iPad VPN from Cisco ASA 5520

Hello

I'm trying to get my ipad to VPN to our Cisco ASA5520.

I think I have all the correct settings on both ends (I am able to vpn to the asa using a cisco 871 as the remote client).

I think that for some reason the client vpn on ipad is not even make the asa. My question is: How can I monitor the ASA logs to see if the same connection attempt and eventually find the failure?

Thank you

M

try: -.

Debug crypto ISAKMP

Debug crypto ipsec

Vpn-sessiondb SH remote control (to see if the client is connected)

I have configured ipad for remote vpn client, the user could connect to the 5520 but why that I had to use the ip addresses to access, but I couldn't use internal dns names. try to understand that at this moment.

It may be useful

Manish

Tags: Cisco Security

Similar Questions

  • What VPN work as a PPTP vpn firewall CISCO-ASA-5520.

    Hi all

    Can you please tell me which replace the VPN I can configure PPTP on ASA 5520 firewall. What VPN work as a PPTP vpn firewall CISCO-ASA-5520.

    You can use the wizard VPN of RA with ASDM and confiugre L2TP IPSEC VPN that does not need a VPN Client must be installed.

    Michael

    Please note all useful posts

  • SSL VPN from Cisco ASA and ACS 5.1 change password

    Dear Sir.

    I am tring configure ASA to change the local password on ACS 5.1. When the user access with ssl vpn if the ACS 5.1 password expiration date. ASA will display the dialog box or window popup to change the password. But it does not work. I'm tring to Setup with the functionality of password management on the SAA. When I enable password management it will not work and is unable to change the password. Could you tell me about this problem?

    Thank you

    Aphichat

    

    Dear Sir,
    

    I'm tring to setup ASA to change local password on ACS 5.1. When user access with ssl vpn if password on ACS 5.1 expire. ASA will show dialog box or pop-up to change password. But It don't work. I'm tring to setup with password management feature on ASA . When I enable password management it don't work and can't to change password. Could you advise me about this problem?
    

    Thank you
    

    Aphichat

    Hi Aphichat,

    Go to the password link below change promt via AEC in ASA: -.

    https://supportforums.Cisco.com/docs/doc-1328;JSESSIONID=A51E68318579261787BD60DDA0707819. Node0

    Hope to help!

    Ganesh.H

    Don't forget to note the useful message

  • Routing with Cisco ASA 5520 VPN

    I have installed IPsec vpn remote users in the Cisco ASA 5520 using RADIUS in my main network. Works very well. I have a site to my Cisco ASA5520 tunnels going to other sites, some of the tunnels have Cisco ASA and some have SonicWalls. I wish that my users VPN remote IPSec to be able to navigate in these tunnels is a site to access remote subnets attached to these tunnels. Do I need to use a combination of routing and the ACL? Or can I just use ACL only? Or just use routing only?

    Thank you

    Carlos

    Hello

    The key to set up here is the two ACL of VPN L2L end points that determine the 'interesting' traffic to connect VPN L2L. You will also need to confirm that the connection of the VPN Client is configured so that traffic to the remote sites have sent to the connection of the VPN client. There are also other things that you should check on your ASA plant

    Here most of the things you usually have to confirm

    • Set up 'permit same-security-traffic intra-interface' if it is already present in your configuration

      • This setting will allow connections to form between the hosts that are connected to the same interface on the ASA. In this case, applies because the VPN client users are connected to the interface 'outside' of the ASA and also remote sites are connected to the ASA to "external". If the traffic between the remote VPN Client and VPN L2L sites will be to enter and exit the same interface
    • You will need to check how the customer if configured VPN connection. Split or full Tunnel tunnel
      • If the connection of the VPN Client is configured as Split Tunnel then you need to add all the networks from the remote to the Split Tunnel, so that the connections between the VPN Client is transmitted to the ASA and from there connections VPN L2L
      • If the connection of the VPN Client is configured as full Tunnel, then there no problem that all traffic is transferred to the Client VPN connection all its assets
    • Define the VPN pool in the ACL of VPN L2L
      • You should make sure that the pool network VPN Client is defined in the ACL that define 'interesting' traffic to connect VPN L2L. So, you need to add the pool VPN VPN L2L configurations on the sites of Central America and remote control
    • Configure NAT0 / NAT exempt for remote VPN Client to L2L VPN Site traffic at both ends of the VPN L2L
      • You must ensure that the NAT0 / exempt NAT rules exist for the VPN Client for Remote Site traffic. This will have to be configured on the SAA "outside" interface. Format of configuration varies naturally a bit on the ASA Central his software level.

