No NAT (vmnet-broken natd(8)) DNS

Similar Questions

• NAT traversal broken after upgrade to 7.04

  We had the work of nat crossing very well on our PIX

  Bundle of 515e run worm 6.3.4

  For ah, esp, iskmp, in the port udp 500.

  crossing of nat enabled. Sysopt permit-ipsec.

  behind the pix, users can estrablish vpn connections, but traffic does not pass. users can establish vpn & pass traffic very well when they are in front of the pix. Users connect to different devices vpn as we have no control or access to

  Hi Eric,.

  If I understand correctly, the error only occurs for users behind your pix for an upgrade to 704?

  Check if the following statements are present in your pix config:

  ISAKMP nat-traversal 20

  ISAKMP ipsec-over-tcp port 10000

  ISAKMP allows outside

  Also, the error can occur because of some missing list access for users behind the pix.

  HTH

  Mike

• How do I restart services (NAT) vmnet with reboot 'everything '.

  Hello

  I'm unable to determine how to restart just the services involved in vmnet8 (NAT) for /etc/vmware/vmnet8/nat/nat.conf changes can take effect.  I've got other guests running and it looks (reason to upgrade?) unreasonable to have to stop all clients and restart vmware via /etc/init.d/vmware reboot.  My reason is the addition of a NAT device would have guest OS and I wish the portability forward to get SSH access.  I see nothing in the new interface server 2.x.x web admin to stop and start services NAT/vmnet8.  I googled for zero results about 1.5 hours.  Any ideas?  I am running 2.0.2 on host CentOS 5.x.

  Thank you

  George

  Try the following which should restart all services network for vmnet8 (NAT):

   /usr/lib/vmware/net-services.sh restart 8
  

  --

  If you have found this device or any other answer useful please consider the use of buttons useful or Correct to award points.

• NAT problem

  Hi Experts,

  One of my office have Cisco ASA 5510 with ios 8.4 (5). Everything is configured and works very well except the static NAT. I have a public IP block, I used to set up static NAT.  The internal server that is configured with the static NAT does not receive internet or anything. When I removed the static NAT, the internet is to learn (with the WAN IP interface). The server is placed in the DMZ. I left the server but it does not work.

  Kind regards

  MARTIN

  Hello

  In your case the configuration format static NAT for the server would be

  network of the object

  This would bind the local IP address of the public IP configured on the command "nat" . This means that outgoing connections would also use this public IP address. If you had a static configuration similar PAT already then you wouldn't really need that UNLESS you change the mapped/local port in the "nat" command.

  But set up static NAT would mean already that he would cancel the PAT Dynamics for outbound connections from this server. Naturally, there is a small chance according to your current configuration of NAT complete even this static NAT can be overridden, but I doubt it. If the above "packet - trace" is intended for the DMZ server in question then there should be no problem.

  -Jouni

• NAT and host only networking

  Hi all

  I have a configuration is to behave in what I believe is a strange way and I hope that someone can confirm this behavior is correct or I have something misconfigured.

  I am simulating 2 sites connected by a WAN to test the configuration of the software.  To do this, I set up 2 Win Server 2003 virtual computers as of the routers, with the result 3 networks.  Common to these two virtual machines (WAN) network is configured on the NAT VMnet.  The other 2 networks/VMnets (LAN) are Hostonly.

  After you add the network adapters and IP configuration, I did a quick ping test to a virtual computer to another and the results are confusing me.  Routing had not been configured on each virtual machine, but I couldn't ping from one virtual computer through the other opposite 'LAN' IP.  Monitoring LAN port while rattling revealed that the source for the ping IP address belonged to the host for the VMnet LAN adapter.  Think that the strange behavior, I've reconfigured the Wan to be Hostonly, and I couldn't ping from one VM through the other until the network has been configured on the virtual machines.

  To playback of VMWare Server user guide, it seems to me that NAT must not automatically route traffic between VMnets.

  So the question is, is VMWare behave properly and I interpret how the virtual network must function properly?  Or is VMWare strange behaviour and I just have to be aware of this?

  Thanks for the help.

  Bingo.

  The host knows the routes to all your virtual networks, because he is a member of all networks. Remove the virtual network for both adapter LAN you created, then they change 'host-only"to"guests only ".

  AWo

  VCP 3 & 4

  \[:o]===\[o:]

  = You want to have this ad as a ringtone on your mobile phone? =

  = Send 'Assignment' to 911 for only $999999,99! =

• run the Web server in vmware

  Hello
  I run the Web server in the os(xp pro) host and now I want to run the Web server in the guest operating system
  I put things in the host operating system, follow
  router setting page (shared ip settings page)
  1 DHCP using OFF
  2 DMZ host server using on 192.168.10.201
  3. setting of virtual server 192.168.10.201 port TCP port internal external port 81 81
  TCP/IP
  1 use the following IP 192.168.10.201
  2 gateway 192.168.10.1
  3. the DNS settings of
  4. on the Advanced tab > Internet connection sharing > VMware Network Adapter VMnet 8
  for now, when someone tries to access my WAN IP then page host server is apear (from external network)
  If I stop server Web host then cannot access my WAN IP

  and in VMware, I put the (Windows XP Pro)
  TCP/IP configuration
  1 use the following IP 192.168.88.201
  2. default gateway 192.168.88.2
  3. the DNS settings of
  4. click the guest OS tab and click Edit > virtual network editor > NAT VMnet host is VMnet8
  5. setting NAT > Port forwarding > Add >: host port 81 machine virtual ip address 192.168.88.201 port 81
  and at the moment access to 192.168.88.201 in the guest operating system is ok the page is apear
  but nothing is apear when try and access my WAN IP external network and if I start it the host Web server then the host page is apear that im is not the intention of
  How can I make the Web server of the guest to access other networks operating system?
  in the guest operating system, I can access Web server of the customer by access 192.168.10.201
  but I can't access Web server of the client by typing host operating system access the 192.168.10.201
  any ideas? My version of vmware's vmware-workstation - 6.5.2 for windows

  Hi Teayun,

  Thanks for visiting the site of the community of Microsoft Windows XP. The question you have posted is related to VMware and would be better suited to the VMware or TechNet community. Please visit the link below to find a community that will support what ask you

  http://www.VMware.com/support/
  http://TechNet.Microsoft.com/en-us/default.aspx Shawn - Support Engineer - MCP, MCDST
  Microsoft Answers Support Engineer
  Visit our Microsoft answers feedback Forum and let us know what you think

• Host computer cannot see do not comment

  I worked on it for a few days and just can't get this to work! Would appreciate any help!

  I have a host computer that running Windows 7 Professional 64 bit. It is the output of an ipconfig/all command from the host:

  Windows IP configuration

  Name of the host...: NIPPON

  Primary Dns suffix...:

  Node... type: hybrid

  Active... IP routing: No.

  Active... proxy WINS: No.

  Ethernet connection to the Local network card:

  The connection-specific DNS suffix. :

  ... Description: 82578DC Intel(r) Gigabit network connection

  Physical address.... : 90-FB-A6-2D-FF-83

  DHCP active...: Yes

  Autoconfiguration enabled...: Yes

  Address IPv6 local link...: fe80::2434:b02:bae7:1786% 10 (Preferred)

  IPv4 address: 192.168.0.13 (Preferred)

  ... Subnet mask: 255.255.255.0.

  Lease obtained...: Wednesday, January 22, 2014 10:18:52

  End of the lease...: Thursday, January 23, 2014 10:18:51

  ... Default gateway. : 192.168.0.1.

  DHCP server...: 192.168.0.1.

  DHCPv6 IOOKING...: 194050982

  DHCPv6 DUID customer...: 00-01-00-01-1A-59-65-69-90-FB-A6-2D-FF-83

  DNS servers...: 205.171.3.65

  205.171.2.65

  NetBIOS over TCP/IP...: enabled

  Ethernet VMware Network adapter adapt VMnet1:

  The connection-specific DNS suffix. :

  ... Description: VMware Virtual Ethernet adapt for VMnet1

  Physical address.... : 00-50-56-C0-00-01

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  Address IPv6 local link...: fe80::ecba:3513:52 1 b: 56cb % 24 (Preferred)

  IPv4 address: 192.168.80.1 (Preferred)

  ... Subnet mask: 255.255.255.0.

  ... Default gateway. :

  DHCPv6 IOOKING...: 402673750

  DHCPv6 DUID customer...: 00-01-00-01-1A-59-65-69-90-FB-A6-2D-FF-83

  DNS servers: fec0:0:0:ffff:1 1%

  FEC0:0:0:FFFF:2 1%

  FEC0:0:0:FFFF:3 1%

  NetBIOS over TCP/IP...: enabled

  Ethernet VMware Network adapter adapt VMnet8:

  The connection-specific DNS suffix. :

  ... Description: VMware Virtual Ethernet adapt for VMnet8

  Physical address.... : 00-50-56-C0-00-08

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  Address IPv6 local link...: fe80::dca0:aab:6ffb:f57b % 26 (Preferred)

  IPv4 address...: 192.168.126.1 (Preferred)

  ... Subnet mask: 255.255.255.0.

  ... Default gateway. :

  DHCPv6 IOOKING...: 436228182

  DHCPv6 DUID customer...: 00-01-00-01-1A-59-65-69-90-FB-A6-2D-FF-83

  DNS servers: fec0:0:0:ffff:1 1%

  FEC0:0:0:FFFF:2 1%

  FEC0:0:0:FFFF:3 1%

  NetBIOS over TCP/IP...: enabled

  Tunnel adapter isatap. {80A45D7C-0F1D-4270-83DC-B03014CF06A1}:

  State of the media...: Media disconnected

  The connection-specific DNS suffix. :

  ... Description: Microsoft ISATAP adapter

  Physical address.... : 00-00-00-00-00-00-00-E0

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  Card tunnel Local Area Connection * 11:

  State of the media...: Media disconnected

  The connection-specific DNS suffix. :

  ... Description: Teredo Tunneling Pseudo-Interface

  Physical address.... : 00-00-00-00-00-00-00-E0

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  Tunnel adapter isatap. {1A1757EC-DE43-460C-B319-F51AAFB47459}:

  State of the media...: Media disconnected

  The connection-specific DNS suffix. :

  ... Description: Adapter Microsoft ISATAP #3

  Physical address.... : 00-00-00-00-00-00-00-E0

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  Tunnel adapter isatap. {085C8798-E738-445A-9C94-6F36332D1FE4}:

  State of the media...: Media disconnected

  The connection-specific DNS suffix. :

  ... Description: Adapter Microsoft ISATAP #4

  Physical address.... : 00-00-00-00-00-00-00-E0

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  It is the output of a command prompt ipconfig/all:

  Windows IP configuration

  Name of the host...: SharePointVMWare

  Primary Dns suffix...:

  Node... type: hybrid

  Active... IP routing: No.

