GANYMEDE + SSH authentication problem Fo ASA

Dear Sir

I managed an ASA 5540 assets/failover pair. SSH authentication is performed via GANYMEDE + ACS located 4.2 in the same VLAN as the inside interface of the firewall. I have added two firewalls on the ACS using their inside as the interface IP addresses (using addresses active and reserve). I can succesfully authenticate and connect to the ASA assets without any problem. But on the SAA on hold, I get SSH prompt but I couldn't connect. When I see the log of failed attempts under GBA, I noticed that "Unknown SIN" for the ASA. How can I solve this problem?

Best regards

Abebe Amare

Engineer network, VivaCell

Hi Abebe,

On the ASA high school, please check the following:

SH failover---> and make sure that the secondary image is waiting ready and not missed.

HS-Server aaa---> check the output and see if the ASA marked the radius server under the name 'UP' and the exchange of packets.

Activate the following debugs and perform an authentication test as shown:

Debug aaa authentication

debugging Ganymede

Debug ssh

aaa-server host username authentication test "insert name of" passes "insert a password."

Provide me with him debugs after taking on your username in it so that I can analyze.

See you soon,.

Christian V

Tags: Cisco Security

Similar Questions

With Ganymede ACS authentication problem

My organization was using ACS with AD to authenticate users for access to network devices.

But lately, it does not work. There has been no known changes.

Can anyone help point the possible problems or links to see how the actual configuration of the CSA to be or look like for that to work.

My apologies if this is naïve question, am not not so easy with ACS.

Thank you!

Hello

There are two ways to correct the message 'windows dialin permission required. You can either add permissions to call on the user accounts on your database of Windows, or you can remove the option "Require Dialin permissions" ACS. To do this, go to "External user databases" and select "Database Configuration". Then go in your database of Windows and click "configure". The first option is a

box that gives you the opportunity to "make sure that grant dialin permission is checked.

Checking this box will cause the error you get if your windows users do not have permissions to call. If you uncheck this box, it must clarify this.

HTH

JK

Authentication problem when you try to connect

I have a Linksys router. Connected WN2000RPT as described in the instructions of Netgear. Everything went through the lights very well, good, EXT appears on the scan available networks, etc. Tried to connect a Smart TV Vizio and burn TV Amazon tablet Asus. All 3 devices show... EXT with a strong signal. However, each device does not, connect with an error message 'Authentication problem' or simply 'cannot connect."

My router is connected using personal safety ' WPA2/WPA mixed. " When you configure the wifi extender, I said to use the same SSID and the security that the router setting. Online reading on the settings available on the WN2000 and decided that the problem was perhaps a "lag" in the security implementation because WN2000 is not the same as available router setting. Do you have a factory reset on extension and returned to through the procedure, only not selected use the same level of security as a router, but manually selected WPA/PSK (AES) for the Extender. Same exact error of my devices as before.

I thought that maybe by using the security settings of the router it was to spoil the Extender because they do not have the same settings available. But perhaps using different parameters (when the Extender receives the signal from the router, but perhaps on a "pass-through" only basis?) problems as well?

So, can someone tell me if there is a way to get my devices to connect to the Extender, or this is always going to be a problem because the router has a security setting, and if I manually set the security OR say scope to use the same security settings, it will not work because the two units are not compatible? I'm doing something wrong? Any ideas? Thank you!

Hello RealisticDave

Did you have a different SSID on the router and not the same as routers SSID?

DarrenM

Yoga of 1050F WiFi authentication problem 2

Hello

I am a new Member and just upgraded to 5 android. Seems a big mistake because it is unable to connect to the internet (no problem with android 4) says authentication problem. Tried cancellation and re - enter password, router turning on and off power and factory reset. Nothing. If Lenovo come with a repair how will I be able to get into the Tablet when I have no internet connection. For the moment, I have a tablet which is equally useful as a tile. Help

Hello

Just disable IPV6 in your Inbox, because Lollipop use IPV6 (default) and some box are not entirely compatible.

BIAPPS-ODI authentication problem

Hi friends,
IM at biapps 11g with ODI 11 g. I configured connection odi in the studio and can properly connect to see these maps std BIAPPS in ODI.
But 2 days before, im in the face of an authentication problem by connecting the ODI studio with the user who I connected successfully forward.
The error that I'm facing here is the
ODI: 26130: could not connect to the repository, ODI-10190: user dev_biadmin has his account has expired.

Im getting the error above and the user tried to connect is "dev_biadmin" in the studio of ODI.

Therefore, to the question above, I followed the MOS score below

ORS Installer fails with ODI-10190: user FUSION_APPS_PROV_PATCH_APPID has his account has expired (Doc ID 1666023.1()

IM facing the same error explained in the note above, but force helped me because it treats FUSIONAPPS BI I guess.

Kindly advice me friends, to solve this problem.

Brgds,
Saro

Hi, Saro,

Connection to studio ODI as a SUPERVISOR user. Go to ODI--> Switch authentication mode--> give your contact information to ODIREPO and sign in.

You will get the message properly connected. Click the Security tab. try to connect as a SUPERVISOR. Once the connection is successful. Go to the user of the cprresponding (dev_biadmin) account and change the password.

Logout and go to ODI--> switch authentication mode. Give the details. It will change external authentication. Now you should be able to log in as dev_biadmin.

Hope this will solve your problem...

Kind regards

Vanina

I have several websites in Muse. Everything was fine until last night. When publishing to Business Catalyst I get a message, teling me the following: unknown authentication problem - shared unknown error: 80. What should do?

I have several websites in Muse. Everything was fine until last night. When publishing to Business Catalyst I get a message, teling me the following: unknown authentication problem - shared unknown error: 80. What should do?

Hello

To resolve this problem, you will need to disconnect muse and connect again.

Here are the steps to the disconnection of Muse:

1. help > log out.

2. Once signed on restart Muse (please sign using Adobe ID if she invites to connect)

You should be all set.

Concerning

Vivek

Problem connection ASA 5520 GANYMEDE

I'm just confused at this point. This is the configuration I have so far for the configuration of Ganymede on ASA 5520. SH run

aaa-server TacServer protocol tacacs+aaa-server TacServer (LAN) host 172.19.0.226key *****

user-identity default-domain LOCALaaa authentication telnet console LOCALaaa authentication http console TacServer LOCAL aaa authentication ssh console TacServer LOCAL aaa authentication enable console TacServer LOCALaaa authorization command TacServer LOCAL

route LAN 172.19.0.0 255.255.255.0 172.30.186.1 1

After that I was done with the Setup, I was able to connect using my username tacacas and the password you + activate password.

After that, I closed my GANYMEDE server + to try to the local database. It worked for the user name and password but my password enable does not work locally. Got to be something very simple and he had written down, I was connected via the cable from the console and also changed it was completely with the user name and password but still not able to go into enable mode.

After that failed I returned and turned on on my server TACACAS. When to wait a few minutes and trying to connect via tacacas NO GO. He doesn't like my username and password.

So now I'm locked out and have to do password recovery because I can not connect using tacacas, and when tacacas is off I can not go in the local mode.

Very litle documentation cisco out there for this issue... Any thoughts what coukld be the cause? I know that GANYMEDE works very well since he works on 500 + devices, I'm just confused at this point.

I need to check a few things before recovery of password:

To activate question, try typing the login: follow-up of your user name and password.

For Ganymede number:

1.] error on the section of logging of the server Ganymede while accessing the credentials of Ganymede.

2.] was there any problems reachbility during this time?

3.] all services came fine?

4.] should focus on debugs following:

debugging Ganymede

Debug aaa authentication

I'm not sure if this can be replicated, but yes love to help out if possible.

