licenses for ASA 5505, site-to-site vpn

Hi, gang,

I've not worked on ASA for a few years, so a little rusty on the issuance of licenses. my client has 5 locations, a few computers at each location. 4 tunnels vpn site-to-site will be implemented, so that 1 Server @ main location of accounting is accessible from other. simple configuration. I wonder if I have to purchase additional licenses? This is the part number of the device that I'm aiming for:

ASA5505-BUN-K9
Cisco ASA 5505 Adaptive Security Appliance 8 ports Fast Ethernet Switch with 10 user licenses

Thank you!

Jonathan

Your license for the VPN is perfectly fine as the Base license supports 10 VPN-peers. The 10 user license is what could restrict more.

And if the 5505 is not yet bought, go directly to the ASA 5506 - X as the 5505 is a legacy device and will probably go little EOS.

Tags: Cisco Security

Similar Questions

  • Impossible to disable Easy VPN remote for ASA 5505 6.4 AMPS

    When installing ASA 5505, we chose Easy VPN remote.  Now, we want to turn it off.  We go to Configuration in ASDM > remote access VPN > Easy VPN remote and try to clear the checkbox enable Easy VPN remote, but it will not uncheck.  How can we disable it?

    ASDM, go in tools--> command line Interface...--> and then enter 'without activating vpnclient'--> the button 'send '.

    Which will disable the Easy VPN remote on the SAA.

    Hope that helps.

  • Cisco Anyconnect/WebVPN license for ASA 5510

    Hello

    Someone could please check the licenses for ASA 5510 attachment and let me know. We currently have ASA 5510 with basic license. According to the table attached under VPN sessions, he mentions that "250 combined SESSIONS IPSec and WebVPN" and to "Max box of WebVPN Session" it is mentioned that 2nd meeting, exceeding that we must buy license optional webvpn. While we the 250 combined license for IPSec and webVPN. We must purchase additional anyconnect license to set up remote access for users who want to use the internal resources from outside the network. OrElse, we don't have to purchase license and can configure webvpn/anyconnect of existing combined license existing users basic ASA license? Waiting for your response. Thank you.

    You are welcome.

    1 Yes

    2 AnyConnect requires no Java, but it can he use when connecting to one AnyConnect SSL VPN client and launch the Web browser option start Java-based. There was a bug with the AnyConnect old versions had later who should have addresses. You also have the option to launch via IE and using ActiveX or simply throw AnyConnect directly - neither of these two methods require Java.

    Here is a document TAC on the Java questions if you want more details.

    Please take a moment to note the useful messages and mark your answers questions.

  • Cisco ASA 5505 site for multiple subnet of the site.

    Hello. I need help to configure my cisco asa 5505.

    I set up a VPN between two ASA 5505 tunnel

    Site 1:

    Subnet 192.168.77.0

    Site 2:

    Have multiple VLANs and now the tunnel goes to vlan400 - 192.168.1.0

    What I need help:

    Site 1, I need to be able to reach a different virtual LAN on site 2. vlan480 - 192.168.20.0

    And 1 site I have to reach 192.168.77.0 subnet of vlan480 - 192.168.20.0

    Vlan480 is used for phones. In vlan480, we have a PABX.

    Is this possible to do?

    Any help would be much appreciated!

    Config site 2:

    : Saved

    :

    ASA Version 7.2 (2)

    !

    ciscoasa hostname

    domain default.domain.invalid

    activate the password encrypted x

    names of

    name 192.168.1.250 DomeneServer

    name of 192.168.1.10 NotesServer

    name 192.168.1.90 Steadyily

    name 192.168.1.97 TerminalServer

    name 192.168.1.98 eyeshare w8

    name 192.168.50.10 w8-print

    name 192.168.1.94 w8 - app

    name 192.168.1.89 FonnaFlyMedia

    !

    interface Vlan1

    nameif Vlan1

    security-level 100

    IP 192.168.200.100 255.255.255.0

    OSPF cost 10

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP address 79.x.x.226 255.255.255.224

    OSPF cost 10

    !

    interface Vlan400

    nameif vlan400

    security-level 100

    IP 192.168.1.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan450

    nameif Vlan450

    security-level 100

    IP 192.168.210.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan460

    nameif Vlan460-SuldalHotell

    security-level 100

    IP 192.168.2.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan461

    nameif Vlan461-SuldalHotellGjest

    security-level 100

    address 192.168.3.1 IP 255.255.255.0

    OSPF cost 10

    !

    interface Vlan462

    Vlan462-Suldalsposten nameif

    security-level 100

    192.168.4.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Vlan470

    nameif vlan470-Kyrkjekontoret

    security-level 100

    IP 192.168.202.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan480

    nameif vlan480 Telefoni

    security-level 100

    address 192.168.20.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan490

    nameif Vlan490-QNapBackup

    security-level 100

    IP 192.168.10.1 255.255.255.0

    OSPF cost 10

    !

    interface Vlan500

    nameif Vlan500-HellandBadlands

    security-level 100

    192.168.30.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Vlan510

    Vlan510-IsTak nameif

    security-level 100

    192.168.40.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Vlan600

    nameif Vlan600-SafeQ

    security-level 100

    192.168.50.1 IP address 255.255.255.0

    OSPF cost 10

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    switchport access vlan 500

    switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610

    switchport mode trunk

    !