    These should be the most common things to set up and confirm for traffic to flow between the VPN Client and Remote Sites

    Hope this helps please rate if yes or ask more if necessary.

    -Jouni

  • Is supported PPTP vpn cisco ASA 5520 firewall?

    Hi all

    I'm Md.kamruzzaman. My compnay buy a firewall of cisco asa 5520 and I want to configure PPTP vpn on asa 5520 firewall. Is it possible to configure the PPTP vpn to asa firewall. If possible can you please tell me what is the procedure to configure the PPTP vpn.

    Best regards

    MD.kamruzzaman

    Sorry, but the Cisco ASA firewall does not support PPTP VPN termination.

    You may terminate IPSec and SSL VPN but not of type PPTP.

    If you are new to the ASA, how best to configure the supported VPN types is via the VPN Wizard integrated into the application of management of ASSISTANT Deputy Ministers.

  • Cisco VPN 3060 - Cisco ASA conversion

    We are about to embark on the passage of all extensions L2L and network (Cisco ASA 5505 s) of the Cisco VPN 3060 concentrator to a Cisco ASA 5520.

    We bsemblable woul to see if there is a simple method to do this as a converter?  Also, there are lessons learned?  We run 8.4.3 so that we know that the NAT configuration has differed.  The 3060 configuration can be changed in anyway for help in configuring the ASA?

    Thank you

    Dwane

    Thank you for your understanding Dwane.

    Please mark this message as answered.

    Good day.

  • Site to Site VPN between Cisco ASA 5505 and Sonicwall TZ170

    I'm trying to implement a VPN site-to site between our data center and office.  The data center has a Cisco ASA 5505 and the Office has a Sonicwall TZ170.  I managed to configure the two so that the vpn connects.  Each of the firewall I ping the IP Address of the internet firewall on the other side and a desktop computer I can ping the IP Address of the firewall internal datacenter but I can't carry traffic between private subnets datacenter and desktop.  Can anyone help?

    The config below has had IPs/passwords has changed.