Jatin kone

-Does the rate of useful messages-

A problem when authentication via Radius ASA

Hi all

Please give me a helping hand. I have a problem when through ASA 5520 via Radius Authentication for ACS 4.0 via the VPN device. I need to configure secure authentication and NAC for remote user VPN. It simply does not work, but it works when you use Ganymede so all the connection seems to be ok as ACS succesfully authenticate a remote via MS AD VPN user when you use Ganymede. But I read that I can not use NAC when Ganymede using, I'm good? ASA and ACS journals indicate a problem with the shared key but I already double checked the key on both sides, the IP address is correct on SAA and I also tried all possible methods of RADIUS on SAA. Any idea where might be a problem?

Hello

When you use ACS 4.0, then make sure that the AAA Client for ASA entry you created on GBA, if under a NDG, then make sure that there is no key to the NDG level.

Otherwise, pass entry client ASA as RADIUS ACS in NDG (Unassigned) on ACS.

Kind regards

Prem

5.6 ACS authentication problem

We are in the process of upgrading our ACS 4.1 for a 5.6 ACS appliance.

The unit is installed on the network, etc. correctly licensed.

I joined the ACS server to the AD domain without problem. I created a few local and external (AD) users for testing.

I created a network (switch catalyst) as a Ganymede client device + and specified single-connect.

When I SSH into the switch, I can connect using my AD user name and password, but I can't go into enable mode. It says "authentication failure".

My aaa settings are

radius-server host 172.25.50.8
RADIUS-server timeout 3
RADIUS-server application made
radius-server key

Miss me something somewhere, I don't know where. If I try and download the bundle to support ACS, it says download, but does not say where (or how).

any advice would be great. I'm new to this product.

See the document: http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/migration/guide/migration_guide/Migration_support.html#pgfId-1014889

Problem with ASA 5505 VPN remote access

After about 1 year to have the VPN Client from Cisco connection to an ASA 5505 with no problems, all of a sudden one day it stops working. The customer is able to get a connection to the ASA and browse the local network for only about 30 seconds after the connection. After that, no access is available to the network behind the ASA. I have tried everything I can think of to try to solve the problem, but at this point, I'm just banging my head against a wall. Anyone know what could cause this?

Here is the cfg running of the ASA

----------------------------------------------------------------------------------------

: Saved

:

ASA Version 8.4 (1)

!

hostname NCHCO

enable encrypted password xxxxxxxxxxxxxxx

xxxxxxxxxxx encrypted passwd

names of

description of NCHCO name 192.168.2.0 City offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address **. ***. 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

boot system Disk0: / asa841 - k8.bin

passive FTP mode

network of the NCHCO object

Subnet 192.168.2.0 255.255.255.0

network object obj - 192.168.1.0

subnet 192.168.1.0 255.255.255.0

network object obj - 192.168.2.64

subnet 192.168.2.64 255.255.255.224

network object obj - 0.0.0.0

subnet 0.0.0.0 255.255.255.0

network obj_any object

subnet 0.0.0.0 0.0.0.0

the Web server object network

the FINX object network

Home 192.168.2.11

rdp service object

source between 1-65535 destination eq 3389 tcp service

Rdp description

outside_nat0_outbound extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

outside_nat0_outbound extended access list permit ip object NCHCO 192.168.2.0 255.255.255.0

inside_nat0_outbound extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

inside_nat0_outbound list of allowed ip extended access all 192.168.2.64 255.255.255.224

permit access list extended ip 0.0.0.0 inside_nat0_outbound 255.255.255.0 192.168.2.64 255.255.255.224

outside_1_cryptomap extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

outside_1_cryptomap_1 extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

LAN_Access list standard access allowed 192.168.2.0 255.255.255.0

LAN_Access list standard access allowed 0.0.0.0 255.255.255.0

NCHCO_splitTunnelAcl_1 list standard access allowed 192.168.2.0 255.255.255.0

AnyConnect_Client_Local_Print deny ip extended access list a whole

AnyConnect_Client_Local_Print list extended access permit tcp any any eq lpd

Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 631

print the access-list AnyConnect_Client_Local_Print Note Windows port

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

AnyConnect_Client_Local_Print list extended access permit udp any host 224.0.0.251 eq 5353

AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

AnyConnect_Client_Local_Print list extended access permit udp any host 224.0.0.252 eq 5355

Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 137

AnyConnect_Client_Local_Print list extended access udp allowed any any eq netbios-ns

outside_access_in list extended access permit tcp any object FINX eq 3389

outside_access_in_1 list extended access allowed object rdp any object FINX

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

mask of VPN_Pool VPN_Start VPN_End of local pool IP 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 649.bin

don't allow no asdm history

ARP timeout 14400

NAT (inside, all) static source NCHCO destination NCHCO static obj - 192.168.1.0 obj - 192.168.1.0

NAT (inside, all) static source any any destination static obj - 192.168.2.64 obj - 192.168.2.64

NAT (inside, all) source static obj - 0.0.0.0 0.0.0.0 - obj destination static obj - 192.168.2.64 obj - 192.168.2.64

!

network obj_any object

NAT dynamic interface (indoor, outdoor)

the FINX object network

NAT (inside, outside) interface static service tcp 3389 3389

Access-group outside_access_in_1 in interface outside

Route outside 0.0.0.0 0.0.0.0 69.61.228.177 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

network-acl outside_nat0_outbound

WebVPN

SVC request to enable default svc

Enable http server

http 192.168.1.0 255.255.255.0 inside

http *. **. ***. 255.255.255.255 outside

http *. **. ***. 255.255.255.255 outside

http NCHCO 255.255.255.0 inside

http 96.11.251.186 255.255.255.255 outside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac ikev1 l2tp-transform

IKEv1 crypto ipsec transform-set l2tp-transformation mode transit

Crypto ipsec transform-set vpn-transform ikev1 esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA ikev1

transport mode encryption ipsec transform-set TRANS_ESP_3DES_SHA ikev1

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5 ikev1

transport mode encryption ipsec transform-set TRANS_ESP_3DES_MD5 ikev1

Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set pfs Group1

crypto dynamic-map dyn-map 10 set transform-set l2tp vpn-transform processing ikev1

dynamic-map encryption dyn-map 10 value reverse-road

Crypto-map dynamic outside_dyn_map 20 set transform-set ESP-3DES-SHA ikev1

Crypto-map dynamic outside_dyn_map 20 the value reverse-road

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs Group1

peer set card crypto outside_map 1 74.219.208.50

card crypto outside_map 1 set transform-set ESP-3DES-SHA ikev1

map outside_map 20-isakmp ipsec crypto dynamic outside_dyn_map

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

inside crypto map inside_map interface

card crypto vpn-map 1 match address outside_1_cryptomap_1

card crypto vpn-card 1 set pfs Group1

set vpn-card crypto map peer 1 74.219.208.50

card crypto 1 set transform-set ESP-3DES-SHA ikev1 vpn-map

dynamic vpn-map 10 dyn-map ipsec isakmp crypto map

crypto isakmp identity address

Crypto ikev1 allow inside

Crypto ikev1 allow outside

IKEv1 crypto ipsec-over-tcp port 10000

IKEv1 crypto policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

IKEv1 crypto policy 15

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

IKEv1 crypto policy 35

preshared authentication

3des encryption

sha hash

Group 2

life 86400

enable client-implementation to date

Telnet 192.168.1.0 255.255.255.0 inside

Telnet NCHCO 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH NCHCO 255.255.255.0 inside

SSH timeout 5

Console timeout 0

dhcpd address 192.168.2.150 - 192.168.2.225 inside

dhcpd dns 216.68.4.10 216.68.5.10 interface inside

lease interface 64000 dhcpd inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server DNS 192.168.2.1

