How to set up a one-way IPSec-L2L tunnel

This may be a silly question, since VPN for communications between the parties of confidence and that most people would try to correct a unidirectional tunnel.

But I'm interested to transform a regular one-way only, tunnel that traffic to my side can initiate the tunnel.

Recently, we built this tunnel between our ASA5510 and ASA5510 of our biz partner to run critical applications on their web servers not connected to the Internet. I want to tie down so that they cannot launch the VPN. I have the crypto ACL set to limit to a port address, so they can only come from this port once the tunnel is established. We also have a personal firewall installed on each host.

Any idea on how to make the one-way tunnel and protect also us better once the tunnel is mounted?

Hello

You can use the following command:

defined card crypto seq - num connection-type name {only answer | only | two-way}

This command defines whether the tunnel is come only or single answer. If you set the tunnel on your side to come alone, the asa will never accept the installation of tunnel from your business partner. However, you can still start the configuration of the vpn tunnel.

Check:

http://www.Cisco.com/en/us/partner/docs/security/ASA/asa80/command/reference/C5.html#wp2152576

Even if the reference is to ASA8.0 I know it works for 7.2.x so

Hope this helps

Kind regards

Pieter-Jan

Tags: Cisco Security

Similar Questions

  • I get the error message on debugging ipsec-l2l tunnel

    Hello

    Can someone help me understand the debug message?
    I get the error message on debugging ipsec-l2l tunnel

    I tried to configure an ASA5520 with an ipsec-l2l to ios router 1721

    = 1721 router =.

    Cisco 1721 (flash: c1700-k9o3sy7 - mz.123 - 2.XC2.bin)
    80.89.47.102 outside
    inside 10.100.110.1 255.255.255.0

    Debug crypto ipsec
    Debug crypto ISAKMP

    -config-
    crypto ISAKMP policy 1
    BA 3des
    md5 hash
    preshared authentication
    Group 2
    0 1234567890 128.39.189.10 crypto isakmp key address
    !
    !
    Crypto ipsec transform-set esp-3des pix-series
    !
    ASA 10 ipsec-isakmp crypto map
    defined by peer 128.39.189.10
    transform-set pix - Set
    match address 101
    !
    !
    interface FastEthernet0

    Outside-interface description

    IP 80.89.47.102 255.255.255.252

    NAT outside IP

    card crypto asa

    !

    interface Vlan10
    Inside description
    IP 10.100.110.1 255.255.255.0
    IP nat inside

    !

    !

    IP nat inside source overload map route interface FastEthernet0 sheep

    !

    access-list 101 permit ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255

    !

    access-list 110 deny ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255
    access-list 110 permit ip 10.100.110.0 0.0.0.255 any
    !
    sheep allowed 10 route map
    corresponds to the IP 110
    !

    = Config ASA =.

    Cisco 5520 ASA Version 8.2 (1)
    128.39.189.10 outside
    inside 10.100.4.255 255.255.252.0

    Debug crypto ipsec
    Debug crypto ISAKMP

    -Config-
    !
    Allow Access-list extended sheep 255.255.252.0 IP 10.100.4.0 10.100.110.0 255.255.255.0
    !
    access extensive list ip 10.100.4.0 outside110 allow 255.255.252.0 10.100.110.0 255.255.255.0
    !

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    86400 seconds, duration of life crypto ipsec security association
    Crypto ipsec kilobytes of life - safety 4608000 association
    card crypto outside_map 11 match address outside110
    peer set card crypto outside_map 11 80.89.47.102
    card crypto outside_map 11 game of transformation-ESP-3DES-MD5
    outside_map interface card crypto outside
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    md5 hash
    Group 2
    life 86400

    !

    attributes of Group Policy DfltGrpPolicy
    VPN-idle-timeout no
    Protocol-tunnel-VPN IPSec

    !

    tunnel-group 80.89.47.102 type ipsec-l2l
    IPSec-attributes tunnel-group 80.89.47.102
    pre-shared key 1234567890

    Concerning
    Tor

    You have a transformation defined on the SAA named ESP-3DES-MD5? Your crypto card refers to that but I don't see it listed in the config you have posted. I don't have much experience with routers, but is MD5 hashing algoritm (and why it is not)?