    External Datacenter: 1.1.1.4

    External office: 1.1.1.1

    Internal data center: 10.5.0.1/24

    Internal office: 10.10.0.1/24

    : Saved
    :
    ASA Version 8.2 (1)
    !
    hostname datacenterfirewall
    mydomain.tld domain name
    activate the password encrypted
    passwd encrypted
    names of
    name 10.10.0.0 OfficeNetwork
    10.5.0.0 DatacenterNetwork name
    !
    interface Vlan1
    nameif inside
    security-level 100
    10.5.0.1 IP address 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    1.1.1.4 IP address 255.255.255.0
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passive FTP mode
    clock timezone IS - 5
    clock to summer time EDT recurring
    DNS server-group DefaultDNS
    buydomains.com domain name
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    inside_access_in list extended access permit icmp any one
    inside_access_in list extended access permitted tcp a whole
    inside_access_in list extended access udp allowed a whole
    inside_access_in of access allowed any ip an extended list
    outside_access_in list extended access permit icmp any one
    outside_access_in list extended access udp allowed any any eq isakmp
    IP DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0 allow Access-list extended pixtosw
    pixtosw list extended access allow icmp DatacenterNetwork 255.255.255.0 OfficeNetwork 255.255.255.0
    IP OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0 allow Access-list extended pixtosw
    pixtosw list extended access allow icmp OfficeNetwork 255.255.255.0 DatacenterNetwork 255.255.255.0
    outside_cryptomap_66.1 list of allowed ip extended access all OfficeNetwork 255.255.255.0
    outside_cryptomap_66.1 ip OfficeNetwork 255.255.255.0 allowed extended access list all
    outside_cryptomap_66.1 list extended access permit icmp any OfficeNetwork 255.255.255.0
    outside_cryptomap_66.1 list extended access allowed icmp OfficeNetwork 255.255.255.0 everything
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    IP verify reverse path to the outside interface
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 623.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT-control
    Global 1 interface (outside)
    NAT (inside) 1 0.0.0.0 0.0.0.0
    inside_access_in access to the interface inside group
    Access-group outside_access_in in interface outside
    Route inside 0.0.0.0 0.0.0.0 1.1.1.1 1
    Route OfficeNetwork 255.255.255.0 outside 1.1.1.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    Enable http server
    http 10.5.0.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set esp-aes-256 walthamoffice, esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Crypto dynamic-map ciscopix 1 corresponds to the address outside_cryptomap_66.1
    Crypto dynamic-map ciscopix 1 transform-set walthamoffice
    Crypto dynamic-map ciscopix 1 the value reverse-road
    map dynmaptosw 66-isakmp ipsec crypto dynamic ciscopix
    dynmaptosw interface card crypto outside
    crypto isakmp identity address
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    crypto ISAKMP policy 13
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    lifetime 28800
    crypto ISAKMP policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    No encryption isakmp nat-traversal
    Telnet 10.5.0.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 10.5.0.0 255.255.255.0 inside
    SSH timeout 5
    Console timeout 0
    management-access inside
    dhcpd address 10.5.0.2 - 10.5.0.254 inside
    dhcpd allow inside
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    NTP server 66.250.45.2 source outdoors
    NTP server 72.18.205.157 source outdoors
    NTP server 208.53.158.34 source outdoors
    WebVPN
    attributes of Group Policy DfltGrpPolicy
    VPN-idle-timeout no
    username admin password encrypted
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *.
    !
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    message-length maximum 512
    !
    context of prompt hostname
    Cryptochecksum:7f319172e5de9c0e550804a263f8e49e
    : end

    Mattew, obvious lack of education is the rule exempt from nat for your tunnel, your access list pixtosw is similar on this example, I assume that you have gone through this link, if it does not see the configs on both sides.

    Add the statement of rule sheep in asa and try again.

    NAT (inside) 0-list of access pixtosw

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008052c9d4.shtml

    Concerning

  • AnyConnect VPN for Cisco ASA 5505 refused connections

    I'm trying to set up my Cisco 5505 with AnyConnect VPN client VPN access.  Here is the relevant information of my config:

    interface Vlan2
    
    mac-address xxxx.xxxx.xxxx
    
    nameif outside
    
    security-level 0
    
    ip address A.A.A.A 255.255.255.240
    
    !
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq pptp
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq https
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq ftp
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq https
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq ftp
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq www
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq smtp
    
    access-list outside_access_in extended permit icmp any any
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq ssh
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq 8080
    
    access-list outside_access_in extended permit gre any host C.C.C.C
    
    access-list outside_access_out extended permit ip any any
    
    access-list inside_access_in extended permit ip any any
    
    access-list inside_access_in extended permit ip any interface outside
    
    access-list inside_access_out extended permit ip any any
    

    access-group inside_access_in in interface inside
    
    access-group inside_access_out out interface inside
    
    access-group outside_access_in in interface outside
    
    access-group outside_access_out out interface outside
    

    webvpn
    
    enable inside
    
    enable outside
    
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    
    svc enable
    

    group-policy DfltGrpPolicy attributes
    
    dns-server value X.X.X.X
    
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    
    split-tunnel-policy tunnelspecified
    
    split-tunnel-network-list value
    
    address-pools value palm
    
    webvpn
    
      svc rekey time 30
    
      svc rekey method ssl
    
      svc ask enable default webvpn
    

    policy-map global_policy
    
    class inspection_default
    
      inspect pptp
    
      inspect http
    
      inspect icmp
    
      inspect ftp
    
    !

