Modification of the VPN on ASA version 7.1

Hi all

I have two problems to solve

  1. I've added 5 new network lines to an existing tunnel of B2B. Three 3 of the new route network are able to establish sessions on the tunnel but two 2 are unable. I've done a tracert to computer and track stops within the ASA. There is no newspaper showing on the SAA to suggest traffic reaches the ASA. I cloned the existing NAT and ACLs and rules static, but without success.
  2. 3 July 11, 2013 15:22:42 713902 Group = 82.199.93.3, IP = 82.199.93.3, error QM WSF (P2 struct & 0xb07054c0, mess id 0x5eafb9bb).
    3 July 11, 2013 15:22:42 713902 Group = 82.199.93.3, IP = 82.199.93.3, Removing counterpart of table Correlator has failed, no match!
    4 July 11, 2013 15:22:42 752012 IKEv1 has failed to set up a tunnel.  Card Tag = outside_map.  Map of sequence number = 1.
    3 July 11, 2013 15:22:42 752015 The tunnel manager does not have a document SA L2L.  All configured IKE versions did not establish the tunnel. Card Tag = outside_map.  Map of sequence number = 1.

Thankx

The error message "Approved Removing from table Correlator has failed, no football match!" shows the most often only remote tht doesn't have the mirror image configuration to allow traffic between the VPN and so some of the IKE SAs did not form.

Tags: Cisco Security

Similar Questions

  • Customization of SSL VPN Cisco ASA version 8

    Is there a way to customize the appearance of the SSL VPN? To change the features of the ASA custmization? To change the total look of the portal page the way we like it and not the Cisco default settings? For example, the RDP plugin has always display the help text on the right side, and we would like to show different text in this area. We were able to change it but could not import to the area of the asa.

    Import of SSL vpn customization ASA is not possible. Impossible also to change the appearance of the portal page.

  • Rejecting the VPN clients by version

    Is it possible that I can refuse access customers by their version which they run? Can someone send me a link on how I could do this?

    Thank you

    Dwane

    Dwane,

    How are you? I think that's what you're looking for:

    ~~~~~~~~~~~~~~~~

    ustomers Type & Version limiting build rules to allow or deny VPN Clients according to their type and software version. Build these rules exactly, using the formats, abbreviations and other specifications of rule below.

    Build rules in the format p [ermit] /d [eny]:, for example, d VPN 3002: 3.6*.

    The * character is a wildcard character. You can use it several times to each rule. For example:

    refuse *: 3.6* = deny all clients running software version 3.6 x.

    Use a separate line for each rule.

    Rules of order of priority. The first rule that matches is the rule that applies. If a rule later contradicted, the system ignores. If you set all the rules, all connections are allowed.

    When a customer matches any of the rules, the connection is refused. This means that if you set a deny rule, you must also set at least an allow rule, or all connections are refused.

    For software and hardware customers, customer type and software version must match their appearance (non-case sensitive) in the monitoring | Screen sessions, including spaces. We recommend that you copy and paste from this screen to it.

    "N/a" for the type or version to identify the client sends no information. For example: n permit / a:n / a = allow any client who does not send the client, type, and version.

    You can use a total of 255 characters for the rules. The line break between rules using two characters. To keep the characters, use p for permits and d to deny. Eliminate the spaces except as required for the type of client and the version. You don't need a space before or after the colon (:)).

    Configuration mode checkbox to use Configuration Mode with clients IPSec (also known as the method of setting up ISAKMP or Transaction of Configuration). This option Exchange with the client configuration settings while negotiating SAs. If you check this box, the settings of Configuration of Mode; otherwise, ignore them. The box is checked by default.

    To use the split tunneling, you must check this box.

    If you checked L2TP over IPSec as the Tunneling protocols, do not check this box.

    ~~~~~~~~~~~~~~~~~

    Please see the link below, you will need to have 4.7 running on your CVPN:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2284/products_configuration_guide_chapter09186a00803ee1f0.html

    My two cents,

    Frank

  • Impossible to reconnect the VPN to ASA on the internet

    Hello

    I ASA5540 running IOS 8.04 - K8, users are able to the VPN connection over the internet but impossible to reconnect the VPN when users disconnected abnormally (abnormally means they are not manually disconnect, VPN disconnect everything manually without problem occur). ASA showing an active session of the disconnected user and the user having reason 433 at the re-login VPN.

    Any suggestion and recommendation for this case.

    Awaiting your repies.

    Thank you very much.

    Kind regards

    Arsalan

    Hello

    under the tunnel-group, try to reduce the keepalive interval... Can help detect that the peer is down faster...

    Best wishes

    McLaughlin

  • How to configure bandwidth allowed on the VPN IPSec ASA tunnels?

    ASA 5505 8.2.1

    ASA 5520 8.4

    We currently have a tunnel set up between 2 ASAs

    is 1 - possible to assign 1.5 Mbps of Bandwidth (BW) to this tunnel? Then if Tunnel number 2 is set up I could assign 2 Mbit to this one for example?

    I'm not talking to prioritize certain type of traffic on the IPsec tunnel, I'm talking about Tunnel 1 to 1.5 Mbps of BW guaranteed for all traffic that passes through it. Same for tunnel 2

    Then

    2-How do to control the quantity of biological weapons in an IPsec tunnel?

    Please provide documentation possible

    Thank you

    Johnny

    Hello! Please consult this document:

    https://supportforums.Cisco.com/docs/doc-1230

    ___

    HTH. Please rate this post if this has been helpful. If it solves your problem, please mark this message as "right answer".

  • CME SSL VPN with ASA

    Hi all

    We are working on a new deployment of CME 9.1 for a small office. As part of this deployment, our plan was to have several remote phones connect via SSLVPN to an ASA on our network border allowing them to communicate with the router of the CME. We bought the appropriate of the VPN to ASA and licenses of paper for phones remotely.

    I'm following the instructions in this document: http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/admin/configura...

    However, the penalty, I'm having is that when I try to enter the settings for vpn-Group (page 19 of the pdf) the command is not available on my router - unrecognized command. I fear that this could mean that I'm missing a license/feature set to my router CME, is that correct? We bought a C2921CME-SRSTK9 router, but I may need the SEC/K9 license? If this is the case, can someone show me the part number or SKU, I would need to buy?

    Moreover, is anyway that I could get around to adding this to the router config - perhaps change the configuration of phone XML directly?

    Thanks in advance!

    It is correct, you will need the license of security. SKU is: L-SL-29-SEC-K9 =

    http://www.Cisco.com/c/en/us/products/collateral/routers/1900-series-int...

  • Cisco ASA, connect an IP address on the OUTSIDE of the VPN remote access

    Hello

    I tried to find resources on the net but could not find a solution, then post it here. Maybe someone can help.

    So the problem is that I'm trying to access a server on the cloud for remote VPN access (cisco asa 5510).

    The server on the cloud (54.54.54.54) is only accessible from the outside interface (192.168.11.2) NY Firewall (cisco asa 5510)

    I added some ACE for this in the ACL of VPN tunnel to divide.

    NY-standard host allowed fw # access - list vpn_remote-customer 54.54.54.54

    And I see the road added to my cliet machine after the VPN connection, but still it cannot connect to this server.

    The network INTERIOR, I can connect to the server.

    Thanks in advance.

    Hello

    This is most likely a problem with NAT hair/U-turn hairpin.

    Will need to see the configurations or you would need to check yourself

    I don't know what your version of the Software ASA is to be like who determines what is the format of NAT configuration.

    So far, you have confirmed that the ASA VPN configuration provides the VPN Client with the route to the remote server. Then in circulation should be tunnel to the ASA.

    Then, you will need to check the output of this command

    See the race same-security-traffic

    You should see the command in the output below

    permit same-security-traffic intra-interface

    If you do not, you will need to add it. This effect of controls is to allow traffic to enter an interface and exit through the same interface. In your case this applies to Internet VPN Client traffic to the remote server as it between ' outside ' and spell through the 'outside'.

    Then, should ensure that dynamic PAT is configured for the VPN Clients.

    8.2 software (and below)

    You most likely have a dynamic configuration PAT like that on the firewall, if levels of above running software version

    Global 1 interface (outside)

    NAT (inside) 1 0.0.0.0 0.0.0.0

    In this situation if we wanted to add dynamic PAT for a pool of VPN, we would add

    NAT (outside) 1

    This would allow users to use the same public IP address as LAN users, when accessing the remote VPN server

    Software 8.3 (and above)

    Because the NAT configuration format is completely different in the latest software, you could probably just add a new configuration of NAT completely without adding a

    network of the VPN-PAT object

    subnet

    dynamic NAT interface (outdoors, outdoor)

    Of course, its possible that there could be some configuration NAT already on the device which could cause problems for this configuration. If this does not work then that we would have to look at the actual configurations on the ASA.