    James

  • How to make my confidence one ways c# windows application that should not blocked by antivirus Applications and how to get the third-party certificate for that?

    Hello

    I built a windows c# application that accesses OS, printer information using WMI query, monitor keyboard strokes overall Win32 API and calls others our executables too.

    Whenever I try to deploy it to computers to our customers, it is getting blocked by antivirus applications.

    If I want to make my request as being approved, we mean that it shouldn't be blocked by antivirus applications.

    How to get the certificate of trustee for my application? Even I am ready to make my request as registered product.

    Kindly let me know the procedures, solutions.

    Thank you

    Senthilkumar AK


    This issue is beyond the scope of this site and must be placed on Technet or MSDN

    http://social.msdn.Microsoft.com/forums/en-us/home

  • Why no implicit route for traffic from IPSec-L2L tunnel?

    In a hub-and-spoke IPSec environment, it is not difficult to implement routing by spoke to the hub.

    But on the side of the hub of a tunnel, where the gateway of last resort for traffic by spoke it, it seems almost counterintuitive than the ACL instructions and even cryptographic doesn't implicitly create a route for the traffic of the station in the tunnel at the end (talk).  It could always be replaced with a static if necessary.

    There is probably a good reason for this, but I can't think of it.  Or am I the only person who thinks it is strange... or maybe an opportunity to feature?

    Hello

    This feature exists and is called reverse road injection. The route is created dynamically (based on ACL Cryptography) and is only available when the SA is up.

    http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gt_rrie.html

    HTH

    Laurent.

  • Cisco ASA 5515 two asa firewall ipsec vpn tunnel is not coming

    HelloW everyone.

    I configured ipsec vpn tunnel between Singapore and Malaysia with asa firewall.

    but the vpn does not come to the top. can someone tell me what can be the root cause?

    Here is the configuration of twa asa: (I changed the ip address all the)

    Singapore:

    See the race
    ASA 2.0000 Version 4
    !
    ASA5515-SSG520M hostname
    activate the encrypted password of PVSASRJovmamnVkD
    names of
    !
    interface GigabitEthernet0/0
    nameif inside
    security-level 100
    IP 192.168.15.4 255.255.255.0
    !
    interface GigabitEthernet0/1
    nameif DMZ
    security-level 50
    IP 192.168.5.3 255.255.255.0
    !
    interface GigabitEthernet0/2
    nameif outside
    security-level 0
    IP 160.83.172.8 255.255.255.224
    <--- more="" ---="">
                  
    !
    <--- more="" ---="">
                  
    interface GigabitEthernet0/3
    <--- more="" ---="">
                  
    Shutdown
    <--- more="" ---="">
                  
    No nameif
    <--- more="" ---="">
                  
    no level of security
    <--- more="" ---="">
                  
    no ip address
    !
    interface GigabitEthernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/5
    nameif test
    security-level 100
    IP 192.168.168.219 255.255.255.0
    !
    interface Management0/0
    management only
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    connection of the banner ^ C please disconnect if you are unauthorized access ^ C
    connection of the banner please disconnect if you are unauthorized access
    boot system Disk0: / asa922-4-smp - k8.bin
    passive FTP mode
    network of the SG object
    <--- more="" ---="">
                  
    192.168.15.0 subnet 255.255.255.0
    network of the MK object
    192.168.6.0 subnet 255.255.255.0
    service of the TCP_5938 object
    Service tcp destination eq 5938
    Team Viewer description
    service tcp_3306 object
    Service tcp destination eq 3306
    service tcp_465 object
    tcp destination eq 465 service
    service tcp_587 object
    Service tcp destination eq 587
    service tcp_995 object
    tcp destination eq 995 service
    service of the TCP_9000 object
    tcp destination eq 9000 service
    network of the Inside_host object
    Home 192.168.15.202
    service tcp_1111 object
    Service tcp destination eq 1111
    service tcp_7878 object
    Service tcp destination eq 7878
    service tcp_5060 object
    SIP, service tcp destination eq
    <--- more="" ---="">
                  