    When I try to connect, I get this error in the real-time log viewer:

    TCP access denied by ACL from X.X.X.X/57356 to outside:A.A.A.A/443

    Here are the details of the license:

    Licensed features for this platform:
    
    Maximum Physical Interfaces  : 8
    
    VLANs                        : 3, DMZ Restricted
    
    Inside Hosts                 : Unlimited
    
    Failover                     : Disabled
    
    VPN-DES                      : Enabled
    
    VPN-3DES-AES                 : Enabled
    
    SSL VPN Peers                : 2
    
    Total VPN Peers              : 10
    
    Dual ISPs                    : Disabled
    
    VLAN Trunk Ports             : 0
    
    Shared License               : Disabled
    
    AnyConnect for Mobile        : Disabled
    
    AnyConnect for Linksys phone : Disabled
    
    AnyConnect Essentials        : Disabled
    
    Advanced Endpoint Assessment : Disabled
    
    UC Phone Proxy Sessions      : 2
    
    Total UC Proxy Sessions      : 2
    
    Botnet Traffic Filter        : Disabled
    

    This platform has a Base license.

    Can someone tell me what I am doing wrong or what access list I'm missing?

    I have two Cisco ASA 5510 firewall with a similar setup configuration and the AnyConnect SSL VPN works great.

    Hi Matt,

    You are probably landing on the tunnel-group by default - you will need to indicate which group to connect to the client. This can be done in different ways - I see that you already have a defined group aliases, but to be able to use that you must configure:

    WebVPN

    tunnel-group-list activate

    Alternatively, if you have only a single group, you can add 'group-url https://yourasa.yourcompany.com/ permit' to the webvpn attributes tunnel-group.

    HTH

    Herbert

  • Addition of Compact Flash in a Cisco ASA 5520

    I'm trying to install a 512 MB COmpact Flash for an ASA 5520 Cisco.  We inserted the compact flash, but when we do a DIR, it does not show.  even as an unformatted device.

    What should we do to make this a usable CF?  I just need to recharge the ASA or do I need to format the CF.  It was inserted into the slot in the back of the ASA 5520, and we ensured that had been properly rests.

    Thank you

    Dwane

    The Cisco FAQ article:

    I can hot flash player? For example, is it possible to change the flash player when Cisco ASA is turned on and running?

    It is always recommended that you turn off the Cisco ASA, while you insert the flash drive. This disables all working processes and allows the ASA to recognize the flash from the startup process.

  • Upgrade to Cisco ASA 5520 8.2.5 to 9.1.7

    Hello

    I have an upgrade tonight for a customer to upgrade a StandAlone ASA 5520 in version 8.2.5 in 9.1.7. I have the same upgrade week next to the same client for a failover pair.

    I already have this kind of process of 8.2.x upgrade to 9.1.x so I know the entire process, since I have to take a first step 8.2.5 8.4.6 then 9.1.7. In addition this customer has no statement of Nat therefore normally an easy process.

    But today during my routine to prepare for the upgrade (I prefer to make a double or triple check before) I found this bug:

    https://BST.cloudapps.Cisco.com/bugsearch/bug/CSCuh19234;JSESSIONID=0A69...

    This bug is fixed in version 8.4.7, and 8.4.6.99. But it is not recommended by the upgrade process for a 8.2.5 to 8.4.7 jump and I can not find the 8.4.6.99 version.

    I don't want to have any problems during my upgrade with something I can avoid.

    As I said I already have this updated in the past without any problem and with a more complex configuration.

    Has anyone as a return to this process for the last months? Should I do an extra step? (before first 8.2.5 to 8.4.5 8.4.6 or 8.4.7)

    Thank you in advance for your answer.

    There are a few incidents reported for ASA 5520 8.2.5 hit this defect running.

