Internet VPN through Proxy Clients

Similar Questions

• Cisco ASA5520 facing ISP with private IP address. How to get the IPSec VPN through the internet?

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-marge-top : 0 ; mso-para-marge-droit : 0 ; mso-para-marge-bas : 10.0pt ; mso-para-marge-left : 0 ; ligne-hauteur : 115 % ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ;}

  Hello guys,.

  I have Cisco ASA5520 facing the ISP with private IP address. We don't have a router and how to get the IPSec VPN through the internet?

  The question statement not the interface pointing to ISP isn't IP address private and inside as well.

  Firewall configuration:

  Firewall outside interface Gi0 10.0.1.2 > ISP 10.0.1.1 with security-level 0

  Firewall inside the interface Ethernet0 192.168.1.1 > LAN switch 192.168.1.2 with security-level 100

  I have public IP block 199.9.9.1/28

  How can I use the public IP address to create the IPSec VPN tunnel between two sites across the internet?

  can I assign a public IP address on the Gig1 inside the interface with the security level of 100 and how to apply inside to carry on this interface?

  If I configure > firewall inside of the item in gi1 interface ip address 199.9.9.1/28 with security-level 100. How to make a safe lane VPN through this interface on the internet?

  I'm used to the public IP address allocation to the interface outside of the firewall and private inside the interface IP address.

  Please help with configuration examples and advise.

  Thank you

  Eric

  Unfortunately, you can only complete the VPN connection on the interface the VPN connection source, in your case the external interface.

  3 options:

  (1) connect a router in front of the ASA and assign your public ip address to the ASA outside interface.

  OR /.

  (2) If your ISP can perform static translation of 1 to 1, then you can always finish the VPN on the external interface and ask your provider what is the static ip address assigned to your ASA out of the IP (10.0.1.2) - this will launch the VPN of bidirectionally

  OR /.

  (3) If your ISP performs PAT (dynamic NAT), then you can only start the tunnel VPN on the side of the ASA and the other end of the tunnel must be configured to allow VPN LAN-to-LAN dynamics.

• problems with vpn firewall/proxy configuration

  Hello

  I want to access vpn through firewall/proxy (Client VPN) client-side.

  I installed the vpn gateway as firewall pix 515 using Microsoft CA IKE SA.

  I want to establish the vpn tunnel to my vpn through a proxy/firewall client.

  I tried in some places of vpn client where the firewall acts as a linux machine in which he allowed with the ipsec and NAT esp feature. Its works perfectly. But only one concurrent vpn client. Also the first tunnel vpn disconnects when the second user tries without knowing the first established tunnel.

  I heard that we can drive this problem using "NAT Taversal" mode which is available in version ios 6.3 as concentrator 3000 Cisco pix.

  I want to know how NAT Traversal can solve my problem in which multiple concurrent users without support nat esp in a configuration only one simultaneous user without support nat esp in a configuration of firewall/proxy or firewall/proxy.

  Thank you

  Karthikeyan V

  The VPN client is able to detect that he's been through a NAT/PAT device on the way to the hub/PIX, and then if both ends support it, they will automatically start NAT - T and encapsulate the IPSec packets in UDP port 4500 packets. These can then be NAT would properly and you will not get disconnections or problems you currently see.

  You don't see that a client can connect and customers being disconnected when the other connects it is your PAT instrument cannot process the ISAKMP and IPSec packets correctly. It is a fairly common symptom.

  PIX v6.3 code will support NAT - T, should be available in March sometime.

• Blocking of the internal services of VPN and Proxy

  Hello

  I have some users with Windows 7 and MAC laptops inside my network domestic who is protected by the R7000.

  I'd like know if its possible to block sessions VPN and Proxy, initiated from these internal, to communicate with Internet computers.

  Thank you

  Try VPN Service to block.

• Internet connection through different VLAN

  Could someone help me here please.

  Have a cisco SG500 2 (mode layer 3) configured with 3 VLAN connected to a modem adsl (Trendnet) - vlan voice 1 data, vlan 2, vlan 3 tests.  Routing between VLANs is ok I can ping any device in any vlan and have access to the internet through the vlan 1 but no internet access on the other vlan is the vlan 2 and 3. No ping to adsl, if I plugged in a device in the vlan 2 or 3. My question is do I have a router or firewall in order to provide internet access through all my VLAN or is it possible with the SG500 connected to adsl? a turn on ip Routing and the default route in my SG500, but still no luck. need internet connection for the PC as well as voip devices.