    service tcp_5080 object
    Service tcp destination eq 5080
    network of the NETWORK_OBJ_192.168.15.0_24 object
    192.168.15.0 subnet 255.255.255.0
    inside_access_in list extended access allowed object SG ip everything
    OUTSIDE_IN list extended access permit tcp any newspaper EQ 9000 Inside_host object
    access extensive list ip 192.168.15.0 outside_cryptomap allow 255.255.255.0 object MK
    pager lines 24
    Enable logging
    timestamp of the record
    exploitation forest-size of the buffer of 30000
    debug logging in buffered memory
    recording of debug trap
    debugging in the history record
    asdm of logging of information
    host test 192.168.168.231 record
    host test 192.168.168.203 record
    Within 1500 MTU
    MTU 1500 DMZ
    Outside 1500 MTU
    test MTU 1500
    management of MTU 1500
    no failover
    <--- more="" ---="">
                  
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 7221.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source SG SG static destination MK MK non-proxy-arp-search to itinerary
    !
    network of the SG object
    NAT dynamic interface (indoor, outdoor)
    network of the Inside_host object
    NAT (inside, outside) interface static 9000 9000 tcp service
    inside_access_in access to the interface inside group
    Access-group OUTSIDE_IN in interface outside
    Route outside 0.0.0.0 0.0.0.0 160.83.172.x 1
    Route inside 10.0.1.0 255.255.255.0 192.168.15.199 1
    Route inside 10.0.2.0 255.255.255.0 192.168.15.199 1
    Route inside 10.0.11.0 255.255.255.0 192.168.15.199 1
    Route inside 10.1.0.0 255.255.0.0 192.168.15.199 1
    Route inside 10.8.0.0 255.255.0.0 192.168.15.199 1
    Route inside 10.104.0.0 255.255.0.0 192.168.15.199 1
    Route inside 192.168.8.0 255.255.255.0 192.168.15.199 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    <--- more="" ---="">
                  
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    the ssh LOCAL console AAA authentication
    Enable http server

    Community trap SNMP-server host test 192.168.168.231 *.
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps syslog
    Crypto ipsec transform-set ikev1 VPN-TRANSFORM esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec pmtu aging infinite - the security association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    crypto CRYPTO - map 2 map corresponds to the address outside_cryptomap
    card crypto CRYPTO-map 2 set peer 103.246.3.54
    card crypto CRYPTO-map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto CRYPTO-map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    CRYPTO-card interface card crypto outside
    trustpool crypto ca policy
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400

    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
    internal GroupPolicy1 group strategy
    attributes of Group Policy GroupPolicy1
    Ikev1 VPN-tunnel-Protocol
    username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
    username gmsadmin password HS/VyK0jtJ/PANQT encrypted privilege 15
    tunnel-group 143.216.30.7 type ipsec-l2l
    tunnel-group 143.216.30.7 General-attributes
    Group Policy - by default-GroupPolicy1
    <--- more="" ---="">
                  
    IPSec-attributes tunnel-group 143.216.30.7
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    Overall description
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    <--- more="" ---="">
                  
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:ccce9a600b491c8db30143590825c01d
    : end

    Malaysia:

    :
    ASA 2.0000 Version 4
    !
    hostname ASA5515-SSG5-MK
    activate the encrypted password of PVSASRJovmamnVkD
    names of
    !
    interface GigabitEthernet0/0
    nameif inside
    security-level 100
    IP 192.168.6.70 255.255.255.0
    !
    interface GigabitEthernet0/1
    nameif DMZ
    security-level 50
    IP 192.168.12.2 255.255.255.0
    !
    interface GigabitEthernet0/2
    nameif outside
    security-level 0
    IP 143.216.30.7 255.255.255.248
    <--- more="" ---="">
                  
    !
    interface GigabitEthernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/4
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface GigabitEthernet0/5
    nameif test
    security-level 100
    IP 192.168.168.218 255.255.255.0
    !
    interface Management0/0
    management only
    nameif management
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    <--- more="" ---="">
                  