    You can go for an extra for 8.4.x upgrade as you mentioned to avoid default we can't say for sure if you will encounter this situation or not.  8.4.6.99 can be a picture of development so be unavailable unless you want to call TAC and confirm or obtain any other image in 8.4.x train.
    Maybe add another upgrade code can't hurt as that hit the bug.

    Kind regards
    Dinesh Moudgil

    PS Please rate helpful messages.

  • IPSec VPN between Cisco ASA and Fortigate1000

    Hello

    I find a useful document on how to create a tunnel VPN IPSec with ASA 5510 firewall Fortigate 1000...

    the configuration of the coast FG is done without any problem, BUT the document (. doc FG) said I must configure the ASA with a GRE interface and assign an internal IP address in order to communicate with the FG...

    The question is: How do I configure the interface on the SAA ACCORD?

    Thanks in advance, Experts...

    Kind regards...

    ASA firewall does not support the interface/GRE GRE tunnel.

    If you need to have GRE configured, you will need to complete the GRE tunnel on router IOS.

    If you want to configure just pure tunnel VPN IPSec (lan-to-lan), here is an example of configuration on the side of the ASA:

    http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080950890.shtml

    Hope that helps.

  • Cisco ASA 5520, 8.02, 4GE SSM, IPS?

    I have an ASA 5520 with 4GE SSM module.

    The ASDM, I see IPS basic signatures... anyway to upgrade these signatures, add to, etc.?

    Not really, you must purchase the AIP - SSM module for this.

    Concerning

    Farrukh

  • Cisco ASA 5520 cannot ping between VPN Tunnels

    I have the main site and sites A and B.  A to connect to the hand and B connects to the main.  I can ping from A hand and has for main.  I can ping from main to B and B to main.  However, I can not ping from A to B.  A and B are sonicwall 2040 and main is a 5520.  The question should not be with the 5520 none allowing traffic between the two VPN Tunnels, but I can't understand why it does not work.  Can someone give an idea on that?  Thanks in advance.

    Hello

    I see that you use ASDM. Always makes my eyes bleed when I need to look at the DM_INLINE of named objects and try to make sense the CLI format

    Seems to me that there are problems with the NAT.

    If you don't mind a small break between the main Site and remote locations, I'd say changing some follows the NAT configuration

    Remove old

    no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_10 DM_INLINE_NETWORK_10 non-proxy-arp-search of route static destination

    no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_12 DM_INLINE_NETWORK_12 non-proxy-arp-search of route static destination

    Add a new

    object-group network NETWORK-2790

    object-network 10.217.0.0 255.255.255.0

    object-network 10.217.1.0 255.255.255.0

    object-group network NETWORK-3820

    object-network 10.216.0.0 255.255.255.0

    object-network 10.216.1.0 255.255.255.0

    object-group network NETWORK-COLO

    object-net 10.8.0.0 255.255.255.0

    destination of NETWORK of NETWORK-2790-2790 static NAT (outside, outside) static source NETWORK - 3820 - 3820

    NAT static destination of NETWORK of NETWORK-COLO-COLO (indoor, outdoor) static source NETWORK - 2790 - 2790

    NAT static destination of NETWORK of NETWORK-COLO-COLO (indoor, outdoor) static source NETWORK - 3820 - 3820

    The first new line of configuring NAT manages the NAT0 configuration for traffic between SiteA and SiteB. The following configurations of NAT 2 manage the NAT0 for traffic between the main Site - hand Site SiteA - SiteB

    -Jouni

  • VPN Cisco ASA 5520

    Hello, my name is Jeremy Rose, I am a novice...

    I'm trying to set up a VPN in a private network to access a server from outside of our firewall.

    The VPN functions, however, we are unable to contact the server once the VPN is in place.

    I can provide more information, as requested, any ladies or gentlemen reccomendations?

    Thank you

    Jeremy

    Ensure that valuable traffic corresponds to both ends basically.  So if your server is 192.168.1.10 and changed to 10.1.1.10 you must update under the card encryption ACL.