  Active... proxy WINS: No.

  Ethernet connection to the Local network card:

  The connection-specific DNS suffix. :

  ... Description: Intel(r) PRO/1000 MT Network Connection

  Physical address.... : 00-0C-29-0C-67-84

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  IPv4 address: 192.168.0.15 (Preferred)

  ... Subnet mask: 255.255.255.0.

  ... Default gateway. : 192.168.0.1.

  DNS servers...: 205.171.3.65

  205.171.2.65

  NetBIOS over TCP/IP...: enabled

  Tunnel adapter isatap. {023D1021-75E5-4509-84F8-50C6525F1751}:

  State of the media...: Media disconnected

  The connection-specific DNS suffix. :

  ... Description: Microsoft ISATAP adapter

  Physical address.... : 00-00-00-00-00-00-00-E0

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  Card tunnel Local Area Connection * 9:

  The connection-specific DNS suffix. :

  ... Description: Teredo Tunneling Pseudo-Interface

  Physical address.... : 00-00-00-00-00-00-00-E0

  DHCP active...: No.

  Autoconfiguration enabled...: Yes

  IPv6 address: 2001:0:9 d 38:90 d 7: 468:a90:b823:fde5 (Prefer

  Red)

  Address IPv6 local link...: fe80::468:a90:b823:fde5% 13 (Preferred)

  ... Default gateway. : ::

  NetBIOS over TCP/IP...: disabled

  The host adapter is running in bridged mode. I am able to ping and see the guest host, but not vice versa. I tried NAT, VMNet, etc, but nothing seems to work.

  Any ideas would be greatly appreciated!

  Please don't mind asking me, but you have disabled firewall to the client. He is one who, by default, to block ping (ICMP) traffic in more recent versions of Windows.

  André

• Problem with the VPN site to site for the two cisco asa 5505

  Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

  Cisco Config asa1

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 172.xxx.xx.4 255.255.240.0
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.60.2 255.255.255.0
  !
  passive FTP mode
  network of the Lan_Outside object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
  network of the Lan_Outside object
  NAT (inside, outside) interface dynamic dns
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.60.0 255.255.255.0 inside
  http 96.xx.xx.222 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 96.88.75.222
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  inside access management

  dhcpd address 192.168.60.50 - 192.168.60.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_96.xx.xx.222 group strategy
  attributes of Group Policy GroupPolicy_96.xx.xx.222
  VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 96.xx.xx.222 type ipsec-l2l
  tunnel-group 96.xx.xx.222 General-attributes
  Group - default policy - GroupPolicy_96.xx.xx.222
  96.XX.XX.222 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error

  ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

  Cisco ASA 2 config

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 96.xx.xx.222 255.255.255.248
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.1.254 255.255.255.0
  !
  passive FTP mode
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  network of the Lan_Outside object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_4
  ip protocol object
  icmp protocol object
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
  !
  network of the Lan_Outside object
  dynamic NAT (all, outside) interface
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  http 172.xxx.xx.4 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 172.110.74.4
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0

  dhcpd address 192.168.1.50 - 192.168.1.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_172.xxx.xx.4 group strategy
  attributes of Group Policy GroupPolicy_172.xxx.xx.4
  L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 172.xxx.xx.4 type ipsec-l2l
  tunnel-group 172.xxx.xx.4 General-attributes
  Group - default policy - GroupPolicy_172.xxx.xx.4
  172.xxx.XX.4 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error
  inspect the http

  For IKEv2 configuration: (example config, you can change to encryption, group,...)

  -You must add the declaration of exemption nat (see previous answer).

  -set your encryption domain ACLs:

  access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

  -Set the Phase 1:

  Crypto ikev2 allow outside
  IKEv2 crypto policy 10
  3des encryption
  the sha md5 integrity
  Group 5
  FRP sha
  second life 86400

  -Set the Phase 2:

  Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
  Esp aes encryption protocol
  Esp integrity sha-1 protocol

  -set the Group of tunnel

  tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
  REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
  IKEv2 authentication remote pre-shared-key cisco123

  
  IKEv2 authentication local pre-shared-key cisco123

  -Define the encryption card

  address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
  card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
  card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
  CRYPTOMAP interface card crypto outside
  crypto isakmp identity address

  On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

  Thank you

• ASA 5505. VPN Site-to-Site does not connect!

  Hello!
  Already more than a week there, as we had a new channel of communication of MGTSa (Ontario terminal Sercomm RV6688BCM, who barely made in the 'bridge' - had to do the provider in order to receive our white Cisco Ip address), and now I train as well more that one week to raise between our IKEv1 IPsec Site-to-Site VPN tunnel closes offices.
  Configurable and use the wizard in ASDM and handles in the CLI, the result of a year, the connection does not rise.
  Cisco version 9.2 (2), the image of the Cisco asa922 - k8.bin, Security Plus license version, version 7.2 AMPS (2).
  What I'll never know...
  Debugging and complete configuration enclose below.
  Help, which can follow any responses, please! I was completely exhausted!

  Config:

  Output of the command: "sh run".

  : Saved
  :
  : Serial: XXXXXXXXXXXX
  : Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor
  :
  ASA Version 9.2 (2)
  !
  hostname door-71
  activate the encrypted password of F6OJ0GOws7WHxeql
  names of
  IP local pool vpnpool 10.1.72.100 - 10.1.72.120 mask 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 10.1.72.254 255.255.255.0
  !
  interface Vlan2
  nameif outside_mgts
  security-level 0
  62.112.100.R1 255.255.255.252 IP address
  !
  passive FTP mode
  clock timezone 3 MSK/MSD
  clock to DST MSK/MDD recurring last Sun Mar 02:00 last Sun Oct 03:00
  DNS lookup field inside
  DNS server-group MGTS
  Server name 195.34.31.50
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  network of the NET72 object
  10.1.72.0 subnet 255.255.255.0
  network object obj - 0.0.0.0
  host 0.0.0.0
  network of the Nafanya object
  Home 10.1.72.5
  network object obj - 10.1.72.0
  10.1.72.0 subnet 255.255.255.0
  network of the NET61 object
  10.1.61.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_10.1.72.96_27 object
  subnet 10.1.72.96 255.255.255.224
  network of the NETT72 object
  10.1.72.0 subnet 255.255.255.0
  network of the NET30 object
  10.1.30.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_10.1.72.0_24 object
  10.1.72.0 subnet 255.255.255.0
  object-group service OG INET
  the purpose of the echo icmp message service
  response to echo icmp service object
  service-object icmp traceroute
  service-object unreachable icmp
  service-purpose tcp - udp destination eq echo
  the DM_INLINE_NETWORK_1 object-group network
  network-object NET30
  network-object, object NET72
  DM_INLINE_TCP_1 tcp service object-group
  port-object eq www
  EQ object of the https port
  inside_access_in extended access list permit ip object NET72 object-group DM_INLINE_NETWORK_1
  access extensive list ip 10.1.72.0 inside_access_in allow 255.255.255.0 any
  inside_access_in extended access list permit ip object Nafanya any idle state
  inside_access_in list extended access allowed object-group OG INET an entire
  inside_access_in of access allowed any ip an extended list
  inside_access_in list extended access deny ip any alerts on any newspaper
  outside_mgts_access_in list extended access allowed object-group OG INET an entire
  outside_mgts_access_in list extended access permit tcp any any DM_INLINE_TCP_1 object-group
  outside_mgts_access_in list extended access deny ip any alerts on any newspaper
  access extensive list ip 10.1.72.0 outside_mgts_cryptomap allow 255.255.255.0 object NET61
  VPN-ST_splitTunnelAcl permit 10.1.72.0 access list standard 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  outside_mgts MTU 1500
  IP check path reverse interface outside_mgts
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside outside_mgts) static source NET72 NET72 NETWORK_OBJ_10.1.72.96_27 NETWORK_OBJ_10.1.72.96_27 non-proxy-arp-search of route static destination
  NAT (inside outside_mgts) static source NETWORK_OBJ_10.1.72.0_24 NETWORK_OBJ_10.1.72.0_24 NET61 NET61 non-proxy-arp-search of route static destination
  !
  network obj_any object
  NAT (inside outside_mgts) dynamic obj - 0.0.0.0
  network of the NET72 object
  NAT (inside outside_mgts) interface dynamic dns
  inside_access_in access to the interface inside group
  Access-group outside_mgts_access_in in the outside_mgts interface
  Route 0.0.0.0 outside_mgts 0.0.0.0 62.112.100.R 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  without activating the user identity
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  the ssh LOCAL console AAA authentication
  Enable http server
  http 10.1.72.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  card crypto outside_mgts_map 1 match address outside_mgts_cryptomap
  card crypto outside_mgts_map 1 set pfs Group1
  peer set card crypto outside_mgts_map 1 91.188.180.42
  card crypto outside_mgts_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_mgts_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  card crypto outside_mgts_map interface outside_mgts
  inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  inside crypto map inside_map interface
  Crypto ca trustpoint ASDM_TrustPoint0
  registration auto
  E-mail [email protected] / * /
  name of the object CN = door-71
  Serial number
  IP address 62.112.100.42
  Proxy-loc-transmitter
  Configure CRL
  Crypto ca trustpoint ASDM_TrustPoint1
  registration auto
  ASDM_TrustPoint1 key pair
  Configure CRL
  trustpool crypto ca policy
  string encryption ca ASDM_TrustPoint0 certificates
  certificate eff26954
  30820395 3082027d a0030201 020204ef f2695430 0d06092a 864886f7 0d 010105
  019
  6460ae26 ec5f301d 0603551d 0e041604 14c9a3f2 d70e6789 38fa4b01 465d 1964
  60ae26ec 5f300d06 092 has 8648 01050500 03820101 00448753 7baa5c77 86f70d01
  62857b 65 d05dc91e 3edfabc6 7b3771af bbedee14 673ec67d 3d0c2de4 b7a7ac05
  5f203a8c 98ab52cf 076401e5 1a2c6cb9 3f7afcba 52c617a5 644ece10 d6e1fd7d
  28b57d8c aaf49023 2037527e 9fcfa218 9883191f 60b221bf a561f2be d6882091
  0222b7a3 3880d6ac 49328d1f 2e085b15 6d1c1141 5f850e5c b6cb3e67 0e373591
  94a 82781 44493217 and 38097952 d 003 5552 5c445f1f 92f04039 a23fba20 b9d51b13
  f511f311 d1feb2bb 6d056a15 7e63cc1b 1f134677 8124c 024 3af56b97 51af8253
  486844bc b1954abe 8acd7108 5e4212df db835d76 98ffdb2b 8c8ab915 193b 8167
  0db3dd54 c8346b96 c4f4eff7 1e7cd576 a8b1f86e 3b868a6e 89
  quit smoking
  string encryption ca ASDM_TrustPoint1 certificates
  certificate a39a2b54
  3082025f 30820377 a0030201 020204 has 3 9a2b5430 0d06092a 864886f7 0d 010105
  0500304 06035504 03130767 36313137 30120603 55040513 6174652d 3110300e b
     