L2TP ipsec VPN-tunnel-Protocol ikev1

nchco.local value by default-field

attributes of Group Policy DfltGrpPolicy

value of server DNS 192.168.2.1

L2TP ipsec VPN-tunnel-Protocol ikev1 ssl-clientless ssl-client

allow password-storage

enable IPSec-udp

enable dhcp Intercept 255.255.255.0

the address value VPN_Pool pools

internal NCHCO group policy

NCHCO group policy attributes

value of 192.168.2.1 DNS Server 8.8.8.8

Ikev1 VPN-tunnel-Protocol

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list NCHCO_splitTunnelAcl_1

value by default-field NCHCO.local

admin LbMiJuAJjDaFb2uw encrypted privilege 15 password username

username privilege 15 encrypted password yB1lHEVmHZGj5C2Z 8njferg

username NCHvpn99 password dhn. JzttvRmMbHsP encrypted

attributes global-tunnel-group DefaultRAGroup

address (inside) VPN_Pool pool

address pool VPN_Pool

authentication-server-group (inside) LOCAL

authentication-server-group (outside LOCAL)

LOCAL authority-server-group

authorization-server-group (inside) LOCAL

authorization-server-group (outside LOCAL)

Group Policy - by default-DefaultRAGroup

band-Kingdom

band-band

IPSec-attributes tunnel-group DefaultRAGroup

IKEv1 pre-shared-key *.

NOCHECK Peer-id-validate

tunnel-group DefaultRAGroup ppp-attributes

No chap authentication

no authentication ms-chap-v1

ms-chap-v2 authentication

tunnel-group DefaultWEBVPNGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

tunnel-group 74.219.208.50 type ipsec-l2l

IPSec-attributes tunnel-group 74.219.208.50

IKEv1 pre-shared-key *.

type tunnel-group NCHCO remote access

attributes global-tunnel-group NCHCO

address pool VPN_Pool

Group Policy - by default-NCHCO

IPSec-attributes tunnel-group NCHCO

IKEv1 pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

call-home

Profile of CiscoTAC-1

no active account

http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

email address of destination [email protected] / * /

destination-mode http transport

Subscribe to alert-group diagnosis

Subscribe to alert-group environment

Subscribe to alert-group monthly periodic inventory

monthly periodicals to subscribe to alert-group configuration

daily periodic subscribe to alert-group telemetry

Cryptochecksum:a2110206e1af06974c858fb40c6de2fc

: end

ASDM image disk0: / asdm - 649.bin

ASDM VPN_Start 255.255.255.255 inside location

ASDM VPN_End 255.255.255.255 inside location

don't allow no asdm history

---------------------------------------------------------------------------------------------------------------

And here are the logs of the Cisco VPN Client when sailing, then is unable to browse the network behind the ASA:

---------------------------------------------------------------------------------------------------------------

Cisco Systems VPN Client Version 5.0.07.0440

Copyright (C) 1998-2010 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.1.7601 Service Pack 1

Config files directory: C:\Program Files (x 86) \Cisco Systems\VPN Client\

1 09:44:55.677 01/10/13 Sev = Info/6 CERT / 0 x 63600026

Try to find a certificate using hash Serial.

2 09:44:55.677 01/10/13 Sev = Info/6 CERT / 0 x 63600027

Found a certificate using hash Serial.

3 09:44:55.693 01/10/13 Sev = Info/6 GUI/0x63B00011

RELOADED successfully certificates in all certificate stores.

4 09:45:02.802 10/01/13 Sev = Info/4 CM / 0 x 63100002

Start the login process

5 09:45:02.802 01/10/13 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

6 09:45:02.802 01/10/13 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "*." **. ***. *** »

7 09:45:02.802 10/01/13 Sev = Info/6 IKE/0x6300003B

Try to establish a connection with *. **. ***. ***.

8 09:45:02.818 10/01/13 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

9 09:45:02.865 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) to *. **. ***. ***

10 09:45:02.896 10/01/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

11 09:45:02.896 10/01/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

12 09:45:02.896 10/01/13 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

13 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

14 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

15 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

16 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

17 09:45:02.927 01/10/13 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

18 09:45:02.927 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) to *. **. ***. ***

19 09:45:02.927 01/10/13 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xDD3B, Remote Port = 0x01F4

20 09:45:02.927 01/10/13 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is NOT behind a NAT device

21 09:45:02.927 01/10/13 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

22 09:45:02.943 10/01/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

23 09:45:02.943 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

24 09:45:02.943 01/10/13 Sev = Info/4 CM / 0 x 63100015

Launch application xAuth

25 09:45:03.037 01/10/13 Sev = Info/6 GUI/0x63B00012

Attributes of the authentication request is 6: 00.

26 09:45:03.037 01/10/13 Sev = Info/4 CM / 0 x 63100017

xAuth application returned

27 09:45:03.037 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

28 09:45:03.037 10/01/13 Sev = Info/4 IPSEC / 0 x 63700008

IPSec driver started successfully

29 09:45:03.037 01/10/13 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

30 09:45:03.083 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

31 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

32 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

33 09:45:03.083 01/10/13 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

34 09:45:03.083 01/10/13 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

35 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

36 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

37 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="" **.**.***.***="" isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

38 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 192.168.2.70

39 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.255.0

40 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 192.168.2.1

41 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 8.8.8.8

42 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000001

43 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

44 09:45:03.146 10/01/13 Sev = Info/5 IKE/0x6300000F

SPLIT_NET #1

= 192.168.2.0 subnet

mask = 255.255.255.0

Protocol = 0

SRC port = 0

port dest = 0

45 09:45:03.146 10/01/13 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = NCHCO.local

46 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_UDP_NAT_PORT, value = 0 x 00002710

47 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

48 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = 8.4 (1) Cisco systems, Inc. ASA5505 Version built by manufacturers on Tuesday, January 31, 11 02:11

49 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

50 09:45:03.146 01/10/13 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

51 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 192.168.2.70, GW IP = *. **. ***. remote IP address = 0.0.0.0

52 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to *. **. ***. ***

53 09:45:03.177 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

54 09:45:03.177 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

55 09:45:03.177 01/10/13 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

56 09:45:03.177 01/10/13 Sev = Info/5 IKE / 0 x 63000047

This SA was already alive for 1 second, expiration of adjustment to 86399 seconds now

57 09:45:03.193 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

58 09:45:03.193 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" qm="" *(hash,="" sa,="" non,="" id,="" id,="" notify:status_resp_lifetime)="" from="">

59 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify is set to 28800 seconds

60 09:45:03.193 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH) to *. **. ***. ***

61 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000059

IPsec Security Association of loading (MsgID = SPI OUTBOUND SPI INCOMING = 0x3EBEBFC5 0xAAAF4C1C = 967A3C93)

62 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000025

OUTGOING ESP SPI support: 0xAAAF4C1C

63 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000026

Charges INBOUND ESP SPI: 0x3EBEBFC5

64 09:45:03.193 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

65 09:45:03.521 01/10/13 Sev = Info/6 CVPND / 0 x 63400001

Launch VAInst64 for controlling IPSec virtual card

66 09:45:03.896 01/10/13 Sev = Info/4 CM / 0 x 63100034

The virtual card has been activated:

IP=192.168.2.70/255.255.255.0

DNS = 192.168.2.1, 8.8.8.8

WINS = 0.0.0.0 0.0.0.0

Domain = NCHCO.local

Split = DNS names

67 09:45:03.912 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 0.0.0.0 0.0.0.0 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 0.0.0.0 0.0.0.0 261

68 09:45:07.912 01/10/13 Sev = Info/4 CM / 0 x 63100038

Were saved successfully road to file changes.