  • Client VPN und Cisco asa 5505 tunnel work but no traffic

    Hi all

    I am new to this forum and Don t have a lot of experience with Cisco, so I hope I can get help from specialists.

    I have the following problem:

    I installed und konfigured ASA 5505 for use with vpn client. I would like to access the local network from outside through vpn.

    To test, I installed ASA 5505 with ADSL (pppoe) and tried to give access to the internal network.

    Of course whenever I have recive the supplier's different IP address, but it didn't is not a problem reconfigure in the vpn client.

    After the connection is established (vpn tunnel work) I can see my external network packets. But I Don t have any connection to the internal network.

    I erased my setup yesterday and tried to reconfigure ASA again. I didn t tested yesterday, because it was too late. And I know that I Don t have the authorization rule at present by the ACL. But I think I'm having the same problem again. (tunnel but no traffic).

    What I did wrong. Could someone let me know what I have to do today.

    With hope for your help Dimitri.

    ASA configuration after reset and basic configuration: works to the Internet from within the course.

    : Saved

    : Written by enable_15 to the CEDT 20:29:18.909 Sunday, August 29, 2010

    !

    ASA Version 8.2 (2)

    !

    ciscoasa hostname

    activate 2KFQnbNIdI.2KYOU encrypted password

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.1.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    PPPoE client vpdn group home

    IP address pppoe setroute

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    boot system Disk0: / asa822 - k8.bin

    passive FTP mode

    clock timezone THATS 1

    clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

    DNS domain-lookup outside

    DNS server-group DefaultDNS

    Server name 194.25.0.60

    Server name 194.25.0.68

    DM_INLINE_TCP_1 tcp service object-group

    port-object eq www

    EQ object of the https port

    inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 no matter what eq field open a debug session

    inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any object-group DM_INLINE_TCP_1 open a debug session

    inside_access_in list extended access deny ip any any debug log

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.0.0 255.255.0.0

    permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.10.0 255.255.255.128

    homegroup_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Outside 1500 MTU

    Within 1500 MTU

    IP local pool homepool 192.168.10.1 - 192.168.10.100 mask 255.255.255.0

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm-625 - 53.bin

    ASDM location 192.168.0.0 255.255.0.0 inside

    ASDM location 192.168.10.0 255.255.255.0 inside

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    inside_access_in access to the interface inside group

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    VPDN group home request dialout pppoe

    VPDN group House localname 04152886790

    VPDN group House ppp authentication PAP

    VPDN username 04152886790 password 1

    dhcpd outside auto_config

    !

    dhcpd address 192.168.1.5 - 192.168.1.36 inside

    dhcpd allow inside

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    TFTP server 192.168.1.5 inside c:/tftp-root

    WebVPN

    Group Policy inner residential group

    attributes of the strategy of group home group

    value of 192.168.1.1 DNS server

    Protocol-tunnel-VPN IPSec

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list homegroup_splitTunnelAcl

    username user01 encrypted password privilege 0 v5P40l1UGvtJa7Nn

    user01 username attributes

    VPN-strategy group home group

    tunnel-group home group type remote access

    attributes global-tunnel-group home group

    address homepool pool

    Group Policy - by default-homegroup

    tunnel-group group residential ipsec-attributes

    pre-shared-key ciscotest

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:930e6cddf25838e47ef9633dc2f07acb

    : end

    Hello

    Normally, you want a static public IP address on the ASA to allow it to receive connections from VPN clients (avoid to change the IP address all the time).

    If you connect via VPN, check the following:

    1. the tunnel is established:

    HS cry isa his

    Must say QM_IDLE or MM_ACTIVE

    2 traffic is flowing (encrypted/decrypted):

    HS cry ips its

    3. Enter the command:

    management-access inside

    And check if you can PING the inside ASA VPN client IP.

    4. check that the default gateway for the LAN internal ASA within intellectual property (or there is a road to the ASA to send traffic to the VPN clients).

    Federico.

Maybe you are looking for