Migration to ISE for servers 3395 Cisco Cisco SNS 3495 question

Similar Questions

• Check the ISE for the VPN Cisco posture

  Hello community,

  first of all thank you for taking the time to read my post. I have a deployment in which requires the characteristic posture of controls for machines of VPN Cisco ISE. I know that logically once a machine on the LAN, Cisco ISE can detect and apply controls posture on clients with the Anyconnect agent but what about VPN machines? The VPN will end via a VPN concentrator, which then connects to an ASA5555X that is deployed as an IPS only. Are there clues to this?

  Thank you!

  The Cisco ASA Version 9.2.1 supports the change in RADIUS authorization (CoA) (RFC 5176). This allows for the gesticulations of users against the ISE Cisco VPN without the need of an IPN. Once a VPN user connects, the ASA redirects web traffic to the LSE, where the user is configured with a Network Admission Control (NAC) or Web Agent. The agent performs specific controls on the user's computer to determine its conformity against one together configured posture rules, such as the rules of operating system (OS) patches, AntiVirus, registry, Application, or Service.

  The posture validation results are then sent to the ISE. If the machine is considered the complaint, then the ISE can send a RADIUS CoA to the ASA with the new set of authorization policies. After validation of the successful posture and CoA, the user is allowed to access internal resources.

  http://www.Cisco.com/c/en/us/support/docs/security/Adaptive-Security-Appliance-ASA-software/117693-configure-ASA-00.html

• Limitation of ISE for concurrent user (same user)

  Dear,

  I have cisco ISE 3355 version 2.0.4.018 my question is how can I restrict the user authenticated to access devices of two only by his username and password.

  where I have cisco what ISE integrated with AD internal for internal employees accessing the SSID and I need to limit the access used for two devices only (PC and phone)

  If anyone can help me?

  Kind regards

  This 1.1.1.268code doesn't have the feature of concurrent session. You need to wait for 1.2 which is scheduled for late July.

  Jatin kone
  -Does the rate of useful messages-

• Angel losenord for servers 'time Capsule '.

  JAG city ansluta en MacBook Air up to Time Capsule (fjärde generation) och skulle min "Ange losenord for servers 'Time Capsule' sa att den blir tillganglig for Time Machine. Men losenordet jag angav som jag har stallt for Time Capsule fungera inte min. Other annat losenord kan menas?

  Forsok losenord for MacBook Air.

• How to use PowerPhotos to perform a migration of Aperture for photo

  We are running Yosemite and openness. We have about 10 Aperture libraries, some libraries have about 6000 images.

  We have the Photos app on our Mac but don't use it yet.   What workflow we should follow to upgrade to El Capitan and migrate from Aperture for the Photos using PowerPhotos.

  I have been informed that we should first upgrade to El Capitan.   But I don't know how to use PowerPhotos to help us in this migration.

  I read on the PowerPhotos site below.

  "If you have a lot of existing iPhoto or libraries to open that you want to migrate Photos, PowerPhotos will help automate your migration if you do not have to spend time to care for children of this long process."

  It's a good question for FatCat (authors of PowerPhotos) support or study Chapter 7 of their manual - https://www.fatcatsoftware.com/powerphotos/Help/table%20of%20contents.html

  LN

• How to use the same services-config for servers the and remote.

  My flex project works very well using the bottom but when I download my flash on the server I do not work, all the files and related paths are the same execpt remote is a linux server.

  <? XML version = "1.0" encoding = "UTF-8"? >
  <>services-config
  < services >
  < id = 'amfphp-flashremoting-service' service
  Class = "Flex.Messaging.services.RemotingService"
  messageTypes = "flex.messaging.messages.RemotingMessage' >"
  
  < destination id = "amfphp" >
  <>channels
  < Ref channel = "my-amfphp" / >
  < / channels >
  Properties of <>
  < source > * < / source >
  < / properties >
  < / destination >
  < / service >
  < / services >
  <>channels
  < channel-definition id = "my-amfphp" class = "mx.messaging.channels.AMFChannel" >
  " < endpoint uri = ' http://localhost/domainn.org/AMFPHP/gateway.php "class="flex.messaging.endpoints.AMFEndpoint"/ > "
  < / channel-definition >
  < / channels >
  < / services-config >

  I think the problem is the line

  
  " < endpoint uri = ' http://localhost/domainn.org/AMFPHP/gateway.php "class="flex.messaging.endpoints.AMFEndpoint"/ > "

  but I don't know how to use the same services-config for servers the and remote.

  I'll back up a bit.