    interface Ethernet0/3

    switchport access vlan 490

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    passwd encrypted x

    passive FTP mode

    clock timezone WAT 1

    DNS server-group DefaultDNS

    domain default.domain.invalid

    permit same-security-traffic inter-interface

    permit same-security-traffic intra-interface

    Lotus_Notes_Utgaaande tcp service object-group

    UT og Frim Notes Description til alle

    area of port-object eq

    port-object eq ftp

    port-object eq www

    EQ object of the https port

    port-object eq lotusnotes

    EQ Port pop3 object

    EQ pptp Port object

    EQ smtp port object

    Lotus_Notes_inn tcp service object-group

    Description of the inn og alle til Notes

    port-object eq www

    port-object eq lotusnotes

    EQ Port pop3 object

    EQ smtp port object

    object-group service Reisebyraa tcp - udp

    3702 3702 object-port Beach

    5500 5500 object-port Beach

    range of object-port 9876 9876

    object-group service Remote_Desktop tcp - udp

    Description Tilgang til Remote Desktop

    3389 3389 port-object range

    object-group service Sand_Servicenter_50000 tcp - udp

    Description program tilgang til sand service AS

    object-port range 50000 50000

    VNC_Remote_Admin tcp service object-group

    Description Fra ¥ oss til alle

    5900 5900 port-object range

    object-group service Printer_Accept tcp - udp

    9100 9100 port-object range

    port-object eq echo

    ICMP-type of object-group Echo_Ping

    echo ICMP-object

    response to echo ICMP-object

    object-group service Print tcp

    9100 9100 port-object range

    FTP_NADA tcp service object-group

    Suldalsposten NADA tilgang description

    port-object eq ftp

    port-object eq ftp - data

    Telefonsentral tcp service object-group

    Hoftun description

    port-object eq ftp

    port-object eq ftp - data

    port-object eq www

    EQ object of the https port

    port-object eq telnet

    Printer_inn_800 tcp service object-group

    Fra 800 thought-out og inn til 400 port 7777 description

    range of object-port 7777 7777

    Suldalsposten tcp service object-group

    Description send av mail hav Mac Mail at - Ã ¥ nrep smtp

    EQ Port pop3 object

    EQ smtp port object

    http2 tcp service object-group

    Beach of port-object 81 81

    object-group service DMZ_FTP_PASSIVE tcp - udp

    55536 56559 object-port Beach

    object-group service DMZ_FTP tcp - udp

    20 21 object-port Beach

    object-group service DMZ_HTTPS tcp - udp

    Beach of port-object 443 443

    object-group service DMZ_HTTP tcp - udp

    8080 8080 port-object range

    DNS_Query tcp service object-group

    of domain object from the beach

    object-group service DUETT_SQL_PORT tcp - udp

    Description for a mellom andre og duett Server nett

    54659 54659 object-port Beach

    outside_access_in of access allowed any ip an extended list

    outside_access_out of access allowed any ip an extended list

    vlan400_access_in list extended access deny ip any host 149.20.56.34

    vlan400_access_in list extended access deny ip any host 149.20.56.32

    vlan400_access_in of access allowed any ip an extended list

    Vlan450_access_in list extended access deny ip any host 149.20.56.34

    Vlan450_access_in list extended access deny ip any host 149.20.56.32

    Vlan450_access_in of access allowed any ip an extended list

    Vlan460_access_in list extended access deny ip any host 149.20.56.34

    Vlan460_access_in list extended access deny ip any host 149.20.56.32

    Vlan460_access_in of access allowed any ip an extended list

    vlan400_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande

    vlan400_access_out list extended access permit tcp any host DomeneServer object-group Remote_Desktop

    vlan400_access_out list extended access permit tcp any host TerminalServer object-group Remote_Desktop

    vlan400_access_out list extended access permit tcp any host http2 object-group Steadyily

    vlan400_access_out list extended access permit tcp any host NotesServer object-group Lotus_Notes_inn

    vlan400_access_out list extended access permit tcp any host NotesServer object-group Remote_Desktop

    vlan400_access_out allowed extended access list tcp any host w8-eyeshare object-group Remote_Desktop

    vlan400_access_out allowed extended access list tcp any host w8 - app object-group Remote_Desktop

    vlan400_access_out list extended access permit tcp any host FonnaFlyMedia range 8400-8600

    vlan400_access_out list extended access permit udp any host FonnaFlyMedia 9000 9001 range

    vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host DomeneServer

    vlan400_access_out list extended access permitted tcp 192.168.4.0 255.255.255.0 host w8 - app object-group DUETT_SQL_PORT

    Vlan500_access_in list extended access deny ip any host 149.20.56.34

    Vlan500_access_in list extended access deny ip any host 149.20.56.32

    Vlan500_access_in of access allowed any ip an extended list

    vlan470_access_in list extended access deny ip any host 149.20.56.34

    vlan470_access_in list extended access deny ip any host 149.20.56.32

    vlan470_access_in of access allowed any ip an extended list

    Vlan490_access_in list extended access deny ip any host 149.20.56.34

    Vlan490_access_in list extended access deny ip any host 149.20.56.32

    Vlan490_access_in of access allowed any ip an extended list

    Vlan450_access_out list extended access permit icmp any any Echo_Ping object-group

    Vlan1_access_out of access allowed any ip an extended list

    Vlan1_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

    Vlan1_access_out deny ip extended access list a whole

    Vlan1_access_out list extended access permit icmp any any echo response

    Vlan460_access_out list extended access permit icmp any any Echo_Ping object-group

    Vlan490_access_out list extended access permit icmp any any Echo_Ping object-group

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTPS

    Vlan490_access_out list extended access permit tcp any host 192.168.10.10 object-group DMZ_HTTP

    Vlan500_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan470_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan470_access_out list extended access permit tcp any host 192.168.202.10 - group Remote_Desktop object

    Vlan510_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan480_access_out of access allowed any ip an extended list

    Vlan510_access_in of access allowed any ip an extended list

    Vlan600_access_in of access allowed any ip an extended list

    Vlan600_access_out list extended access permit icmp any one

    Vlan600_access_out list extended access permit tcp any host w8-print object-group Remote_Desktop

    Vlan600_access_out list extended access permitted tcp 192.168.1.0 255.255.255.0 host w8-printing eq www

    Vlan600_access_out list extended access permitted tcp 192.168.202.0 255.255.255.0 host w8-printing eq www

    Vlan600_access_out list extended access permitted tcp 192.168.210.0 255.255.255.0 host w8-printing eq www