  c084dcd9 d250e194 abcb3eb8 1da93bd0 fb0dba1a b1c35b43 d547a841 5d4ee1a4
  14bdb207 7dd790a4 0cd 70471 5f3a896a 07bd56dc ea01b3dd 254cde88 e1490e97
  f3e54c05 551adde0 66aa3782 c85880c2 b162ec29 4e49346a df71062d 6d6d8f49
  62b9de93 ba07b4f7 a50e77e1 8f54b32b 6627cb27 e982b36f a 362973, 0 88de3272
  9bd6d4d2 8ca1e11f 214f20a9 78bdea95 78fdc45c d6d45674 6acb9bcb d0bd930e
  638eedfe cd559ab1 e1205c48 3ee9616f e631db55 e82b623c 434ffdc1 11020301
  0001 has 363 3061300f 0603551d 130101ff 0101ff30 04053003 0e060355 1d0f0101
  ff040403 1f060355 02018630 230418 30168014 0cea70bf 0d0e0c4b eb34a0b1 1 d
  8242 has 549 0603 551d0e04 1604140c ea70bf0d 0e0c4beb 34a0b182 301D 5183ccf9
  42a 54951 010105 05000382 0101004e 7bfe054a 0d 864886f7 0d06092a 83ccf930
  d434a27c 1d3dce15 529bdc5f 70a2dff1 98975de9 2a97333b 96077966 05a8e9ef
  bf320cbd ecec3819 ade20a86 9aeb5bde bd129c7b 29341e4b edf91473 f2bf235d
  9aaeae21 a629ccc6 3c79200b b9a89b08 bf38afb6 ea56b957 4430f692 a 4745, 411
  34d71fad 588e4e18 2b2d97af b2aae6b9 b6a22350 d031615b 49ea9b9f 2fdd82e6
  ebd4dccd df93c17e deceb796 f268abf1 881409b 5 89183841 f484f0e7 bd5f7b69
  ebf7481c faf69d3e 9d24df6e 9c2b0791 785019f7 a0d20e95 2ef35799 66ffc819
  4a77cdf2 c6fb4380 fe94c13c d4261655 7bf3d6ba 6289dc8b f9aad4e1 bd918fb7
  32916fe1 477666ab c2a3d591 a84dd435 51711f6e 93e2bd84 89884c
  quit smoking
  crypto isakmp identity address
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 activate outside_mgts port 443 customer service
  Crypto ikev2 access remote trustpoint ASDM_TrustPoint0
  Crypto ikev1 allow inside
  Crypto ikev1 enable outside_mgts
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  without ssh stricthostkeycheck
  SSH 10.1.72.0 255.255.255.0 inside
  SSH timeout 60
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  vpnclient Server 91.188.180.X
  vpnclient mode network-extension-mode
  vpnclient nem-st-autoconnect
  VPN - L2L vpnclient vpngroup password *.
  vpnclient username aradetskayaL password *.
  dhcpd auto_config outside_mgts
  !
  dhcpd update dns replace all two interface inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL-trust ASDM_TrustPoint0 inside point
  SSL-trust ASDM_TrustPoint0 outside_mgts point
  WebVPN
  Select outside_mgts
  internal GroupPolicy_91.188.180.X group strategy
  attributes of Group Policy GroupPolicy_91.188.180.X
  Ikev1 VPN-tunnel-Protocol
  internal group VPN - ST strategy
  attributes of group VPN - ST policy
  value of 195.34.31.50 DNS Server 8.8.8.8
  Ikev1 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value VPN-ST_splitTunnelAcl
  by default no
  aradetskayaL encrypted HR3qeva85hzXT6KK privilege 15 password username
  tunnel-group 91.188.180.X type ipsec-l2l
  attributes global-tunnel-group 91.188.180.X
  Group - default policy - GroupPolicy_91.188.180.42
  IPSec-attributes tunnel-group 91.188.180.X
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  remotely IKEv2 authentication certificate
  pre-shared-key authentication local IKEv2 *.
  remote access to tunnel-group VPN - ST type
  VPN-general ST-attributes tunnel-group
  address vpnpool pool
  Group Policy - by default-VPN-ST
  tunnel-group ipsec VPN ST-attributes
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:212e4f5035793d1c219fed57751983d8
  : end

  door-71 # sh crypto ikev1 his

  There are no SAs IKEv1

  door-71 # sh crypto ikev2 his

  There are no SAs IKEv2

  door-71 # sh crypto ipsec his

  
  There is no ipsec security associations
  door-71 # sh crypto isakmp

  There are no SAs IKEv1

  There are no SAs IKEv2

  Global statistics IKEv1
  The active Tunnels: 0
  Previous Tunnels: 0
  In bytes: 0
  In the packages: 0
  In packs of fall: 0
  In Notifys: 0
  In the constituencies of P2: 0
  In P2 invalid Exchange: 0
  In P2 Exchange rejects: 0
  Requests for removal in his P2: 0
  Bytes: 0
  Package: 0
  Fall packages: 0
  NOTIFYs out: 0

  
  Exchanges of P2: 0
  The Invalides Exchange P2: 0
  Exchange of P2 rejects: 0
  Requests to remove on P2 Sa: 0
  Tunnels of the initiator: 0
  Initiator fails: 0
  Answering machine fails: 0
  Ability system breaks down: 0
  AUTH failed: 0
  Decrypt failed: 0
  Valid hash fails: 0
  No failure his: 0

  IKEV1 statistics for Admission appeals
  In negotiating SAs Max: 25
  In negotiating SAs: 0
  In negotiating SAs Highwater: 0
  In negotiating SAs rejected: 0

  Global statistics IKEv2
  The active Tunnels: 0
  Previous Tunnels: 0
  In bytes: 0
  In the packages: 0
  In packs of fall: 0
  In Fragments of fall: 0
  In Notifys: 0
  In Exchange for the P2: 0
  In P2 invalid Exchange: 0
  In P2 Exchange rejects: 0
  In IPSEC delete: 0
  In delete IKE: 0
  Bytes: 0
  Package: 0
  Fall packages: 0
  Fragments of fall: 0
  NOTIFYs out: 0
  Exchange of P2: 0
  The Invalides Exchange P2: 0
  Exchange of P2 rejects: 0
  On IPSEC delete: 0
  The IKE Delete: 0
  Locally launched sAs: 0
  Locally launched sAs failed: 0
  SAs remotely initiated: 0
  SAs remotely initiated failed: 0
  System capacity: 0
  Authentication failures: 0
  Decrypt failures: 0
  Hash failures: 0
  Invalid SPI: 0
  In the Configs: 0
  Configs: 0
  In the Configs rejects: 0
  Configs rejects: 0
  Previous Tunnels: 0
  Previous Tunnels wraps: 0
  In the DPD Messages: 0
  The DPD Messages: 0
  The NAT KeepAlive: 0
  IKE recomposition launched locally: 0
  IKE returned to the remote initiated key: 0
  Generate a new key CHILD initiated locally: 0
  CHILD given to the remote initiated key: 0

  IKEV2 statistics for Admission appeals
  Max active SAs: no limit
  Max in negotiating SAs: 50
  Challenge cookie line: never
  Active sAs: 0
  In negotiating SAs: 0
  Incoming requests: 0
  Accepted incoming requests: 0
  A rejected incoming requests: 0
  Out of requests: 0
  Out of the applications accepted: 0
  The outgoing rejected requests: 0
  A rejected queries: 0
  Rejected at the SA: 0 Max limit
  Rejected low resources: 0
  Rejected the current reboot: 0
  Challenges of cookie: 0
  Cookies transmitted challenges: 0
  Challenges of cookie failed: 0

