L2l Tunnel upward, without traffic transits

Similar Questions

• L2L ASA tunnel upward, no traffic (or one way...)

  I have two ASA 5505, 8.2 (1), call the HQ and BRANCH. HQ is a L2L towards a third point, and that one works fine.

  Now I'm setting up a VPN L2L between HQ and BRANCH. The tunnel rises (passes, phases 1 and 2), but I can't ping from both ends.

  HS cry isa his looks like 100% ok

  Cree SH ips its shows that HQ has only decaps, while the branch has only the program. If HQ looks like the main suspect for me (even with his other L2L works very well).

  Here are the configs, great if someone could help me to identify problems of config...

  -----------------------------------------------------------------

  HQ:

  ASA Version 8.2 (1)

  !

  hostname HQ

  domain blah.com/results.htm

  enable password blah

  encrypted passwd bla

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 172.16.106.1 255.255.255.128

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address 191.xx.xx.xx 255.255.255.248

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  boot system Disk0: / asa821 - k8.bin

  DNS server-group DefaultDNS

  domain blah.com/results.htm

  access extensive list ip 172.16.106.0 inside_outbound_nat0_acl allow 255.255.255.128 all

  access extensive list ip 172.16.106.0 outside_cryptomap_20 allow 255.255.255.0 any

  access extensive list ip 172.16.106.0 inside_nat0_outbound allow 255.255.255.0 any

  access extensive list ip 172.16.106.0 inside_nat0_outbound allow 255.255.255.128 172.16.106.160 255.255.255.224

  access extensive list ip 172.16.106.0 outside_1_cryptomap allow 255.255.255.0 any

  access extensive list ip 172.16.106.0 outside_1_cryptomap_1 allow 255.255.255.0 any

  IP 172.16.106.0 allow to Access-list HQ-BRANCH extended 255.255.255.128 172.16.106.160 255.255.255.248

  !

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 1 0.0.0.0 0.0.0.0

  Route outside 0.0.0.0 0.0.0.0 191.xx.xx.xx 1

  !

  Sysopt noproxyarp inside

  !

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto ipsec security association replay disable

  card crypto outside_map 1 match address outside_1_cryptomap_1

  card crypto outside_map 1 set 191.xx.xx.xx counterpart

  map outside_map 1 set of transformation-ESP-3DES-MD5 crypto

  address for correspondence card crypto outside_map 10 HQ-GENERAL management

  card crypto outside_map 10 peers set 82.xx.xx.xx

  outside_map card crypto 10 the transform-set ESP-3DES-MD5 value

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 30

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  No encryption isakmp nat-traversal

  !

  WebVPN

  tunnel-group 191.xx.xx.xx type ipsec-l2l

  191.XX.XX.XX group of tunnel ipsec-attributes

  pre-shared-key *.

  tunnel-group 82.xx.xx.xx type ipsec-l2l

  82.XX.XX.XX group of tunnel ipsec-attributes

  pre-shared-key *.

  by default-group 191.xx.xx.xx tunnel-Group-map

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  global service-policy global_policy

  context of prompt hostname

  : end

  -----------------------------------------------------------------

  GENERAL management:

  ASA Version 8.2 (1)

  !

  hostname BRANCH

  activate djfldksjafl encrypted password

  djfldksjafl encrypted passwd

  names of

  !

  interface Vlan1

  No nameif

  no level of security

  no ip address

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  interface Vlan3

  nameif inside

  security-level 100

  IP 172.16.106.161 255.255.255.248

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  switchport access vlan 3

  !

  interface Ethernet0/2

  Shutdown

  !

  interface Ethernet0/3

  Shutdown

  !

  interface Ethernet0/4

  switchport access vlan 3

  !

  interface Ethernet0/5

  Shutdown

  !

  interface Ethernet0/6

  Shutdown

  !

  interface Ethernet0/7

  Shutdown

  !

  boot system Disk0: / asa821 - k8.bin

  the obj_any object-group network

  IP 172.16.106.160 allow to Access-list BRANCH-HQ extended 255.255.255.248 172.16.106.0 255.255.255.128

  IP 172.16.106.160 allow Access - list extended SHEEP 255.255.255.248 172.16.106.0 255.255.255.128

  Enable logging

  ICMP unreachable rate-limit 1 burst-size 1

  !

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 0 access-list SHEEP

  NAT (inside) 1 0.0.0.0 0.0.0.0

  Route outside 0.0.0.0 0.0.0.0 82.xx.xx.xx

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  address for correspondence card crypto 10 BRANCH-HQ outside_map

  card crypto outside_map 10 peers set 191.xx.xx.xx

  card crypto outside_map 10 transform-set RIGHT

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  dhcpd dns xx.xx.xx.xx

  dhcpd outside auto_config

  !

  dhcpd address 172.16.106.162 - 172.16.106.166 inside

  dhcpd allow inside

  !