  Breakpoint URLS are defined as follows in the services - config.xml:

  https://{server.name}:{server.port}/{context.root}/messagebroker/amfsecure

  The meaning of each of the tokens is clearer when we see them as part of a complete url. If your context root is set to http://localhost , then I have no idea how your application runs in any environment.

  If you leave the server.name and server.port chips in your configuration file, then they will be replaced when executing according to the location from which your application is served. However, the context.root token is replaced at the time of the compilation based on the value that you specify in Flex Builder or when calling mxmlc.

  In order to reuse your file services - config.xml, you must use the same context-root on your development environment and to your deployment environment.

• NetBackup for VMS in VCENTER instead of VMs, Questions

  Hello

  We test netbackup to get all the (incremental) days for machines virtual configuration the Vcenter

  but your comments:

  (1) the administrator says it seems slower than the normal backup against for servers prior to conversion, is that correct? is it because vmdk is used here?

  (2) the VMWARE administrator admits it takes each time the same size when the snapshot, which should not be correct, right? and if yes, they will use the same datastore-> may cause problems so complete, that will make complete

  (3) if install us the agent on the virtual machines, which will have backup of disks, which will be a problem if restore us for example?

  (4) I have some vm but ending the backup snapshot is not deleted, I'll check that again today to see, this is a common problem for some hosts? the virtual machine is with brute map features, will exclude us or change something when the backup for this virtual machine? or is not released

  (5) what is the main differences between this way and have agents on the virtual machines? wise management? problem restoring vmdk or? or what exactly

  Please notify

  Thank you

  (1) the administrator says it seems slower than the normal backup against for servers prior to conversion, is that correct? is it because vmdk is used here?

  This could very well be the case, depending on how you made the prior of backups and what type/speed storage you have.

  (2) the VMWARE administrator admits it takes each time the same size when the snapshot, which should not be correct, right? and if so, they will use same datastore-> can cause problems if it is full, which will make full

  A snapshot CAN reach the same size as its parent disk, in order to fill in data warehouses is possible. However, in the time it takes to create a backup, you should not usually see this kind of growth in the Delta. Overprovisioning of data warehouses can be ok, but their follow-up is crucial. VMFS needs free space - http://kb.vmware.com/kb/1003412

  (3) if install us the agent on the virtual machines, which will have backup of disks, which will be a problem if restore us for example?

  It works exactly the same way as physical servers. There should be no problem here.

  (4) I have some vm but ending the backup snapshot is not deleted, I'll check that again today to see, this is a common problem for some hosts? the virtual machine is with brute map features, will exclude us or change something when the backup for this virtual machine? or is not released

  Photos should be deleted once the backup is complete. It is not uncommon for this sometimes fails. Tools such as the free RVTools reports can be useful to quickly identify these: http://www.robware.net/ Check out http://www.symantec.com/business/support/index?page=content&id=HOWTO70902 for more information on RDM and NetBackup. The client/agent is often useful here.

  (5) what is the main differences between this way and have agents on the virtual machines? wise management? problem restoring vmdk or?  or what exactly

  The biggest difference between the OnDemand and the approach of the policy of VMware is that it gets you files (agent) and the other gets you an image full virtual machine (vmdk) and you can also get the files in some operating systems. Alternatively, you can restore these backup files in many cases CBT/BLIB with VMware political is a great approach you can get images of computer virtual complete with increments

• I have a Leica LR but my creative cloud annual subscription has expired, my Lightroom my LR library for 2015 and beyond now has a question mark and I can't open pictures

  I have a subscription valid and active Leica camera.

  How can I get Adobe to recognize? My creative cloud has expired. I'm frozen out of my photo library

  Using the redemption code Leica I downloaded successfully updated day to day LR 6 but my LR library for 2015 and beyond now has a question mark, and I can't open the images.

  Any suggestions?

  Is this something that Adobe has to rectify?

  Thank you

  John

  The question mark has nothing to do with your subscription at the end. The question mark on your records indicates that Lightroom cannot find the photos, because they have been moved or renamed, or delete outside of Lightroom. The instructions to fix it are: Adobe Lightroom - find folders and files moved or missing

• I am currently working on a site that has the integration of Paypal which includes the page redirects (confirm or cancel). My goal is to have the implementation of site with a layout for desktop, Tablet and phone. My question is when I have a redirect pag

  I am currently working on a site that has the integration of Paypal which includes the page redirects (confirm or cancel). My goal is to have the implementation of site with a layout for desktop, Tablet and phone. My question is when I have a redirect page should I create a separate provision of the page for each device or just a provision of office that fits all three screen sizes? I hope that if the html page has the same name of the device (query) is automatically detected. Help with the help of Adobe Muse CC

  By Payal integration, you mean paypal html button? or etc payment gateway configuration? If this is a configuration of the gateway to your site domain name then a single page with any structure will work, but if you use the button code for all associated formats then you will need to create separate pages for all.