    Hope this helps

    Let me know how it goes

    -Jouni

  • ASA Version 9.0 (1) - Ping works both inside and outside, WWW does not work for remote VPN

    I am at a loss, I can connect VIA VPN and Ping inside the IPs (192.168.1.2) and outside (4.2.2.2) IPs of the remote VPN client, but can't surf WWW. Inside the network, all users have WWW access and the network is fine. I'm new on the revisions to ver 8.3 and don't see what I'm missing?

    Info:

    ASA-A # sh xl
    in use, the most used 12 4
    Flags: D - DNS, e - extended, I - identity, i - dynamics, r - portmap,
    s - static, T - twice, N - net-to-net
    NAT inside:192.168.1.0/24 to outside:24.180.x.x/24
    flags s idle 0:10:46 timeout 0:00:00
    NAT outside:192.168.2.0/24 to outside:24.180.x./24
    flags s idle 0:00:59 timeout 0:00:00
    NAT inside:192.168.1.0/24 to any:192.168.1.0/24
    sitting inactive flags 0:11:51 timeout 0:00:00
    NAT any:192.168.2.0/24 to inside:192.168.2.0/24
    sitting inactive flags 0:11:51 timeout 0:00:00
    ASA-A #.

    ASA-A # sh nat
    Manual NAT policies (Section 1)
    1 (inside) to destination of (all) Inside_Net Inside_Net the VPN-NET VPN static static
    translate_hits = 3, untranslate_hits = 3

    Auto NAT policies (Section 2)
    1 (inside) (outside) static source Inside_Net 24.180.x.x
    translate_hits = 3, untranslate_hits = 184
    2 (outdoor) (outdoor) static source VPN-net 24.180.x.x
    translate_hits 97, untranslate_hits = 91 =
    ASA-A #.

    Journal of the Sho:

    % 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection for udp src outside:192.168.2.10/137(LOCAL\User) dst outside:192.168.2.255/137 refused due to path failure reverse that of NAT
    % ASA-609002 7: duration of outside local host: 192.168.2.255 disassembly 0:00:00
    % ASA-609001 7: built outside local host: 192.168.2.255

    % 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection for udp src outside:192.168.2.10/137(LOCAL\User) dst outside:192.168.2.255/137 refused due to path failure reverse that of NAT
    % ASA-609002 7: duration of outside local host: 192.168.2.255 disassembly 0:00:00

    Current config:

    ASA Version 9.0 (1)
    !
    ASA-A host name
    domain a.local
    enable the encrypted password xxxxx
    XXXXX encrypted passwd
    names of
    IP local pool vpnpool 192.168.2.10 - 192.168.2.20
    !
    interface Ethernet0/0
    Inet connection description
    switchport access vlan 2
    !
    interface Ethernet0/1
    LAN connection description
    switchport access vlan 3
    !
    interface Ethernet0/2
    switchport access vlan 3
    !
    interface Ethernet0/3
    switchport access vlan 3
    !
    interface Ethernet0/4
    switchport access vlan 3
    !
    interface Ethernet0/5
    switchport access vlan 3
    !
    interface Ethernet0/6
    switchport access vlan 3
    !
    interface Ethernet0/7
    switchport access vlan 3
    !
    interface Vlan1
    No nameif
    no level of security
    no ip address
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address 24.180.x.x 255.255.255.248
    !
    interface Vlan3
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    banner exec   ********************************************
    banner exec   *                                          *
    exec banner * ASA-A *.
    banner exec   *                                          *
    exec banner * CISCO ASA5505 *.
    banner exec   *                                          *
    exec banner * A Services Inc.              *
    exec banner * xxx in car Street N. *.
    exec banner * city, ST # *.
    banner exec   *                                          *
    banner exec   ********************************************
    exec banner ^
    passive FTP mode
    DNS server-group DefaultDNS
    domain a.local
    permit same-security-traffic intra-interface
    network obj_any object
    subnet 0.0.0.0 0.0.0.0
    network of the Inside_Net object
    subnet 192.168.1.0 255.255.255.0
    network of the VPN-net object
    Subnet 192.168.2.0 255.255.255.0
    access-list extended sheep permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
    allowed incoming access extended gre a whole list
    inbound udp allowed extended access list any host 24.180.x.x eq 1723
    list of allowed inbound tcp extended access any host 24.180.x.x eq pptp
    list of allowed inbound tcp extended access any host 24.180.x.x eq smtp
    list of allowed inbound tcp extended access any host 24.180.x.x eq www
    list of allowed inbound tcp extended access any host 24.180.x.x eq https
    list of allowed inbound tcp extended access any host 24.180.x.x eq 987
    inbound udp allowed extended access list any host 24.180.x.x eq 25
    inbound udp allowed extended access list any host 24.180.x.x eq 443
    inbound udp allowed extended access list any host 24.180.x.x eq www
    inbound udp allowed extended access list any host 24.180.x.x eq 987
    pager lines 24
    Enable logging
    debug logging in buffered memory
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow all outside
    ICMP allow any inside
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    public static Inside_Net Inside_Net destination NAT (inside, all) static source VPN-NET VPN
    !
    network of the Inside_Net object
    NAT static 24.180.x.x (indoor, outdoor)
    network of the VPN-net object
    24.180.x.x static NAT (outdoors, outdoor)
    Access-group interface incoming outside
    Route outside 0.0.0.0 0.0.0.0 24.180.x.x 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    Enable http server
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
    Crypto ipsec transform-set ikev1 VPN remote esp-3des esp-md5-hmac
    Crypto ipsec ikev2 VPN ipsec-proposal-remotetest
    Protocol esp encryption aes - 256, aes - 192, aes, 3des and
    Esp integrity sha-1 protocol
    Crypto ipsec pmtu aging infinite - the security association
    Crypto-map dynamic dyn1 1jeu ikev1 transform-set remote VPN
    Crypto-map dynamic dyn1 1jeu reverse-road
    map VPN - map 1-isakmp ipsec crypto dynamic dyn1
    VPN-card interface card crypto outside
    Crypto ca trustpoint _SmartCallHome_ServerCA
    Configure CRL
    trustpool crypto ca policy
    Crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
    010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
    30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
    0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
    65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
    68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
    302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
    63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
    010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
    082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
    ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
    45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
    1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
    6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
    445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
    1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
    2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
    4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
    b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
    99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018
    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
    quit smoking
    Crypto ikev1 allow outside
    IKEv1 crypto policy 1
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 43200
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0

    dhcpd outside auto_config
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    user name UName encrypted password privilege 15 xxxxxxxxx
    type tunnel-group remote VPN remote access
    attributes global-tunnel-group VPN-remote controls
    address vpnpool pool
    tunnel-group, ipsec VPN-remote controls-attributes
    IKEv1 pre-shared-key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    !
    global service-policy global_policy
    context of prompt hostname
    anonymous reporting remote call
    Cryptochecksum:43db9ab2d3427289fb9a0fdb22b551fa
    : end

    Hello

    Its propably because you do not have a DNS server configured for VPN users. Try this command:

     group-policy DfltGrpPolicy attributes dns-server value 8.8.8.8

  • ASA Anyconnect VPN do not work or download the VPN client

    I have a Cisco ASA 5505 that I try to configure anyconnect VPN and thought, I've changed my setup several times but trying to access my static public IP address of the external IP address to download the image, I am not able to. Also when I do a package tracer I see he has been ignored through the acl when the packets from side to the ASA via port 443, it drops because of the ACL. My DMZ so will he look like something trying to access the ASA via the VPN's going to port 443. Here is my config