    Interface Port - Channel 1
    No nameif
    no level of security
    IP 1.1.1.1 255.255.255.0
    !
    boot system Disk0: / asa922-4-smp - k8.bin
    passive FTP mode
    clock timezone GMT + 8 8
    network of the SG object
    192.168.15.0 subnet 255.255.255.0
    network of the MK object
    192.168.6.0 subnet 255.255.255.0
    service of the TCP_5938 object
    Service tcp destination eq 5938
    Team Viewer description
    service tcp_3306 object
    Service tcp destination eq 3306
    service tcp_465 object
    tcp destination eq 465 service
    service tcp_587 object
    Service tcp destination eq 587
    service tcp_995 object
    tcp destination eq 995 service
    service of the TCP_9000 object
    <--- more="" ---="">
                  
    tcp destination eq 9000 service
    network of the Inside_host object
    Home 192.168.6.23
    service tcp_1111 object
    Service tcp destination eq 1111
    service tcp_7878 object
    Service tcp destination eq 7878
    service tcp_5060 object
    SIP, service tcp destination eq
    service tcp_5080 object
    Service tcp destination eq 5080
    network of the NETWORK_OBJ_192.168.2.0_24 object
    192.168.6.0 subnet 255.255.255.0
    inside_access_in list extended access allowed object SG ip everything
    VPN-INTERESTING-TRAFFIC extended access list permit ip object MK SG
    OUTSIDE_IN list extended access permit tcp any newspaper EQ 9000 Inside_host object
    outside_cryptomap to access extended list ip 192.168.6.0 allow 255.255.255.0 object SG
    pager lines 24
    Enable logging
    timestamp of the record
    exploitation forest-size of the buffer of 30000
    debug logging in buffered memory
    recording of debug trap
    asdm of logging of information
    <--- more="" ---="">
                  
    host test 192.168.168.231 record
    host test 192.168.168.203 record
    Within 1500 MTU
    MTU 1500 DMZ
    Outside 1500 MTU
    test MTU 1500
    management of MTU 1500
    reverse IP check management interface path
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 7221.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source MK MK static destination SG SG route no-proxy-arp-search
    NAT (inside, outside) static source NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 static destination SG SG route no-proxy-arp-search
    !
    network of the MK object
    NAT dynamic interface (indoor, outdoor)
    network of the Inside_host object
    NAT (inside, outside) interface static 9000 9000 tcp service
    inside_access_in access to the interface inside group
    Access-group OUTSIDE_IN in interface outside
    Route outside 0.0.0.0 0.0.0.0 143.216.30.x 1
    <--- more="" ---="">
                  
    Route inside 10.2.0.0 255.255.0.0 192.168.6.200 1
    Route inside 10.6.0.0 255.255.0.0 192.168.6.200 1
    Route inside 192.168.254.0 255.255.255.0 192.168.6.200 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    the ssh LOCAL console AAA authentication
    Enable http server

    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 VPN-TRANSFORM esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    <--- more="" ---="">
                  
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec pmtu aging infinite - the security association
    crypto CRYPTO - map 2 map corresponds to the address outside_cryptomap
    card crypto CRYPTO-map 2 set peer 160.83.172.8
    card crypto CRYPTO-map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    CRYPTO-card interface card crypto outside
    trustpool crypto ca policy
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    SSH timeout 60
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    management of 192.168.1.2 - dhcpd address 192.168.1.254
    enable dhcpd management
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
    attributes of Group Policy DfltGrpPolicy
    Ikev1 VPN-tunnel-Protocol l2tp ipsec without ssl-client
    internal GroupPolicy1 group strategy
    attributes of Group Policy GroupPolicy1
    Ikev1 VPN-tunnel-Protocol
    username, password admin eY/fQXw7Ure8Qrz7 encrypted privilege 15
    username gmsadmin password HS/VyK0jtJ/PANQT encrypted privilege 15
    <--- more="" ---="">
                  
    tunnel-group MK SG type ipsec-l2l
    IPSec-attributes tunnel-group MK-to-SG
    IKEv1 pre-shared-key *.
    tunnel-group 160.83.172.8 type ipsec-l2l
    tunnel-group 160.83.172.8 General-attributes
    Group Policy - by default-GroupPolicy1
    IPSec-attributes tunnel-group 160.83.172.8
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    <--- more="" ---="">
                  
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
    : end

    Good news, that VPN has been implemented!

    According to the ping problem, my suggestion is to check, if some type of firewall based on host computers on both sides block ICMP requests.

    Anyway, you can still use the capture of packets on the inside of the interfaces of the two ASAs, to check if the ICMP traffic is to reach the ASA.