  Thank you

  Hi Paul, the switch performs no NAT function so if your modem is only a modem giving public IP addresses then you would need a router to support the NAT function and support the vlan or the static routes.

  If your modem works as a router, need you a static route on the modem to point to the SVI to the switch to allow the clients of vlan connection to connect to the modem to turn, what makes the internet work.

  -Tom
  Please mark replied messages useful

• From AnyConnect VPN through an RDP Session

  Hello

  We have AnyConnect (ver. 3.1.01065) set up on our ASA5520 boxes. VPN works well from the office, but I also need the ability to establish a VPN connection through a RDP connection (i.e. I use RDP to connect to a PC that has installed AnyConnect, then try to establish a VPN connection).

  I downloaded the Cisco VPN profile editor, chaned the option to 'AllowRemoteUsers '. Then the relevant group policy profile applied. Connected PC (and not via RDP) VPN, so that it downloads the new profile and then disconnected again.

  However, I can't yet start VPN through an RDP connection. (Error is "the ability to set up VPN for remote desktop is disabled.) A VPN connection cannot be established.")

  I checked the file XML on the local PC to confirm the profile was downloaded (and is, and I do not see the option AllowRemoteUsers.)

  This has also happened with the previous AnyConnect version (3.0.xxxx).

  Local routing tables of the PC look good, and I don't see any conflicts that would cause the RDP session to drop.

  Also - if I connect the VPN, then RDP on the PC, the VPN and the RDP sessions work fine.

  Any ideas would be appreciated!

  Thank you

  Tony

  Hi Tony,.

  To do this both the ASA and the client must have the same XML profile.

  I just tested this with AC 3.1 and ASA 8.4 and it works beautifully.

  I included the XML file.

  * BTW, make sure that the profile is assigned to the appropriate group strategy.

  HTH.

  Portu.

  Please note all useful posts

• How to allow access to the external network of VPN through PPTP

  Hi guys, this is probably a simple one, but I have not much firewall experience so any help is appreciated.

  We would like to have the opportunity to connect to a private network virtual to a company, we have recently acquired.  When you connect to it directly from the Internet (not), it is accessible.  However, behind our firewall, there is no access.  We use Cisco ASA 8.2 (2)

  Currently, we have an entry as follows:

  PPTP tcp service object-group

  EQ pptp Port object

  inside_access_in list extended access permit tcp any host object_name object-group PPTP

  Please can anyone advise what else are required to complete what I'm not sure of what else is needed?  Basically, we want any device within our network in order to access the VPN through PPTP.

  Your help is appreciated

  Kind regards

  Hi Angelo,.

  It should work when you make a pptp permitted and inspected. But will also Appreciate ACL with your firewall to the PPTP server.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080094a5a.shtml#pptpwith

  The above documents helps you better understand.

  Please assess whether the information provided is useful.

  By

  Knockaert

• Can not share the internet connection through Wifi

  Hi all

  I am connected to the internet using an external antenna connected via USB to my mac (WIRELESS n 801.11). I want to share this connection since my mac with other devices, i.e. my iPhone. I use the internet connection through system preferences--> sharing--> sharing internet--> connection on the part of wlan to computers via WIFI and give a name and a password for the wifi settings. When I start the connection icon wifi on the the high watch the arrow menu to the top, but it gives an IP address from 169 auto... etc etc and I can't any traffic to my iPhone.

  I tried to configure IPv4 to use DHCP with a manual (instead of automatic DHCP) address and IP I enter the IP address used in the WiFi, wifi says that it is connected to the name of the internet connection in the shared connection, I opened but once again no traffic to the iPhone. Also tried disabling the firewall, once again nothing.

  I run El Capitan 10.11.2.

  Clues?

  OS X El Capitan: share your Internet connection

• Need me a firewall if my internet connection through a router. I'm with Virgin and I have a D-Link router

  Need me a firewall if my internet connection through a router. I'm with Virgin and I have a D-Link router

  On Friday, June 8, 2012 14:45:42 + 0000, Ian 213 wrote:

  Need me a firewall if my internet connection through a router. I'm with Virgin and I have a D-Link router

  Your router provides firewall protection, so the need is not the same
  as if you had no a router. There are some who say you need to no.
  all firewall software.