    XXXX # sh run
    : Saved
    :
    ASA Version 8.4 (3)
    !
    hostname XXXX
    search for domain name
    activate pFTzVNrKdD9x5rhT encrypted password
    zPBAmb8krxlXh.CH encrypted passwd
    names of
    !
    interface Ethernet0/0
    Outside-interface description
    switchport access vlan 20
    !
    interface Ethernet0/1
    Uplink DMZ description
    switchport access vlan 30
    !
    interface Ethernet0/2
    switchport access vlan 10
    !
    interface Ethernet0/3
    switchport access vlan 10
    !
    interface Ethernet0/4
    Ganymede + ID description
    switchport access vlan 10
    switchport monitor Ethernet0/0
    !
    interface Ethernet0/5
    switchport access vlan 10
    !
    interface Ethernet0/6
    switchport access vlan 10
    !
    interface Ethernet0/7
    Description Wireless_AP_Loft
    switchport access vlan 10
    !
    interface Vlan10
    nameif inside
    security-level 100
    IP 192.168.10.1 255.255.255.0
    !
    interface Vlan20
    nameif outside
    security-level 0
    IP address x.x.x.249 255.255.255.248
    !
    Vlan30 interface
    no interface before Vlan10
    nameif dmz
    security-level 50
    IP 172.16.30.1 255.255.255.0
    !
    boot system Disk0: / asa843 - k8.bin
    passive FTP mode
    DNS lookup field inside
    DNS domain-lookup outside
    DNS domain-lookup dmz
    DNS server-group DefaultDNS
    Name-Server 8.8.8.8
    Server name 8.8.4.4
    search for domain name
    network obj_any1 object
    subnet 0.0.0.0 0.0.0.0
    network of the Webserver_DMZ object
    Home 172.16.30.8
    network of the Mailserver_DMZ object
    Home 172.16.30.7
    the object DMZ network
    172.16.30.0 subnet 255.255.255.0
    network of the FTPserver_DMZ object
    Home 172.16.30.9
    network of the Public-IP-subnet object
    subnet x.x.x.248 255.255.255.248
    network of the FTPserver object
    Home 172.16.30.8
    network of the object inside
    192.168.10.0 subnet 255.255.255.0
    network of the VPN_SSL object
    10.101.4.0 subnet 255.255.255.0
    outside_in list extended access permit tcp any newspaper object Mailserver_DMZ eq www
    outside_in list extended access permit tcp any newspaper EQ 587 Mailserver_DMZ object
    outside_in list extended access permit tcp any newspaper SMTP object Mailserver_DMZ eq
    outside_in list extended access permit tcp any newspaper of the Mailserver_DMZ eq pop3 object
    outside_in list extended access permit tcp any newspaper EQ 2525 Mailserver_DMZ object
    outside_in list extended access permit tcp any newspaper of the Mailserver_DMZ eq imap4 object
    outside_in list extended access permit tcp any newspaper EQ 465 Mailserver_DMZ object
    outside_in list extended access permit tcp any newspaper EQ 993 Mailserver_DMZ object
    outside_in list extended access permit tcp any newspaper EQ 995 object Mailserver_DMZ
    outside_in list extended access permit tcp any newspaper EQ 5901 Mailserver_DMZ object
    outside_in list extended access permit tcp any newspaper Mailserver_DMZ eq https object
    Note access list ACL for VPN Tunnel from Split vpn_SplitTunnel
    vpn_SplitTunnel list standard access allowed 192.168.10.0 255.255.255.0
    pager lines 24
    Enable logging
    timestamp of the record
    exploitation forest-size of the buffer to 8192
    logging trap warnings
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    MTU 1500 dmz
    local pool VPN_SSL 10.101.4.1 - 10.101.4.4 255.255.255.0 IP mask
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 647.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT (inside, outside) static source inside inside static destination VPN_SSL VPN_SSL
    NAT (exterior, Interior) static source VPN_SSL VPN_SSL
    !
    network obj_any1 object
    NAT static interface (indoor, outdoor)
    network of the Webserver_DMZ object
    NAT (dmz, outside) static x.x.x.250
    network of the Mailserver_DMZ object
    NAT (dmz, outside) static x.x.x.. 251
    the object DMZ network
    NAT (dmz, outside) static interface
    Access-group outside_in in external interface
    Route outside 0.0.0.0 0.0.0.0 x.x.x.254 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    AAA-server protocol Ganymede HNIC +.
    AAA-server host 192.168.10.2 HNIC (inside)
    Timeout 60
    key *.
    identity of the user by default-domain LOCAL
    Console HTTP authentication AAA HNIC
    AAA console HNIC ssh authentication
    Console AAA authentication telnet HNIC
    AAA authentication secure-http-client
    http 192.168.10.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ca trustpoint localtrust
    registration auto
    Configure CRL
    Crypto ca trustpoint VPN_Articulate2day
    registration auto
    name of the object CN = vpn.articulate2day.com
    sslvpnkey key pair
    Configure CRL
    Telnet 192.168.10.0 255.255.255.0 inside
    Telnet timeout 30
    SSH 192.168.10.0 255.255.255.0 inside
    SSH timeout 15
    SSH version 2
    Console timeout 0
    No vpn-addr-assign aaa

    DHCP-client update dns
    dhcpd dns 8.8.8.8 8.8.4.4
    dhcpd outside auto_config
    !
    dhcpd address 192.168.10.100 - 192.168.10.150 inside
    dhcpd allow inside
    !
    dhcpd address dmz 172.16.30.20 - 172.16.30.23
    dhcpd enable dmz
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    authenticate the NTP
    NTP server 192.168.10.2
    WebVPN
    allow outside
    AnyConnect image disk0:/anyconnect-linux-64-3.1.06079-k9.pkg 1
    AnyConnect enable
    tunnel-group-list activate
    internal VPN_SSL group policy
    VPN_SSL group policy attributes
    value of server DNS 8.8.8.8
    client ssl-VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list vpn_SplitTunnel
    the address value VPN_SSL pools
    WebVPN
    activate AnyConnect ssl dtls
    AnyConnect Dungeon-Installer installed
    AnyConnect ssl keepalive 15
    AnyConnect ssl deflate compression
    AnyConnect ask enable
    ronmitch50 spn1SehCw8TvCzu7 encrypted password username
    username ronmitch50 attributes
    type of remote access service
    type tunnel-group VPN_SSL_Clients remote access
    attributes global-tunnel-group VPN_SSL_Clients
    address VPN_SSL pool
    Group Policy - by default-VPN_SSL
    tunnel-group VPN_SSL_Clients webvpn-attributes
    enable VPNSSL_GNS3 group-alias
    type tunnel-group VPN_SSL remote access
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect esmtp
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
    : end

    XXXX #.

    You do not have this configuration:

     object network DMZ nat (dmz,outside) static interface

    Try and take (or delete):

     object network DMZ nat (dmz,outside) dynamic interface

  • Cannot find the next jump - ASA 5505 VPN routing l2l

    We have a 5505 (soon to be replaced by two 5515-x) firewall with two VPN l2l.

    "Were trying to allow a remote site traffic flow through the other remote site but the syslog shows."

            10.5.25.4 1 172.16.10.10 0

    Could not locate the next hop for ICMP outside:10.5.25.4/1 to inside:172.16.10.10/0 routing

    Config is less than

    :

    ASA Version 8.4 (3)

    names of

    !

    interface Ethernet0/0

    switchport access vlan 2

    Speed 100

    full duplex

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    <--- more="" ---="">

    !

    interface Ethernet0/7

    switchport access vlan 10

    !

    interface Vlan1

    nameif inside

    security-level 100

    allow-ssc-mgmt

    IP 10.5.19.254 255.255.255.0

    !

    interface Vlan2

    WIMAX Interface Description

    nameif outside

    security-level 0

    IP address x.247.x.18 255.255.255.248

    !