  IKEv1 global IPSec over TCP statistics
  --------------------------------
  Embryonic connections: 0
  Active connections: 0
  Previous connections: 0
  Incoming packets: 0
  Inbound packets ignored: 0
  Outgoing packets: 0
  Outbound packets ignored: 0
  The RST packets: 0
  Heartbeat Recevied ACK packets: 0
  Bad headers: 0
  Bad trailers: 0
  Chess timer: 0
  Checksum errors: 0
  Internal error: 0

   
  door-71 # sh statistical protocol all cryptographic
  [Statistics IKEv1]
  Encrypt packets of requests: 0
  Encapsulate packets of requests: 0
  Decrypt packets of requests: 0
  Decapsulating requests for package: 0
  HMAC calculation queries: 0
  ITS creation queries: 0
  SA asked to generate a new key: 0
  Deletion requests: 0
  Next phase of allocation key applications: 0
  Number of random generation queries: 0
  Failed requests: 0
  [Statistics IKEv2]
  Encrypt packets of requests: 0
  Encapsulate packets of requests: 0
  Decrypt packets of requests: 0
  Decapsulating requests for package: 0
  HMAC calculation queries: 0
  ITS creation queries: 0
  SA asked to generate a new key: 0
  Deletion requests: 0
  Next phase of allocation key applications: 0
  Number of random generation queries: 0
  Failed requests: 0
  [IPsec statistics]
  Encrypt packets of requests: 0
  Encapsulate packets of requests: 0
  Decrypt packets of requests: 0
  Decapsulating requests for package: 0
  HMAC calculation queries: 0
  
  ITS creation queries: 0
  SA asked to generate a new key: 0
  Deletion requests: 0
  Next phase of allocation key applications: 0
  Number of random generation queries: 0
  Failed requests: 0
  [SSL statistics]
  Encrypt packets of queries: 19331
  Encapsulate packets of queries: 19331
  Decrypt packets of queries: 437
  Package requests decapsulating: 437
  HMAC calculation queries: 19768
  ITS creation queries: 178
  SA asked to generate a new key: 0
  Requests to remove SA: 176
  Next phase of allocation key applications: 0
  Number of random generation queries: 0
  Failed requests: 0
  [Statistical SSH are not taken in charge]
  [Statistics SRTP]
  Encrypt packets of requests: 0
  Encapsulate packets of requests: 0
  Decrypt packets of requests: 0
  Decapsulating requests for package: 0
  HMAC calculation queries: 0
  ITS creation queries: 0
  SA asked to generate a new key: 0
  Deletion requests: 0
  Next phase of allocation key applications: 0
  Number of random generation queries: 0
  Failed requests: 0
  [Statistics]
  Encrypt packets of requests: 0
  Encapsulate packets of requests: 0
  Decrypt packets of requests: 0
  Decapsulating requests for package: 0
  HMAC calculation queries: 6238
  ITS creation queries: 0
  SA asked to generate a new key: 0
  Deletion requests: 0
  Next phase of allocation key applications: 0
  Number of queries random generation: 76
  Failure of queries: 9

  door-71 # sh crypto ca trustpoints

  Trustpoint ASDM_TrustPoint0:
  Configured for the production of a self-signed certificate.

  Trustpoint ASDM_TrustPoint1:
  Configured for the production of a self-signed certificate.

  If you need something more, then spread!
  Please explain why it is that I don't want to work?

  Hello

  When the IPSEC tunnel does not come to the top, the first thing comes to my mind is to run a tracer of package from the CLI and the phases in it. Please run this command from your firewall side and share the output. I've just compiled this command with the random ip address and ports of your given range.

  Packet-trace entry inside tcp 10.1.72.2 1233 10.1.61.2 443 detailed

  Best regards

  Amandine

• Customers unable to browse the internet on the router from Cisco 871 K9

  Hello world

  "I just bought my Version of K9 Cisco router 871 running this flash system image: c870-advsecurityk9 - mz.124 - 4.T8.bin".

  I am trying to configure this router for home use, while I can block a part of Web traffic (porn sites, sites of films because of the children), but I realized that I was unable to apply the access list Match-class version url (http host).

  My major problem is still the base of the router config. WAN has a DHCP IP assignment with the 192.168.1.0 network

  The Lan is supposed to have 192.168.3.0 network. IP addresses seem to be properly attributed but not able to ping on the internet router. Local client also cannot resolve DNS. Here is my cofig file.

  Please help.

  Richard #sh run
  Building configuration...

  Current configuration: 1727 bytes
  !
  version 12.4
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  host Richard name
  !
  boot-start-marker
  boot-end-marker
  !
  !
  No aaa new-model
  !
  resources policy
  !
  IP subnet zero
  IP cef
  No dhcp use connected vrf ip
  !
  IP dhcp pool Richard pool
  import all
  network 192.168.3.0 255.255.255.0
  default router 192.168.3.1
  domain richardedet.com
  192.168.1.1 DNS server
  Rental 2 0
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  interface FastEthernet0
  spanning tree portfast
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  !
  interface FastEthernet4
  DHCP IP address
  Check IP unicast accessible source - via rx allow by default 100
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NAT outside IP
  IP virtual-reassembly
  automatic speed
  full-duplex
  !
  interface Vlan1
  Description Local network VLAN
  address 192.168.3.1 IP 255.255.255.0
  !
  IP classless
  IP route 0.0.0.0 0.0.0.0 FastEthernet4
  IP route 192.168.3.0 FastEthernet4 255.255.255.0
  !
  no ip address of the http server
  no ip http secure server
  overload of IP nat inside source list 101 interface FastEthernet4
  IP nat inside source map route RMAP-NAT interface FastEthernet4 overload
  The dns server IP
  !
  recording of debug trap
  recording ease Committee.2
  access-list 100 permit udp any any eq bootpc
  access-list 100 permit tcp any one
  access-list 100 permit icmp any one
  access-list 101 permit ip 192.168.3.0 0.0.0.255 any
  !
  control plan
  !
  !
  Line con 0
  richard password
  opening of session
  no activation of the modem
  telnet output transport
  line to 0
  richard password
  opening of session
  telnet output transport
  line vty 0 3
  richard password
  opening of session
  entry ssh transport
  line vty 4
  richard password
  opening of session
  !
  max-task-time 5000 Planner
  end

  Hello

  problem is that you have changed the IP address of the interface VLAN 1 from 192.168.1.254 to 192.168.1.1
  If you need to change by default-router dhcp pool:
  Select conf t
  Richard-Edet dhcp IP pool
  no default router
  default router 192.168.1.1
  end

  NAT is also missing:
  Enable
  conf t
  IP access-list standard NAT
  permit 192.168.1.0 0.0.0.255
  output
  IP nat inside source list NAT interface SA4 overload
  end

  Also perhaps you cannot ping the router console PC because the computer's firewall blocks the ICMP protocol. In windows, I'm sure he is blocked by the firewall. Then you can try ping 192.168.1.1 from the PC and it should work.

  Try above changes and then write me if it works, or so we can make other changes.
  You can also post the output of the commands (if this will not work):
  router: ip road show
  router: ping 8.8.8.8 (it should work if your internet provider doesn´t blocks the ICMP protocol)
  PC: ipconfig/all

• Move connections VPN Site to Site of new interface

  Hello

  We have 2 VPN tunnels from site to site in our Organization - two remote sites to connect to the firewall even at our headquarters. All 3 firewalls are only asa5510 running code 8.4.

  We want to have the VPN tunnel separated from general traffic internet access/surfing the web. I'm going through the tunnels of the current interface on our head office to a new interface firewall. I thought that this should be pretty easy - change the IP addresses of the peers and make sure I have a static routing entry set so that VPN tunnel traffic leaves the correct interface, but I'm having a terrible time. I've been using the ASDM interface and I think that may be the source of my problem.

  Can anyone confirm that I want to (move only the VPN tunnels to e0 e0/0/2) is indeed possible? Any help on the current configuration would be greatly appreciated as well.

  Thank you!
  Greg

  HEAD OFFICE firewall

  interface Ethernet0/0

  Speed 100

  full duplex

  nameif outside

  security-level 0

  IP address 207.x.x.122 255.255.255.248

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  IP 192.168.1.254 255.255.255.0

  !

  interface Ethernet0/2

  link Internet Description for all tunnel traffic

  Speed 100

  full duplex

  nameif VPN_outside

  security-level 0

  IP address 206.y.y.202 255.255.255.248

  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  network object obj - 192.168.1.0
  subnet 192.168.1.0 255.255.255.0
  network object obj - 192.168.10.0
  192.168.10.0 subnet 255.255.254.0
  network object obj - 192.168.4.0
  subnet 192.168.4.0 255.255.254.0
  network object obj - 192.168.100.0
  255.255.255.0 subnet 192.168.100.0
  network object obj - 192.168.30.0
  192.168.30.0 subnet 255.255.254.0
  network object obj - 192.168.40.0
  192.168.40.0 subnet 255.255.254.0
  network object obj - 192.168.250.0
  192.168.250.0 subnet 255.255.254.0
  network of the Massey-Data object
  192.168.80.0 subnet 255.255.255.0
  the object Massey-voice network
  192.168.86.0 subnet 255.255.255.0
  network of the Stratford-Data object
  192.168.70.0 subnet 255.255.255.0

  the Massey_Traffic object-group network
  network-object Massey-Data
  network-object Massey-voice
  the Stone_Traffic object-group network
  network-object object obj - 192.168.1.0
  network-object object obj - 192.168.10.0
  network-object object obj - 192.168.30.0
  network-object object obj - 192.168.40.0
  network-object object obj - 192.168.100.0
  network-object object obj - 192.168.250.0
  network-object object obj - 192.168.4.0
  the Stratford_Traffic object-group network
  Stratford-Data Network-object

  VPN_outside_access_out of access allowed any ip an extended list

  outside_stratford list extended access permitted ip object-group Stone_Traffic-group of objects Stratford_Traffic

  global_mpc of access allowed any ip an extended list

  outside_massey list extended access permitted ip object-group Stone_Traffic-group of objects Massey_Traffic

  NAT (inside, outside) static source Stone_Traffic Stone_Traffic Massey_Traffic Massey_Traffic non-proxy-arp-search of route static destination

  NAT (inside, outside) static source Stone_Traffic Stone_Traffic Stratford_Traffic Stratford_Traffic non-proxy-arp-search of route static destination

  !