  WebVPN

  tunnel-group 191.xx.xx.xx type ipsec-l2l

  191.XX.XX.XX group of tunnel ipsec-attributes

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  !

  global service-policy global_policy

  context of prompt hostname

  : end

  -----------------------------------------------------------------

  Best,

  Johnny

  Hello Johnny,.

  Great to hear that, there, you have some points for you

  Please check the question as answered so future users can draw from what you did

• Dynamic L2L Tunnel - the Tunnel is up, will not pass the LAN traffic

  Hello everyone. I am repurposing an ASA for my business at a remote site and must use a dynamic Configuration of L2L with Split tunneling active. We used these in the past and they work a lot, and I've referenced Cisco official documentation for the implementation. Currently, I am having a problem where I am unable to pass traffic on the local remote network over the VPN tunnel (it does even not raise the tunnel of form). However, if I run the following command in the ASA remote:

  Ping inside the 192.168.9.1

  I receive the ICMP responses. In addition, this traffic causes the VPN Tunnel to be created as indicated by show ISA SA:

  1 peer IKE: xx.xx.xx.xx

  Type: L2L role: initiator

  Generate a new key: no State: MM_ACTIVE

  Here is the IP addressing scheme:

  Network remotely (with the ASA problem): 192.168.12.0/24

  Basic network (Hub): 192.168.9.0/24

  Other rays: 192.168.0.0/16

  Config:

  ASA Version 8.2 (1)
  !
  hostname xxxxxxxxx
  domain xxxxxxxxxxx.local
  activate the xxxxxxxx password
  passwd xxxxxxxxx
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  192.168.12.1 IP address 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS server-group DefaultDNS
  domain xxxxxxxx.local
  permit same-security-traffic intra-interface
  to_hq to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  inside_nat0_outbound to access extended list ip 192.168.12.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
  pager lines 24
  Within 1500 MTU
  Outside 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto outside_map 10 correspondence address to_hq
  crypto outside_map 10 card game CORE peers. ASA. WAN. INTELLECTUAL PROPERTY
  outside_map crypto 10 card value transform-set ESP-3DES-SHA
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd 192.168.9.2 dns 208.67.222.222
  !
  dhcpd address 192.168.12.101 - 192.168.12.131 inside
  rental contract interface 86400 dhcpd inside
  dhcpd xxxxxxxxx.local area inside interface
  dhcpd ip interface 192.168.9.50 option 66 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  tunnel-group basis. ASA. WAN. Type of IP ipsec-l2l
  tunnel-group basis. ASA. WAN. IPSec-attributes of intellectual property
  pre-shared key xxxxxxxxxxxx
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname

  Once the tunnel is in place, LAN to the Remote Site traffic won't pass through the VPN Tunnel any upward. On the side of ASA Core, I was able to Telnet in the ASA distance very well, but could not ping the Remote Access Point.

  Someone at - it a glimpse of my problem?

  Hello

  Add:

  NAT (inside) 0-list of access inside_nat0_outbound

• Making the NAT for VPN through L2L tunnel clients

  Hi.I has the following situation in my network. We need for users who log on our site with the VPN clients to connect to another site via a tunnel L2L. The problem is that I need NAT addresses from the pool of VPN client in another beach before going on the L2L tunnel because on the other side, we have duplication of networks.

  I tried to do NAT with little success as follows:

  ACL for pool NAT of VPN:

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.0.0 255.255.255.0

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.5.0 255.255.255.0

  NAT:

  Global 172.20.105.1 - 172.20.105.254 15 (outdoor)

  NAT (inside) 15 TEST access-list

  CRYPTO ACL:

  allowed ro access list extended LAN ip 255.255.0.0 192.168.0.0 255.255.255.0

  allowed ro access list extended LAN ip 255.255.0.0 192.168.5.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.0.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.5.0 255.255.255.0

  permit same-security-traffic intra-interface

  Am I missing something here? Something like this is possible at all?

  Thanks in advance for any help.

  We use the ASA 5510 with software version 8.0 (3) 6.

  You need nat to the outside, not the inside.

  NAT (outside) 15 TEST access-list

• L2l Tunnel between 2POIGNEES: general query on ACL sheep/crypto

  Hi all

  For the L2L tunnel between 2POIGNEES work very well, we configure normally same network to network - sheep & cryptos ACL on both ends of the SAA. My question is...

  It will work without any problem, if on one end of the ASA, the ACL sheep & crypto are combined to form the group object (to limit the ASA configs) and on the other end address net net address ACL sheep & crypto still exists (not consolidated in the Group of objects)... ? If it works, it works even if the tunnel is between ASA--> router.

  Thanks in advance

  MS

  MS, it will work if the other side does not use the same scenario of acl consolidated using groups of objects. ACLs and groups of objects are significant locally on the device.

  You can consolidate the ACLs on the ASA/PIX using TCP or UDP-groups of objects or groups of objects network and that your acl to the respective object-group, they always have the same effect as when they have been configured individually line by line.