    passive FTP mode

    clock timezone GMT 1

    permit same-security-traffic inter-interface

    permit same-security-traffic intra-interface

    network obj_any object

    subnet 0.0.0.0 0.0.0.0

    network guestwifi object

    10.1.110.0 subnet 255.255.255.0

    <--- more="" ---="">

    network of the NETWORK_OBJ_10.5.19.0_24 object

    10.5.19.0 subnet 255.255.255.0

    network of the NETWORK_OBJ_10.5.31.0_24 object

    10.5.31.0 subnet 255.255.255.0

    network of the NETWORK_OBJ_172.16.0.0_16 object

    subnet 172.16.0.0 255.255.0.0

    the object DS365-Cloud network

    172.16.10.0 subnet 255.255.255.0

    Description DS365-Cloud

    network of the object to the inside-network-16

    10.5.0.0 subnet 255.255.0.0

    atanta network object

    10.5.16.0 subnet 255.255.255.0

    Atanta description

    network guest_dyn_nat object

    10.5.29.0 subnet 255.255.255.0

    network of the NETWORK_OBJ_172.16.254.0_25 object

    subnet 172.16.254.0 255.255.255.128

    network of the NETWORK_OBJ_10.5.16.0_20 object

    subnet 10.5.16.0 255.255.240.0

    network of the NETWORK_OBJ_10.5.16.0_26 object

    255.255.255.192 subnet 10.5.16.0

    network of the LDAP_DC7 object

    Home 10.5.21.1

    <--- more="" ---="">

    LDAP description

    network c2si object

    range 10.5.21.180 10.5.21.200

    network of the NETWORK_OBJ_10.5.25.0_24 object

    10.5.25.0 subnet 255.255.255.0

    object-group network rfc1918

    object-network 192.168.0.0 255.255.0.0

    object-network 172.16.0.0 255.255.240.0

    object-network 10.0.0.0 255.0.0.0

    the DM_INLINE_NETWORK_1 object-group network

    object-network 10.5.19.0 255.255.255.0

    network-object 10.5.20.0 255.255.254.0

    object-network 10.5.22.0 255.255.255.0

    object-network 10.5.30.0 255.255.255.0

    object-network 192.168.100.0 255.255.255.0

    the Sure_Signal object-group network

    network-object x.183.x.128 255.255.255.192

    network-host x.183.133.177 object

    network-host x.183.133.178 object

    network-host x.183.133.179 object

    network-host x.183.133.181 object

    network-host x.183.133.182 object

    the LDAP_source_networks object-group network

    network-object 135.196.24.192 255.255.255.240

    <--- more="" ---="">

    object-network 195.130.x.0 255.255.255.0

    network-object x.2.3.128 255.255.255.192

    network-object 213.235.63.64 255.255.255.192

    object-network 91.220.42.0 255.255.255.0

    object-network 94.x.240.0 255.255.255.0

    object-network 94.x.x.0 255.255.255.0

    the c2si_Allow object-group network

    host of the object-Network 10.5.16.1

    host of the object-Network 10.5.21.1

    network-object object c2si

    the DM_INLINE_NETWORK_2 object-group network

    network-object 10.5.20.0 255.255.254.0

    object-network 10.5.21.0 255.255.255.0

    object-network 10.5.22.0 255.255.255.0

    object-network 10.5.29.0 255.255.255.0

    network-object, object NETWORK_OBJ_10.5.19.0_24

    the DM_INLINE_NETWORK_3 object-group network

    object-network 10.5.19.0 255.255.255.0

    network-object 10.5.20.0 255.255.254.0

    object-network 10.5.21.0 255.255.255.0

    object-network 10.5.22.0 255.255.255.0

    atanta network-object

    the DM_INLINE_NETWORK_4 object-group network

    network-object 10.5.20.0 255.255.254.0

    <--- more="" ---="">

    object-network 10.5.21.0 255.255.255.0

    object-network 10.5.22.0 255.255.255.0

    object-network 10.5.23.0 255.255.255.0

    object-network 10.5.30.0 255.255.255.0

    network-object, object NETWORK_OBJ_10.5.19.0_24

    atanta network-object

    network-object DS365-Cloud

    inside_access_in list extended access permit tcp any eq 50 Sure_Signal object-group

    inside_access_in list extended access permit tcp any object-group Sure_Signal eq pptp

    inside_access_in list extended access permits will all object-group Sure_Signal

    inside_access_in list extended access permit udp any eq ntp Sure_Signal object-group

    inside_access_in access list extended icmp permitted no echo of Sure_Signal object-group

    inside_access_in list extended access permit udp any eq 50 Sure_Signal object-group

    inside_access_in list extended access permit udp any eq Sure_Signal object-group 4500

    inside_access_in list extended access permit udp any eq isakmp Sure_Signal object-group

    inside_access_in of access allowed any ip an extended list

    255.255.0.0 allow access list extended ip 10.5.0.0 clientvpn 10.5.30.0 255.255.255.0

    access-list extended BerkeleyAdmin-clientvpn ip 10.5.0.0 allow 255.255.0.0 10.5.30.0 255.255.255.0

    IP 10.5.21.0 allow to Access-list BerkeleyUser-clientvpn extended 255.255.255.0 10.5.30.0 255.255.255.0

    outside_cryptomap extended access list permit ip object inside-network-16 10.5.25.0 255.255.255.0

    access extensive list ip 10.5.29.0 guest_access_in allow 255.255.255.0 any

    state_bypass allowed extended access list tcp 192.168.100.0 255.255.255.0 10.5.30.0 255.255.255.0 connect

    state_bypass allowed extended access list tcp 10.5.30.0 255.255.255.0 192.168.100.0 255.255.255.0 connect

    state_bypass allowed extended access list tcp 10.5.29.0 255.255.255.0 10.5.30.0 255.255.255.0 connect

    <--- more="" ---="">

    state_bypass allowed extended access list tcp 10.5.30.0 255.255.255.0 10.5.29.0 255.255.255.0 connect

    outside_access_in list extended access permit icmp any one

    access extensive list ip 10.5.16.0 outside_cryptomap_1 allow 255.255.240.0 10.5.16.0 255.255.255.192

    access-list extended global_access permitted tcp object-group LDAP_source_networks host 10.5.21.1 eq ldap

    access extensive list 10.5.0.0 ip outside_cryptomap_2 255.255.0.0 allow object DS365-Cloud

    outside_cryptomap_3 list extended access allowed object-group ip DM_INLINE_NETWORK_4 10.5.25.0 255.255.255.0

    pager lines 24

    Enable logging

    exploitation forest-size of the buffer of 100000

    recording of debug console

    debug logging in buffered memory

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    IP local pool clientvpn 10.5.30.1 - 10.5.30.100

    mask 172.16.254.1 - 172.16.254.100 255.255.255.0 IP local pool VPN_IP_Pool

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    ICMP allow any inside

    ICMP allow all outside

    don't allow no asdm history

    ARP timeout 14400

    NAT (inside, outside) source static rfc1918 rfc1918 destination rfc1918 static rfc1918

    NAT (inside, outside) static source NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.31.0_24 NETWORK_OBJ_10.5.31.0_24 non-proxy-arp-search of route static destination

    <--- more="" ---="">

    NAT (inside, outside) static source NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 NETWORK_OBJ_10.5.19.0_24 non-proxy-arp-search of route static destination

    NAT (inside, outside) static source to the static inside-network-16 inside-network-16 destination DS365-DS365-cloud no-proxy-arp-route search

    NAT (inside, outside) static source DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 NETWORK_OBJ_172.16.254.0_25 NETWORK_OBJ_172.16.254.0_25 non-proxy-arp-search of route static destination

    NAT (inside, outside) static source NETWORK_OBJ_10.5.16.0_20 NETWORK_OBJ_10.5.16.0_20 NETWORK_OBJ_10.5.16.0_26 NETWORK_OBJ_10.5.16.0_26 non-proxy-arp-search of route static destination

    NAT (inside, outside) source static c2si_Allow c2si_Allow NETWORK_OBJ_172.16.254.0_25 NETWORK_OBJ_172.16.254.0_25 non-proxy-arp-search of route static destination

    NAT (inside, outside) source static atanta atanta static destination NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search to itinerary

    NAT (inside, outside) static source DS365-DS365-cloud static destination NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search to itinerary

    NAT (inside, outside) static source DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search of route static destination

    NAT (inside, outside) static source NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 static destination DS365-DS365-cloud no-proxy-arp-route search

    NAT (inside, outside) static source DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3 static destination DS365-DS365-cloud no-proxy-arp-route search

    NAT (inside, outside) static source to the inside-network-16 inside-network-16 destination static NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search to itinerary

    NAT (inside, outside) static source DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 non-proxy-arp-search of route static destination

    !

    network obj_any object

    NAT dynamic interface (indoor, outdoor)

    network of the LDAP_DC7 object

    NAT 194.247.x.19 static (inside, outside) tcp ldap ldap service

    inside_access_in access to the interface inside group

    Access-group outside_access_in in interface outside

    Access-Group global global_access

    !

    Router eigrp 143

    No Auto-resume

    Network 10.5.19.0 255.255.255.0

    <--- more="" ---="">

    Network 10.5.29.0 255.255.255.0

    Network 10.5.30.0 255.255.255.0

    redistribute static

    !

    Route outside 0.0.0.0 0.0.0.0 194.247.x.17 1 track 1

    Route inside 10.5.16.0 255.255.255.0 10.5.19.252 1

    Timeout xlate 03:00

    Pat-xlate timeout 0:00:30

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    RADIUS protocol for AAA-server group

    AAA (inside) 10.5.21.1 host server group

    key *.