  network obj_any object

  NAT (inside, outside) interface dynamic dns

  Access-group outside_access_out outside interface

  Access-group interface inside inside_access_out

  Access-group interface VPN_outside VPN_outside_access_out

  Route outside 0.0.0.0 0.0.0.0 207.x.x.121 1

  Route 0.0.0.0 VPN_outside 0.0.0.0 206.y.y.201 10

  Route inside 192.168.4.0 255.255.254.0 192.168.1.252 1

  Route inside 192.168.10.0 255.255.254.0 192.168.1.252 1

  Route inside the 192.168.30.0 255.255.254.0 192.168.1.252 1

  Route inside 192.168.40.0 255.255.254.0 192.168.1.252 1

  Route inside 192.168.100.0 255.255.255.0 192.168.1.252 1

  Route inside the 192.168.250.0 255.255.254.0 192.168.1.252 1

  Crypto ipsec ikev2 AES256 ipsec-proposal

  Protocol esp encryption aes-256

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 ipsec-proposal AES192

  Protocol esp encryption aes-192

  Esp integrity sha - 1, md5 Protocol

  Crypto ipsec ikev2 ipsec-proposal AES

  Esp aes encryption protocol

  Esp integrity sha - 1, md5 Protocol

  card crypto outside_map 1 match address outside_stratford

  card crypto outside_map 1 set 207.a.a.4 counterpart

  outside_map map 1 set ikev2 proposal ipsec crypto AES

  outside_map map 1 lifetime of security association set seconds 28800 crypto

  card crypto outside_map 1 set security-association life kilobytes 4608000

  card crypto outside_map 2 match address outside_massey

  card crypto outside_map 2 peers set 206.b.b.186

  outside_map map 2 set AES AES192 AES256 ipsec-proposal ikev2 crypto

  outside_map interface card crypto outside

  tunnel-group 207.a.a.4 type ipsec-l2l

  tunnel-group 207.a.a.4 General-attributes

  strategy-group-by default DfltGrpPolicy-Stratford

  207.a.a.4 group of tunnel ipsec-attributes

  IKEv1 pre-shared-key *.

  remote control-IKEv2 pre-shared-key authentication *.

  pre-shared-key authentication local IKEv2 *.

  tunnel-group 206.b.b.186 type ipsec-l2l

  206.b.b.186 tunnel ipsec-attributes group

  remote control-IKEv2 pre-shared-key authentication *.

  pre-shared-key authentication local IKEv2 *.

  IKEv2 crypto policy 1

  aes encryption

  integrity sha

  Group 2

  FRP sha

  second life 86400

  IKEv2 crypto policy 10

  aes encryption

  the md5 integrity

  Group 2

  FRP md5

  second life 86400

  Crypto ikev2 allow outside

  RemoteSite 1

  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Corvette of crypto card 1 is the VPNtraffic address
  card crypto corvette 1 counterpart set 207.x.x.122
  card 1 set ikev2 proposal ipsec crypto AES Corvette
  corvette interface card crypto outside

  NAT (inside, outside) static source Stratford_Traffic Stratford_Traffic Stone_Traffic Stone_Traffic non-proxy-arp-search of route static destination

  No encryption isakmp nat-traversal
  IKEv2 crypto policy 1
  aes encryption
  integrity sha
  Group 2
  FRP sha
  second life 86400
  Crypto ikev2 allow outside

  type tunnel-group StratfordVPN remote access
  attributes global-tunnel-group StratfordVPN
  Group Policy - by default-StratfordPolicy
  tunnel-group StratfordVPN webvpn-attributes
  enable Stratford group-alias
  tunnel-group 207.x.x.122 type ipsec-l2l
  tunnel-group 207.x.x.122 General-attributes
  Group Policy - by default-StratfordPolicy
  207.x.x.122 group of tunnel ipsec-attributes
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.

  Your basic approach is on the right track. I think you have a problem of routing so.

  I see your external routes configuration with:

  Route outside 0.0.0.0 0.0.0.0 207.x.x.121 1

  Route 0.0.0.0 VPN_outside 0.0.0.0 206.y.y.201 10

  Not being more accurate, which would force the ASA to route traffic for your VPN peer on the (longer metric!) VPN_Outside the interface eth0/2?

  I would put a 32 road for each of your remote in place as counterparts:

  Route VPN_outside 255.255.255.255 206.y.y.201

• Problem VPN ASA 5505 8.3 (1) a site

  Hello

  My problem is with VPN site-to-site. It's between ASA5505 8.3 (1) and Pix 501 6.3 (5). The tunnel is created between them and it's good, here you have the results to see the crypto ipsec's and isakmp his

  ciscoasa # sh crypto isakmp his

  ITS enabled: 1

  Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

  Total SA IKE: 1

  1 peer IKE: 91.X.X.57

  Type: L2L role: initiator

  Generate a new key: no State: MM_ACTIVE

  ciscoasa # sh crypto ipsec his

  Interface: outside

  Tag crypto map: outside_map, seq num: 1, local addr: 79.X.X.2

  list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

  local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.11.0/255.255.255.0/0/0)

  current_peer: 91.X.X.57

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 3757, #pkts decrypt: 3757, #pkts check: 3757

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0

  success #frag before: 0, failures before #frag: 0, #fragments created: 0

  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0

  #send errors: 0, #recv errors: 0

  local crypto endpt. : 79.X.X.2/0, remote Start crypto. : 91.X.X.57/0

  Path mtu 1500, fresh ipsec generals 74, media, mtu 1500

  current outbound SPI: F1C2FD46

  current inbound SPI: 1BCF8C49

  SAS of the esp on arrival:

  SPI: 0x1BCF8C49 (466586697)

  transform: aes-256-esp esp-md5-hmac no compression

  running parameters = {L2L, Tunnel}

  slot: 0, id_conn: 376832, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (4373665/20348)

  Size IV: 16 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0xFFFFFFFF to 0xFFFFFFFF

  outgoing esp sas:

  SPI: 0xF1C2FD46 (4056087878)

  transform: aes-256-esp esp-md5-hmac no compression

  running parameters = {L2L, Tunnel}

  slot: 0, id_conn: 376832, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (4374000/20348)

  Size IV: 16 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0x00000000 0x00000001

  But the problem is, as you can see in a show crypto ipsec sa, there is now traffic to a remote network of ASA

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  I have a single device on the remote network sends data to a sysloger on the local network and it works fine, all received messages but not other way to traffic.

  To make sure that I go see the Nat and packet - trace entry inside tcp 192.168.10.7 1024 192.168.11.250 80 and looks like SHEEP works very well and traffic is allowed, but still once anything gets into the tunnel of local network

  Results

  ciscoasa # sh nat

  Manual NAT policies (Section 1)

  1 (one) to (all) source static sheep sheep sheep destination static sheep

  translate_hits = 0, untranslate_hits = 38770

  2 (inside) for the service public static obj - the source (on the outside) TCP1433 TCP1433 79.X.X.5 192.168.10.7

  translate_hits = 0, untranslate_hits = 95

  3 (inside) to the source (external) static obj - 192.168.10.7 interface service zzz zzz

  translate_hits = 0, untranslate_hits = 19

  4 (inside) of the (whole) source static obj - 10.0.0.0 obj - 10.0.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

  translate_hits = 17, untranslate_hits = 0

  5 (inside) of the (whole) source static obj - obj - static 192.168.10.0 192.168.10.0 obj - obj-destination 10.1.1.1 10.1.1.1

  translate_hits = 134, untranslate_hits = 0

  6 (inside) to the (whole) source static obj - 10.1.1.1 obj - 10.1.1.1 destination static obj - 192.168.10.0 obj - 192.168.10.0

  translate_hits = 0, untranslate_hits = 0

  7 (inside) of the (whole) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

  translate_hits = 172, untranslate_hits = 53

  Auto NAT policies (Section 2)

  1 (inside) (outside) source static obj - 192.168.10.3 service TCP 3389 3389 79.X.X.5

  translate_hits = 12, untranslate_hits = 4823

  2 (inside) (outside) source static obj - 192.168.10.5 79.X.X.3 DNS

  translate_hits = 341869, untranslate_hits = 41531

  3 (inside) (outside) source static obj - 192.168.10.3 - 01 79.X.X.5 service TCP 444 444

  translate_hits = 0, untranslate_hits = 0

  4 (inside) to the source (external) static obj - 192.168.10.7 tcp 3389 3389 service interface

  translate_hits = 21, untranslate_hits = 751

  5 (inside) (outside) source static obj - 192.168.10.7 - 02 interface tcp 8080 https service

  translate_hits = 0, untranslate_hits = 100

  6 (inside) (outside) source static obj - 192.168.10.11 79.X.X.5 TCP smtp smtp service

  translate_hits = 2, untranslate_hits = 18838

  7 (inside) (outside) source static obj - 192.168.10.11 - 01 udp 443 443 service 79.X.X.5

  translate_hits = 0, untranslate_hits = 0

  8 (inside) (outside) source static obj - 192.168.10.11 - 02 79.X.X.5 tcp https https service

  translate_hits = 221, untranslate_hits = 9770

  9 (inside) (outside) source static obj - 192.168.10.11 - 03 79.X.X.5 tcp https https service

  translate_hits = 0, untranslate_hits = 0

  10 (inside) (outside) source static obj - 192.168.10.15 79.X.X.5 service tcp www 81

  translate_hits = 0, untranslate_hits = 34

  11 (inside) (outside) source static obj - 192.168.10.26 79.X.X.5 service TCP 8080 8080

  translate_hits = 9, untranslate_hits = 4407

  12 (inside) (outside) source static obj - 192.168.10.26 - 01 79.X.X.5 tcp 8080 www service

  translate_hits = 0, untranslate_hits = 578

  13 (inside) (outside) source static obj - 192.168.10.220 79.X.X.6 service TCP 3389 3389

  translate_hits = 0, untranslate_hits = 41

  14 (inside) (outside) source static obj - 192.168.10.220 - 1 79.X.X.6 tcp https https service

  translate_hits = 0, untranslate_hits = 3

  15 (inside) to the obj_any interface dynamic source (external)

  translate_hits = 410005, untranslate_hits = 144489

  16 (invited) to dynamic interface of the source (outside) obj_any-01

  translate_hits = 19712, untranslate_hits = 4490

  ciscoasa # packet - trace entry inside tcp 192.168.10.7 1024 192.168.11.250 80

  Phase: 1

  Type: UN - NAT

  Subtype: static

  Result: ALLOW

  Config:

  NAT (any, any) source static sheep sheep sheep destination static sheep

  Additional information:

  NAT divert on exit to the outside interface

  Untranslate 192.168.11.250/80 to 192.168.11.250/80

  Phase: 2

  Type: ACCESS-LIST

  Subtype: Journal

  Result: ALLOW

  Config:

  Access-group inside_out in interface inside

  access-list extended inside_out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd9886ae8, priority = 13, area = allowed, deny = false

  hits = 18503, user_data = 0xd6581290, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

  IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

  IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  input_ifc = output_ifc = any to inside,

  Phase: 3

  Type: IP-OPTIONS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd80c87c8, priority = 0, sector = inspect-ip-options, deny = true

  hits = 1047092, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

  IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

  input_ifc = output_ifc = any to inside,

  Phase: 4

  Type: NAT

  Subtype:

  Result: ALLOW

  Config:

  NAT (any, any) source static sheep sheep sheep destination static sheep

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd9859830, priority = 6, area = nat, deny = false

  hits = 2107, user_data = 0xd83a9b48, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

  IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

  IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  input_ifc = none, output_ifc = any

  Phase: 5

  Type: HOST-LIMIT

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd8114d98, priority = 0, domain = host-limit, deny = false

  hits = 674350, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

  IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

  input_ifc = output_ifc = any to inside,

  Phase: 6

  Type: VPN

  Subtype: encrypt

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd83a9960, priority = 70, domain = encrypt, deny = false

  hits = 26732, user_data = 0xce165c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol

  IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

  IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  input_ifc = none, output_ifc = external

  Phase: 7

  Type: NAT

  Subtype: rpf check

  Result: ALLOW

  Config:

  NAT (any, any) source static sheep sheep sheep destination static sheep

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd98d1d70, priority = 6, area = nat-reversed, deny = false

  hits = 1419, user_data = 0xd83a9b48, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

  IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0

  IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  input_ifc = none, output_ifc = any

  Phase: 8

  Type: VPN

  Subtype: ipsec-tunnel-flow

  Result: ALLOW

  Config:

  Additional information:

  Reverse flow from returns search rule:

  ID = 0xd9bda388, priority = 69 = ipsec-tunnel-flow area, deny = false

  hits = 486, user_data is 0x13492cc, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  IP/ID=192.168.11.0 SRC, mask is 255.255.255.0, port = 0

  IP/ID=192.168.10.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  input_ifc = out, output_ifc = any

  Phase: 9

  Type: IP-OPTIONS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Reverse flow from returns search rule:

  ID = 0xd8192ab0, priority = 0, sector = inspect-ip-options, deny = true

  hits = 1169899, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  IP/ID=0.0.0.0 SRC, mask is 0.0.0.0, port = 0

  IP/ID=0.0.0.0 DST, mask is 0.0.0.0, port = 0, dscp = 0 x 0

  input_ifc = out, output_ifc = any

  Phase: 10

  Type: CREATING STREAMS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  New workflow created with the 1293619 id, package sent to the next module

  Information module for forward flow...

  snp_fp_tracer_drop

  snp_fp_inspect_ip_options

  snp_fp_tcp_normalizer

  snp_fp_translate

  snp_fp_adjacency

  snp_fp_encrypt

  snp_fp_fragment

  snp_ifc_stat

  Information for reverse flow...

  snp_fp_tracer_drop

  snp_fp_inspect_ip_options

  snp_fp_ipsec_tunnel_flow

  snp_fp_translate

  snp_fp_tcp_normalizer

  snp_fp_adjacency

  snp_fp_fragment

  snp_ifc_stat

  Result:

  input interface: inside

  entry status: to the top

  entry-line-status: to the top

  output interface: outside

  the status of the output: to the top

  output-line-status: to the top

  Action: allow

  It is a complete config for ASA

  VPN

  Network local 192.168.10.0/24

  remote network 192.168.11.0/24

  Config

  :

  ASA Version 8.3 (1)

  !

  ciscoasa hostname

  domain.com domain name

  activate the password * encrypted

  passwd * encrypted

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.10.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 79.X.X.2 255.255.255.248

  !

  interface Vlan12

  prior to interface Vlan1

  nameif comments

  security-level 80

  192.168.4.1 IP address 255.255.255.0

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  switchport access vlan 2

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  switchport access vlan 12

  !

  boot system Disk0: / asa831 - k8.bin

  passive FTP mode

  clock timezone GMT/UTC 0

  summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS server-group DefaultDNS

  Server name 192.168.10.11

  domain.com domain name

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  network object obj - 192.168.0.0

  Subnet 192.168.0.0 255.255.0.0

  network object obj - 192.168.2.0

  Subnet 192.168.2.0 255.255.255.128

  network object obj - 10.0.0.0

  subnet 10.0.0.0 255.0.0.0

  network object obj - 192.168.10.2

  host 192.168.10.2

  network object obj - 192.168.10.2 - 01

  host 192.168.10.2

  network object obj - 192.168.10.3

  host 192.168.10.3

  network object obj - 192.168.10.2 - 02

  host 192.168.10.2

  network object obj - 192.168.10.2 - 03

  host 192.168.10.2

  network object obj - 192.168.10.3 - 01

  Home 192.168.10.7

  network object obj - 192.168.10.5

  host 192.168.10.5

  newserver network object

  Home 192.168.10.7

  New SQL Server description

  network object obj - 192.168.10.7

  Home 192.168.10.7

  network of the A_79.X.X.6 object

  Home 79.X.X.6

  network of the PublicServer_NAT1 object

  Home 192.168.10.7

  zzz service object

  service source eq 1 65535 udp syslog destination range

  Syslog description

  purpose of the 79.X.X.5 network

  Home 79.X.X.5

  service of the TCP1433 object

  destination service tcp source eq 1433 1 65535 range

  Description TCP1433

  network object obj - 192.168.10.220

  Home 192.168.10.220

  network object obj - 192.168.10.220 - 1

  Home 192.168.10.220

  network object obj - 192.168.10.222

  Home 192.168.10.222

  network object obj - 192.168.10.2 - 04

  host 192.168.10.2

  network object obj - 192.168.10.7 - 02

  Home 192.168.10.7

  network object obj - 192.168.10.11

  Home 192.168.10.11

  network object obj - 192.168.10.11 - 01

  Home 192.168.10.11

  network object obj - 192.168.10.11 - 02

  Home 192.168.10.11

  network object obj - 192.168.10.11 - 03

  Home 192.168.10.11

  network object obj - 192.168.10.26

  Home 192.168.10.26

  network object obj - 192.168.10.26 - 01

  Home 192.168.10.26

  network object obj - 192.168.10.15

  Home 192.168.10.15

  network object obj - 192.168.10.11 - 04

  Home 192.168.10.11

  network object obj - 10.1.1.1

  host 10.1.1.1

  network object obj - 192.168.10.0

  192.168.10.0 subnet 255.255.255.0

  network object obj - 192.168.10.220 - 2

  Home 192.168.10.220

  network vpn-local object

  192.168.10.0 subnet 255.255.255.0

  object network vpn - ru

  subnet 192.168.11.0 255.255.255.0

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  network obj_any-01 object

  subnet 0.0.0.0 0.0.0.0

  object-group service syslog udp

  Service Description syslog group

  port-object eq syslog

  object-group service udp zzzz

  port-object eq syslog

  object-group service sss udp

  port-object eq syslog

  object-group network sheep

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.11.0 255.255.255.0

  object-network 192.168.3.0 255.255.255.0

  outside_all of access allowed any ip an extended list

  VPN_splitTunnelAcl list standard access allowed 192.168.0.0 255.255.0.0

  VPN_splitTunnelAcl list standard access allowed 10.0.0.0 255.0.0.0

  permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.2.0 255.255.255.128

  inside_nat0_outbound to access ip 10.0.0.0 scope list allow 255.0.0.0 192.168.2.0 255.255.255.128

  access-list extended inside_out allow ip 192.168.11.0 255.255.255.0 192.168.10.0 255.255.255.0

  access-list extended inside_out permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

  scope of the inside_out to the list of permitted any one ip access

  inside_out to the access list extended 192.168.11.0 allowed any ip 255.255.255.0

  inside_out to the list of access permit tcp host 192.168.10.2 any eq smtp

  inside_out to the list of access permit tcp any any eq smtp

  access-list extended inside_out allow udp 192.168.10.0 255.255.255.0 host 10.1.1.1

  access-list extended inside_out permit udp host 10.1.1.1 192.168.10.0 255.255.255.0

  inside_out to the list of allowed extensive access icmp host 192.168.10.7 all

  inside_out to the list of allowed extensive access a whole icmp

  outside_zzz list of allowed ip extended access any external interface

  outside_zzz list extended access permit tcp host 87.X.X.73 host 79.X.X.5 eq 1433

  outside_zzz tcp extended access list refuse any host 79.X.X.5 eq 1433

  outside_zzz list extended access permitted tcp 207.126.144.0 255.255.240.0 eq 79.X.X.5 the smtp host

  outside_zzz tcp extended access list refuse any host 79.X.X.5 eq smtp

  outside_zzz access-list extended permit ip any host 79.X.X.5

  outside_zzz of access allowed any ip an extended list

  permit access list extended ip 192.168.10.0 outside_in 255.255.255.0 192.168.11.0 255.255.255.0

  access extensive list ip 192.168.11.0 outside_in allow 255.255.255.0 192.168.10.0 255.255.255.0

  access extensive list ip 192.168.11.0 outside_in allow 255.255.255.0 any

  outside_in list extended access permit tcp any host 192.168.10.15 eq 81

  outside_in list extended access permit ip any host 192.168.10.5

  access-list outside_in extended permit ip any host 79.X.X.4

  outside_in list extended access permit tcp host 82.X.X.166 host 192.168.10.7 eq 1433