  But my opinion is that you would be a lot safer if you have run a
  router software, and since there is little reason not to, I
  recommend that you do.

  Ken Blake, Microsoft MVP

  I agree.

  @OP Windows XP (SP2 and above), Vista, 7 and 8 all have active firewall software by default.

  There is no need of any 3rd party firewall.

  Some users like running programs such as ZoneAlarm because it warns him from the processes that use the network, and then there is the possibility to deny/allow it on the spot, or deny/allow forever. There may be slight discomfort in the installation, but once it's for all your programs, and then it really can work in silent mode.

  Microsoft Firewall simply leave everything default, but they can be configured manually to block anything outgoing or incoming.

• I want to offer internet access to my client area but I am unable to give it the authorization of domain server? Please help me as soon as possible.

  I want to offer internet access to my client area but I am unable to give it the authorization of domain server? Please help me as soon as possible.

  Hello

  Your question of Windows is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please ask your question in the appropriate Forum TechNet. You can follow the link to your question:

  http://social.technet.Microsoft.com/forums/en-us/categories/

• get internet connection through another computer...

  Hello

  I would go straight to the point :)

  I have a desktop running windows vista. I have a normal internet connection through a router that connects to the internet on this desktop computer.

  now, I also have a laptop with windows xp and here is what I do. my laptop's wireless was always bothers me, sometimes it connects, sometimes it doesn't work out... so I saw that there is an Ethernet card installed in the laptop with an Ethernet port.

  My question is this:

  I have a lot of Ethernet cables at home and I was wondering if there is a way to get internet to my laptop via the Ethernet port on my desktop, but without needing the desktop computer to be running, cause I only use my laptop these days and my router is too far to connect from my room. I hope you understand my problem. In theory, I think it's possible to do, but I'm not sure how, so please help me on this one. my laptop also has firewire, but I prefer ethernet for some reason any.

  Thank you

  Hello

  Sorry, but you cannot get a connection via another computer if the computer is off.

  I'm not sure that I understand completely the topology.  However, if the office is connected by cable to a router for Internet connection, you can solve the problem by buying a simple network switch.

  You take the cable from the desktop and connect to the switch. Then you plug the desktop and laptop computer at the switch.

  That this switch network does, it divides a cable to feed many computers.

  Example of a switch that can be connected with a cable to a router and feed 5 computers.

  http://www.Newegg.com/product/product.aspx?item=N82E16833166034-

  Jack - Microsoft MVP, Windows networking. WWW.EZLAN.NET

• How coonect Simulator to the internet inside the proxy server?

  Hello

  I try to connect the simulator of the internet inside the proxy server or firewall. I installed MDS and it running when I run my code on the Simulator. I get a 400 responsecode and get a "Connection refused" URL: 80 "then, of course, my program is not extract data etc.» But when I try to access the Web as "URL" url it displays the error message "error HTTP 400: bad request.» The server could not understand the page request, or was not able to process for some reason. Please try loading a different page.

  I also had local sites of access by http://localhost/mysite etc., but it comes up with: "HTTP ERROR 403: Forbidden you are not authorized to view this page." Please try loading a different page. »

  Please help me how can I connect Simulator to the internet so I can run the application.

  Thank you

  Hay I have the solution to this thread, please go to the following link: this link might be useful...

  http://www.BlackBerry.com/knowledgecenterpublic/livelink.exe/fetch/2000/348583/800792/801079/How_To _...

• Internet VPN Client

  Hello

  I need to make users with vpn client on the LAN of the central office, going to the internet using the internet connection of the central office. I want to say wihout having split tunnel and without using a proxy internal. I would like to know if it is possible with the PIX or ASA. I think it's like say to have traffic going in and out the firewall using the same outside the interface. Thank you very much in advance for your support appreciated.

  Best regards

  Angelo

  Yes, undoubtedly capable.

  You must configure the following:

  permit same-security-traffic intra-interface

  In addition, assuming that you have already "global 1 interface (outside)", you can configure the following:

  NAT (outside) 1

  For example: If the ip pool for vpn client subnet is 192.168.100.0/24, then the following:

  NAT (outside) 1 192.168.100.0 255.255.255.0

  Hope that helps.

• SSL vpn through the same internet connection to another site

  Hi, I have a network with a box of Juniper SSL that connect to port DMZ ASA5510, wher outside the ASA is the same outside the box of SSL vpn.