  Thank you

  Sanjit

• Cisco ACS to tool Migration of ISE

  Hi all.

  I am gtrying to migrate using the migration tool in our LABORATORY ACS 5.3 to ISE 1.2 and I take advantage of this error:

  D:\migTool>migration.bat
  log4j: WARN no such property [encoding] in com.cisco.acs.positron.migration.utils.Log4jTextAreaAppender.
  INFO [main] MigrationApplicationDriver.main:56: applies from the main method.
  Exception in thread "main" org.springframework.beans.factory.BeanDefinitionStoreException: cannot read the candidate class component: file [D:\migTool\bin\com\cisco\acs\positron\migra
  tion\gui\components\treetable\JTreeTable.class]; nested exception is java.lang.ArrayIndexOutOfBoundsException: 3145
  at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.findCandidateComponents(ClassPathScanningCandidateComponentProvider.java:237)
  at com.cisco.acs.positron.migration.MigrationApplicationDriver.main(MigrationApplicationDriver.java:61)
  Caused by: java.lang.ArrayIndexOutOfBoundsException: 3145
  at org.springframework.asm.ClassReader.readClass (unknown Source)
  at org.springframework.asm.ClassReader.accept (unknown Source)
  at org.springframework.asm.ClassReader.accept (unknown Source)
  to org.springframework.core.type.classreading.SimpleMetadataReader. (SimpleMetadataReader.java:54)
  at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:80)
  at org.springframework.core.type.classreading.CachingMetadataReaderFactory.getMetadataReader(CachingMetadataReaderFactory.java:82)
  at org.springframework.core.type.classreading.SimpleMetadataReaderFactory.getMetadataReader(SimpleMetadataReaderFactory.java:76)
  at org.springframework.core.type.filter.AbstractTypeHierarchyTraversingFilter.match(AbstractTypeHierarchyTraversingFilter.java:105)
  at org.springframework.core.type.filter.AbstractTypeHierarchyTraversingFilter.match(AbstractTypeHierarchyTraversingFilter.java:76)
  at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.isCandidateComponent(ClassPathScanningCandidateComponentProvider.java:280)
  at org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider.findCandidateComponents(ClassPathScanningCandidateComponentProvider.java:214)

  Hello Juan Carlos.

  If your query is resolved, then mark them as response.

  Thank you

• ISE web auth for other than cisco switch (D-link 3528)

  Is it possible to use ISE (posture inline node) to redirect to portal comments ISE wired users?

  And wired users will get full network access after they pass the web auth.

  Hello

  Theoretically, it could work if the switch is able to send all the attributes in accounting packets, such as IP address and mac address by asking the station id. If the attributes are missing or incorrect, the iPEP ISE will never create the session (see show pep session table).

  That said, who probably never have been tested, so you may want to reconsider your design, there is no guarantee that this can still work.

• Update of connectivity for 10G VIC Cisco NAC 1225 Options

  I currently have the opportunity to upgrade a server C220M3 UCS Intel standard 1 G of LOM to 10G and I'm looking at different ways to do this.  It is a stand-alone UCS server running VMware.

  Currently in this environment, it is not a port of uplink switch 10G which can be used to connect to a port of UCS 10 G, I'm looking how to fill at least 10G upgrade on the side of the UCS hardware and have this component completed, all having a period of transition from the connectivity of 1 G in the short term.

  It seems that the 1225 VIC is the obvious choice to do this, as price wise, it is reasonable and it is fully featured, even though we only need 10 g ethernet (no FCoE in the short term).

  An option I was looking at was to use the 1225dts model, this to support backward compatible with 1000BaseT, 10BaseT.  However if it is an easy choice on UCS, Cisco do not seem to have modules of 10 G of copper on the side of the switch, except in specific models of the Nexus family.  What limits our options of switching in the future (this excludes the use of 4500-x or 3850 s for example).

  10G of fiber is an option, such as Twinax, but this brings me to my next questions.

  1. it seems that, according to the data sheet of C220M3 to http://www.cisco.com/c/dam/en/us/products/collateral/servers-unified-com... (see table 14) that the 1225 does not support Twinax.  In fact, it is the only NIC and ANC listed who apparently can't stand, which seems odd.  Is this correct, and what is the reason behind this?   Is it a hardware problem, a software problem or a problem of documentation?

  2. If Twinax Cisco is not an option, the 1225 does support 1 G SFP as the GLC-SX-MM?

  3. it looks like the X 520 map for UCS might work, because I believe that it can work with dual rate 1 G / 10 G SFP.  Someone has already tried this or have any comments on the way that those with UCS?