    AAA (inside) 10.5.16.1 host server group

    key *.

    identity of the user by default-domain LOCAL

    the ssh LOCAL console AAA authentication

    AAA authentication LOCAL telnet console

    Enable http server

    <--- more="" ---="">

    http 192.168.1.0 255.255.255.0 inside

    http 10.5.16.0 255.255.240.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

    Sysopt connection tcpmss 1350

    SLA 1 monitor

    type echo protocol ipIcmpEcho 8.8.4.4 outside interface

    SLA monitor Appendix 1 point of life to always start-time now

    Crypto ipsec transform-set ikev1 strong-comp esp-aes-256 esp-sha-hmac

    Crypto ipsec ikev1 transform-set strong aes-256-esp esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

    Crypto ipsec ikev2 strong ipsec proposal

    Protocol esp encryption aes-256

    Esp integrity sha-1 protocol

    <--- more="" ---="">

    Crypto ipsec ikev2 AES256 ipsec-proposal

    Protocol esp encryption aes-256

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 ipsec-proposal AES192

    Protocol esp encryption aes-192

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 ipsec-proposal AES

    Esp aes encryption protocol

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 proposal ipsec 3DES

    Esp 3des encryption protocol

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 ipsec-proposal OF

    encryption protocol esp

    Esp integrity sha - 1, md5 Protocol

    Crypto-map dynamic dyn1 1 set transform-set ikev1 strong

    1 correspondence address outside_cryptomap_1 outside crypto map

    crypto card outside pfs set 1

    1 set 83.x.172.68 counterpart outside crypto map

    Crypto card outside 1 set transform-set ESP-AES-256-SHA ikev1

    1 set ikev2 AES256 ipsec-proposal outside crypto map

    card crypto off game 2 address outside_cryptomap_3

    map external crypto 2 peers set 23.100.x.177

    card external crypto 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5

    <--- more="" ---="">

    map external crypto 2 set AES256 AES192 AES strong proposal ipsec ikev2

    Crypto card outside 2 kilobytes of life of security association set 102400000

    card crypto outside match 3 address outside_cryptomap_2

    3 set pfs outside crypto map

    map external crypto 3 peers set 91.x.3.39

    crypto card outside ikev1 set 3 transform-set ESP-3DES-SHA

    map external crypto 3 3DES ipsec-ikev2 set proposal

    dynamic outdoor 100 dyn1 ipsec-isakmp crypto map

    card crypto outside interface outside

    Crypto ca trustpoint _SmartCallHome_ServerCA

    Configure CRL

    IKEv2 crypto policy 1

    aes-256 encryption

    integrity sha

    Group 2

    FRP sha

    second life 86400

    IKEv2 crypto policy 10

    aes-192 encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 20

    aes encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 30

    3des encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 40

    the Encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    Crypto ikev2 allow outside

    Crypto ikev1 allow outside

    IKEv1 crypto policy 1

    preshared authentication

    aes-256 encryption

    sha hash

    Group 2

    lifetime 28800

    IKEv1 crypto policy 2

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    !

    track 1 rtr 1 accessibility

    Telnet 10.5.16.0 255.255.240.0 inside

    Telnet timeout 5

    SSH 83.x.x.90 255.255.255.255 outside

    SSH timeout 5

    Console timeout 0

    dhcpd outside auto_config

    !

    dhcprelay Server 10.5.21.1 on the inside

    time-out of 60 dhcprelay

    a basic threat threat detection

    statistical threat detection port

    <--- more="" ---="">

    Statistical threat detection Protocol

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    NTP 10.5.19.253 Server prefer

    WebVPN

    allow outside

    AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

    AnyConnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 2

    AnyConnect enable

    tunnel-group-list activate

    attributes of Group Policy DfltGrpPolicy

    Ikev1 VPN-tunnel-Protocol l2tp ipsec without ssl-client

    internal GroupPolicy_c2si group strategy

    attributes of Group Policy GroupPolicy_c2si

    WINS server no

    value of 10.5.16.1 DNS server 10.5.21.1

    client ssl-VPN-tunnel-Protocol

    by default no

    internal GroupPolicy_91.x.3.39 group strategy

    attributes of Group Policy GroupPolicy_91.x.3.39

    VPN-tunnel-Protocol ikev1, ikev2

    internal GroupPolicy_83.x.172.68 group strategy

    attributes of Group Policy GroupPolicy_83.x.172.68

    VPN-tunnel-Protocol ikev1, ikev2

    <--- more="" ---="">

    internal GroupPolicy_23.100.x.177 group strategy

    attributes of Group Policy GroupPolicy_23.100.x.177

    VPN-tunnel-Protocol ikev1, ikev2

    internal GroupPolicy_user group strategy

    attributes of Group Policy GroupPolicy_user

    WINS server no

    value of 10.5.21.1 DNS server 10.5.16.1

    client ssl-VPN-tunnel-Protocol

    Split-tunnel-policy tunnelspecified

    Split-tunnel-network-list value BerkeleyAdmin-clientvpn

    myberkeley.local value by default-field

    internal GroupPolicy_23.101.x.122 group strategy

    attributes of Group Policy GroupPolicy_23.101.x.122

    VPN-tunnel-Protocol ikev1, ikev2

    internal GroupPolicy1 group strategy

    attributes of Group Policy GroupPolicy1

    VPN-tunnel-Protocol ikev1, ikev2

    internal BerkeleyUser group strategy

    attributes of Group Policy BerkeleyUser

    value of 10.5.21.1 DNS server 10.5.16.1

    Split-tunnel-policy tunnelspecified

    Split-tunnel-network-list value BerkeleyUser-clientvpn

    myberkeley.local value by default-field

    internal DS365 group policy

    <--- more="" ---="">

    DS365 group policy attributes

    VPN-idle-timeout no

    VPN-filter no

    IPv6-vpn-filter no

    VPN-tunnel-Protocol ikev1, ikev2

    internal BerkeleyAdmin group strategy

    attributes of Group Policy BerkeleyAdmin

    value of 10.5.21.1 DNS server 10.5.16.1

    Split-tunnel-policy tunnelspecified

    Split-tunnel-network-list value BerkeleyAdmin-clientvpn

    myberkeley.local value by default-field

    acsadmin encrypted V6hUzNl366K37eiV privilege 15 password username

    atlanta uxelpvEvM3I7tw.Z encrypted privilege 15 password username

    username of berkeley Kj.RBvUp5dtyLw5T encrypted password

    type tunnel-group BerkeleyUser remote access

    attributes global-tunnel-group BerkeleyUser

    address clientvpn pool

    authentication-server-group

    Group Policy - by default-BerkeleyUser

    IPSec-attributes tunnel-group BerkeleyUser

    IKEv1 pre-shared-key *.

    type tunnel-group BerkeleyAdmin remote access

    attributes global-tunnel-group BerkeleyAdmin

    address clientvpn pool

    <--- more="" ---="">

    authentication-server-group

    Group Policy - by default-BerkeleyAdmin

    IPSec-attributes tunnel-group BerkeleyAdmin

    IKEv1 pre-shared-key *.

    type tunnel-group user remote access

    tunnel-group user General attributes

    address pool VPN_IP_Pool

    authentication-server-group

    Group Policy - by default-GroupPolicy_user

    tunnel-group user webvpn-attributes

    enable-alias of user group

    type tunnel-group c2si remote access

    tunnel-group c2si-global attributes

    address pool VPN_IP_Pool

    authentication-server-group

    Group Policy - by default-GroupPolicy_c2si

    tunnel-group c2si webvpn-attributes

    Group-alias c2si enable

    tunnel-group 83.x.172.68 type ipsec-l2l

    tunnel-group 83.x.172.68 General-attributes

    Group - default policy - GroupPolicy_83.x.172.68

    83.x.172.68 group of tunnel ipsec-attributes

    IKEv1 pre-shared-key *.

    remote control-IKEv2 pre-shared-key authentication *.