  To access issues eno hav network internal at all.

  Now, I need VPN SSL Juniper box remote users and internal conenct o my remote sites, who take the client connection through an internet router (Cisco throug site to site vpn IPSec) again to the th eremote site.

  Is it possible, my hunch is Yes "can be done."

  Currently, I'm fitting get no where, I get no hits ASA DMZ ACL if I try to access the remote site of the SSL vpn client resources.

  Schema attached

  Any help would be appreciated

  Shouldn't be a problem.

  On the Juniper SSL, you must check if the roads has been added to the remote IPSec LAN point to the ip address DMZ ASA instead of pointing to the internet through the Juniper SSL box.

  You need to configure NAT exemption on the ASA box between the pool SSL subnet to the Remote LAN of IPSec. As a result, you must also include the SSL subnet to Remote LAN subnets in the crypto ACL and mirror image ACL on the remote site ACL Cryptography.

  Hope that helps.

• No internet access through VPN

  Hi, I have the router Cisco 881 (MPC8300) with c880data-universalk9 - mz.153 - 3.M4.bin when users establish a VPN connection to the corporate network, had access to all the resources but no internet access, please help me what else I need to configure to achieve my goal. I don't want to split the tunnel, internet via VPN, users must have. In my opinion, I have put an additional configuration for NAT, but my router not recognize u-Turn and NAT commands on the object on the network.

  My config:

  Building configuration...

  Current configuration: 13562 bytes
  !
  ! Last configuration change at 09:52:38 PCTime Saturday, May 16, 2015, by admin
  version 15.3
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  XXX host name
  !
  boot-start-marker
  start the flash system: c880data-universalk9 - mz.153 - 3.M4.bin
  boot-end-marker
  !
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login ciscocp_vpn_xauth_ml_1 local
  AAA authentication login ciscocp_vpn_xauth_ml_2 local
  AAA authorization exec default local
  AAA authorization ciscocp_vpn_group_ml_1 LAN
  AAA authorization ciscocp_vpn_group_ml_2 LAN
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  iomem 10 memory size
  clock timezone PCTime 1 0
  PCTime of summer time clock day March 30, 2003 02:00 October 26, 2003 03:00
  !
  Crypto pki trustpoint TP-self-signed-1751279470
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1751279470
  revocation checking no
  rsakeypair TP-self-signed-1751279470
  !
  !
  TP-self-signed-1751279470 crypto pki certificate chain
  certificate self-signed 01
  XXXX
  !
  !
  Protocol-IP port-map user - 2 tcp 8443 port
  user-Protocol IP port-map - 1 tcp 3389 port
  !