    Vlan600_access_in_1 of access allowed any ip an extended list

    Vlan461_access_in of access allowed any ip an extended list

    Vlan461_access_out list extended access permit icmp any any Echo_Ping object-group

    vlan400_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

    outside_20_cryptomap_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

    outside_20_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.77.0 255.255.255.0

    access-list Vlan462-Suldalsposten_access_in extended ip allowed any one

    access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo response

    access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo response

    access-list Vlan462-Suldalsposten_access_in_1 extended ip allowed any one

    pager lines 24

    Enable logging

    asdm of logging of information

    MTU 1500 Vlan1

    Outside 1500 MTU

    vlan400 MTU 1500

    MTU 1500 Vlan450

    MTU 1500 Vlan460-SuldalHotell

    MTU 1500 Vlan461-SuldalHotellGjest

    vlan470-Kyrkjekontoret MTU 1500

    MTU 1500 vlan480-Telefoni

    MTU 1500 Vlan490-QNapBackup

    MTU 1500 Vlan500-HellandBadlands

    MTU 1500 Vlan510-IsTak

    MTU 1500 Vlan600-SafeQ

    MTU 1500 Vlan462-Suldalsposten

    no failover

    Monitor-interface Vlan1

    interface of the monitor to the outside

    the interface of the monitor vlan400

    the interface of the monitor Vlan450

    the interface of the Vlan460-SuldalHotell monitor

    the interface of the Vlan461-SuldalHotellGjest monitor

    the interface of the vlan470-Kyrkjekontoret monitor

    Monitor-interface vlan480-Telefoni

    the interface of the Vlan490-QNapBackup monitor

    the interface of the Vlan500-HellandBadlands monitor

    Monitor-interface Vlan510-IsTak

    Monitor-interface Vlan600-SafeQ

    the interface of the monitor Vlan462-Suldalsposten

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 522.bin

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    vlan400_nat0_outbound (vlan400) NAT 0 access list

    NAT (vlan400) 1 0.0.0.0 0.0.0.0 dns

    NAT (Vlan450) 1 0.0.0.0 0.0.0.0 dns

    NAT (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0

    NAT (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0

    NAT (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0

    NAT (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns

    NAT (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0

    NAT (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0

    NAT (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0

    NAT (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0

    static (vlan400, external) 79.x.x.x DomeneServer netmask 255.255.255.255

    static (vlan470-Kyrkjekontoret, external) 79.x.x.x 192.168.202.10 netmask 255.255.255.255

    static (vlan400, external) 79.x.x.x NotesServer netmask 255.255.255.255 dns

    static (vlan400, external) 79.x.x.231 netmask 255.255.255.255 TerminalServer

    static (vlan400, external) 79.x.x.234 Steadyily netmask 255.255.255.255

    static (vlan400, outside) w8-eyeshare netmask 255.255.255.255 79.x.x.232

    static (Vlan490-QNapBackup, external) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns

    static (Vlan600-SafeQ, external) 79.x.x.235 w8 - print subnet mask 255.255.255.255

    static (vlan400, outside) w8 - app netmask 255.255.255.255 79.x.x.236

    static (Vlan450, vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

    (Vlan500-HellandBadlands, vlan400) static 192.168.30.0 192.168.30.0 netmask 255.255.255.0

    (vlan400, Vlan500-HellandBadlands) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    (vlan400, Vlan450) static 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    static (vlan400, external) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255

    static (Vlan462-Suldalsposten, vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0

    static (vlan400, Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    static (vlan400, Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0

    static (Vlan600-SafeQ, vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

    static (Vlan600-SafeQ, Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

    static (Vlan600-SafeQ, vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0

    static (Vlan450, Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0

    static (vlan470-Kyrkjekontoret, Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0

    Access-group interface Vlan1 Vlan1_access_out

    Access-group outside_access_in in interface outside

    Access-group outside_access_out outside interface

    Access-group vlan400_access_in in the vlan400 interface

    vlan400_access_out group access to the interface vlan400

    Access-group Vlan450_access_in in the Vlan450 interface

    Access-group interface Vlan450 Vlan450_access_out

    Access-group interface Vlan460-SuldalHotell Vlan460_access_in

    Access-group interface Vlan460-SuldalHotell Vlan460_access_out

    Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_in

    Access-group interface Vlan461-SuldalHotellGjest Vlan461_access_out

    Access-group vlan470_access_in in interface vlan470-Kyrkjekontoret

    vlan470_access_out access to the interface vlan470-Kyrkjekontoret group

    access to the interface vlan480-Telefoni, vlan480_access_out group

    Access-group interface Vlan490-QNapBackup Vlan490_access_in

    Access-group interface Vlan490-QNapBackup Vlan490_access_out

    Access-group interface Vlan500-HellandBadlands Vlan500_access_in

    Access-group interface Vlan500-HellandBadlands Vlan500_access_out

    Access-group interface Vlan510-IsTak Vlan510_access_in

    Access-group interface Vlan510-IsTak Vlan510_access_out

    Access-group Vlan600_access_in_1 interface Vlan600-SafeQ

    Access-group Vlan600_access_out interface Vlan600-SafeQ

    Access-group Vlan462-Suldalsposten_access_in_1 Vlan462-Suldalsposten interface

    Access-group Vlan462-Suldalsposten_access_out_1 Vlan462-Suldalsposten interface

    Route outside 0.0.0.0 0.0.0.0 79.x.x.225 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout, uauth 0:05:00 absolute

    x x encrypted privilege 15 password username

    the ssh LOCAL console AAA authentication

    Enable http server

    http 192.168.210.0 255.255.255.0 Vlan450

    http 192.168.200.0 255.255.255.0 Vlan1

    http 192.168.1.0 255.255.255.0 vlan400

    No snmp server location

    No snmp Server contact

    SNMP-Server Community public

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    card crypto outside_map 20 match address outside_20_cryptomap_1

    card crypto outside_map 20 set pfs

    peer set card crypto outside_map 20 62.92.159.137

    outside_map crypto 20 card value transform-set ESP-3DES-SHA

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    ISAKMP crypto enable vlan400

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    tunnel-group 62.92.159.137 type ipsec-l2l

    IPSec-attributes tunnel-group 62.92.159.137

    pre-shared-key *.