    <--- more="" ---="">

    pre-shared-key authentication local IKEv2 *.

    tunnel-group 23.101.x.122 type ipsec-l2l

    tunnel-group 23.101.x.122 General-attributes

    Group - default policy - GroupPolicy_23.101.x.122

    23.101.x.122 group of tunnel ipsec-attributes

    IKEv1 pre-shared-key *.

    remote control-IKEv2 pre-shared-key authentication *.

    pre-shared-key authentication local IKEv2 *.

    tunnel-group 91.x.3.39 type ipsec-l2l

    tunnel-group 91.x.3.39 general-attributes

    Group - default policy - GroupPolicy_91.x.3.39

    91.x.3.39 group of tunnel ipsec-attributes

    IKEv1 pre-shared-key *.

    remote control-IKEv2 pre-shared-key authentication *.

    pre-shared-key authentication local IKEv2 *.

    tunnel-group 23.100.x.177 type ipsec-l2l

    tunnel-group 23.100.x.177 General-attributes

    Group - default policy - GroupPolicy_23.100.63.177

    23.100.x.177 group of tunnel ipsec-attributes

    IKEv1 pre-shared-key *.

    remote control-IKEv2 pre-shared-key authentication *.

    pre-shared-key authentication local IKEv2 *.

    class-map state_bypass

    corresponds to the state_bypass access list

    Policy-map state_bypass_policy

    class state_bypass

    set the advanced options of the tcp-State-bypass connection

    !

    service-policy state_bypass_policy to the inside interface

    context of prompt hostname

    anonymous reporting remote call

    Cryptochecksum:bbc6f2ec2db9b09a1b6eb90270ddfeea

    : end

    PTB-ch-asa5505 #.

                   

    Ah OK I see now.

    Your cryptomap for the cloud of DS365 is:

    access extensive list 10.5.0.0 ip outside_cryptomap_2 255.255.0.0 allow object DS365-Cloud

    so, which covers interesting traffic.

    However, your NAT statement is:

    NAT (inside, outside) static source NETWORK_OBJ_10.5.25.0_24 NETWORK_OBJ_10.5.25.0_24 static destination DS365-DS365-cloud no-proxy-arp-route search

    Network 10.5.25.0 is remote, then it will actually appear to be an "outside" network so I think you need this statement to begin "nat (outside, outside).

  • LT2P configuration vpn cisco asa with the internet machine windows/mac issue

    Dear all,

    I have properly configured configuration vpn L2TP on asa 5510 with 8.0 (4) version of IOS.

    My internet does not work when I connect using the vpn. Even if I give power of attorney or dns or I remove the proxy

    It does not work. only the resources behind the firewall, I can access. I use the extended access list

    I tried also with the standard access list.

    Please please suggest what error might be.

    Thank you

    JV

    Split for L2TP over IPSec tunnel tunnel is not configured on the head end (ASA), it must be configured on the client itself, in accordance with the following Microsoft article:

    http://TechNet.Microsoft.com/en-us/library/bb878117.aspx

  • Cisco ASA 5510 - Cisco Client can connect to the VPN but cannot Ping!

    Hello

    I have an ASA 5510 with the configuration below. I have configure the ASA as vpn server for remote access with cisco vpn client, now my problem is that I can connect but I can not ping.

    Config

    ciscoasa # sh run

    : Saved

    :

    ASA Version 8.0 (3)

    !

    ciscoasa hostname

    activate the 5QB4svsHoIHxXpF password / encrypted

    names of

    xxx.xxx.xxx.xxx SAP_router_IP_on_SAP name

    xxx.xxx.xxx.xxx ISA_Server_second_external_IP name

    xxx.xxx.xxx.xxx name Mail_Server

    xxx.xxx.xxx.xxx IncomingIP name

    xxx.xxx.xxx.xxx SAP name

    xxx.xxx.xxx.xxx Web server name

    xxx.xxx.xxx.xxx cms_eservices_projects_sharepointold name

    isa_server_outside name 192.168.2.2

    !

    interface Ethernet0/0

    nameif outside

    security-level 0

    address IP IncomingIP 255.255.255.248

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    IP 192.168.2.1 255.255.255.0

    !

    interface Ethernet0/2

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Ethernet0/3

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Management0/0

    nameif management

    security-level 100

    IP 192.168.1.253 255.255.255.0

    management only

    !

    passwd 123

    passive FTP mode

    clock timezone IS 2

    clock summer-time EEDT recurring last Sun Mar 03:00 last Sun Oct 04:00

    TCP_8081 tcp service object-group

    EQ port 8081 object

    DM_INLINE_TCP_1 tcp service object-group

    EQ port 3389 object

    port-object eq ftp

    port-object eq www

    EQ object of the https port

    EQ smtp port object

    EQ Port pop3 object

    port-object eq 3200

    port-object eq 3300

    port-object eq 3600

    port-object eq 3299

    port-object eq 3390

    EQ port 50000 object

    port-object eq 3396

    port-object eq 3397

    port-object eq 3398

    port-object eq imap4

    EQ port 587 object

    port-object eq 993

    port-object eq 8000

    EQ port 8443 object

    port-object eq telnet

    port-object eq 3901

    purpose of group TCP_8081

    EQ port 1433 object

    port-object eq 3391

    port-object eq 3399

    EQ object of port 8080

    EQ port 3128 object

    port-object eq 3900

    port-object eq 3902

    port-object eq 7777

    port-object eq 3392

    port-object eq 3393

    port-object eq 3394

    Equalizer object port 3395

    port-object eq 92

    port-object eq 91

    port-object eq 3206

    port-object eq 8001

    EQ port 8181 object

    object-port 7778 eq

    port-object eq 8180

    port-object 22222 eq

    port-object eq 11001

    port-object eq 11002

    port-object eq 1555

    port-object eq 2223

    port-object eq 2224

    object-group service RDP - tcp

    EQ port 3389 object

    3901 tcp service object-group

    3901 description

    port-object eq 3901

    object-group service tcp 50000

    50000 description

    EQ port 50000 object

    Enable_Transparent_Tunneling_UDP udp service object-group

    port-object eq 4500

    access-list connection to SAP Note inside_access_in

    inside_access_in to access extended list ip 192.168.2.0 allow 255.255.255.0 host SAP_router_IP_on_SAP

    access-list inside_access_in note outgoing VPN - PPTP

    inside_access_in list extended access permitted tcp 192.168.2.0 255.255.255.0 any eq pptp

    access-list inside_access_in note outgoing VPN - GRE

    inside_access_in list extended access allow accord 192.168.2.0 255.255.255.0 any

    Comment from inside_access_in-list of access VPN - GRE

    inside_access_in list extended access will permit a full

    access-list inside_access_in note outgoing VPN - Client IKE

    inside_access_in list extended access permitted udp 192.168.2.0 255.255.255.0 any isakmp eq

    Comment of access outgoing VPN - IPSecNAT - inside_access_in-list T

    inside_access_in list extended access permitted udp 192.168.2.0 255.255.255.0 any eq 4500

    Note to inside_access_in of outgoing DNS list access

    inside_access_in list extended access udp allowed any any eq field

    Note to inside_access_in of outgoing DNS list access

    inside_access_in list extended access permit tcp any any eq field

    Note to inside_access_in to access list carried forward Ports

    inside_access_in list extended access permitted tcp 192.168.2.0 255.255.255.0 any DM_INLINE_TCP_1 object-group

    access extensive list ip 172.16.1.0 inside_access_in allow 255.255.255.0 any

    outside_access_in of access allowed any ip an extended list

    outside_access_in list extended access permit tcp any any eq pptp

    outside_access_in list extended access will permit a full

    outside_access_in list extended access allowed grateful if any host Mail_Server

    outside_access_in list extended access permit tcp any host Mail_Server eq pptp

    outside_access_in list extended access allow esp a whole

    outside_access_in ah allowed extended access list a whole

    outside_access_in list extended access udp allowed any any eq isakmp

    outside_access_in list of permitted udp access all all Enable_Transparent_Tunneling_UDP object-group

    list of access allowed standard VPN 192.168.2.0 255.255.255.0

    corp_vpn to access extended list ip 192.168.2.0 allow 255.255.255.0 172.16.1.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Outside 1500 MTU

    Within 1500 MTU

    management of MTU 1500

    pool POOL 172.16.1.10 - 172.16.1.20 255.255.255.0 IP mask

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 603.bin

    don't allow no asdm history

    ARP timeout 14400

    NAT-control

    Global (outside) 2 Mail_Server netmask 255.0.0.0

    Global 1 interface (outside)

    Global interface (2 inside)