  This works even if the tunnel is between ASA--> router

  Yes

  HTH

  Jorge

• I get the error message on debugging ipsec-l2l tunnel

  Hello

  Can someone help me understand the debug message?
  I get the error message on debugging ipsec-l2l tunnel

  I tried to configure an ASA5520 with an ipsec-l2l to ios router 1721

  = 1721 router =.

  Cisco 1721 (flash: c1700-k9o3sy7 - mz.123 - 2.XC2.bin)
  80.89.47.102 outside
  inside 10.100.110.1 255.255.255.0

  Debug crypto ipsec
  Debug crypto ISAKMP

  -config-
  crypto ISAKMP policy 1
  BA 3des
  md5 hash
  preshared authentication
  Group 2
  0 1234567890 128.39.189.10 crypto isakmp key address
  !
  !
  Crypto ipsec transform-set esp-3des pix-series
  !
  ASA 10 ipsec-isakmp crypto map
  defined by peer 128.39.189.10
  transform-set pix - Set
  match address 101
  !
  !
  interface FastEthernet0

  Outside-interface description

  IP 80.89.47.102 255.255.255.252

  NAT outside IP

  card crypto asa

  !

  interface Vlan10
  Inside description
  IP 10.100.110.1 255.255.255.0
  IP nat inside

  !

  !

  IP nat inside source overload map route interface FastEthernet0 sheep

  !

  access-list 101 permit ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255

  !

  access-list 110 deny ip 10.100.110.0 0.0.0.255 10.100.4.0 0.0.3.255
  access-list 110 permit ip 10.100.110.0 0.0.0.255 any
  !
  sheep allowed 10 route map
  corresponds to the IP 110
  !

  = Config ASA =.

  Cisco 5520 ASA Version 8.2 (1)
  128.39.189.10 outside
  inside 10.100.4.255 255.255.252.0

  Debug crypto ipsec
  Debug crypto ISAKMP

  -Config-
  !
  Allow Access-list extended sheep 255.255.252.0 IP 10.100.4.0 10.100.110.0 255.255.255.0
  !
  access extensive list ip 10.100.4.0 outside110 allow 255.255.252.0 10.100.110.0 255.255.255.0
  !

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  86400 seconds, duration of life crypto ipsec security association
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto outside_map 11 match address outside110
  peer set card crypto outside_map 11 80.89.47.102
  card crypto outside_map 11 game of transformation-ESP-3DES-MD5
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400

  !

  attributes of Group Policy DfltGrpPolicy
  VPN-idle-timeout no
  Protocol-tunnel-VPN IPSec

  !

  tunnel-group 80.89.47.102 type ipsec-l2l
  IPSec-attributes tunnel-group 80.89.47.102
  pre-shared key 1234567890

  Concerning
  Tor

  You have a transformation defined on the SAA named ESP-3DES-MD5? Your crypto card refers to that but I don't see it listed in the config you have posted. I don't have much experience with routers, but is MD5 hashing algoritm (and why it is not)?

  James

• Why no implicit route for traffic from IPSec-L2L tunnel?

  In a hub-and-spoke IPSec environment, it is not difficult to implement routing by spoke to the hub.

  But on the side of the hub of a tunnel, where the gateway of last resort for traffic by spoke it, it seems almost counterintuitive than the ACL instructions and even cryptographic doesn't implicitly create a route for the traffic of the station in the tunnel at the end (talk).  It could always be replaced with a static if necessary.

  There is probably a good reason for this, but I can't think of it.  Or am I the only person who thinks it is strange... or maybe an opportunity to feature?

  Hello

  This feature exists and is called reverse road injection. The route is created dynamically (based on ACL Cryptography) and is only available when the SA is up.

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t14/feature/guide/gt_rrie.html

  HTH

  Laurent.

• IPSEC tunnel upward - traffic has failed. TTL expired on one side.

  Soho office:

  Site has, ASA 5505

  10.29.0.XX/24

  Main office:

  Site b, ASA 5540

  10.75.0.XX/24

  Tunnel establishes - phase one and two good.  Packet tracer completes successfully on both sides.  A customer on the site of soho cannot send pings to 10.75.0.xx but receives no response.  I see the construction and destruction on the firewall side of soho, but I get no answer.  When I kill the tunnel, send a ping command will be it restore on the side of soho.

  On the side of the head office, pings sent to 10.29.0.xx return: "TTL expired in Transit".  A traceroute shows the package one loop in the firewall.  The ACL look good, cryptographic cards look great and there is no explicit way pointing elsewhere.  If I drop the tunnel, sending pings from the side main office not rebuild the tunnel.

  No idea what I'm missing here or what direction to another head?

  -JP

  Configs of the checkpoint

• VPN tunnel upward, but no traffic?

  I decided to take a Cisco 1800 series router and try to put in place. Up to now I can get out, and everything seems fine. I then tried to configure a VPN tunnel between this router and a sonicwall router secure.

  Now the problem is the GUI of SonicWall and Cisco say that this tunnel is mounted. But I can't access internal networks...