    Telnet 192.168.200.0 255.255.255.0 Vlan1

    Telnet 192.168.1.0 255.255.255.0 vlan400

    Telnet timeout 5

    SSH 171.68.225.216 255.255.255.255 outside

    SSH timeout 5

    Console timeout 0

    dhcpd update dns both

    !

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1

    !

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 outside interface

    !

    dhcpd address 192.168.1.100 - 192.168.1.225 vlan400

    dhcpd option ip 6 DomeneServer 81.167.36.11 interface vlan400

    dhcpd option 3 ip 192.168.1.1 interface vlan400

    vlan400 enable dhcpd

    !

    dhcpd address 192.168.210.100 - 192.168.210.200 Vlan450

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450

    dhcpd ip interface 192.168.210.1 option 3 Vlan450

    enable Vlan450 dhcpd

    !

    dhcpd address 192.168.2.100 - 192.168.2.150 Vlan460-SuldalHotell

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell

    dhcpd 192.168.2.1 ip interface option 3 Vlan460-SuldalHotell

    dhcpd enable Vlan460-SuldalHotell

    !

    dhcpd address 192.168.3.100 - 192.168.3.200 Vlan461-SuldalHotellGjest

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest

    dhcpd ip interface 192.168.3.1 option 3 Vlan461-SuldalHotellGjest

    dhcpd enable Vlan461-SuldalHotellGjest

    !

    dhcpd address 192.168.202.100 - 192.168.202.199 vlan470-Kyrkjekontoret

    interface of dhcpd option 3 ip 192.168.202.1 vlan470-Kyrkjekontoret

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret

    dhcpd enable vlan470-Kyrkjekontoret

    !

    dhcpd option 3 192.168.20.1 ip interface vlan480-Telefoni

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni

    !

    dhcpd address 192.168.10.80 - 192.168.10.90 Vlan490-QNapBackup

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup

    dhcpd 192.168.10.1 ip interface option 3 Vlan490-QNapBackup

    !

    dhcpd address 192.168.30.100 - 192.168.30.199 Vlan500-HellandBadlands

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands

    dhcpd ip interface 192.168.30.1 option 3 Vlan500-HellandBadlands

    dhcpd enable Vlan500-HellandBadlands

    !

    dhcpd address 192.168.40.100 - 192.168.40.150 Vlan510-IsTak

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak

    dhcpd 3 ip Vlan510-IsTak 192.168.40.1 option interface

    Vlan510-IsTak enable dhcpd

    !

    dhcpd address 192.168.50.150 - 192.168.50.199 Vlan600-SafeQ

    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ

    Vlan600-SafeQ enable dhcpd

    !

    dhcpd address 192.168.4.100 - 192.168.4.150 Vlan462-Suldalsposten

    interface option 6 ip DomeneServer 81.167.36.11 Vlan462-Suldalsposten dhcpd

    interface ip dhcpd option 3 Vlan462-Suldalsposten 192.168.4.1

    Vlan462-Suldalsposten enable dhcpd

    !

    !

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    !

    context of prompt hostname

    Cryptochecksum:x

    : end

    Site 1 config:

    : Saved

    :

    ASA Version 7.2 (4)

    !

    ciscoasa hostname

    domain default.domain.invalid

    activate the password encrypted x

    passwd encrypted x

    names of

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.77.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    PPPoE Telenor customer vpdn group

    IP address pppoe setroute

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    switchport access vlan 15

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    passive FTP mode

    DNS server-group DefaultDNS

    domain default.domain.invalid

    outside_access_in list extended access permit icmp any any disable log echo-reply

    access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0

    access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.1.0 255.255.255.0

    pager lines 24

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 524.bin

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    Access-group outside_access_in in interface outside

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    Enable http server

    http 192.168.77.0 255.255.255.0 inside

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set pfs

    peer set card crypto outside_map 1 79.160.252.226

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    outside_map interface card crypto outside

    crypto ISAKMP allow inside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet 192.168.77.0 255.255.255.0 inside

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    VPDN group Telenor request dialout pppoe

    VPDN group Telenor localname x

    VPDN group Telenor ppp authentication chap

    VPDN x x local store password username

    dhcpd outside auto_config

    !

    dhcpd address 192.168.77.100 - 192.168.77.130 inside

    dhcpd dns 192.168.77.1 on the inside interface

    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside

    dhcpd allow inside

    !

    dhcpd option 6 ip 130.67.15.198 193.213.112.4 outside interface

    !

    tunnel-group 79.160.252.226 type ipsec-l2l

    IPSec-attributes tunnel-group 79.160.252.226

    pre-shared-key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:x

    : end

    Hello

    The addition of a new network to the existing VPN L2L should be a fairly simple process.

    Essentially, you need to add the network of the Crypto present ACL configurations "crypto map" . You also need to configure the NAT0 configuration for it in the appropriate interfaces of the SAA. These configurations are all made on both ends of the VPN L2L connection.

    Looking at your configurations above it would appear that you need to the following configurations

    SITE 1

    • We add the new network at the same time the crypto ACL and ACL NAT0

    access extensive list ip 192.168.77.0 outside_1_cryptomap allow 255.255.255.0 192.168.20.0 255.255.255.0

    access extensive list ip 192.168.77.0 inside_nat0_outbound allow 255.255.255.0 192.168.20.0 255.255.255.0

    SITE 2

    • We add new ACL crypto network
    • We create a new NAT0 configuration for interface Vlan480 because there is no previous NAT0 configuration

    outside_20_cryptomap_1 to access extended list ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

    Comment by VLAN480-NAT0 NAT0 for VPN access-list

    access-list VLAN480-NAT0 ip 192.168.20.0 allow 255.255.255.0 192.168.77.0 255.255.255.0

    NAT 0 access-list VLAN480-NAT0 (vlan480-Telefoni)

    These configurations should pretty much do the trick.