69 09:45:07.912 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

**. **. ***. 255.255.255.255 96.11.251.1 96.11.251.149 100

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.2.0 255.255.255.0 192.168.2.70 192.168.2.70 261

192.168.2.0 255.255.255.0 192.168.2.1 192.168.2.70 100

192.168.2.70 255.255.255.255 192.168.2.70 192.168.2.70 261

192.168.2.255 255.255.255.255 192.168.2.70 192.168.2.70 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 192.168.2.70 192.168.2.70 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 192.168.2.70 192.168.2.70 261

70 09:45:07.912 01/10/13 Sev = Info/6 CM / 0 x 63100036

The routing table has been updated for the virtual card

71 09:45:07.912 01/10/13 Sev = Info/4 CM/0x6310001A

A secure connection established

72 09:45:07.943 01/10/13 Sev = Info/4 CM/0x6310003B

Look at address added to 96.11.251.149. Current host name: psaserver, current address (s): 192.168.2.70, 96.11.251.149, 192.168.1.3.

73 09:45:07.943 01/10/13 Sev = Info/4 CM/0x6310003B

Look at address added to 192.168.2.70. Current host name: psaserver, current address (s): 192.168.2.70, 96.11.251.149, 192.168.1.3.

74 09:45:07.943 01/10/13 Sev = Info/5 CM / 0 x 63100001

Did not find the smart card to watch for removal

75 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

76 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700010

Creates a new key structure

77 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370000F

Adding key with SPI = 0x1c4cafaa in the list of keys

78 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700010

Creates a new key structure

79 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370000F

Adding key with SPI = 0xc5bfbe3e in the list of keys

80 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370002F

Assigned WILL interface private addr 192.168.2.70

81 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700037

Configure the public interface: 96.11.251.149. SG: **.**.***.***

82 09:45:07.943 10/01/13 Sev = Info/6 CM / 0 x 63100046

Define indicator tunnel set up in the registry to 1.

83 09:45:13.459 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

84 09:45:13.459 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205276

85 09:45:13.474 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

86 09:45:13.474 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

87 09:45:13.474 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205276, seq # expected is 107205276

88 09:45:15.959 01/10/13 Sev = Info/4 IPSEC / 0 x 63700019

Activate key dating SPI = 0x1c4cafaa key with SPI = 0xc5bfbe3e

89 09:46:00.947 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

90 09:46:00.947 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205277

91 09:46:01.529 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

92 09:46:01.529 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

93 09:46:01.529 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205277, seq # expected is 107205277

94 09:46:11.952 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

95 09:46:11.952 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205278

96 09:46:11.979 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

97 09:46:11.979 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

98 09:46:11.979 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205278, seq # expected is 107205278

---------------------------------------------------------------------------------------------------------------

Any help would be appreciated, thanks!

try to refuse the ACL (access-list AnyConnect_Client_Local_Print extended deny ip any one) at the end of the ACL.

Problem VPN ASA 5505 8.3 (1) a site

Hello

My problem is with VPN site-to-site. It's between ASA5505 8.3 (1) and Pix 501 6.3 (5). The tunnel is created between them and it's good, here you have the results to see the crypto ipsec's and isakmp his

ciscoasa # sh crypto isakmp his

ITS enabled: 1

Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

Total SA IKE: 1

1 peer IKE: 91.X.X.57

Type: L2L role: initiator

Generate a new key: no State: MM_ACTIVE

ciscoasa # sh crypto ipsec his

Interface: outside

Tag crypto map: outside_map, seq num: 1, local addr: 79.X.X.2

list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

Remote ident (addr, mask, prot, port): (192.168.11.0/255.255.255.0/0/0)

current_peer: 91.X.X.57

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

#pkts decaps: 3757, #pkts decrypt: 3757, #pkts check: 3757

compressed #pkts: 0, unzipped #pkts: 0

#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

success #frag before: 0, failures before #frag: 0, #fragments created: 0

Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

#send errors: 0, #recv errors: 0

local crypto endpt. : 79.X.X.2/0, remote Start crypto. : 91.X.X.57/0

Path mtu 1500, fresh ipsec generals 74, media, mtu 1500

current outbound SPI: F1C2FD46

current inbound SPI: 1BCF8C49

SAS of the esp on arrival:

SPI: 0x1BCF8C49 (466586697)

transform: aes-256-esp esp-md5-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 376832, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (4373665/20348)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0xFFFFFFFF to 0xFFFFFFFF

outgoing esp sas:

SPI: 0xF1C2FD46 (4056087878)

transform: aes-256-esp esp-md5-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 376832, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (4374000/20348)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

But the problem is, as you can see in a show crypto ipsec sa, there is now traffic to a remote network of ASA

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

I have a single device on the remote network sends data to a sysloger on the local network and it works fine, all received messages but not other way to traffic.

To make sure that I go see the Nat and packet - trace entry inside tcp 192.168.10.7 1024 192.168.11.250 80 and looks like SHEEP works very well and traffic is allowed, but still once anything gets into the tunnel of local network

Results

ciscoasa # sh nat

Manual NAT policies (Section 1)

1 (one) to (all) source static sheep sheep sheep destination static sheep

translate_hits = 0, untranslate_hits = 38770

2 (inside) for the service public static obj - the source (on the outside) TCP1433 TCP1433 79.X.X.5 192.168.10.7

translate_hits = 0, untranslate_hits = 95

3 (inside) to the source (external) static obj - 192.168.10.7 interface service zzz zzz

translate_hits = 0, untranslate_hits = 19

4 (inside) of the (whole) source static obj - 10.0.0.0 obj - 10.0.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

translate_hits = 17, untranslate_hits = 0

5 (inside) of the (whole) source static obj - obj - static 192.168.10.0 192.168.10.0 obj - obj-destination 10.1.1.1 10.1.1.1

translate_hits = 134, untranslate_hits = 0

6 (inside) to the (whole) source static obj - 10.1.1.1 obj - 10.1.1.1 destination static obj - 192.168.10.0 obj - 192.168.10.0

translate_hits = 0, untranslate_hits = 0

7 (inside) of the (whole) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

translate_hits = 172, untranslate_hits = 53

Auto NAT policies (Section 2)

1 (inside) (outside) source static obj - 192.168.10.3 service TCP 3389 3389 79.X.X.5

translate_hits = 12, untranslate_hits = 4823

2 (inside) (outside) source static obj - 192.168.10.5 79.X.X.3 DNS

translate_hits = 341869, untranslate_hits = 41531

3 (inside) (outside) source static obj - 192.168.10.3 - 01 79.X.X.5 service TCP 444 444

translate_hits = 0, untranslate_hits = 0

4 (inside) to the source (external) static obj - 192.168.10.7 tcp 3389 3389 service interface

translate_hits = 21, untranslate_hits = 751

5 (inside) (outside) source static obj - 192.168.10.7 - 02 interface tcp 8080 https service

translate_hits = 0, untranslate_hits = 100

6 (inside) (outside) source static obj - 192.168.10.11 79.X.X.5 TCP smtp smtp service

translate_hits = 2, untranslate_hits = 18838

7 (inside) (outside) source static obj - 192.168.10.11 - 01 udp 443 443 service 79.X.X.5

translate_hits = 0, untranslate_hits = 0

8 (inside) (outside) source static obj - 192.168.10.11 - 02 79.X.X.5 tcp https https service

translate_hits = 221, untranslate_hits = 9770

9 (inside) (outside) source static obj - 192.168.10.11 - 03 79.X.X.5 tcp https https service

translate_hits = 0, untranslate_hits = 0

10 (inside) (outside) source static obj - 192.168.10.15 79.X.X.5 service tcp www 81

translate_hits = 0, untranslate_hits = 34

11 (inside) (outside) source static obj - 192.168.10.26 79.X.X.5 service TCP 8080 8080

translate_hits = 9, untranslate_hits = 4407

12 (inside) (outside) source static obj - 192.168.10.26 - 01 79.X.X.5 tcp 8080 www service

translate_hits = 0, untranslate_hits = 578

13 (inside) (outside) source static obj - 192.168.10.220 79.X.X.6 service TCP 3389 3389

translate_hits = 0, untranslate_hits = 41

14 (inside) (outside) source static obj - 192.168.10.220 - 1 79.X.X.6 tcp https https service

translate_hits = 0, untranslate_hits = 3

15 (inside) to the obj_any interface dynamic source (external)

translate_hits = 410005, untranslate_hits = 144489

16 (invited) to dynamic interface of the source (outside) obj_any-01

translate_hits = 19712, untranslate_hits = 4490

ciscoasa # packet - trace entry inside tcp 192.168.10.7 1024 192.168.11.250 80

Phase: 1

Type: UN - NAT

Subtype: static

Result: ALLOW

Config:

NAT (any, any) source static sheep sheep sheep destination static sheep

Additional information:

NAT divert on exit to the outside interface

Untranslate 192.168.11.250/80 to 192.168.11.250/80

Phase: 2

Type: ACCESS-LIST

Subtype: Journal

Result: ALLOW

Config:

Access-group inside_out in interface inside

access-list extended inside_out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

Additional information:

Direct flow from returns search rule:

ID = 0xd9886ae8, priority = 13, area = allowed, deny = false

hits = 18503, user_data = 0xd6581290, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0xd80c87c8, priority = 0, sector = inspect-ip-options, deny = true

hits = 1047092, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 4

Type: NAT

Subtype:

Result: ALLOW

Config:

NAT (any, any) source static sheep sheep sheep destination static sheep

Additional information:

Direct flow from returns search rule:

ID = 0xd9859830, priority = 6, area = nat, deny = false

hits = 2107, user_data = 0xd83a9b48, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = any

Phase: 5

Type: HOST-LIMIT

Subtype:

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0xd8114d98, priority = 0, domain = host-limit, deny = false

hits = 674350, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = output_ifc = any to inside,

Phase: 6

Type: VPN

Subtype: encrypt

Result: ALLOW

Config:

Additional information:

Direct flow from returns search rule:

ID = 0xd83a9960, priority = 70, domain = encrypt, deny = false

hits = 26732, user_data = 0xce165c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol

IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = external

Phase: 7

Type: NAT

Subtype: rpf check

Result: ALLOW

Config:

NAT (any, any) source static sheep sheep sheep destination static sheep

Additional information:

Direct flow from returns search rule:

ID = 0xd98d1d70, priority = 6, area = nat-reversed, deny = false

hits = 1419, user_data = 0xd83a9b48, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

input_ifc = none, output_ifc = any

Phase: 8

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0xd9bda388, priority = 69 = ipsec-tunnel-flow area, deny = false

hits = 486, user_data is 0x13492cc, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=192.168.11.0 SRC, mask is 255.255.255.0, port = 0

IP/ID=192.168.10.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 9

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional information:

Reverse flow from returns search rule:

ID = 0xd8192ab0, priority = 0, sector = inspect-ip-options, deny = true

hits = 1169899, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

input_ifc = out, output_ifc = any

Phase: 10

Type: CREATING STREAMS

Subtype:

Result: ALLOW

Config:

Additional information:

New workflow created with the 1293619 id, package sent to the next module

Information module for forward flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_tcp_normalizer

snp_fp_translate

snp_fp_adjacency

snp_fp_encrypt

snp_fp_fragment

snp_ifc_stat

Information for reverse flow...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_ipsec_tunnel_flow

snp_fp_translate

snp_fp_tcp_normalizer

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input interface: inside

entry status: to the top

entry-line-status: to the top

output interface: outside

the status of the output: to the top

output-line-status: to the top

Action: allow

It is a complete config for ASA

VPN

Network local 192.168.10.0/24

remote network 192.168.11.0/24

Config

:

ASA Version 8.3 (1)

!

ciscoasa hostname

domain.com domain name

activate the password * encrypted

passwd * encrypted

names of

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.10.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP 79.X.X.2 255.255.255.248

!

interface Vlan12

prior to interface Vlan1

nameif comments

security-level 80

192.168.4.1 IP address 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 2

!

interface Ethernet0/6

!

interface Ethernet0/7

switchport access vlan 12

!

boot system Disk0: / asa831 - k8.bin

passive FTP mode

clock timezone GMT/UTC 0

summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00

DNS domain-lookup outside

DNS server-group DefaultDNS

Server name 192.168.10.11

domain.com domain name

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

network object obj - 192.168.0.0

Subnet 192.168.0.0 255.255.0.0

network object obj - 192.168.2.0

Subnet 192.168.2.0 255.255.255.128

network object obj - 10.0.0.0

subnet 10.0.0.0 255.0.0.0

network object obj - 192.168.10.2

host 192.168.10.2

network object obj - 192.168.10.2 - 01

host 192.168.10.2

network object obj - 192.168.10.3

host 192.168.10.3

network object obj - 192.168.10.2 - 02

host 192.168.10.2

network object obj - 192.168.10.2 - 03

host 192.168.10.2

network object obj - 192.168.10.3 - 01

Home 192.168.10.7

network object obj - 192.168.10.5

host 192.168.10.5

newserver network object

Home 192.168.10.7

New SQL Server description

network object obj - 192.168.10.7

Home 192.168.10.7

network of the A_79.X.X.6 object

Home 79.X.X.6

network of the PublicServer_NAT1 object

Home 192.168.10.7

zzz service object

service source eq 1 65535 udp syslog destination range

Syslog description

purpose of the 79.X.X.5 network

Home 79.X.X.5

service of the TCP1433 object

destination service tcp source eq 1433 1 65535 range

Description TCP1433

network object obj - 192.168.10.220

Home 192.168.10.220

network object obj - 192.168.10.220 - 1

Home 192.168.10.220

network object obj - 192.168.10.222

Home 192.168.10.222

network object obj - 192.168.10.2 - 04

host 192.168.10.2

network object obj - 192.168.10.7 - 02

Home 192.168.10.7

network object obj - 192.168.10.11

Home 192.168.10.11

network object obj - 192.168.10.11 - 01

Home 192.168.10.11

network object obj - 192.168.10.11 - 02

Home 192.168.10.11

network object obj - 192.168.10.11 - 03

Home 192.168.10.11

network object obj - 192.168.10.26

Home 192.168.10.26

network object obj - 192.168.10.26 - 01

Home 192.168.10.26

network object obj - 192.168.10.15

Home 192.168.10.15

network object obj - 192.168.10.11 - 04

Home 192.168.10.11

network object obj - 10.1.1.1

host 10.1.1.1

network object obj - 192.168.10.0

192.168.10.0 subnet 255.255.255.0

network object obj - 192.168.10.220 - 2

Home 192.168.10.220

network vpn-local object

192.168.10.0 subnet 255.255.255.0

object network vpn - ru

subnet 192.168.11.0 255.255.255.0

network obj_any object

subnet 0.0.0.0 0.0.0.0

network obj_any-01 object

subnet 0.0.0.0 0.0.0.0

object-group service syslog udp

Service Description syslog group

port-object eq syslog

object-group service udp zzzz

port-object eq syslog

object-group service sss udp

port-object eq syslog

object-group network sheep

object-network 192.168.10.0 255.255.255.0

object-network 192.168.11.0 255.255.255.0

object-network 192.168.3.0 255.255.255.0

outside_all of access allowed any ip an extended list

VPN_splitTunnelAcl list standard access allowed 192.168.0.0 255.255.0.0

VPN_splitTunnelAcl list standard access allowed 10.0.0.0 255.0.0.0

permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.2.0 255.255.255.128

inside_nat0_outbound to access ip 10.0.0.0 scope list allow 255.0.0.0 192.168.2.0 255.255.255.128

access-list extended inside_out allow ip 192.168.11.0 255.255.255.0 192.168.10.0 255.255.255.0