  So my cisco LAN is 192.168.11.0 255.255.255.0

  and the Sonic Wall is 192.168.1.0 255.255.255.0

  They can talk even if the tunnel is up. I was hitting my head, and running through the tutorials and just can not understand.

  Here's proof that we have achieved at least the first phase:

  inbound esp sas:
  
        spi: 0xD1BC1B8E(3518765966)
  
          transform: esp-256-aes esp-sha-hmac ,
  
          in use settings ={Tunnel, }
  
          conn id: 3003, flow_id: FPGA:3, crypto map: vpn
  
          sa timing: remaining key lifetime (k/sec): (4541007/2298)
  
          IV size: 16 bytes
  
          replay detection support: Y
  
          Status: ACTIVE
  
  outbound esp sas:
  
        spi: 0xAE589C1E(2925042718)
  
          transform: esp-256-aes esp-sha-hmac ,
  
          in use settings ={Tunnel, }
  
          conn id: 3004, flow_id: FPGA:4, crypto map: vpn
  
          sa timing: remaining key lifetime (k/sec): (4541027/2297)
  
          IV size: 16 bytes
  
          replay detection support: Y
  
          Status: ACTIVE

  So here's my config: (what Miss me?)

  Current configuration : 3972 bytes
  
  !
  
  version 12.4 no service pad
  
  service tcp-keepalives-in service tcp-keepalives-out
  
  service timestamps debug datetime msec
  
  service timestamps log datetime msec
  
  no service password-encryption
  
  !
  
  hostname CompsysRouter
  
  !
  
  boot-start-marker
  
  boot-end-marker
  
  !
  
  enable secret *****************
  
  enable password ***********
  
  !
  
  aaa new-model
  
  !
  
  !
  
  !
  
  aaa session-id common
  
  ip cef
  
  !
  
  !
  
  !
  
  !
  
  no ip domain lookup
  
  ip domain name ********.local
  
  ip inspect name myfw http timeout 3600 ip inspect name myfw tcp timeout 3600 ip inspect name myfw udp timeout 3600 ip inspect name myfw dns timeout 3600 ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 !
  
  !
  
  crypto pki trustpoint TP-self-signed-1821875492 enrollment selfsigned
  
  subject-name cn=IOS-Self-Signed-Certificate-1821875492 revocation-check none
  
  rsakeypair TP-self-signed-1821875492 !
  
  !
  
  crypto pki certificate chain TP-self-signed-1821875492 certificate self-signed 01   30820245 308201AE A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  
    31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  
    69666963 6174652D 31383231 38373534 3932301E 170D3130 31323130 32333433
  
    35325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  
    4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 38323138
  
    37353439 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  
    8100CC57 E44AB177 3594C4C7 E88B1A4F CE4FD392 87CDB75C 2A6A6B1A 87D10791
  
    0134F1FC 54A84BB6 08A40213 35B9DD0A FD813D2F 1C778D01 3F8EBEB0 C4793850
  
    F52F7906 FDBC56A5 A4829AC5 4180DDA7 F54E3AAD DD1D4537 F1F19F11 9AE8A8A0
  
    91C98934 233CF608 1447DA83 41B09E55 4A0FF674 8D060945 07D3F3F9 8EA7B412
  
    5FD30203 010001A3 6D306B30 0F060355 1D130101 FF040530 030101FF 30180603
  
    551D1104 11300F82 0D436F6D 70737973 526F7574 6572301F 0603551D 23041830
  
    168014DC A9938F71 7CCF0E6D 8BC5DFA5 033DD7E4 0F605130 1D060355 1D0E0416
  
    0414DCA9 938F717C CF0E6D8B C5DFA503 3DD7E40F 6051300D 06092A86 4886F70D
  
    01010405 00038181 00148C2F AA7CA155 463B56F2 324FE1ED 3682E618 75E3048F
  
    93E1EA61 3305767A FA93567B AA93B107 83A2F3D6 8F773779 E6BF0204 DC71879A
  
    5F7FC07F 627D8444 48781289 7F8DC06A BC9057B1 4C72AE1F B64284BE 94C6059C
  
    7B6B8A5D 83375B86 3054C760 961E8763 91767604 5E0E0CE3 3736133A E51ACF26
  
    14F3C7C5 60E08BE3 88   quit
  
  username jdixon secret 5 $*****************
  
  !        
  
  !
  
  ip ssh time-out 60 ip ssh authentication-retries 2 !
  
  !
  
  crypto isakmp policy 1 encr aes 256 authentication pre-share
  
  group 2 lifetime 28800 crypto isakmp key address  !
  
  !
  
  crypto ipsec transform-set compsys esp-aes 256 esp-sha-hmac
  
  !
  
  crypto map vpn 10 ipsec-isakmp
  
  set peer set transform-set compsys
  
  match address 101 !
  
  !
  