    Let me know if it worked

    -Jouni

  • ASA 5505 site to site VPN between A to site B, then B site MPLS network internal

    Hi all

    I'll put up the VPN site to site between two site A to site B.  Two local site of A and B are connected correctly.  However for my site B have an other intern MPLS to another site.  The thin connection of LAN has completely to the LAN B MPLS router, but cannot connect to other site MPLS.  If I did the SPLM traceroute on another site.  Access internal router LAN B.  Therefore, I'm confused what part of my setup to trick you and any document for my reference.  Thank you very much.

    Local area NETWORK a (ASA 5505)---(ASA 5505) Local LAN B - router internal B - B router MPLS - another site.

    >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>xxxxxxxxxxxxxxx

    Hello, Alan

    After having crossed the configuration that I realized that the problem was with the main campus network was not in the list of nat step in the direction of the ASA. After you have added that, everthing works

    Thank you

    Please note the useful messages!

    Harish

  • ASA 5505 Site tunnel site

    I have a simple question, but want to make sure, before I start.

    I have 3 5505 devices corp 1 and 1 to two areas of the site. Is it possible to have several tunnels on the asa corp? a #1 site and the other site #2?

    My license is based on the whole of the SAA.

    I already have remote user VPN configuration on the devices as well. Who does wrong or interfere with anything to add tunnels?

    Appreciate any help or advice.

    -Jon

    You can have up to 10 peers of vpn based on your license, which included the two vpn site-to-site and remote access.

    If the total number of simultaneous vpn peers is not greater than 10 (2 at most 8 and site to site vpn remote connected), you should be OK.

  • ASA 5505 site-site does not

    Hi all

    I'm having problems to set up a VPN site-to-site simple between two new ASA 5505. I tried several times with the ASDM entry manual configuration tool or by using the wizard, reset each time at the factory does not by default, but the tunnel.

    I followed it it down to the following lines at the reception:

    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, PHASE 1 COMPLETED
    
    May 11 16:42:53 [IKEv1]: IP = 1.1.1.2, Keep-alive type for this connection: DPD
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Starting P1 rekey timer: 73440 seconds.
    
    May 11 16:42:53 [IKEv1 DECODE]: IP = 1.1.1.2, IKE Responder starting QM: msg id = 693161c8
    
    May 11 16:42:53 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=693161c8) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 192
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing SA payload
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing nonce payload
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    
    May 11 16:42:53 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received
    
    1.1.1.2
    
    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received remote Proxy Host data in ID Payload:  Address 1.1.1.2, Protocol 0, Port 0
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    
    May 11 16:42:53 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received
    
    1.1.1.1
    
    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received local Proxy Host data in ID Payload:  Address 1.1.1.1, Protocol 0, Port 0
    
    May 11 16:42:53 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing notify payload
    
    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, QM IsRekeyed old sa not found by addr
    
    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = outside_map, seq = 1...
    
    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = outside_map, seq = 1, ACL does not match proxy IDs src:1.1.1.2 dst:1.1.1.1
    
    May 11 16:42:53 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 1.1.1.2/255.255.255.255/0/0 local proxy 1.1.1.1/255.255.255.255/0/0 on interface outside

    ´

    Looks to me to the remote proxy host and proxy localhost data outside IP instead of subnets (10.0.0.0/24 and 192.168.0.0/24)... How can I fix?

    Hello

    Him debugs watch ASA's answering machine, so the other ASA is the initiator.

    It seems that you have configured the initiator mode only come

    Example:

    crypto map OUTSIDE_map 20 set type of connection are created only...

    If you have that, it attempts to establish the phase 2 its between the ip address of (public) au first, then between the configured ACL...

    If you are only created, please remove it.

  • Need SSL for ASA 5505 10 license with basic license - security plus license is necessary?

    A salesman told me that one of my clients needs an upgrade to a security plus license before he can ask 10 SSL VPN licenses. I travelled the Cisco's Web site and could not find anything about it either, saying that. Nobody knows what it takes to go? Thank you.

    I never installed them on a non - ASA SecPlus, but the documentation clearly indicates that it is supported:

    http://www.Cisco.com/en/us/docs/security/ASA/asa84/license/license_management/license.html#wp2141762

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • SSL VPN license for ASA

    It must be an easy question - but I'm having a hard time finding an answer. How are the SSL VPN to the end user a license?

    Let's say I have 300 users, SSL, but only 20 concurrent SSL at any time. Do I need licenses for the 300 full or 20 competitors?

    Thank you

    Jim

    Hey Jim,.

    SSL licenses for only simultaneous connections. The only limitation you will encounter is how SSL sessions each platform supports (i.e. 750 concurrent sessions on an ASA5520).

  • Cisco ASA 5505 Dual-ISP backup VPN

    I am creating a tunnel of an ASA 5505 to a pix 501 backup in the case of the failure of main Internet service provider.  The external face of Pix will remain the same, but not quite how I can create a new card encryption and it use backup ISP interface without down the main tunnel.

    My first thought was to add the following encryption to the configuration below card:

    card crypto outside_map 2 match address outside_1_cryptomap
    peer set card crypto outside_map 2 9.3.21.13
    card outside_map 2 game of transformation-ESP-DES-MD5 crypto
    card crypto outside_map interface backupisp--> but that would break the current tunnel.