  outside_in list extended access permit tcp host 84.X.X.30 host 192.168.10.7 eq 1433

  outside_in list extended access tcp refuse any host 192.168.10.7 eq 1433

  outside_in list extended access permit tcp any host 192.168.10.3 eq 444

  outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 host 192.168.10.11 eq 444

  outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 eq smtp host 192.168.10.11

  outside_in list extended access permitted tcp 207.126.144.0 255.255.240.0 host 192.168.10.2 eq smtp

  outside_in list extended access tcp refuse any host 192.168.10.11 eq smtp

  outside_in list extended access tcp refuse any host 192.168.10.2 eq smtp

  outside_in list extended access permit tcp any host 192.168.10.2 eq smtp

  outside_in list extended access permit udp any host 192.168.10.2 eq 443

  outside_in list extended access permit tcp any host 192.168.10.3 eq 3389

  outside_in list extended access permit tcp any host 192.168.10.2 eq 4125

  outside_in list extended access permit tcp any host 192.168.10.11 eq https

  outside_in list extended access permit tcp any host 192.168.10.2 eq https

  outside_in list extended access allowed esp all the host 91.X.X.57

  outside_in list extended access permit tcp any host 192.168.10.3 eq 1433

  access-list extended outside_in permit ip host 91.X.X.57 all

  access-list outside_in extended permit ip any host 79.X.X.5

  access-list outside_in extended permit ip any host 79.X.X.2

  outside_in list extended access permit tcp any host 79.X.X.6 eq 3389

  outside_in list extended access permit tcp any host 192.168.10.220 eq 3389

  outside_in list extended access permit tcp any host 79.X.X.5 eq 81

  access extensive list permits all ip a outside_in

  outside_in list extended access permit tcp host 91.X.X.178 host 192.168.10.7 eq 1433

  outside_in list extended access permit tcp host 87.X.X.73 host 192.168.10.7 eq 1433

  access-list extended qnap permit ip host 192.168.10.26 all

  access-list extended qnap permit ip any host 192.168.10.26

  phone_bypass list extended access allowed host 10.1.1.1 ip 192.168.10.0 255.255.255.0

  permit phone_bypass to access extended list ip 192.168.10.0 255.255.255.0 host 10.1.1.1

  phone_bypass list extended access allowed host 10.1.1.1 ip 192.168.2.0 255.255.255.0

  phone_bypass to access extended list ip 192.168.2.0 allow 255.255.255.0 host 10.1.1.1

  list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

  extended vpn 192.168.11.0 ip access list allow 255.255.255.0 192.168.10.0 255.255.255.0

  pager lines 24

  Enable logging

  exploitation forest-size of the buffer 1024000

  logging asdm-buffer-size 512

  logging buffered information

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  Comments of MTU 1500

  mask of local pool RemoteVPN 192.168.2.20 - 192.168.2.100 IP 255.255.255.0

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow any inside

  ICMP allow all outside

  ASDM image disk0: / asdm - 631.bin

  enable ASDM history

  ARP timeout 14400

  NAT (any, any) source static sheep sheep sheep destination static sheep

  NAT source service (Interior, exterior) static obj - 192.168.10.7 79.X.X.5 TCP1433 TCP1433

  NAT (inside, outside) source static obj - 192.168.10.7 interface service zzz zzz

  NAT (inside, all) source static obj - 10.0.0.0 obj - 10.0.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

  NAT (inside, all) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 10.1.1.1 obj - 10.1.1.1

  NAT (inside, all) source static obj - 10.1.1.1 obj - 10.1.1.1 destination static obj - 192.168.10.0 obj - 192.168.10.0

  NAT (inside, all) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.2.0 obj - 192.168.2.0

  !

  network object obj - 192.168.10.3

  NAT (inside, outside) static service tcp 3389 3389 79.X.X.5

  network object obj - 192.168.10.3 - 01

  NAT (inside, outside) static 79.X.X.5 tcp 444 444 service

  network object obj - 192.168.10.5

  NAT (inside, outside) public static dns 79.X.X.3

  network object obj - 192.168.10.7

  NAT (inside, outside) interface static service tcp 3389 3389

  network object obj - 192.168.10.220

  NAT (inside, outside) static service tcp 3389 3389 79.X.X.6

  network object obj - 192.168.10.220 - 1

  NAT (inside, outside) static 79.X.X.6 tcp https https service

  network object obj - 192.168.10.7 - 02

  NAT (inside, outside) interface static tcp 8080 https service

  network object obj - 192.168.10.11

  NAT (inside, outside) static 79.X.X.5 tcp smtp smtp service

  network object obj - 192.168.10.11 - 01

  NAT (inside, outside) udp 443 443 service 79.X.X.5 static

  network object obj - 192.168.10.11 - 02

  NAT (inside, outside) static 79.X.X.5 tcp https https service

  network object obj - 192.168.10.11 - 03

  NAT (inside, outside) static 79.X.X.5 tcp https https service

  network object obj - 192.168.10.26

  NAT (inside, outside) static 79.X.X.5 8080 8080 tcp service

  network object obj - 192.168.10.26 - 01

  NAT (inside, outside) static 79.X.X.5 tcp 8080 www service

  network object obj - 192.168.10.15

  NAT (inside, outside) static 79.X.X.5 tcp 81 www service

  network obj_any object

  NAT dynamic interface (indoor, outdoor)

  network obj_any-01 object

  NAT dynamic interface (guest, outdoor)

  Access-group inside_out in interface inside

  Access-group outside_in in external interface

  Route outside 0.0.0.0 0.0.0.0 79.X.X.1 1

  Route inside 10.0.0.0 255.0.0.0 192.168.10.4 1

  Route outside 10.1.1.1 255.255.255.255 192.168.10.4 1

  Route outside 192.168.11.0 255.255.255.0 79.X.X.2 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  RADIUS Protocol RADIUS AAA server

  reactivation impoverishment deadtime mode 1

  AAA-server RADIUS (inside) host 192.168.10.7

  key *.

  AAA authentication http LOCAL console

  the ssh LOCAL console AAA authentication

  LOCAL AAA authorization command

  http server enable 444

  http 0.0.0.0 0.0.0.0 inside

  http 0.0.0.0 0.0.0.0 outdoors

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  No vpn sysopt connection permit

  Service resetoutside

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-SHA 256 - aes - esp esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto-map dynamic outside_dyn_map pfs set 20 Group1

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  card crypto outside_map 1 match for vpn

  outside_map game 1 card crypto peer 91.X.X.57

  card crypto outside_map 1 set of transformation-ESP-AES-SHA

  outside_map map 1 lifetime of security association set seconds 28800 crypto

  card crypto outside_map 1 set security-association life kilobytes 4608000

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  lifetime 28800

  Crypto isakmp nat-traversal 3600

  Telnet timeout 5

  SSH 0.0.0.0 0.0.0.0 inside

  SSH 0.0.0.0 0.0.0.0 outdoors

  SSH timeout 30

  Console timeout 0

  dhcpd dns 83.X.X.8 83.X.X.10

  dhcpd outside auto_config

  !

  dhcpd address 192.168.10.50 - 192.168.10.100 inside

  dhcpd dns 83.X.X.8 83.X.X.10 interface inside

  dhcpd lease interface 600 inside

  dhcpd interface to domain.com domain inside

  !

  Reviews of dhcpd address 192.168.4.50 - 192.168.4.100

  Dhcpd lease 600 interface comments

  Comments enable dhcpd

  !

  priority queue inside

  priority-queue outdoors

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  NTP 93.170.32.1 Server

  NTP 93.170.32.2 Server

  NTP 89.145.68.17 Server prefer

  WebVPN

  allow outside

  SVC image disk0:/anyconnect-win-2.4.1012-k9.pkg 1 regex 'Windows NT'

  SVC image disk0:/anyconnect-wince-ARMv4I-2.4.1012-k9.pkg 2 regex "Windows CE"

  enable SVC

  Auto-signon allow ip 192.168.0.0 255.255.0.0 basic auth-type

  internal l2l group policy

  attributes of the l2l group policy

  VPN-idle-timeout no

  Protocol-tunnel-VPN IPSec

  attributes of Group Policy DfltGrpPolicy

  value of server DNS 192.168.10.11

  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPN_splitTunnelAcl

  value by default-field DOMAINl.local

  internal VPNv group strategy

  attributes of Group Policy VPNv

  value of server DNS 192.168.10.11

  Protocol-tunnel-VPN IPSec webvpn

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPN_splitTunnelAcl

  field default value domain.com

  password username test * encrypted privilege 0

  username test attributes

  VPN-group-policy VPNv

  ID password cisco * encrypted

  roger password username * encrypted privilege 15

  attributes global-tunnel-group DefaultRAGroup

  address pool RemoteVPN

  attributes global-tunnel-group DefaultWEBVPNGroup

  address pool RemoteVPN

  Group-LOCAL RADIUS authentication server

  type tunnel-group VPNv remote access

  attributes global-tunnel-group VPNv

  address pool RemoteVPN

  Group-LOCAL RADIUS authentication server

  Group Policy - by default-VPNv

  IPSec-attributes tunnel-group VPNv

  pre-shared key *.

  tunnel-group testgroup type remote access

  tunnel-group testgroup General attributes

  management of the password password-expire-to-days 90

  tunnel-group 91.X.X.57 type ipsec-l2l

  IPSec-attributes tunnel-group 91.X.X.57

  pre-shared key *.

  !

  Global class-card class

  match default-inspection-traffic

  class-map qnap_band

  corresponds to the list of access qnap

  The class-card phone

  corresponds to the phone_bypass access list

  !

  !