  !
  
  interface FastEthernet0/0
  
  ip address "LOCAL ROUTER OUTSIDE" 255.255.255.248 ip access-group Inbound in ip nat outside
  
  ip inspect myfw out
  
  ip virtual-reassembly
  
  duplex auto
  
  speed auto
  
  no keepalive
  
  crypto map vpn
  
  !
  
  interface FastEthernet0/1
  
  ip address 192.168.11.1 255.255.255.0 ip nat inside
  
  ip virtual-reassembly
  
  duplex auto
  
  speed auto
  
  !
  
  ip forward-protocol nd
  
  ip route 0.0.0.0 0.0.0.0 !
  
  !
  
  ip http server
  
  ip http authentication local
  
  ip http secure-server
  
  ip nat inside source list 1 interface FastEthernet0/0 overload
  
  ip nat inside source static tcp 192.168.11.55 3389 interface FastEthernet0/0 9999 !
  
  ip access-list extended Inbound
  
  permit icmp any any
  
  permit gre host "REMOTE ROUTER" host "LOCAL ROUTER" permit esp host "REMOTE ROUTER" host "LOCAL ROUTER" permit udp host "REMOTE ROUTER" host "LOCAL ROUTER" eq isakmp
  
  permit ahp host "REMOTE ROUTER" host "LOCAL ROUTER" permit udp host "REMOTE ROUTER" host "LOCAL ROUTER" eq non500-isakmp
  
  permit ip host "REMOTE ROUTER" any
  
  permit tcp any host "LOCAL ROUTER" eq 22 !
  
  access-list 1 permit 192.168.11.0 0.0.0.255 access-list 101 permit ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255 !
  
  !
  
  !
  
  !
  
  control-plane
  
  !        
  
  !
  
  !
  
  line con 0 line aux 0 line vty 0 4 !
  
  scheduler allocate 20000 1000 end

  NAT exemption is where it is a failure.

  Please kindly change to as follows:

  access-list 150 deny ip 192.168.11.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 150 permit ip 192.168.11.0 0.0.0.255 any

  IP nat inside source list 150 interface fastethernet0/0 overload

  no nat ip within the source list 1 interface fastethernet0/0 overload

  Hope that helps.

• L2l tunnel question

  Hello...

  I created a tunnel of L2L b & w a Juniper NetScreen VPN 3005... .the tunnel is mounted, but we both are unable to ping the ip allowed... Another thing, I don't see him rx traffic but no traffic tx from... suspecting me keep the alives...

  It's the second tunnel I built on this VPN 3005 box, this first has no problem with what I have now...

  help them on this issue... Thanks in advance

  Hello

  Well, that's your problem. When the 192.168.10.10 pc attempts to send traffic to the PC 172.16.10.10 traffic goes first to the Pix. But because you run v6.x from the pix it is not allowed to send the traffic, he came back on the same interface the and he needs to do this to send traffic to the VPN 3005.

  With pix v7.x, you can do this, but a solution to your problem without having to upgrade would be to add a static route on your 192.168.10.10 PC saying to 172.16.10.10 go to 192.168.10.15.

  HTH

  Jon

• VPN-> ASA1 < - l2l Tunnel - > client-> Service ASA2 will not work?

  Hello

  I have spent a lot of time with this problem, but I have not found a working configuration. I sound so simple, but nothing seems to work.

  We have a Site 2 Site tunnel established between two ASA 5505, in the network 'ASA2, 192.168.33.0/24' a terminal server server is located.

  A warrior of the road the VPN user connects to the network 'ASA1, 192.168.0.0/24' using the Cisco VPN Client. It is able to connect to its network services, but not the services that are found in the ASA2 network. The log file is clean, without drops.

  The client shows stats both networks secure routes.

  I'm blind for the solution, or is this not possible?

  Someone has an int for me?

  Best regards

  Markus

  Looks like you need to configure 192.168.0.0/24 within the field of encryption for the tunnel between ASA 1 with the ASA2 L2L.

  You must configure the user of warrior to also encrypt the traffic to the ASA2 network.

  You must activate the same communication intra-interface security, so that traffic can enter ASA 1, then let ASA 1 ASA 2 on the same outside the interface.

  HTH >

• S2S VPN - cannot get the tunnel upward

  I couldn't lift a VPN site-to site because of a configuration error that I can't fix

  The topology is Server1 > Hub > ASA - 1 ASA-2<><>

  When I launch a ping server 1 Server 2 to try to get out of the tunnel to the top, I get the following error:

  % ASA-6-110002: unable to locate the output for ICMP inside:192.168.100.2/2655 to 192.168.200.2/0 interface

  No matter which side I am ping, I get the error on both of the ASA. Here is the config for the two ASA, thanks for any help.