    NAT (inside) 0-list of access corp_vpn

    NAT (inside) 1 0.0.0.0 0.0.0.0

    static (inside, outside) tcp Mail_Server 8001 8001 ISA_Server_second_external_IP netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server 8000 ISA_Server_second_external_IP 8000 netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server pptp pptp netmask 255.255.255.255 isa_server_outside

    public static tcp (indoor, outdoor) Mail_Server smtp smtp isa_server_outside mask 255.255.255.255 subnet

    static (inside, outside) tcp 587 Mail_Server isa_server_outside 587 netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server 9444 isa_server_outside 9444 netmask 255.255.255.255

    static (inside, outside) tcp 9443 Mail_Server 9443 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp 3389 3389 netmask 255.255.255.255 isa_server_outside Mail_Server

    static (inside, outside) tcp 3390 Mail_Server 3390 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp Mail_Server 3901 isa_server_outside 3901 netmask 255.255.255.255

    static (inside, outside) tcp SAP 50000 50000 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp SAP 3200 3200 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) SAP 3299 isa_server_outside 3299 netmask 255.255.255.255 tcp

    static (inside, outside) tcp Mail_Server www isa_server_outside www netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server https isa_server_outside https netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server pop3 pop3 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp imap4 Mail_Server imap4 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp cms_eservices_projects_sharepointold 9999 9999 netmask 255.255.255.255 isa_server_outside

    public static 192.168.2.0 (inside, outside) - corp_vpn access list

    Access-group outside_access_in in interface outside

    inside_access_in access to the interface inside group

    Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout, uauth 0:05:00 absolute

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 192.168.2.0 255.255.255.0 inside

    http 192.168.1.0 255.255.255.0 management

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp - esp-md5-hmac transet

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto-map dynamic dynmap 10 set pfs

    Crypto-map dynamic dynmap 10 transform-set ESP-3DES-SHA transet

    cryptomap 10 card crypto ipsec-isakmp dynamic dynmap

    cryptomap interface card crypto outside

    crypto isakmp identity address

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    md5 hash

    Group 2

    life 86400

    crypto ISAKMP policy 30

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    No encryption isakmp nat-traversal

    Telnet 192.168.2.0 255.255.255.0 inside

    Telnet 192.168.1.0 255.255.255.0 management

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    dhcpd dns xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx interface inside

    dhcpd domain.local domain inside interface

    !

    a basic threat threat detection

    host of statistical threat detection

    Statistics-list of access threat detection

    Management Server TFTP 192.168.1.123.

    internal group mypolicy strategy

    mypolicy group policy attributes

    Split-tunnel-policy tunnelspecified

    Split-tunnel-network-list value VPN

    Pseudo vpdn password 123

    vpdn username attributes

    VPN-group-policy mypolicy

    type of remote access service

    type mypolicy tunnel-group remote access

    tunnel-group mypolicy General attributes

    address-pool

    strategy-group-by default mypolicy

    tunnel-group mypolicy ipsec-attributes

    pre-shared-key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    inspect the pptp

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:b8bb19b6cb05cfa9ee125ad7bc5444ac

    : end

    Thank you very much.

    Hello

    You probably need

    Policy-map global_policy

    class inspection_default

    inspect the icmp

    inspect the icmp error

    Your Tunnel of Split and NAT0 configurations seem to.

    -Jouni

  • Install two the separate IPSec VPNS on ASA 5505

    Hello

    I'll have set up a second tunnel IPSec VPN on my Cisco ASA 5505 to another office.  I was able to configure one without problem through the ASDM, but were not able to get the second.

    The IPSec tunnel connects to a WRVS4400N router to the other office.  I tried the debug crypto isakmp and ipsec crypto, but I get nothing.  Here is the config.  Something seems wrong on my end?   I've also attached a screenshot of the configuration settings on the remote router.

    Output of the command: "show run".

    : Saved
    :
    ASA Version 8.2 (5)
    !
    hostname WayneASA

    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP 70.91.18.205 255.255.255.252
    !
    interface Vlan5
    Shutdown
    No nameif
    security-level 50
    IP 192.168.10.1 255.255.255.0
    !
    passive FTP mode
    clock timezone IS - 5
    clock to summer time EDT recurring
    DNS lookup field inside
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    75.75.75.75 server name
    75.75.76.76 server name
    domain 3gtms.com
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    inside_access_in of access allowed any ip an extended list
    IPSec_Access to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
    inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.224
    inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
    inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
    TunnelSplit1 list standard access allowed 192.168.10.0 255.255.255.224
    TunnelSplit1 list standard access allowed 192.168.1.0 255.255.255.0
    outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
    outside_2_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
    outside_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
    RemoteTunnel_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
    RemoteTunnel_splitTunnelAcl_1 list standard access allowed 192.168.1.0 255.255.255.0

    pager lines 24
    Enable logging
    Within 1500 MTU
    Outside 1500 MTU
    IP mask 255.255.255.224 local pool VPNPool 192.168.10.1 - 192.168.10.30
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 0-list of access inside_nat0
    NAT (inside) 1 0.0.0.0 0.0.0.0

    inside_access_in access to the interface inside group
    Access-group out_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 70.91.18.206 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    the ssh LOCAL console AAA authentication
    Enable http server
    http 0.0.0.0 0.0.0.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    Crypto ipsec transform-set esp-3des esp-md5-hmac VPNTransformSet
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto IPSec_map 1 corresponds to the address IPSec_Access
    card crypto IPSec_map 1 set peer 50.199.234.229
    card crypto IPSec_map 1 the transform-set VPNTransformSet value
    card crypto IPSec_map 2 corresponds to the address outside_2_cryptomap
    card crypto IPSec_map 2 set pfs Group1
    card crypto IPSec_map 2 set peer 98.101.139.210
    card crypto IPSec_map 2 the transform-set VPNTransformSet value
    card crypto IPSec_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
    IPSec_map interface card crypto outside
    card crypto outside_map 1 match address outside_1_cryptomap
    peer set card crypto outside_map 1 50.199.234.229

    crypto ISAKMP allow outside
    crypto ISAKMP policy 1
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 43200
    Telnet 192.168.1.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 inside
    SSH timeout 60
    Console timeout 0
    management-access inside
    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.100 - 192.168.1.199 inside
    dhcpd dns 75.75.75.75 75.75.76.76 interface inside
    dhcpd allow inside
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    internal RemoteTunnel group strategy
    attributes of Group Policy RemoteTunnel
    value of server DNS 75.75.75.75 75.75.76.76
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list RemoteTunnel_splitTunnelAcl_1
    3gtms.com value by default-field
    eric 0vcSd5J/TLsFy7nU password user name encrypted privilege 15
    username password encrypted URsSXKLozQMSeCBk privilege 5 lestofts
    username lestofts attributes
    type of remote access service
    algobel lBWy5eNbHMCDPzuL encrypted password username
    username algobel attributes
    type of remote access service
    type tunnel-group RemoteTunnel remote access
    attributes global-tunnel-group RemoteTunnel
    address pool VPNPool
    Group Policy - by default-RemoteTunnel
    IPSec-attributes tunnel-group RemoteTunnel
    pre-shared key *.
    tunnel-group 50.199.234.229 type ipsec-l2l
    IPSec-attributes tunnel-group 50.199.234.229
    pre-shared key *.
    tunnel-group 98.101.139.210 type ipsec-l2l
    IPSec-attributes tunnel-group 98.101.139.210
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the icmp
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the dns
    inspect the pptp
    inspect the sip
    !
    global service-policy global_policy
    context of prompt hostname
    anonymous reporting remote call
    Cryptochecksum:a86adc4b23977672679b6fb72d0bc187
    : end

    You are also missing the NAT0 rule

    inside_nat0 to access extended list ip 192.168.2.0 allow 255.255.255.0 192.168.5.0 255.255.255.0

    -Jouni

  • Remote access VPN with ASA 5510 by using the DHCP server

    Hello

    Can someone please share your knowledge to help me find out why I'm not able to receive an IP address on the remote access VPN connection so that I can get an IP local pool DHCP?

    I'm trying to set up remote access VPN with ASA 5510. It works with dhcp local pool but does not seem to work when I tried to use an existing DHCP server. It is tested in an internal network as follows:

    !

    ASA Version 8.2 (5)

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    IP 10.6.0.12 255.255.254.0

    !

    IP local pool testpool 10.6.240.150 - 10.6.240.159 a mask of 255.255.248.0. (worked with it)

    !

    Route inside 0.0.0.0 0.0.0.0 10.6.0.1 1

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Crypto-map dynamic dyn1 1jeu transform-set FirstSet

    dynamic mymap 1 dyn1 ipsec-isakmp crypto map

    mymap map crypto inside interface

    crypto ISAKMP allow inside

    crypto ISAKMP policy 1

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 43200

    !