    In addition, you can try to enable ICMP inspection:

    Policy-map global_policy
    class inspection_default

    inspect the icmp

    inspect the icmp error

  • How to set one of my pictures as a screen saver

    I can't understand how to set one of my own photos as the screensaver on my iMac... How do I do it please?

    System Preferences > desktop and screen saver > screen saver > select one of the modes that uses a table > screen saver Options > choose a folder...

    Made in regards to the BONES of the Mavericks.

    Clearly, it will work best when you have more than one image.

    I guess you mean screensaver and no paper painted (preferably same group)?

  • How to set the render property of the field on one facet of panelSplitter?

    Hi, experts,
    In jdev 11.1.2.3,.
    How to set the render property of the field on one facet of panelSplitter?
    -If the panelSplitter is reduced then make some fields in the second pane. otherwise, do not make these fields.

    It is not an easy job for me to set the EL expression.
    Thank you.

    OK, just did a small test case. It turns out that the difficulty is to automatically update the fields when the separator discloses. To add a pair of earphone client/server. This sends the event to disclose to the bean to update the fields.
    Page code:

    

  
  
    
      
        function disclosePanelSplitter( event) {
            var inputComp = event.getSource();
            AdfCustomEvent.queue(inputComp, "myDiscloseEvent",
            {}, true);
        }

    and the corresponding bean to the scope of the request

    package de.hahn.xyzxyz.view.panelsplitter;

import oracle.adf.view.rich.component.rich.layout.RichPanelSplitter;
import oracle.adf.view.rich.context.AdfFacesContext;
import oracle.adf.view.rich.render.ClientEvent;

public class PanelSplitterBean {
    private RichPanelSplitter panelSplitter;

    public PanelSplitterBean() {
    }

    public void setPanelSplitter(RichPanelSplitter panelSplitter) {
        this.panelSplitter = panelSplitter;
    }

    public RichPanelSplitter getPanelSplitter() {
        return panelSplitter;
    }

    public void doCustomEvent(ClientEvent event)
    {
        AdfFacesContext.getCurrentInstance().addPartialTarget(panelSplitter);
    }

}

    Timo

  • Monthly newsletters. How to set one up?

    Hello everyone. I know how to design an email template. But how do install you a monthly newsletter? What should I know? How are these subscription lists work?

    I am trying to set up a monthly newsletter and I wish that all of the information needed to make one.


    You thank all in advance.

    > I don't know how to create a dynamic site, but it's not the same.

    It is basically the same that more dynamic sites, with which I have worked. My point is that if you're competent enough to build yourself, you would have worked on the basics of what you ask the subject.

    > 1. How a designer / developer offer a newsletter on a client?

    >1a. If a customer wants to use hi's own delivery method (delivery service) while the designer is supposed to do? Just the model newsletter?

    Yes.

    1 b and how will do the subscription list to work? He put the databese on clients Server?

    If you build your own solution, then Yes, the database goes on the customer's server.

    2. How do you do this database online to make your lists of subcription to work. How "call" them by making the newsletter template? Calling them I mean code that I'm supposed to use to call an external file/database in my newsletter.

    You need to clarify this - what you want to store in the database? If the info of the subscription, then you just a few simple tables to store the information of the Subscriber. You would not "call" cela by making the model - use you it when sending the newsletter.

    If you plan on "insertion" the contents of the database in your newsletter, then this is exactly the same as any other dynamic database driven site. You fill in the code html using script on the server side and then send out.

    (ps: I don't know how to work a list of subscriptions.) What kind of file is it? Where to put it?)

    A list of subscriptions is a table or tables in a database.

    3 when I do the email templates that I have to deliver the html code and then the client it uses in its mailing software. When I do a newsletter which files should I provide to the customer?

    If you build a complete solution, you need to deliver and install all the parts - html templates, css, database, script files, etc.
    Monthly newsletters. How to set one up?

  • How can I set homepage to one of hotmail and others like google?

    I just changed from IE to Firefox. I used to open with google.co.uk on the first page, then hotmail on a second and then whenever I clicked to a new page, it does default to google. I'm not a geek, but can anyone say if this can be done in Firefox please?