  !
  ASA-1 hostname
  !
  interface GigabitEthernet0
  nameif outside
  security-level 0
  IP 80.1.1.1 255.255.255.252
  !
  interface GigabitEthernet1
  nameif inside
  security-level 100
  IP 192.168.100.1 address 255.255.255.0
  !
  passive FTP mode
  network of the PC_LAN object
  255.255.255.0 subnet 192.168.100.0
  network of the REMOTE_LAN object
  192.168.200.0 subnet 255.255.255.0
  extended access list ACL-OUTSIDE-PING icmp permitted any one
  LAB_S2S_VPN to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.200.0 255.255.255.0 connect
  LAB_S2S_VPN list extended access allow icmp 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0 connect
  pager lines 24
  Enable logging
  exploitation forest-size of the buffer of 6000
  debug logging in buffered memory
  Outside 1500 MTU
  Within 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any inside
  ARP timeout 14400
  NAT static PC_LAN PC_LAN destination (indoor, outdoor) static source REMOTE_LAN REMOTE_LAN
  Access-Group ACL-OUTSIDE-PING to the interface inside
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec transform-set ikev1 aes-esp - SHA-AES-ESP esp-sha-hmac
  card crypto VPN_CRYPTO_MAP 1 corresponds to the address LAB_S2S_VPN
  card crypto VPN_CRYPTO_MAP 1 set peer 80.1.1.2
  card crypto VPN_CRYPTO_MAP 1 set transform-set ESP-AES-SHA ikev1
  VPN_CRYPTO_MAP interface card crypto outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  management-access inside
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  tunnel-group 80.1.1.2 type ipsec-l2l
  IPSec-attributes tunnel-group 80.1.1.2
  IKEv1 pre-shared-key *.

  ASA-2 host name
  !
  interface GigabitEthernet0
  nameif outside
  security-level 0
  IP 80.1.1.2 255.255.255.252
  !
  interface GigabitEthernet1
  nameif inside
  security-level 100
  192.168.200.1 IP address 255.255.255.0
  !
  interface GigabitEthernet2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  passive FTP mode
  network of the PC_LAN object
  192.168.200.0 subnet 255.255.255.0
  network of the REMOTE_LAN object
  255.255.255.0 subnet 192.168.100.0
  extended access list ACL-OUTSIDE-PING icmp permitted any one
  LAB_S2S_VPN to access extended list ip 192.168.200.0 allow 255.255.255.0 192.168.100.0 255.255.255.0 connect
  LAB_S2S_VPN list extended access allow icmp 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0 connect
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  NAT static REMOTE_LAN REMOTE_LAN destination (indoor, outdoor) static source PC_LAN PC_LAN
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec transform-set ikev1 aes-esp - SHA-AES-ESP esp-sha-hmac
  card crypto VPN_CRYPTO_MAP 1 corresponds to the address LAB_S2S_VPN
  card crypto VPN_CRYPTO_MAP 1 set peer 80.1.1.1
  card crypto VPN_CRYPTO_MAP 1 set transform-set ESP-AES-SHA ikev1
  VPN_CRYPTO_MAP interface card crypto outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  tunnel-group 80.1.1.1 type ipsec-l2l
  IPSec-attributes tunnel-group 80.1.1.1
  IKEv1 pre-shared-key *.
  !

  You won't have a road to 192.168.200.2 so he was not able to locate the next hop for the traffic of the tunnel.

  These static routes adding causes all traffic to be sent to the default gateway of the internet, including VPN and VPN traffic not.
  So adding a route for 192.168.200.0 pointing to 80.1.1.X gave the same results.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• L2l tunnel and show connection addess

  Hello world

  ASA 5505 L2L 5520 tunnel a.

  The tunnel is running.

  5505 # sh crypto isakmp his

  IKEv1 SAs:

  ITS enabled: 1
  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)
  Total SA IKE: 1

  1 IKE Peer: 10.31.2.30
  Type: L2L role: initiator
  Generate a new key: no State: MM_ACTIVE

  There are no SAs IKEv2

  SH crypto ipsec his
  Interface: Visitor_Edge
  Tag crypto map: D_Traffic_Crypto, seq num: 1, local addr: 10.31.2.20

  When I sh conn address 10.31.2.20 all the
  5 in use, most used 9316
  ESP visitor identity Ifc 10.31.2.20 NP 10.31.2.30, idle 0:00:00, 9912 bytes, flags - 1
  UDP 10.31.2.30:500 NP identity Ifc 10.31.2.20:500 visitor, slowed down to 0:00:09, 3365216, flags - 2 bytes
  ESP visitor identity Ifc 10.31.2.20 NP 10.31.2.30, idle 0:00:00, 3816 bytes, flags - 3

  Must understand the connections 1 and 3 are used for what purpose and why they have no port information?

  As 2 is tunnel connection using port 500. but the connections 1 and 3 have no port number, why?

  Concerning

  Mahesh

  Connection 1 and 3 represent the traffic going in and out, ESP that sit directly on the IP header, so there is no port information.

  Connection 2 represent IKE messages that are exchanging messages on port UDP 500.