    VPN-addr-assign aaa

    VPN-addr-assign dhcp

    !

    internal group testgroup strategy

    testgroup group policy attributes

    DHCP-network-scope 10.6.192.1

    enable IPSec-udp

    IPSec-udp-port 10000

    !

    username testlay password * encrypted

    !

    tunnel-group testgroup type remote access

    tunnel-group testgroup General attributes

    strategy-group-by default testgroup

    DHCP-server 10.6.20.3

    testgroup group tunnel ipsec-attributes

    pre-shared key *.

    !

    I got following output when I test connect to the ASA with Cisco VPN client 5.0

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: (4) SA (1) + KE + NUNCIO (10) + ID (5), HDR + VENDO

    4024 bytesR copied in 3,41 0 seconds (1341 by(tes/sec) 13) of the SELLER (13) seller (13) + the SELLER (13), as well as the SELLER (13) ++ (0) NONE total length: 853

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, SA payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ISA_KE

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, nonce payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received xauth V6 VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, DPD received VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received Fragmentation VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received NAT-Traversal worm 02 VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, the customer has received Cisco Unity VID

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, connection landed on tunnel_group testgroup

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA payload processing

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA proposal # 1, turn # 9 entry overall IKE acceptable matches # 1

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build the payloads of ISAKMP security

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building ke payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building nonce payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for answering machine...

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of payload ID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of Cisco Unity VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing payload V6 VID xauth

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building dpd vid payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing the payload of the NAT-Traversal VID ver 02

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of Fragmentation VID + load useful functionality

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, send Altiga/Cisco VPN3000/Cisco ASA GW VID

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR SA (1) KE (4) NUNCIO (10) + ID (5) + HASH (8) + SELLER (13) + the SELLER (13) + the SELLER (13) + the SELLER (13) NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) total length: 440

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + HASH (8) + NOTIFY (11) + NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) overall length: 168

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, useful treatment IOS/PIX Vendor ID (version: 1.0.0 capabilities: 00000408)

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, the customer has received Cisco Unity VID

    Jan 16 15:39:21 [IKEv1]: Group = testgroup, I

    [OK]

    KenS-mgmt-012 # P = 10.15.200.108, status of automatic NAT detection: remote end is NOT behind a NAT device this end is NOT behind a NAT device

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 72

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 87

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, transformation MODE_CFG response attributes.

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = authorized

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = authorized

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized primary WINS

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized secondary WINS

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Compression IP = disabled

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling political = disabled

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: setting Proxy browser = no - modify

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: browser Local Proxy bypass = disable

    Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, (testlay) the authenticated user.

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 64

    Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + NONE (0) overall length: 60

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cfg ACK processing attributes

    Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 49ae1bb8) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 182

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, treatment cfg request attributes

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 address!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 network mask!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for DNS server address.

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the address of the WINS server.

    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, transaction mode attribute unhandled received: 5

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the banner!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting save PW!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: receipt of request for default domain name!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for Split-Tunnel list!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for split DNS!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for PFS setting!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Proxy Client browser setting!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the list of backup peer ip - sec!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting disconnect from the Client Smartcard Removal!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Version of the Application.

    Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Type of Client: Windows NT Client Application Version: 5.0.07.0440

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for FWTYPE!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: request received for the DHCP for DDNS hostname is: DEC20128!

    Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the UDP Port!

    Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

    Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = b04e830f) with payloads: HDR + HASH (8) + NOTIFY (11) + (0) NONE total length: 84

    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload

    Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload

    Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets.  No last packet retransmit.

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE has received the response from type [] at the request of the utility of IP address

    Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cannot get an IP address for the remote peer

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE TM V6 WSF (struct & 0xd8030048) , : TM_DONE, EV_ERROR--> TM_BLD_REPLY, EV_IP_FAIL--> TM_BLD_REPLY NullEvent--> TM_BLD_REPLY, EV_GET_IP--> TM_BLD_REPLY, EV_NEED_IP--> TM_WAIT_REQ, EV_PROC_MSG--> TM_WAIT_REQ, EV_HASH_OK--> TM_WAIT_REQ, NullEvent

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE AM Responder WSF (struct & 0xd82b6740) , : AM_DONE, EV_ERROR--> AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL--> AM_TM_INIT_MODECFG_V6H NullEvent--> AM_TM_INIT_MODECFG, EV_WAIT--> AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG--> AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK--> AM_TM_INIT_XAUTH_V6H NullEvent--> AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b ending: 0x0945c001, refcnt flags 0, tuncnt 0

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending clear/delete with the message of reason

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing the payload to delete IKE

    Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm

    Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 9de30522) with payloads: HDR HASH (8) + DELETE (12) + (0) NONE total length: 80

    Kind regards

    Lay

    For the RADIUS, you need a definition of server-aaa:

    Protocol AAA - NPS RADIUS server RADIUS

    AAA-server RADIUS NPS (inside) host 10.10.18.12

    key *.

    authentication port 1812

    accounting-port 1813

    and tell your tunnel-group for this server:

    General-attributes of VPN Tunnel-group

    Group-NPS LOCAL RADIUS authentication server

    --
    Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
    http://www.Kiva.org/invitedBy/karsteni

  • Convert the VPN Site-to-Site of PIX to ASA 8.2

    I worked on the conversion of a config above a PIX an ASA 8.2 but I am running into trouble with the site to site vpn. The PIX has a VPN client and site to site. Given that some of the configs for the cross from site to site on the VPN client I'm confuse. Any help would be apperciated.

    Below are excerpts from just the PIX VPN related orders.

    permit access ip 192.168.0.0 list Remote_splitTunnelAcl 255.255.0.0 any

    inside_outbound_nat0_acl ip access list allow any 192.168.0.160 255.255.255.240

    inside_outbound_nat0_acl Zenoss_OS CNP 255.255.255.0 ip host allowed access list

    inside_outbound_nat0_acl SilverBack NOC 255.255.255.0 ip host allowed access list

    inside_outbound_nat0_acl allowed host NOC 255.255.255.0 enoss_Hardware ip access-list

    outside_cryptomap_dyn_20 ip access list allow any 192.168.0.160 255.255.255.240

    outside_cryptomap_20 Zenoss_OS CNP 255.255.255.0 ip host allowed access list

    outside_cryptomap_20 SilverBack NOC 255.255.255.0 ip host allowed access list

    outside_cryptomap_20 Zenoss_Hardware CNP 255.255.255.0 ip host allowed access list

    IP pool local DHCP_Pool 192.168.0.161 - 192.168.0.174

    NAT (inside) 0-list of access inside_outbound_nat0_acl

    Sysopt connection permit VPN

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Dynamic crypto map outside_dyn_map 20 match address outside_cryptomap_dyn_20

    Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-DES-MD5 value

    outside_map 20 ipsec-isakmp crypto map

    card crypto outside_map 20 match address outside_cryptomap_20

    card crypto outside_map 20 peers set 205.x.29.41

    outside_map crypto 20 card value transform-set ESP-DES-SHA

    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

    client authentication card crypto outside_map LOCAL

    outside_map interface card crypto outside

    ISAKMP allows outside

    ISAKMP key address 205.x.29.41 netmask 255.255.255.255 No.-xauth-config-mode no.

    ISAKMP nat-traversal 180

    part of pre authentication ISAKMP policy 20

    encryption of ISAKMP policy 20

    ISAKMP policy 20 md5 hash

    20 2 ISAKMP policy group

    ISAKMP duration strategy of life 20 86400

    part of pre authentication ISAKMP policy 40

    encryption of ISAKMP policy 40

    ISAKMP policy 40 sha hash

    40 2 ISAKMP policy group

    ISAKMP duration strategy of life 40 86400

    vpngroup address pool DHCP_Pool GHA_Remote

    vpngroup dns 192.168.0.11 server GHA_Remote

    vpngroup wins 192.168.0.11 GHA_Remote-Server

    vpngroup GHA_Remote by default-field x.org

    vpngroup split tunnel Remote_splitTunnelAcl GHA_Remote

    vpngroup idle 1800 GHA_Remote-time

    vpngroup password KEY GHA_Remote

    I guess what I really wonder is if someone can convert the version of site to site of this VPN ASA 8.2 config so I can compare it to what I have. I need to have this, so I can just fall into place and work.

    Also, it does appear that political isakmp 40 are used, correct?

    On your ASA in Setup mode, simply type vpnsetup steps for remote access ipsec or vpnsetup site - not and it lists what it takes or you can download the PIX of the ASA migration tool.

Maybe you are looking for