    Hello

    To change the home page:

    To change the new tab:

    Go to Subject: config seek browser.newtab.url change in its value to a url you want.

  • How to set up a network password?

    I have a linksys router and I want to know how to set up a network password. The purpose of this is that I don't want other users to have access to my wireless internet. Either way, I'm using windows xp pro. Thank you so much in advance!

    what you are looking for is a "wireless encryption key.

    I recommend using dartybox.com as a resource for this. Depending on your router, you will find the installation wizards to help you with the configureing wireless security.

    Here are some main parameters that you will want to choose (if you are prompted to set in the Wizard):

    • WPA (not WEP) - maybe isn't able to use WPA2 with XP
    • 128-bit (not 64)
    • password or key: do not use a Word from the dictionary.

    and don't forget there are two 'passwords' on your router. One is the router admin password that gives you access to the configuration of the router. The second is the wireless key or password.

  • How to set a date in a datefield?

    Hi, how to set a date ("24/02/2009") in datefield. the date ' 02/24/2009' is of type string and is in the format "dd-MM-YYYY" as same as datefield Date format. Thanks in advance.

    Is it analyze yourself and use the Calendar class to set the year, month etc you are ripping into the calendar object - then do a Calendar.getTime ().  Or use

    HttpDateParser

    If your data is one of the supported formats.  Sorry haven't checked myself.

    Don't know other ways in the J2ME code.

  • How to set up a second user

    Original title:

    Beginning uop

    How can I set up my new laptop without using my email and password or how to set up a second user?

    Hello

    8.1 Windows and Windows RT 8.1, that you have created a standard, an administrator or the child's account, you can also choose one of the following two ways to connect:

    • With a Microsoft (an e-mail address and password) account. Signature with an e-mail address and password allows you to use your favorite applications and your unique settings and preferences on any PC.

    • With a local account. Signature with a local account (with or without password) allows you to use the files, settings, and applications on your local computer only.

    If you are an administrator, you can easily add accounts of users through laptop settings. For instructions, see creating a user account.

    You can see the following link for details on the user account.

    User accounts: frequently asked questions

    It will be useful. Please let us know if you need help on this issue or any problem related to Windows.

  • How to set a video clip for canvas

    I have 2 objects to animate in Adobe, MovieClipA, and MovieClipB movie clip

    MovieClipA has 10 images on the first and the last picture is the code this.stop ();

    MovieClipB has 2 frames, on both images is the this.stop (code);

    I also have a button, which when pressed parts MovieClipA using the play(); function.

    I want to play once MovieClipB MovieClipA hits frame 10.  I put in MovieClipB.play (); but it says that movieclipb is not defined.  How it set if javascript can read?

    MovieClipA and MovieClipB are at the same level. If you try to talk to one inside the other, the script is not at the same level it's a down from there. "parent" is the way that direct you to the level you upward. Yes, mother. MovieClipB go to the right thing.

  • How to set a mark in a document so that I can continue to read later?

    How to set a mark in a (large) document so I can continue reading later? (as a marker of paper in a book paper)

    Many facilities, owner, user, service, etc., the manuals are long enough, and often, we don't have the time to read in one sitting.   I need a way to place a tag or a 'Ribbon' (use of Adobe 'signet' for something else) to the point where I stop playing, so I can easily continue from there when then I have a little time.

    Use annotation tools, like the stars. Then, you can simply open the comments list, click it and it will jump to its location.

  • How to set the text to reveal and to scroll through the center of the screen?

    I need text "appear from nowhere" in the center of the screen, revealing a letter at a time as it scrolls by one-way or the other. NO scrolling on the screen.  I know how key framework to make the scroll, but do not know how to set up a mask (I guess) to hide the text until it moves beyond the Center. Please do not answer simply to use a mask, I get it!  I need to know how to implement that?  I can't find anywhere a tutorial that explains this.

    There are many ways to do it, one way:

    Set up and keyframe your type, and when you get to behave the way you want to, select the type of clip on the timeline and go to the menu Clip > nest.

    Click OK.

    Now, click the nested in the Assembly and in the effect controls panel, spin open opacity control and define a mask (it will probably interverti switched on) to hide the part of movable type you don't want.

    If you go back to the original item to make adjustments, double-click on the nested element.

    MtD

Maybe you are looking for