  !
  !
  !
  IP domain name dmn.local
  8.8.8.8 IP name-server
  IP-server names 8.8.4.4
  IP cef
  No ipv6 cef
  !
  !
  license udi pid CISCO881-K9 sn FCZ174992C8
  !
  !
  username privilege 15 secret 5 xxxx xxxx
  username secret VPNUSER 5 xxxx
  !
  !
  !
  !
  !
  !
  type of class-card inspect sdm-nat-user-protocol--2-1 correspondence
  game group-access 105
  corresponds to the user-Protocol - 2
  type of class-card inspect entire game SDM_AH
  match the name of group-access SDM_AH
  type of class-card inspect entire game PAC-skinny-inspect
  Skinny Protocol game
  type of class-card inspect entire game SDM_IP
  match the name of group-access SDM_IP
  type of class-card inspect entire game PAC-h323nxg-inspect
  match Protocol h323-nxg
  type of class-card inspect entire game PAC-cls-icmp-access
  match icmp Protocol
  tcp protocol match
  udp Protocol game
  type of class-card inspect entire game PAC-h225ras-inspect
  match Protocol h225ras
  type of class-card inspect entire game SDM_ESP
  match the name of group-access SDM_ESP
  type of class-card inspect entire game PAC-h323annexe-inspect
  match Protocol h323-annex
  type of class-card inspect entire game PAC-cls-insp-traffic
  match Protocol pptp
  dns protocol game
  ftp protocol game
  https protocol game
  match icmp Protocol
  match the imap Protocol
  pop3 Protocol game
  netshow Protocol game
  Protocol shell game
  match Protocol realmedia
  match rtsp Protocol
  smtp Protocol game
  sql-net Protocol game
  streamworks Protocol game
  tftp Protocol game
  vdolive Protocol game
  tcp protocol match
  udp Protocol game
  type of class-card inspect the correspondence SDM_GRE
  match the name of group-access SDM_GRE
  type of class-card inspect entire game PAC-h323-inspect
  h323 Protocol game
  type of class-card inspect correspondence ccp-invalid-src
  game group-access 103
  type of class-card inspect entire game PAC-sip-inspect
  sip protocol game
  type of class-card inspect correspondence sdm-nat-https-1
  game group-access 104
  https protocol game
  type of class-card inspect all match mysql
  match the mysql Protocol
  type of class-card inspect correspondence ccp-Protocol-http
  http protocol game
  type of class-card inspect entire game CCP_PPTP
  corresponds to the SDM_GRE class-map
  inspect the class-map match PAC-insp-traffic type
  corresponds to the class-map PAC-cls-insp-traffic
  type of class-card inspect entire game SDM_EASY_VPN_SERVER_TRAFFIC
  match Protocol isakmp
  match Protocol ipsec-msft
  corresponds to the SDM_AH class-map
  corresponds to the SDM_ESP class-map
  type of class-card inspect correspondence ccp-icmp-access
  corresponds to the class-ccp-cls-icmp-access card
  type of class-card inspect the correspondence SDM_EASY_VPN_SERVER_PT
  corresponds to the SDM_EASY_VPN_SERVER_TRAFFIC class-map
  !
  type of policy-map inspect PCB - inspect
  class type inspect PCB-invalid-src
  Drop newspaper
  class type inspect mysql
  inspect
  class type inspect PCB-Protocol-http
  inspect
  class type inspect PCB-insp-traffic
  inspect
  class type inspect PCB-sip-inspect
  inspect
  class type inspect PCB-h323-inspect
  inspect
  class type inspect ccp-h323annexe-inspect
  inspect
  class type inspect ccp-h225ras-inspect
  inspect
  class type inspect ccp-h323nxg-inspect
  inspect
  class type inspect PCB-skinny-inspect
  inspect
  class class by default
  drop
  type of policy-card inspect sdm-license-ip
  class type inspect SDM_IP
  Pass
  class class by default
  Drop newspaper
  type of policy-card inspect sdm-pol-NATOutsideToInside-1
  class type inspect sdm-nat-https-1
  inspect
  class type inspect sdm-nat-user-protocol--2-1
  inspect
  class type inspect CCP_PPTP
  Pass
  class class by default
  Drop newspaper
  type of policy-card inspect PCB-enabled
  class type inspect SDM_EASY_VPN_SERVER_PT
  Pass
  class class by default
  drop
  type of policy-card inspect PCB-permits-icmpreply
  class type inspect PCB-icmp-access
  inspect
  class class by default
  Pass
  !
  safety zone-to-zone
  security of the area outside the area
  ezvpn-safe area of zone
  zone-pair security PAC-zp-self-out source destination outside zone auto
  type of service-strategy inspect PCB-permits-icmpreply
  zone-pair security PAC-zp-in-out source in the area of destination outside the area
  type of service-strategy inspect PCB - inspect
  source of PAC-zp-out-auto security area outside zone destination auto pair
  type of service-strategy inspect PCB-enabled
  sdm-zp-NATOutsideToInside-1 zone-pair security source outside the area of destination in the area
  type of service-strategy inspect sdm-pol-NATOutsideToInside-1
  in the destination box source sdm-zp-in-ezvpn1 ezvpn-pairs area security
  type of service-strategy inspect sdm-license-ip