access-list extended inside_out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

scope of the inside_out to the list of permitted any one ip access

inside_out to the access list extended 192.168.11.0 allowed any ip 255.255.255.0

inside_out to the list of access permit tcp host 192.168.10.2 any eq smtp

inside_out to the list of access permit tcp any any eq smtp

access-list extended inside_out allow udp 192.168.10.0 255.255.255.0 host 10.1.1.1

access-list extended inside_out permit udp host 10.1.1.1 192.168.10.0 255.255.255.0

inside_out to the list of allowed extensive access icmp host 192.168.10.7 all

inside_out to the list of allowed extensive access a whole icmp

outside_zzz list of allowed ip extended access any external interface

outside_zzz list extended access permit tcp host 87.X.X.73 host 79.X.X.5 eq 1433

outside_zzz tcp extended access list refuse any host 79.X.X.5 eq 1433

outside_zzz list extended access permitted tcp 207.126.144.0 255.255.240.0 eq 79.X.X.5 the smtp host

outside_zzz tcp extended access list refuse any host 79.X.X.5 eq smtp

outside_zzz access-list extended permit ip any host 79.X.X.5

outside_zzz of access allowed any ip an extended list

permit access list extended ip 192.168.10.0 outside_in 255.255.255.0 192.168.11.0 255.255.255.0

access extensive list ip 192.168.11.0 outside_in allow 255.255.255.0 192.168.10.0 255.255.255.0

access extensive list ip 192.168.11.0 outside_in allow 255.255.255.0 any

outside_in list extended access permit tcp any host 192.168.10.15 eq 81

outside_in list extended access permit ip any host 192.168.10.5

access-list outside_in extended permit ip any host 79.X.X.4

outside_in list extended access permit tcp host 82.X.X.166 host 192.168.10.7 eq 1433

outside_in list extended access permit tcp host 84.X.X.30 host 192.168.10.7 eq 1433

outside_in list extended access tcp refuse any host 192.168.10.7 eq 1433

outside_in list extended access permit tcp any host 192.168.10.3 eq 444

outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 host 192.168.10.11 eq 444

outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 eq smtp host 192.168.10.11

outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 host 192.168.10.2 eq smtp

outside_in list extended access tcp refuse any host 192.168.10.11 eq smtp

outside_in list extended access tcp refuse any host 192.168.10.2 eq smtp

outside_in list extended access permit tcp any host 192.168.10.2 eq smtp

outside_in list extended access permit udp any host 192.168.10.2 eq 443

outside_in list extended access permit tcp any host 192.168.10.3 eq 3389

outside_in list extended access permit tcp any host 192.168.10.2 eq 4125

outside_in list extended access permit tcp any host 192.168.10.11 eq https

outside_in list extended access permit tcp any host 192.168.10.2 eq https

outside_in list extended access allowed esp all the host 91.X.X.57

outside_in list extended access permit tcp any host 192.168.10.3 eq 1433

access-list extended outside_in permit ip host 91.X.X.57 all

access-list outside_in extended permit ip any host 79.X.X.5

access-list outside_in extended permit ip any host 79.X.X.2

outside_in list extended access permit tcp any host 79.X.X.6 eq 3389

outside_in list extended access permit tcp any host 192.168.10.220 eq 3389

outside_in list extended access permit tcp any host 79.X.X.5 eq 81

access extensive list permits all ip a outside_in

outside_in list extended access permit tcp host 91.X.X.178 host 192.168.10.7 eq 1433

outside_in list extended access permit tcp host 87.X.X.73 host 192.168.10.7 eq 1433

access-list extended qnap permit ip host 192.168.10.26 all

access-list extended qnap permit ip any host 192.168.10.26

phone_bypass list extended access allowed host 10.1.1.1 ip 192.168.10.0 255.255.255.0

permit phone_bypass to access extended list ip 192.168.10.0 255.255.255.0 host 10.1.1.1

phone_bypass list extended access allowed host 10.1.1.1 ip 192.168.2.0 255.255.255.0

phone_bypass to access extended list ip 192.168.2.0 allow 255.255.255.0 host 10.1.1.1

list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

extended vpn 192.168.11.0 ip access list allow 255.255.255.0 192.168.10.0 255.255.255.0

pager lines 24

Enable logging

exploitation forest-size of the buffer 1024000

logging asdm-buffer-size 512

logging buffered information

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

Comments of MTU 1500

mask of local pool RemoteVPN 192.168.2.20 - 192.168.2.100 IP 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ICMP allow all outside

ASDM image disk0: / asdm - 631.bin

enable ASDM history

ARP timeout 14400

NAT (any, any) source static sheep sheep sheep destination static sheep

NAT source service (Interior, exterior) static obj - 192.168.10.7 79.X.X.5 TCP1433 TCP1433

NAT (inside, outside) source static obj - 192.168.10.7 interface service zzz zzz

NAT (inside, all) source static obj - 10.0.0.0 obj - 10.0.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

NAT (inside, all) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 10.1.1.1 obj - 10.1.1.1

NAT (inside, all) source static obj - 10.1.1.1 obj - 10.1.1.1 destination static obj - 192.168.10.0 obj - 192.168.10.0

NAT (inside, all) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

!

network object obj - 192.168.10.3

NAT (inside, outside) static service tcp 3389 3389 79.X.X.5

network object obj - 192.168.10.3 - 01

NAT (inside, outside) static 79.X.X.5 tcp 444 444 service

network object obj - 192.168.10.5

NAT (inside, outside) public static dns 79.X.X.3

network object obj - 192.168.10.7

NAT (inside, outside) interface static service tcp 3389 3389

network object obj - 192.168.10.220

NAT (inside, outside) static service tcp 3389 3389 79.X.X.6

network object obj - 192.168.10.220 - 1

NAT (inside, outside) static 79.X.X.6 tcp https https service

network object obj - 192.168.10.7 - 02

NAT (inside, outside) interface static tcp 8080 https service

network object obj - 192.168.10.11

NAT (inside, outside) static 79.X.X.5 tcp smtp smtp service

network object obj - 192.168.10.11 - 01

NAT (inside, outside) udp 443 443 service 79.X.X.5 static

network object obj - 192.168.10.11 - 02

NAT (inside, outside) static 79.X.X.5 tcp https https service

network object obj - 192.168.10.11 - 03

NAT (inside, outside) static 79.X.X.5 tcp https https service

network object obj - 192.168.10.26

NAT (inside, outside) static 79.X.X.5 8080 8080 tcp service

network object obj - 192.168.10.26 - 01

NAT (inside, outside) static 79.X.X.5 tcp 8080 www service

network object obj - 192.168.10.15

NAT (inside, outside) static 79.X.X.5 tcp 81 www service

network obj_any object

NAT dynamic interface (indoor, outdoor)

network obj_any-01 object

NAT dynamic interface (guest, outdoor)

Access-group inside_out in interface inside

Access-group outside_in in external interface

Route outside 0.0.0.0 0.0.0.0 79.X.X.1 1

Route inside 10.0.0.0 255.0.0.0 192.168.10.4 1

Route outside 10.1.1.1 255.255.255.255 192.168.10.4 1

Route outside 192.168.11.0 255.255.255.0 79.X.X.2 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

RADIUS Protocol RADIUS AAA server

reactivation impoverishment deadtime mode 1

AAA-server RADIUS (inside) host 192.168.10.7

key *.