• L2l multiple rays routing traffic

  I have a problem I hope you can shed some light on this. I have all 3 sites connected with VPN/IPsec ikev2 tunnels using ASA 5505 and 5510 with 8.4 + code. Please see the image below for more details on my installation. All VPN tunnels are up and send traffic across the immediate neighbor, the problem is that I can't ping or access the ASA2 subnet ASA3 subnet or ASA2 of ASA3, that I'm missing in my setup? Please see below and thank you in advance for any help you can provide this.

  

  ASA 3 VPN Config:
  protocol esp integrity sha-1
  crypto ipsec security-association pmtu-aging infinite
  crypto map crypto_map 1 match address AS3_ACL
  crypto map crypto_map 1 set peer 1.1.1.1
  crypto map crypto_map 1 set ikev2 ipsec-proposal aes_256
  crypto map crypto_map interface outside
  crypto ca trustpool policy
  crypto ikev2 policy 1
  encryption aes-256
  integrity sha256
  group 2
  prf sha256
  lifetime seconds 86400
  tunnel-group 1.1.1.1 type ipsec-l2l
  tunnel-group 1.1.1.1 general-attributes
  default-group-policy ipsec_group_policy
  tunnel-group 1.1.1.1 ipsec-attributes
  ikev2 remote-authentication pre-shared-key *****
  ikev2 local-authentication pre-shared-key *****
  vpn-idle-timeout 6000
  vpn-session-timeout none
  vpn-tunnel-protocol ikev2
  nat (inside,outside) source static all_inside_networks all_inside_networks destination static all_outside_networks all_outside_networks no-proxy-arp route-lookup
  object-group network all_inside_networks
  network-object 10.0.1.0 255.255.255.0
  object-group network all_outside_networks
  network-object 10.0.0.0 255.255.255.0
  network-object 10.0.18.0 255.255.255.0
  access-list ASA3_ACL extended permit ip object-group all_inside_networks object-group all_outside_networks
  

  Hello

  Seems to me that your ASA1 missing certain rules in the 'card crypto' ACL

  ASA3_ACL list extended access permitted ip object-group objects ASA3 ASA2-group

  ASA2_ACL list extended access permitted ip object-ASA3 group ASA2 object

  You miss also the "nat" command I mentioned

  public static ASA2 ASA2 destination NAT (outside, outside) static source ASA3 ASA3

  You do not have a second order of "nat" because this must match the connection management training is the

  Hope this helps

  -Jouni

• Static L2L Tunnel - will not come to the top

  Hi all

  Currently have a very big problem with a site that I can't go there for the moment.

  We have one HUB ASA5505 SEC + a few other ASA connected via VPN L2L. We have static L2L 1 active, 1 dynamic L2L Active, and I am currently trying to add a second static Tunnel L2L.

  I checked that each WAN Interface can ping each other, and both devices have full internet connectivity. There is no double nat or being content filtering. I noticed that my Client remote access VPN Cisco will not properly connect through the ASA despite full internet connectivity, but when I connect directly to a modem, I was able to connect properly. So apparently the ISP isn't blocking IPSEC traffic as far as I KNOW.

  Static2 uses currently a temporary license of TAC since our license is currently waiting for arrival, but a release of version see the watch all VPN/3des features are enabled.

  Here are the configs:

  ASA5505-HUB hostname
  domain xxxxxxx.local
  activate the password xxxxxxxxxxx
  names of
  name 192.168.9.50 xxxxxxxxx
  name 192.168.9.51 xxxxxxxxx xxxxxxxxxx description
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.9.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address xxxxxxxxxxxxx 255.255.255.248
  !
  interface Vlan3
  nameif dmz
  security-level 50
  IP 10.10.9.1 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  switchport access vlan 3
  !
  interface Ethernet0/5
  switchport access vlan 3
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passwd xxxxxxxxxxxx
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS lookup field inside
  DNS server-group DefaultDNS
  Server name xxxxxxxxxx
  Server name xxxxxxxxxxxxxxx
  domain xxxxxxxxxxxx.local
  permit same-security-traffic intra-interface
  permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
  access-list 101 extended allow icmp a whole
  access-list standard split allow 192.168.0.0 255.255.0.0
  permit to_static1 to access extended list ip 192.168.0.0 255.255.0.0 192.168.14.0 255.255.255.0
  permit to_static2 to access extended list ip 192.168.0.0 255.255.0.0 192.168.16.0 255.255.255.0< this="" is="" the="" problem="">
  RTP list extended access udp any permitted any 10000 20000 Beach
  RTP list extended access permitted tcp everything any 10000 20000 Beach
  pager lines 24
  monitor debug logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 dmz
  mask IP local RA-pool 192.168.99.1 - 192.168.99.126 255.255.255.128
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_nat0_outbound
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 75.146.188.94 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout, uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  set of 20 SYSTEM_DEFAULT_CRYPTO_MAP crypto dynamic-map transform-set ESP-3DES-SHA
  card crypto outside_map 10 correspondence address to_static1
  card crypto outside_map 10 peers set xxxxxxxxxx
  outside_map crypto 10 card value transform-set ESP-3DES-SHA
  card crypto outside_map 11 match address to_static2
  card crypto outside_map 11 counterpart set xxxxxxxxxxxxx< problem="">
  card crypto outside_map 11 game of transformation-ESP-3DES-SHA
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd outside auto_config
  !
  dhcpd address 192.168.9.101 - 192.168.9.199 inside
  dhcpd dns 192.168.9.2 xxxxxxxxxxx interface inside
  dhcpd xxxxxxxxx.local area inside interface
  xxxxxxxx dhcpd option 66 ip inside interface
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  type of policy-card inspect sip default_sip
  parameters
  Journal of decline in the shares of Max-forwards-validation
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  inspect the rtsp
  inspect the default_sip sip
  !
  global service-policy global_policy
  Group xxxxx-RA internal policy
  xxxxx-RA group policy attributes
  Server DNS value 192.168.9.2 xxxxxxxxxxxxx
  Protocol-tunnel-VPN IPSec l2tp ipsec
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value split
  xxxxxxxxx.local value by default-field
  allow to NEM
  IPSec-attributes tunnel-group DefaultL2LGroup
  pre-shared-key *.
  type tunnel-group xxxxx-RA remote access
  Tunnel-Group global xxxxxx-RA-attributes
  address-RA-pool
  Group Policy - by default-xxxxx-RA
  tunnel-group xxxxxx-ipsec-attributes
  pre-shared-key *.
  tunnel-group STATIC2_WANIP type ipsec-l2l< problem="">
  IPSec-attributes tunnel-group STATIC2_WANIP
  pre-shared-key *.
  tunnel-group STATIC1_WANIP type ipsec-l2l
  IPSec-attributes tunnel-group STATIC1_WANIP
  pre-shared-key *.
  context of prompt hostname