  source of sdm-zp-out-ezpn1 of security area outside zone ezvpn-zone time pair of destination
  type of service-strategy inspect sdm-license-ip
  safety zone-pair sdm-zp-ezvpn-out1-source ezvpn-zone of destination outside the area
  type of service-strategy inspect sdm-license-ip
  safety zone-pair source sdm-zp-ezvpn-in1 ezvpn-area destination in the area
  type of service-strategy inspect sdm-license-ip
  !
  !
  crypto ISAKMP policy 1
  BA 3des
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA aes 256
  preshared authentication
  Group 2
  !
  Configuration group customer crypto isakmp Domena
  key XXXXXX
  DNS 192.168.1.2
  Dmn.local field
  pool SDM_POOL_1
  Save-password
  Max-users 90
  netmask 255.255.255.0
  banner ^ Cwelcome ^ C
  ISAKMP crypto ciscocp-ike-profile-1 profile
  match of group identity Domena
  client authentication list ciscocp_vpn_xauth_ml_2
  ISAKMP authorization list ciscocp_vpn_group_ml_2
  client configuration address respond
  virtual-model 1
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac ESP_AES-256_SHA
  tunnel mode
  !
  Profile of crypto ipsec CiscoCP_Profile1
  game of transformation-ESP_AES-256_SHA
  set of isakmp - profile ciscocp-ike-profile-1
  !
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.9.1 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  no ip address
  !
  interface FastEthernet3
  no ip address
  !
  interface FastEthernet4
  Description $ETH - WAN$ $FW_OUTSIDE$
  IP x.x.x.x 255.255.255.248
  NAT outside IP
  IP virtual-reassembly in
  outside the area of security of Member's area
  automatic duplex
  automatic speed
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ezvpn-safe area of Member's area
  ipv4 ipsec tunnel mode
  Tunnel CiscoCP_Profile1 ipsec protection profile
  !
  interface Vlan1
  Description $ETH_LAN$ $FW_INSIDE$
  IP 192.168.1.1 255.255.255.0
  IP access-group 100 to
  IP nat inside
  IP virtual-reassembly in
  Security members in the box area
  IP tcp adjust-mss 1452
  !
  local IP SDM_POOL_1 192.168.10.10 pool 192.168.10.100
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  The dns server IP
  IP nat inside source list 3 interface FastEthernet4 overload
  IP nat inside source static tcp 192.168.1.3 interface FastEthernet4 443 443
  IP nat inside source static tcp 192.168.1.2 8443 interface FastEthernet4 8443
  IP route 0.0.0.0 0.0.0.0 X.x.x.x
  !
  SDM_AH extended IP access list
  Note the category CCP_ACL = 1
  allow a whole ahp
  SDM_ESP extended IP access list
  Note the category CCP_ACL = 1
  allow an esp
  SDM_GRE extended IP access list
  Note the category CCP_ACL = 1
  allow a gre
  SDM_IP extended IP access list
  Note the category CCP_ACL = 1
  allow an ip
  !
  not run cdp
  !
  Note access-list 3 INSIDE_IF = Vlan1
  Note CCP_ACL category in the list to access 3 = 2
  access-list 3 Let 192.168.1.0 0.0.0.255
  Note access-list 23 category CCP_ACL = 17
  access-list 23 permit 192.168.1.0 0.0.0.255
  access-list 23 allow 10.10.10.0 0.0.0.7
  Note access-list 100 Auto generated by SDM management access feature
  Note access-list 100 category CCP_ACL = 1
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 22
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq www
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq 443
  access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 192.168.1.1 eq cmd
  access-list 100 tcp refuse any host 192.168.1.1 eq telnet
  access-list 100 tcp refuse any host 192.168.1.1 eq 22
  access-list 100 tcp refuse any host 192.168.1.1 eq www
  access-list 100 tcp refuse any host 192.168.1.1 eq 443
  access-list 100 tcp refuse any host 192.168.1.1 eq cmd
  access-list 100 deny udp any host 192.168.1.1 eq snmp
  access ip-list 100 permit a whole
  Note access-list 101 category CCP_ACL = 1
  access-list 101 permit ip 192.168.1.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 1
  access-list 102 permit ip 192.168.1.0 0.0.0.255 any
  Note access-list 103 CCP_ACL category = 128
  access-list 103 allow the ip 255.255.255.255 host everything
  access-list 103 allow ip 127.0.0.0 0.255.255.255 everything
  access-list 103 allow ip 93.179.203.160 0.0.0.7 everything
  Note 104 CCP_ACL category = 0 access-list
  IP access-list 104 allow any host 192.168.1.3
  Note access-list 105 CCP_ACL category = 0
  IP access-list 105 allow any host 192.168.1.2

  -----------------------------------------------------------------------
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 102 in
  transport input telnet ssh
  line vty 5 15
  access class 101 in
  transport input telnet ssh
  !
  !
  end

  I'd be grateful for help

  concerning

  Hello

  Enter the subnet pool VPN to access-list 3 for source NAT

  You may need to check the firewall also rules to allow the connection based on areas you

  HTH,

  Averroès