
  IP 192.168.168.218 255.255.255.0
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  <--- more="" ---="">
                
  Interface Port - Channel 1
  No nameif
  no level of security
  IP 1.1.1.1 255.255.255.0
  !
  boot system Disk0: / asa922-4-smp - k8.bin
  passive FTP mode
  clock timezone GMT + 8 8
  network of the SG object
  192.168.15.0 subnet 255.255.255.0
  network of the MK object
  192.168.6.0 subnet 255.255.255.0
  service of the TCP_5938 object
  Service tcp destination eq 5938
  Team Viewer description
  service tcp_3306 object
  Service tcp destination eq 3306
  service tcp_465 object
  tcp destination eq 465 service
  service tcp_587 object
  Service tcp destination eq 587
  service tcp_995 object
  tcp destination eq 995 service
  service of the TCP_9000 object
  <--- more="" ---="">
                
  tcp destination eq 9000 service
  network of the Inside_host object
  Home 192.168.6.23
  service tcp_1111 object
  Service tcp destination eq 1111
  service tcp_7878 object
  Service tcp destination eq 7878
  service tcp_5060 object
  SIP, service tcp destination eq
  service tcp_5080 object
  Service tcp destination eq 5080
  network of the NETWORK_OBJ_192.168.2.0_24 object
  192.168.6.0 subnet 255.255.255.0
  inside_access_in list extended access allowed object SG ip everything
  VPN-INTERESTING-TRAFFIC extended access list permit ip object MK SG
  OUTSIDE_IN list extended access permit tcp any newspaper EQ 9000 Inside_host object
  outside_cryptomap to access extended list ip 192.168.6.0 allow 255.255.255.0 object SG
  pager lines 24
  Enable logging
  timestamp of the record
  exploitation forest-size of the buffer of 30000
  debug logging in buffered memory
  recording of debug trap
  asdm of logging of information
  <--- more="" ---="">
                
  host test 192.168.168.231 record
  host test 192.168.168.203 record
  Within 1500 MTU
  MTU 1500 DMZ
  Outside 1500 MTU
  test MTU 1500
  management of MTU 1500
  reverse IP check management interface path
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 7221.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source MK MK static destination SG SG route no-proxy-arp-search
  NAT (inside, outside) static source NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 static destination SG SG route no-proxy-arp-search
  !
  network of the MK object
  NAT dynamic interface (indoor, outdoor)
  network of the Inside_host object
  NAT (inside, outside) interface static 9000 9000 tcp service
  inside_access_in access to the interface inside group
  Access-group OUTSIDE_IN in interface outside
  Route outside 0.0.0.0 0.0.0.0 143.216.30.x 1
  <--- more="" ---="">
                
  Route inside 10.2.0.0 255.255.0.0 192.168.6.200 1
  Route inside 10.6.0.0 255.255.0.0 192.168.6.200 1
  Route inside 192.168.254.0 255.255.255.0 192.168.6.200 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  the ssh LOCAL console AAA authentication
  Enable http server

  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 VPN-TRANSFORM esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  <--- more="" ---="">
                
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  <--- more="" ---="">
                
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec pmtu aging infinite - the security association
  crypto CRYPTO - map 2 map corresponds to the address outside_cryptomap
  card crypto CRYPTO-map 2 set peer 160.83.172.8
  card crypto CRYPTO-map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  CRYPTO-card interface card crypto outside
  trustpool crypto ca policy
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  SSH timeout 60
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
  attributes of Group Policy DfltGrpPolicy
  Ikev1 VPN-tunnel-Protocol l2tp ipsec without ssl-client
  internal GroupPolicy1 group strategy
  attributes of Group Policy GroupPolicy1
  Ikev1 VPN-tunnel-Protocol
  username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
  username gmsadmin password HS/VyK0jtJ/PANQT encrypted privilege 15
  <--- more="" ---="">
                
  tunnel-group MK SG type ipsec-l2l
  IPSec-attributes tunnel-group MK-to-SG
  IKEv1 pre-shared-key *.
  tunnel-group 160.83.172.8 type ipsec-l2l
  tunnel-group 160.83.172.8 General-attributes
  Group Policy - by default-GroupPolicy1
  IPSec-attributes tunnel-group 160.83.172.8
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  <--- more="" ---="">
                
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
  : end

  Good news, that VPN has been implemented!

  According to the ping problem, my suggestion is to check, if some type of firewall based on host computers on both sides block ICMP requests.