  Thank you

  Reuben

  Yes, take a look at page 34 of the plug for this server, but the SPF only supported are 10G - SR and the FC8G-SW.

  Do not forget to rate helpful answers

• Source for the latest HUU for server rack Cisco

  Hello, all!

  I was looking around for the latest HUU pack for my aging servers rack of Cisco.  These are the servers C210 M2 garden.  The matrix made MMIC refers to a version 14.4 (s) - which I can't find anywhere to download.  Is there a source for these packs of firmware and driver older?

  If this is not viable, a package in the range 15.X will work on one of these servers C210?  Maybe same 2.X?

  Thanks for all the research!

  Gregg

  Greg,

  Here is the link to the firmware:

  http://software.Cisco.com/download/release.html?mdfid=283862069&flowid=2...

  Here is the link for the drivers:

  http://software.Cisco.com/download/release.html?mdfid=283862069&flowid=2...

  HTH,

  -Kenny

• Initial installtion for firepower and cisco ASA

  Hello

  is there any clear guide to install the device VM firesight with integration of module power of fire ASA? I found some documents that explained the ASA device unit firesight recording. I did it properly. but I amd knows exactly how to create rules in firesight and apply it on the device of the asa.

  Thanks in advance

  Koffi bayet

  Hi, Fabien,

  This link would be useful.

  To install the firepower on SAA

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-firepower-service...

  To install the firepower on ESXI Management Center

  http://www.Cisco.com/c/en/us/support/docs/security/firesight-management-...

  Once you save the Manager module using the link below, you should be able to navigate and create/modify the policy strategy to establish rules for the module of firepower.

  http://www.Cisco.com/c/en/us/support/docs/security/firesight-management-...

  You can check this link for the example configuration of url filtering.

  http://www.Cisco.com/c/en/us/support/docs/security/firesight-management-...

  The fire power user guide has all the information

  http://www.Cisco.com/c/en/us/TD/docs/security/firepower/601/configuratio...

  Rate if helps.

  Yogesh

• Problem with the VPN site to site for the two cisco asa 5505

  Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

  Cisco Config asa1

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 172.xxx.xx.4 255.255.240.0
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.60.2 255.255.255.0
  !
  passive FTP mode
  network of the Lan_Outside object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
  network of the Lan_Outside object
  NAT (inside, outside) interface dynamic dns
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.60.0 255.255.255.0 inside
  http 96.xx.xx.222 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 96.88.75.222
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  inside access management

  dhcpd address 192.168.60.50 - 192.168.60.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_96.xx.xx.222 group strategy
  attributes of Group Policy GroupPolicy_96.xx.xx.222
  VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 96.xx.xx.222 type ipsec-l2l
  tunnel-group 96.xx.xx.222 General-attributes
  Group - default policy - GroupPolicy_96.xx.xx.222
  96.XX.XX.222 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error

  ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

  Cisco ASA 2 config

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 96.xx.xx.222 255.255.255.248
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.1.254 255.255.255.0
  !
  passive FTP mode
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  network of the Lan_Outside object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_4
  ip protocol object
  icmp protocol object
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
  !
  network of the Lan_Outside object
  dynamic NAT (all, outside) interface
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  http 172.xxx.xx.4 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 172.110.74.4
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0

  dhcpd address 192.168.1.50 - 192.168.1.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_172.xxx.xx.4 group strategy
  attributes of Group Policy GroupPolicy_172.xxx.xx.4
  L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 172.xxx.xx.4 type ipsec-l2l
  tunnel-group 172.xxx.xx.4 General-attributes
  Group - default policy - GroupPolicy_172.xxx.xx.4
  172.xxx.XX.4 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error
  inspect the http

  For IKEv2 configuration: (example config, you can change to encryption, group,...)

  -You must add the declaration of exemption nat (see previous answer).

  -set your encryption domain ACLs:

  access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

  -Set the Phase 1:

  Crypto ikev2 allow outside
  IKEv2 crypto policy 10
  3des encryption
  the sha md5 integrity
  Group 5
  FRP sha
  second life 86400

  -Set the Phase 2:

  Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
  Esp aes encryption protocol
  Esp integrity sha-1 protocol

  -set the Group of tunnel

  tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
  REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
  IKEv2 authentication remote pre-shared-key cisco123

  
  IKEv2 authentication local pre-shared-key cisco123

  -Define the encryption card

  address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
  card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
  card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
  CRYPTOMAP interface card crypto outside
  crypto isakmp identity address

  On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

  Thank you