    NYASA # sh run
    : Saved
    :
    ASA Version 7.2 (4)
    !
    NYASA hostname
    domain girls.org
    activate the encrypted password of CHwdJ2WMUcjxIIm8
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    10.1.2.1 IP address 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP 9.17.5.8 255.255.255.240
    !
    interface Vlan3
    Description backup ISP
    nameif backupisp
    security-level 0
    IP 6.27.9.5 255.255.255.0
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    switchport access vlan 3
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passive FTP mode
    DNS server-group DefaultDNS

    outside_access_in list extended access permit icmp any any echo response
    outside_access_in list extended access permit icmp any any source-quench
    outside_access_in list extended access allow all unreachable icmp
    outside_access_in list extended access permit icmp any one time exceed
    outside_access_in list extended access permit icmp any one
    inside_nat0_outbound to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.1.0 255.255.255.0
    inside_nat0_outbound to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.100.0 255.255.255.0
    outside_1_cryptomap to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.1.0 255.255.255.0
    outside_1_cryptomap to access extended list ip 10.1.2.0 allow 255.255.255.0 10.1.100.0 255.255.255.0
    access-list extended 150 permit ip any host 10.1.2.27
    access-list 150 extended allow host ip 10.1.2.27 all
    pager lines 24
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    backupisp MTU 1500
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 524.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT-control
    Global 1 interface (outside)
    interface of global (backupisp) 1
    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 9.17.5.7 1 track 1
    Route 0.0.0.0 backupisp 0.0.0.0 6.27.9.1 254
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    the ssh LOCAL console AAA authentication
    Enable http server
    http 10.1.2.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    ALS 10 monitor
    type echo protocol ipIcmpEcho 4.2.2.2 outside interface
    NUM-package of 3
    timeout of 1000
    frequency 3
    Annex monitor SLA 10 life never start-time now
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    card crypto outside_map 1 match address outside_1_cryptomap
    peer set card crypto outside_map 1 9.3.21.13
    map outside_map 1 set of transformation-ESP-DES-MD5 crypto
    outside_map interface card crypto outside
    crypto isakmp identity address
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    the Encryption
    md5 hash
    Group 2
    life 86400
    Crypto isakmp nat-traversal 20
    !
    track 1 rtr 10 accessibility
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 60
    Console timeout 0
    management-access inside

    ptiadmin encrypted BtOLil2gR0VaUjfX privilege 15 password username
    tunnel-group 9.4.21.13 type ipsec-l2l
    IPSec-attributes tunnel-Group 9.4.21.13
    pre-shared-key *.
    !
    !
    context of prompt hostname
    Cryptochecksum:22bb60b07c4c1805b89eb2376683f861
    : end
    NYASA #.

    Thanks in advance.

    In this case is the PIX in need of two peers (to the ASA).

    The ASA is it requires the card encryption to be applied to the interface of backup as well (as you mentioned)

    card crypto outside_map interface backupisp--> but that would break the current tunnel.

    The command above should not break the current tunnel (if the road to reach the other end goes out through the main interface).

    In addition, you must IP SLA configured in the ASA to allow him to use the primary connection and aid for the connection of accumulation relief tunnel (both to reuse the primary interface when she recovers).

    Federico.

  • Cisco ASA 5505 Site to Site

    Hello, I'm having some trouble at two ASA Site Site configuration and looking for help. I really appreciate your time and effort. When I do a

    L2Lsite2 # show crypto isakmp his

    There is no isakmp sas

    L2Lsite2 # show crypto ipsec his

    There is no ipsec security associations

    If I'm on the side of L2Lsite1 I can not ping 192.168.3.1

    Will transfer configs later.

    Thanks again in advance for your help in this important issue.

    can share you the commmand you used for ping, you can also use packet trace silmulate a VPN traffic, for example:

    Packet-trace within the icmp [the source ip address] 8 8 [destination ip adrdress] detail

  • Try to customize login page for ASA 5505 SSL - VPN

    Nice day

    I'm looking for help to customize the login page for the ssl - vpn as mentioned. When the vpn is configured, the default template allows my customers to connect with this: IMAGE 1

    While trying to change the login page, I have to create a new customization without CLIENT SSL VPN ACCESS-> PORTAL-> CUSTOMIZATION file in the ASDM. When I do this and I'm trying to change the login page, it comes up with 2 forms of authentication and a fast internal password like this: IMAGE 2

    How can I change the login page, I created so that users only see the fields username and password for regular as the default template?

    Thank you all for your time and assistance

    Joel

    Hi Joel,

    What you see is just the preview, right?

    Preview displays the purpose of customization, since the password internal and the second authentication controls are the features that are activated in different parts of the configuration.

    WebVPN

    allow outside

    internal-password enable

    !

    attributes global-tunnel-group DefaultWEBVPNGroup

    secondary-authentication-server-group second_authentication_server


    INFO: This command applies only to the SSL VPN - Clientless and AnyConnect.

    So I recommend to assign this object of customization to a group policy and test access to the content of the specific connection profile.

    Thank you.

    Portu.

    Please note all useful posts

  • Protect and control the license for ASA with the power of fire

    I had 1 ASA 5515 initially delivered with the software cx, then made room for the software of firepower and got the virtual firesight for 2 devices and license of TAMAS tha L-5515, but this license was told only the URLs and malware license, I thought that this license was for all that since he has no other licenses in the data sheet and it's Reference with more features.

    How can I get the license protect and control now so I can add the asa with the firepower to firesight and apply to all licenses

    Thank you

    Hello

    L ASA5515-TAMAS = SKU license plans to "MALWARE" and "URLFilter" and legally gives the user to updates of the signature "PROTECT + CONTROL". It does not license "PROTECT + CONTROL". You need to buy "ASA5515-CTRL-LIC =" to license "PROTECT + CONTROL".

    Please discuss a case with CISCO GLO, they can help provide a CTRL license

    -DD

  • problem with users to access remote vpn site to site vpn network

    I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

    execution of the configuration of my asa 5510 is

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.4(2)
    
    !
    
    hostname asa5510
    
    domain-name dri.local
    
    enable password 8Ry2YjIyt7RRXU24 encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    !
    
    interface Ethernet0/0
    
    nameif outside
    
    security-level 0
    
    ip address x.x.x.178 255.255.255.248
    
    !
    
    interface Ethernet0/1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.10 255.255.255.0
    
    !
    
    interface Ethernet0/2
    
    description Mreza za virtualne masine- mail server, wsus....
    
    nameif DMZ
    
    security-level 50
    
    ip address 172.16.20.1 255.255.255.0
    
    !
    
    interface Ethernet0/3
    
    shutdown
    
    no nameif
    
    no security-level
    
    no ip address
    
    !
    