  and...

  ASA5505-STATIC2 host name
  domain xxxxxxxx.local
  activate the password XXXXXX
  passwd xxxxxxxxxxx
  names of
  !
  interface Ethernet0/0
  switchport access vlan 3
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Ethernet0/2
  switchport access vlan 2
  !
  interface Ethernet0/3
  switchport access vlan 2
  !
  interface Ethernet0/4
  switchport access vlan 2
  !
  interface Ethernet0/5
  switchport access vlan 2
  !
  interface Ethernet0/6
  switchport access vlan 2
  !
  interface Ethernet0/7
  switchport trunk allowed vlan 1-2
  switchport trunk vlan 1 native
  switchport mode trunk
  !
  interface Vlan1
  nameif dmz
  security-level 50
  IP 10.10.0.1 address 255.255.255.0
  !
  interface Vlan2
  nameif inside
  security-level 100
  192.168.16.1 IP address 255.255.255.0
  !
  interface Vlan3
  nameif outside
  security-level 0
  IP address xxxxxxxxxxx 255.255.254.0
  !
  passive FTP mode
  clock timezone CST - 6
  clock to summer time recurring CDT
  DNS lookup field inside
  DNS server-group DefaultDNS
  Server name xxxxxxxxxx
  Server name xxxxxxxxxx
  domain xxxxxxxxxx.local
  access extensive list ip 192.168.16.0 to_hq allow 255.255.255.0 192.168.0.0 255.
  255.0.0
  192.168.16.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.0.0 255.
  255.0.0
  pager lines 24
  MTU 1500 dmz
  Within 1500 MTU
  Outside 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400

  Route outside 0.0.0.0 0.0.0.0 xxxxxxxxxxx
  Global 1 interface (outside)
  NAT (dmz) 1 0.0.0.0 0.0.0.0
  NAT (inside) 0 access-list sheep
  NAT (inside) 1 0.0.0.0 0.0.0.0
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  Enable http server
  http 192.168.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  card crypto cmap1 match 10 address to_hq
  card crypto cmap1 10 peers set xxxxxxxxxxxxxx
  cmap1 crypto 10 card value transform-set ESP-3DES-SHA
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  Telnet 192.168.0.0 255.255.0.0 inside
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd dns 192.168.9.2 xxxxxxxxxxxx
  !
  dhcpd address dmz 10.10.0.100 - 10.10.0.199
  dhcpd lease 10800 dmz interface
  dhcpd enable dmz
  !
  dhcpd address 192.168.16.101 - 192.168.16.131 inside
  lease interface 10800 dhcpd inside
  dhcpd xxxxxxxxxx.local area inside interface
  dhcpd ip interface 192.168.9.50 option 66 inside
  dhcpd allow inside
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  tunnel-group HUB_WANIP type ipsec-l2l
  IPSec-attributes tunnel-group HUB_WANIP
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname

  Any help is appreciated

  Hello

  Seems to me that the ASA named STATIC2-ASA5505 lack some essential associated VPN configurations.

  The encryption card is not attached to any interface

  Configure this

  cmap1 interface card crypto outside

  The Crypto ISAKMP is not enabled on any interface

  Configure this

  crypto ISAKMP allow outside

  Hope this helps

  -Jouni