  Anyway, you can still use the capture of packets on the inside of the interfaces of the two ASAs, to check if the ICMP traffic is to reach the ASA.

  In addition, you can try to enable ICMP inspection:

  Policy-map global_policy
  class inspection_default

  inspect the icmp

  inspect the icmp error

• Client VPN authentication question

  Hi friends,

  I recently started a new company, where the Cisco VPN Client is used by all remote Windows users. I'm not familiar with the customer. I see by our remote access policy that clients authenticate using PAP. This immediately caught my concern.

  My question is if this poses a threat to security? Even if the authentication is not encrypted, it is always the case in a 3DES IPSec tunnel, right? What is the best practice regarding using the VPN client and authentication?

  Thanks in advance!

  Equipment:

  Cisco VPN Client v5 (latest version) on Windows XP SP3

  Microsoft IAS (RADIUS) on W2K3 Server R2 x 64

  Router Cisco 3825

  IOS 12.4.24T Adv IP Services

  If I understand your customer VPN ends on 3825 router. the customer gets the name of username/password prompt after than phase 1 so it may not be clear.

  I hope this helps

  concerning

  -Syed

• Cisco ASA VPN tunnel question - DMZ interface

  I am trying to build a tunnel to a customer with NAT and I'm able to get 3 of the 4 networks to communicate. The 1 that is not responding is a DMZ network. Excerpts from config below. What am I doing wrong with the 10.0.87.0/24 network? The error in the log is "routing cannot locate the next hop.

  interface Ethernet0/1
  Speed 100
  half duplex
  nameif inside
  security-level 100
  the IP 10.0.0.1 255.255.255.0
  OSPF cost 10
  send RIP 1 version
  !
  interface Ethernet0/2
  nameif DMZ
  security-level 4
  IP 172.16.1.1 255.255.255.0
  OSPF cost 10

  network object obj - 172.16.1.0
  subnet 172.16.1.0 255.255.255.0

  object network comm - 10.240.0.0
  10.240.0.0 subnet 255.255.0.0
  network object obj - 10.0.12.0
  10.0.12.0 subnet 255.255.255.0
  network object obj - 10.0.14.0
  10.0.14.0 subnet 255.255.255.0
  network of the DNI-NAT1 object
  10.0.84.0 subnet 255.255.255.0
  network of the DNI-NAT2 object
  10.0.85.0 subnet 255.255.255.0
  network of the DNI-VIH3 object
  10.0.86.0 subnet 255.255.255.0
  network of the DNI-NAT4 object
  10.0.87.0 subnet 255.255.255.0

  the DNI_NAT object-group network
  network-object DNI-NAT1
  network-object DNI-NAT2
  network-object ID-VIH3
  network-object NAT4 DNI

  DNI_VPN_NAT1 to access ip 10.0.0.0 scope list allow 255.255.255.0 object comm - 10.240.0.0
  Access extensive list ip 10.0.12.0 DNI_VPN_NAT2 allow 255.255.255.0 object comm - 10.240.0.0
  Access extensive list ip 10.0.14.0 DNI_VPN_NAT3 allow 255.255.255.0 object comm - 10.240.0.0
  Access extensive list ip 172.16.1.0 DNI_VPN_NAT4 allow 255.255.255.0 object comm - 10.240.0.0
  access-list extended DNI-VPN-traffic permit ip object-group, object DNI_NAT comm - 10.240.0.0

  NAT (inside, outside) source static obj - 10.0.12.0 DNI-NAT2 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp
  NAT (inside, outside) source static obj - 10.0.14.0 DNI-VIH3 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp
  NAT (inside, outside) source static obj - 172.16.1.0 DNI-NAT4 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp

  Hello

  I see that the issue here is the declaration of NAT:

  NAT (inside, outside) source static obj - 172.16.1.0 DNI-NAT4 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp

  The correct statement would be:

  NAT (DMZ, external) source static obj - 172.16.1.0 DNI-NAT4 destination static comm - 10.240.0.0 comm - net 10.240.0.0 to net non-proxy-arp

  Go ahead and do a tracer of packages:

  Packet-trace entry DMZ 172.16.1.15 tcp 443 detailed 10.240.X.X

  Thus, you will see the exempt NAT works now.

  I would like to know how it works!

  Please don't forget to rate and score as correct the helpful post!

  Kind regards

  David Castro,