    interface Management0/0
    
    nameif management
    
    security-level 100
    
    ip address 192.168.1.1 255.255.255.0
    
    management-only
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    dns server-group DefaultDNS
    
    domain-name dri.local
    
    object network VPN-POOL
    
    subnet 192.168.50.0 255.255.255.0
    
    description VPN Client pool
    
    object network LAN-NETWORK
    
    subnet 192.168.0.0 255.255.255.0
    
    description LAN Network
    
    object network NETWORK_OBJ_192.168.0.0_24
    
    subnet 192.168.0.0 255.255.255.0
    
    object network 192.168.0.10
    
    host 192.168.0.10
    
    object service ssl
    
    service tcp destination eq 465
    
    object service tls
    
    service tcp destination eq 995
    
    object network mail_server
    
    host 172.16.20.201
    
    object service StartTLS
    
    service tcp destination eq 587
    
    object service admin_port
    
    service tcp destination eq 444
    
    object service ODMR
    
    service tcp destination eq 366
    
    object service SSL-IMAP
    
    service tcp destination eq 993
    
    object network remote
    
    host 172.16.20.200
    
    object network test
    
    host 192.168.0.22
    
    object network mail
    
    host 172.16.20.200
    
    object network DMZ
    
    host 172.16.20.200
    
    object network Inside_DMZ
    
    host 192.168.0.20
    
    object service rdp
    
    service tcp destination eq 3389
    
    object network DRI_PS99
    
    host 192.168.0.54
    
    object service microsoft_dc
    
    service tcp destination eq 445
    
    object service https448
    
    service tcp destination eq 448
    
    object network mail_server_internal
    
    host 172.16.20.201
    
    object service Acronis_remote
    
    service tcp destination eq 9876
    
    object service Acronis_25001
    
    service tcp destination eq 25001
    
    object service HTTP3000
    
    service tcp destination eq 3000
    
    object network VPNPOOL
    
    subnet 192.168.50.0 255.255.255.0
    
    object-group network PAT-SOURCE-NETWORKS
    
    description Source networks for PAT
    
    network-object 192.168.0.0 255.255.255.0
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object object admin_port
    
    service-object object ssl
    
    service-object object tls
    
    service-object object https448
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object object tls
    
    service-object tcp destination eq pop3
    
    service-object tcp destination eq smtp
    
    object-group service DM_INLINE_SERVICE_3
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object tcp destination eq smtp
    
    service-object object tls
    
    service-object object Acronis_remote
    
    service-object tcp destination eq www
    
    service-object object Acronis_25001
    
    service-object object microsoft_dc
    
    object-group protocol DM_INLINE_PROTOCOL_1
    
    protocol-object ip
    
    protocol-object tcp
    
    object-group service DM_INLINE_SERVICE_4
    
    service-object object Acronis_25001
    
    service-object object Acronis_remote
    
    service-object object microsoft_dc
    
    service-object tcp destination eq www
    
    service-object tcp
    
    service-object ip
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
    
    access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
    
    access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
    
    access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
    
    access-list DMZ extended deny tcp any any eq smtp
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    mtu outside 1500
    
    mtu inside 1500
    
    mtu DMZ 1500
    
    mtu management 1500
    
    ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
    
    !
    
    object network mail_server
    
    nat (DMZ,outside) static x.x.x.179
    
    object network mail
    
    nat (DMZ,outside) static x.x.x.180
    
    access-group outside_access_in in interface outside
    
    access-group DMZ in interface DMZ
    
    route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    timeout floating-conn 0:00:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    action terminate
    
    dynamic-access-policy-record dripolisa
    
    aaa-server DRI protocol ldap
    
    aaa-server DRI (inside) host 192.168.0.20
    
    ldap-base-dn DC=dri,DC=local
    
    ldap-scope subtree
    
    ldap-naming-attribute sAMAccountName
    
    ldap-login-password *****
    
    ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
    
    server-type microsoft
    
    user-identity default-domain LOCAL
    
    aaa authentication enable console LOCAL
    
    aaa authentication http console LOCAL
    
    aaa authentication serial console LOCAL
    
    aaa authentication telnet console LOCAL
    
    aaa authorization command LOCAL
    
    http server enable
    
    http 192.168.1.0 255.255.255.0 management
    
    http 192.168.0.0 255.255.255.0 inside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    
    virtual telnet 192.168.1.12
    
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    
    crypto ipsec ikev2 ipsec-proposal DES
    
    protocol esp encryption des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal 3DES
    
    protocol esp encryption 3des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES
    
    protocol esp encryption aes
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES192
    
    protocol esp encryption aes-192
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES256
    
    protocol esp encryption aes-256
    
    protocol esp integrity sha-1 md5
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 match address outside_cryptomap
    
    crypto map outside_map 1 set peer 195.222.96.223
    
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    
    crypto map outside_map interface outside
    
    crypto ikev2 policy 1
    
    encryption aes-256
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 10
    
    encryption aes-192
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 20
    
    encryption aes
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 30
    
    encryption 3des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 40
    
    encryption des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 enable outside
    
    crypto ikev1 enable outside
    
    crypto ikev1 policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    
    dhcpd address 192.168.0.14-192.168.0.45 inside
    
    !
    
    dhcpd address 172.16.20.2-172.16.20.150 DMZ
    
    dhcpd dns x.x.x.177 interface DMZ
    
    dhcpd auto_config outside interface DMZ
    
    dhcpd option 6 ip x.x.x.177 interface DMZ
    
    dhcpd enable DMZ
    
    !
    
    dhcpd address 192.168.1.2-192.168.1.254 management
    
    dhcpd enable management
    
    !
    