AAA authentication http LOCAL console

the ssh LOCAL console AAA authentication

LOCAL AAA authorization command

http server enable 444

http 0.0.0.0 0.0.0.0 inside

http 0.0.0.0 0.0.0.0 outdoors

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

No vpn sysopt connection permit

Service resetoutside

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-SHA 256 - aes - esp esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto-map dynamic outside_dyn_map pfs set 20 Group1

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

card crypto outside_map 1 match for vpn

outside_map game 1 card crypto peer 91.X.X.57

card crypto outside_map 1 set of transformation-ESP-AES-SHA

outside_map map 1 lifetime of security association set seconds 28800 crypto

card crypto outside_map 1 set security-association life kilobytes 4608000

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

crypto isakmp identity address

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

lifetime 28800

Crypto isakmp nat-traversal 3600

Telnet timeout 5

SSH 0.0.0.0 0.0.0.0 inside

SSH 0.0.0.0 0.0.0.0 outdoors

SSH timeout 30

Console timeout 0

dhcpd dns 83.X.X.8 83.X.X.10

dhcpd outside auto_config

!

dhcpd address 192.168.10.50 - 192.168.10.100 inside

dhcpd dns 83.X.X.8 83.X.X.10 interface inside

dhcpd lease interface 600 inside

dhcpd interface to domain.com domain inside

!

Reviews of dhcpd address 192.168.4.50 - 192.168.4.100

Dhcpd lease 600 interface comments

Comments enable dhcpd

!

priority queue inside

priority-queue outdoors

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

NTP 93.170.32.1 Server

NTP 93.170.32.2 Server

NTP 89.145.68.17 Server prefer

WebVPN

allow outside

SVC image disk0:/anyconnect-win-2.4.1012-k9.pkg 1 regex 'Windows NT'

SVC image disk0:/anyconnect-wince-ARMv4I-2.4.1012-k9.pkg 2 regex "Windows CE"

enable SVC

Auto-signon allow ip 192.168.0.0 255.255.0.0 basic auth-type

internal l2l group policy

attributes of the l2l group policy

VPN-idle-timeout no

Protocol-tunnel-VPN IPSec

attributes of Group Policy DfltGrpPolicy

value of server DNS 192.168.10.11

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list VPN_splitTunnelAcl

value by default-field DOMAINl.local

internal VPNv group strategy

attributes of Group Policy VPNv

value of server DNS 192.168.10.11

Protocol-tunnel-VPN IPSec webvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list VPN_splitTunnelAcl

field default value domain.com

password username test * encrypted privilege 0

username test attributes

VPN-group-policy VPNv

ID password cisco * encrypted

roger password username * encrypted privilege 15

attributes global-tunnel-group DefaultRAGroup

address pool RemoteVPN

attributes global-tunnel-group DefaultWEBVPNGroup

address pool RemoteVPN

Group-LOCAL RADIUS authentication server

type tunnel-group VPNv remote access

attributes global-tunnel-group VPNv

address pool RemoteVPN

Group-LOCAL RADIUS authentication server

Group Policy - by default-VPNv

IPSec-attributes tunnel-group VPNv

pre-shared key *.

tunnel-group testgroup type remote access

tunnel-group testgroup General attributes

management of the password password-expire-to-days 90

tunnel-group 91.X.X.57 type ipsec-l2l

IPSec-attributes tunnel-group 91.X.X.57

pre-shared key *.

!

Global class-card class

match default-inspection-traffic

class-map qnap_band

corresponds to the list of access qnap

The class-card phone

corresponds to the phone_bypass access list

!

!

Policy-map global_policy

Global category

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Policy-map qnap_access

class qnap_band

512000 64000 police entry

512000 64000 release of police

phone class

set the advanced options of the tcp-State-bypass connection

World-Policy policy-map

Global category

inspect the dns

inspect the ftp

inspect the pptp

inspect the rtsp

inspect the sip

inspect the skinny

Policy-map phone_bypass_policy

phone class

set the advanced options of the tcp-State-bypass connection

!

service-policy-international policy global

service-policy qnap_access to the inside interface

privilege level 3 mode exec cmd command perfmon

privilege level 3 mode exec cmd ping command

mode privileged exec command cmd level 3

logging of the privilege level 3 mode exec cmd commands

privilege level 3 exec command failover mode cmd

privilege level 3 mode exec command packet cmd - draw

privilege level 5 see fashion exec running-config command

order of privilege show level 3 exec mode reload

privilege level 3 exec mode control fashion show

privilege see the level 3 exec firewall command mode

privilege see the level 3 exec mode command ASP.

processor mode privileged exec command to see the level 3

privilege command shell see the level 3 exec mode

privilege show level 3 exec command clock mode

privilege exec mode level 3 dns-hosts command show

privilege see the level 3 exec command access-list mode

logging of orders privilege see the level 3 exec mode

privilege, level 3 see the exec command mode vlan

privilege show level 3 exec command ip mode

privilege, level 3 see fashion exec command ipv6

privilege, level 3 see the exec command failover mode

privilege, level 3 see fashion exec command asdm

exec mode privilege see the level 3 command arp

command routing privilege see the level 3 exec mode

privilege, level 3 see fashion exec command ospf

privilege, level 3 see the exec command in aaa-server mode

AAA mode privileged exec command to see the level 3

privilege see the level 3 exec mode command crypto

privilege, level 3 see fashion exec command vpn-sessiondb

privilege level 3 exec mode command ssh show

privilege, level 3 see fashion exec command dhcpd

privilege, level 3 see the vpnclient command exec mode

privilege, level 3 see fashion exec command vpn

privilege level see the 3 blocks from exec mode command

privilege, level 3 see fashion exec command wccp

privilege, level 3 see the exec command in webvpn mode

privilege control module see the level 3 exec mode

privilege, level 3 see fashion exec command uauth

privilege see the level 3 exec command compression mode

level 3 for the show privilege mode configure the command interface

level 3 for the show privilege mode set clock command

level 3 for the show privilege mode configure the access-list command

level 3 for the show privilege mode set up the registration of the order

level 3 for the show privilege mode configure ip command

level 3 for the show privilege mode configure command failover

level 5 mode see the privilege set up command asdm

level 3 for the show privilege mode configure arp command

level 3 for the show privilege mode configure the command routing

level 3 for the show privilege mode configure aaa-order server

level mode 3 privilege see the command configure aaa

level 3 for the show privilege mode configure command crypto

level 3 for the show privilege mode configure ssh command

level 3 for the show privilege mode configure command dhcpd

level 5 mode see the privilege set privilege to command

privilege level clear 3 mode exec command dns host

logging of the privilege clear level 3 exec mode commands

clear level 3 arp command mode privileged exec

AAA-server of privilege clear level 3 exec mode command

privilege clear level 3 exec mode command crypto

level 3 for the privilege cmd mode configure command failover

clear level 3 privilege mode set the logging of command

privilege mode clear level 3 Configure arp command

clear level 3 privilege mode configure command crypto

clear level 3 privilege mode configure aaa-order server

context of prompt hostname

call-home

Profile of CiscoTAC-1

no active account

http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

email address of destination [email protected] / * /

destination-mode http transport

Subscribe to alert-group diagnosis

Subscribe to alert-group environment

Subscribe to alert-group monthly periodic inventory

monthly periodicals to subscribe to alert-group configuration

daily periodic subscribe to alert-group telemetry

Thanks in advance for any help.