    threat-detection basic-threat
    
    threat-detection statistics port
    
    threat-detection statistics protocol
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    group-policy GroupPolicy_x.x.x.223 internal
    
    group-policy GroupPolicy_x.x.x.223 attributes
    
    vpn-tunnel-protocol ikev1 ikev2
    
    group-policy drivpn internal
    
    group-policy drivpn attributes
    
    dns-server value 192.168.0.20 192.168.0.254
    
    vpn-simultaneous-logins 10
    
    vpn-idle-timeout 30
    
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    
    split-tunnel-network-list value Split_Tunnel_List
    
    default-domain value dri.local
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group drivpn type remote-access
    
    tunnel-group drivpn general-attributes
    
    address-pool vpnadrese
    
    authentication-server-group DRI
    
    default-group-policy drivpn
    
    tunnel-group drivpn ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    tunnel-group x.x.x.223 type ipsec-l2l
    
    tunnel-group x.x.x.223 general-attributes
    
    default-group-policy GroupPolicy_x.x.x.223
    
    tunnel-group x.x.x.223 ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    ikev2 remote-authentication pre-shared-key *****
    
    ikev2 local-authentication pre-shared-key *****
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum client auto
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect tftp
    
      inspect ip-options
    
      inspect netbios
    
      inspect icmp
    
      inspect http
    
    !
    
    service-policy global_policy global
    
    prompt hostname context
    
    no call-home reporting anonymous
    
    Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
    
    : end

    running config asa 5505

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.2(1)
    
    !
    
    hostname ciscoasa
    
    enable password csq7sfr0bQJqMGET encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    name 192.168.5.0 PALATA
    
    !
    
    interface Vlan1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.17 255.255.255.0
    
    !
    
    interface Vlan2
    
    nameif outside
    
    security-level 0
    
    ip address 10.13.74.33 255.255.255.0
    
    !
    
    interface Ethernet0/0
    
    switchport access vlan 2
    
    !
    
    interface Ethernet0/1
    
    !
    
    interface Ethernet0/2
    
    !
    
    interface Ethernet0/3
    
    !
    
    interface Ethernet0/4
    
    !
    
    interface Ethernet0/5
    
    !
    
    interface Ethernet0/6
    
    !
    
    interface Ethernet0/7
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object ip
    
    service-object tcp
    
    service-object icmp echo
    
    service-object icmp echo-reply
    
    service-object tcp eq domain
    
    service-object tcp eq ldap
    
    service-object tcp eq smtp
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object ip
    
    service-object tcp eq domain
    
    service-object tcp eq www
    
    service-object tcp eq https
    
    service-object tcp eq smtp
    
    object-group service Sharepoint8080 tcp
    
    port-object eq 8080
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
    
    access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
    
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    logging mail errors
    
    logging from-address
    
    logging recipient-address  level debugging
    
    mtu inside 1500
    
    mtu outside 1500
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    global (outside) 1 interface
    
    nat (inside) 0 access-list inside_nat0_outbound_1
    
    nat (inside) 1 192.168.0.0 255.255.255.0
    
    static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
    
    static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
    
    access-group inside_access_in in interface inside
    
    access-group outside_access_in in interface outside
    
    route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
    
    route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    aaa authentication telnet console LOCAL
    
    http server enable
    
    http 10.13.74.0 255.255.255.0 outside
    
    http 192.168.0.0 255.255.255.0 inside
    
    http 10.15.100.0 255.255.255.0 outside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    
    virtual telnet 192.168.0.53
    
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec security-association lifetime seconds 28800
    
    crypto ipsec security-association lifetime kilobytes 4608000
    
    crypto map outside_map 1 match address outside_2_cryptomap
    
    crypto map outside_map 1 set pfs
    
    crypto map outside_map 1 set peer 10.15.100.15
    
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    
    crypto map outside_map interface outside
    
    crypto isakmp enable outside
    
    crypto isakmp policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    

    threat-detection basic-threat
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group 10.15.100.15 type ipsec-l2l
    
    tunnel-group 10.15.100.15 ipsec-attributes
    
    pre-shared-key *
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect esmtp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect netbios
    
      inspect tftp
    
      inspect icmp
    
    !
    
    service-policy global_policy global
    
    smtp-server 173.194.79.109
    
    prompt hostname context
    
    Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
    
    : end

    Thank you

    Hello

    I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

    EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

    So you don't really have any of those.

    Please mark the question answers and/or assess response

    Ask more if necessary

    -Jouni

  • Site to site VPN - cannot see host

    Hi all

    Site to site VPN is established by Cisco 887 (PPPoE) on the two site. The tunnel is UP.

    Personnel (192.168.5.33) PC I can ping to 60.a.a.54.

    But I cannot ping the inside interface (192.168.0.1).

    I need to access the server site B (192.169.0.150).

    How can I Access/ping to the server PC (192.168.5.33) staff (192.169.0.150)

    Please see the attachment for the tree and conf for ASA 5510 Site has and B Site

    Maybe I'm wrong, but I don't see a purpose for a tunnel between your routers c887. Instead, you need a tunnel between your routers asa.

Maybe you are looking for

  • Laser Jet MFP M127FW Pro: Will not stop "hologram fax page 1" and is stuck in this mode

    I have Laser Jet Pro MFP M127FW.  This morning, a fax came through, and printed, however, the touchscreen rpet ' Print Fax: 1 Page, "with absolutely nothing to print.  I can now no longer print documents, or send and receive faxes again.    When I le

  • Satellite A100-543: the battery appears dead

    My battery died yesterday after I plugged it to my computer. In fact the computer turn off at this time. A burning smell has occurred and after, I tried to start the computer again and it works but the battery seems dead. When I'm on windows with the

  • Promblems of start after restore Vista system?

    I have a dell inspiron N4010. Recently he's been acting kind of strange, so I decided to do a system restore (meaning I put it back to factory settings) Then he did the system restore see the dell startup loading wll it will go to black page with opt

  • Deactivation of the system 53025211

    I have a hp laptop 2000 369VM and the CMOS password is unknown to me. My daughter has forgotten that she used.  Before starting the message "Enter administrator password or power on password" appears. After the failure of 3 attempts the message, "the

  • D drive... ORIGINAL IMAGE... HEWLETT-PACKARD

    Can someone tell me what the "D" drive is on my new HP computer?  It is said to use it to 'restore factory settings'... but that is as far as I know. Should I really to it, i.e. the entire disk. Thank you FLKulchar FLKulchar