Wojciech salvation,

Based on this info, I think that you can run in CSCtb53186, this bug has affected many versions before 8.3 and when fixed DEVs they were always be some details in waiting, and they created CSCtd36473 to these outstanding issues. CSCtd36473 is fixed on 8.3.1.1 intermediate version however is not fixed on 8.3.1 so I suggest you spend at least 8.3.2

http://www.Cisco.com/Cisco/software/release.html?mdfid=279916854&flowid=4818&softwareid=280775065&release=8.3.2.Ed&rellifecycle=&relind=available&RelType=latest

Read this:

Interface: outside
Tag crypto map: outside_map, seq num: 1, local addr: 79.X.X.2

list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)
Remote ident (addr, mask, prot, port): (192.168.11.0/255.255.255.0/0/0)
current_peer: 91.Y.Y.57

#pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
#pkts decaps: 502, #pkts decrypt: 502, #pkts check: 502
compressed #pkts: 0, unzipped #pkts: 0
#pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
success #frag before: 0, failures before #frag: 0, #fragments created: 0
Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
#send errors: 0, #recv errors: 0

outgoing esp sas:

SPI: 0xDE50E6EA (3729843946)

transform: aes-256-esp esp-md5-hmac no compression

running parameters = {L2L, Tunnel}

slot: 0, id_conn: 425984, crypto-card: outside_map

calendar of his: service life remaining (KB/s) key: (4374000/28234)

Size IV: 16 bytes

support for replay detection: Y

Anti-replay bitmap:

0x00000000 0x00000001

VPN CTX = 0x015F913C

By peer IP = 192.168.11.0
Pointer = 0xD98CACD0
State = upwards
Flags = BA + ESP
ITS = 0X019235E7
SPI = 0xDE50E6EA
Group = 0
Pkts = 0
Pkts bad = 0
Incorrect SPI = 0
Parody = 0
Bad crypto = 0
Redial Pkt = 0
Call redial = 0
VPN = filter

hits = 0, user_data is0x15f913c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

hits = 44437, user_data is0xce165c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

As you can see above we are a different context to encrypt the traffic (not used with the spi of the sh cry ipsec his)

If you do the same packet tracer, but this time with the details of the key words at the end probs you will get to see that we use 0xce165c.

Just looked at your configuration again and before you do the upgrade please correct this:

list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

extended vpn 192.168.11.0 ip access list allow 255.255.255.0 192.168.10.0 255.255.255.0

Just remove the second line:

no -access extended vpn ip 192.168.11.0 list allow 255.255.255.0 192.168.10.0 255.255.255.0

Also:

No outside_map interface card crypto outside

and then:

outside_map interface card crypto outside

See if that helps before perforrming upgrade,

Kind regards.

Users wireless with peap authentication problem

Good afternoon

I am currently trying to authenticate users wireless using PEAP and an external RADIUS server. The problem is when I try to authenticate that I get this error:

AAA/AUTHENTIC/PPP: List of selection method "permanent premises.

Dot11-7-AUTH_FAILED: Station... Failed authentication

Should not use local authentication, but the aaa server that I set up.

I looked on the internet but have not found a working solution.

Does anyone know why it does not work?

Here is my configuration running:

Current configuration: 4276 bytes
!
! Last modification of the configuration at 00:45:40 UTC Monday, March 1, 1993
! NVRAM config update at 16:38:23 UTC Thursday, July 24, 2014
! NVRAM config update at 16:38:23 UTC Thursday, July 24, 2014
version 15.2
no service button
horodateurs service debug datetime msec
Log service timestamps datetime msec
encryption password service
!
host ap name
!
!
Pulse 9 logging console
enable secret 5 $1$ QVC3$ dIVAarlXOo52rN3ceZm1k0
!
AAA new-model
!
!
AAA rad_eap radius server group
192.168.2.2 Server ACCT-port auth-port 1812 1813
!
AAA rad_mac radius server group
!
AAA rad_acct radius server group
!
AAA rad_admin radius server group
!
AAA server Ganymede group + tac_admin
!
AAA rad_pmip radius server group
!
RADIUS server AAA dummy group
!
AAA authentication login eap_methods group rad_eap
AAA authentication login mac_methods local
AAA authorization exec default local
AAA accounting network acct_methods power group rad_acct
!
!
!
!
!
AAA - the id of the joint session
no ip Routing
no ip cef
!
!
!
dot11 syslog
!
ssid dot11 test
authentication open eap eap_list
authentication-key wpa version2 management
Comments-mode
!
!
EAP peap profile
peap method
!
Crypto pki token removal timeout default 0
!
...
!
!
Bridge IRB
!
!
!
interface Dot11Radio0
no ip address
no ip route cache
!
encryption ciphers aes - ccm mode
!
SSID test
!
gain of antenna 0
STBC
beamform ofdm
root of station-role
Bridge-Group 1
Bridge-group subscriber-loop-control 1
Bridge-Group 1 covering-disabled people
Bridge-Group 1 block-unknown-source
No source of bridge-Group 1-learning
unicast bridge-Group 1-floods
!
interface Dot11Radio1
no ip address
no ip route cache
Shutdown
gain of antenna 0
no block of dfs
channel SFR
root of station-role
Bridge-Group 1
Bridge-group subscriber-loop-control 1
Bridge-Group 1 covering-disabled people
Bridge-Group 1 block-unknown-source
No source of bridge-Group 1-learning
unicast bridge-Group 1-floods
!
interface GigabitEthernet0
no ip address
no ip route cache
automatic duplex
automatic speed
dot1x EAP authenticator
Bridge-Group 1
Bridge-Group 1 covering-disabled people
No source of bridge-Group 1-learning
!
interface BVI1
192.168.3.10 IP address 255.255.255.0
no ip route cache
!
The default gateway IP
IP forward-Protocol ND
IP http server
IP http secure server
IP http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
radius of the IP source-interface BVI1
!
format of server RADIUS attribute 32 include-in-access-req hour
RADIUS-server host 192.168.2.2 auth-port 1812 acct-port 1813 borders 7 140441081E501F0B7D
RADIUS vsa server send accounting
!
1 channel ip bridge
!
!
!
Line con 0
line vty 0 4
transport of entry all
!
end

Thank you

I don't have installation autonomous APs before but I think I see the problem. You define a list of authentication , called "eap_methods" but you never call for it in the settings of your SSID. Instead he call you a list named "eap_list" in addition, I think that you might miss one order more. So maybe try this:
```
 dot11 ssid test authentication open eap eap_methods authentication network-eap eap_methods authentication key-management wpa version 2 guest-mode
```
I hope this helps!

Thank you for evaluating useful messages!

RADIUS authentication problem

I have a C6509 with switch IOS sup32 base. I also allows RADIUS authentication on the switch. But whenever I have telnet to the switch brings the following:

Username: XXXXXXXX

Password: XXXXXXXX

Quick > activate

User access audit

Username: XXXXXXXX

Password: XXXXXXXX

I don't like the second username. I was expecting after the enable command, I should just be asked to enter my password and do not ask me a username again.

Here is the version of IOS of the switch:

s3223-adventerprisek9_wan - mz.122 - 33.SXH3a.bin

Here is the config of aaa:

AAA new-model

AAA authentication login default group Ganymede + line activate

the AAA authentication enable default group Ganymede + activate

AAA authorization exec default group Ganymede + authenticated if

AAA authorization commands 15 default group Ganymede + authenticated if

AAA accounting exec default start-stop Ganymede group.

orders accounting AAA 15 by default start-stop Ganymede group.

Kind regards

Enrico

you run may be in bug CSCsu21040. This problem is fixed in SXH4.

iCloud for Windows authentication problem

I have iCloud for V5.2.1.69 Windows running on a current version of Windows 10.

I have a version to update to iTunes, without no problem logging into my account.

I can connect to the version of the browser to iCloud without problems.

I have uninstalled and reinstalled the app iCloud three times now and restarted every time.

I can't connect to the application windows to iCloud well! Every time he is saying

"An error has occurred during authentication. Please try again. »

I must have tried 10 times for several hours and still can not!

If someone managed to connect via the Windows application?

I have the same problem. You have made no progress on this?

Thank you

Notification of Motorola ID "Authentication Problem.

I get a message in my opinion every two days, which is called the problem of authentication. Below it is written: Touch connect with Motorola ID. When I touch the notification to see what's going to happen, it just goes back to the home screen (and probably authenticate something). My phone is otherwise seems to work fine... Yes, I got the update.

GANYMEDE + SSH authentication problem Fo ASA

Similar Questions

Maybe you are looking for