  Policy-map global_policy

  Global category

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Policy-map qnap_access

  class qnap_band

  512000 64000 police entry

  512000 64000 release of police

  phone class

  set the advanced options of the tcp-State-bypass connection

  World-Policy policy-map

  Global category

  inspect the dns

  inspect the ftp

  inspect the pptp

  inspect the rtsp

  inspect the sip

  inspect the skinny

  Policy-map phone_bypass_policy

  phone class

  set the advanced options of the tcp-State-bypass connection

  !

  service-policy-international policy global

  service-policy qnap_access to the inside interface

  privilege level 3 mode exec cmd command perfmon

  privilege level 3 mode exec cmd ping command

  mode privileged exec command cmd level 3

  logging of the privilege level 3 mode exec cmd commands

  privilege level 3 exec command failover mode cmd

  privilege level 3 mode exec command packet cmd - draw

  privilege level 5 see fashion exec running-config command

  order of privilege show level 3 exec mode reload

  privilege level 3 exec mode control fashion show

  privilege see the level 3 exec firewall command mode

  privilege see the level 3 exec mode command ASP.

  processor mode privileged exec command to see the level 3

  privilege command shell see the level 3 exec mode

  privilege show level 3 exec command clock mode

  privilege exec mode level 3 dns-hosts command show

  privilege see the level 3 exec command access-list mode

  logging of orders privilege see the level 3 exec mode

  privilege, level 3 see the exec command mode vlan

  privilege show level 3 exec command ip mode

  privilege, level 3 see fashion exec command ipv6

  privilege, level 3 see the exec command failover mode

  privilege, level 3 see fashion exec command asdm

  exec mode privilege see the level 3 command arp

  command routing privilege see the level 3 exec mode

  privilege, level 3 see fashion exec command ospf

  privilege, level 3 see the exec command in aaa-server mode

  AAA mode privileged exec command to see the level 3

  privilege see the level 3 exec mode command crypto

  privilege, level 3 see fashion exec command vpn-sessiondb

  privilege level 3 exec mode command ssh show

  privilege, level 3 see fashion exec command dhcpd

  privilege, level 3 see the vpnclient command exec mode

  privilege, level 3 see fashion exec command vpn

  privilege level see the 3 blocks from exec mode command

  privilege, level 3 see fashion exec command wccp

  privilege, level 3 see the exec command in webvpn mode

  privilege control module see the level 3 exec mode

  privilege, level 3 see fashion exec command uauth

  privilege see the level 3 exec command compression mode

  level 3 for the show privilege mode configure the command interface

  level 3 for the show privilege mode set clock command

  level 3 for the show privilege mode configure the access-list command

  level 3 for the show privilege mode set up the registration of the order

  level 3 for the show privilege mode configure ip command

  level 3 for the show privilege mode configure command failover

  level 5 mode see the privilege set up command asdm

  level 3 for the show privilege mode configure arp command

  level 3 for the show privilege mode configure the command routing

  level 3 for the show privilege mode configure aaa-order server

  level mode 3 privilege see the command configure aaa

  level 3 for the show privilege mode configure command crypto

  level 3 for the show privilege mode configure ssh command

  level 3 for the show privilege mode configure command dhcpd

  level 5 mode see the privilege set privilege to command

  privilege level clear 3 mode exec command dns host

  logging of the privilege clear level 3 exec mode commands

  clear level 3 arp command mode privileged exec

  AAA-server of privilege clear level 3 exec mode command

  privilege clear level 3 exec mode command crypto

  level 3 for the privilege cmd mode configure command failover

  clear level 3 privilege mode set the logging of command

  privilege mode clear level 3 Configure arp command

  clear level 3 privilege mode configure command crypto

  clear level 3 privilege mode configure aaa-order server

  context of prompt hostname

  call-home

  Profile of CiscoTAC-1

  no active account

  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

  email address of destination [email protected] / * /

  destination-mode http transport

  Subscribe to alert-group diagnosis

  Subscribe to alert-group environment

  Subscribe to alert-group monthly periodic inventory

  monthly periodicals to subscribe to alert-group configuration

  daily periodic subscribe to alert-group telemetry

  Thanks in advance for any help.

  Wojciech salvation,

  Based on this info, I think that you can run in CSCtb53186, this bug has affected many versions before 8.3 and when fixed DEVs they were always be some details in waiting, and they created CSCtd36473 to these outstanding issues. CSCtd36473 is fixed on 8.3.1.1 intermediate version however is not fixed on 8.3.1 so I suggest you spend at least 8.3.2

  http://www.Cisco.com/Cisco/software/release.html?mdfid=279916854&flowid=4818&softwareid=280775065&release=8.3.2.Ed&rellifecycle=&relind=available&RelType=latest

  Read this:

  Interface: outside
  Tag crypto map: outside_map, seq num: 1, local addr: 79.X.X.2

  list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
  local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.11.0/255.255.255.0/0/0)
  current_peer: 91.Y.Y.57

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 502, #pkts decrypt: 502, #pkts check: 502
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  outgoing esp sas:

  SPI: 0xDE50E6EA (3729843946)

  transform: aes-256-esp esp-md5-hmac no compression

  running parameters = {L2L, Tunnel}

  slot: 0, id_conn: 425984, crypto-card: outside_map

  calendar of his: service life remaining (KB/s) key: (4374000/28234)

  Size IV: 16 bytes

  support for replay detection: Y

  Anti-replay bitmap:

  0x00000000 0x00000001

  VPN CTX = 0x015F913C

  By peer IP = 192.168.11.0
  Pointer = 0xD98CACD0
  State = upwards
  Flags = BA + ESP
  ITS = 0X019235E7
  SPI = 0xDE50E6EA
  Group = 0
  Pkts = 0
  Pkts bad = 0
  Incorrect SPI = 0
  Parody = 0
  Bad crypto = 0
  Redial Pkt = 0
  Call redial = 0
  VPN = filter

  hits = 0, user_data is0x15f913c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
  IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
  IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  hits = 44437, user_data is0xce165c, cs_id = 0xd83ad0e8, reverse, flags = 0 x 0 = 0 protocol
  IP/ID=192.168.10.0 SRC, mask is 255.255.255.0, port = 0
  IP/ID=192.168.11.0 DST, mask is 255.255.255.0, port = 0, dscp = 0 x 0

  As you can see above we are a different context to encrypt the traffic (not used with the spi of the sh cry ipsec his)

  If you do the same packet tracer, but this time with the details of the key words at the end probs you will get to see that we use 0xce165c.

  Just looked at your configuration again and before you do the upgrade please correct this:

  list of access vpn extended permit ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

  extended vpn 192.168.11.0 ip access list allow 255.255.255.0 192.168.10.0 255.255.255.0

  Just remove the second line:

  no -access extended vpn ip 192.168.11.0 list allow 255.255.255.0 192.168.10.0 255.255.255.0

  Also:

  No outside_map interface card crypto outside

  and then:

  outside_map interface card crypto outside

  See if that helps before perforrming upgrade,

  Kind regards.

• Impossible to join a 2nd Server as a 2nd DC to a domain

  Hello world

  Thanks in advance for your help.

  I would like to set up a test lab, so I can experience on the upgrade of the area from 2003 to 2008 by adding a Server 2008 in a new remote site.

  Now I install a current version of VMWare Server (esx, not). I installed my first new domain controller for a new first domain on the server to the virtual machine. 'S called it Takami.com and DC installation with 192.168.1.2/24. The type of network to the virtual client is 'the bridge' - as some have suggested that NAT and HostOnly.

  DNS and WINS are also configured on the first domain controller. No errors, dns is good.

  Now I tried to add a domain controller 2003 2nd with ip 192.168.1.3 on the same server vm. But now he told me that he cannot join the domain. He told me the RPC server is unavailable and asked me to check section 5171.

  On the two server, they could ping each other, front and rear. Also, I tried to ping the domain of the server 2 takami. HE could he ping too!

  So what else do I need? Both servers are running with SP2.

  I hope you can help... Thanks a lot again!

  Takami Chiro

  With the exception of the DNS configuration on test-dc1, I don't see anything that you may have missed.

  Instead of 127.0.0.1, I would use the real IP for DNS (192.168.1.2).

  André

  Forum upgrade notice:

  VMware will be upgrading systems VMware communities between December 10-12, 2010. During this time, the system will be placed in READ ONLY mode.

• Windows Server 2003 network problem

  Hi all

  I'm putting in place a network of Server 2003 in vmware for purposes of study. I have three installations of Server 2003 and 1 Windows XP Professional VM set up, all are set up in a team of VM. I already put in place a domain controller and DNS on a server, one DHCP server on another and a RRAS server on the third. I have a custom network (vmnet2) that are connected to the three servers and XP system. The RRAS server is configured as a router to the internet. The problem is that my XP client cannot access the internet.

  My custom network is 192.168.10.x. The DC 192.168.10.2 is the DHCP server is 192.168.10.4. Both have their default gateways 192.168.10.3 value which is the ip address of the RRAS server. All IPs for servers are allocated statically. The other RRAS server network card is connected to the host (Windows 7 x 64) NAT. For the server DNS (which is also the domain controller I want an integrated to the RFA area), has no configure forwarders. The RRAS server is able to access the internet.

  The ipconfig/all command and printed itinerary of the RRAS server are attached.

  Can anyone help?

  Thank you

  Adiño

  I guess you still use the bridge for the RRAS service. What type of device is the physical router?

  You must add a route like this:

  Network 192.168.10.0 can be reached through the gateway

  = Send 'Assignment' to 911 for only $999999,99! =

• [Advanced] Is it possible to put the IP Address of the default gateway for a vmnet NAT?

  I am trying to duplicate a computer lab on my Mac environment, and I need the bridge will be located at one address other than VMWare wants to implement.  I know how to create a static IP address for a virtual machine, but I need adjust the routers option in Library/Preferences/VMWare Fusion/vmnet2/dhcpd.conf.  Will there be a networking Library/Preferences/VMWare Fusion/to allow this?  Is there something I can put before or after the "DON'T CHANGE" section dhcpd.conf that replace the parameters in this section?

  Except that, is there a way to prevent the re-writing of the dhcpd.conf file after I made a change to VMWare?  I tried it wrong in various ways, including the re - generate the hash SHA1 of the networking file and reset the modification time of the dhcpd.conf to the original time, without success.

  Here are my current settings:

  subnet 10.10.0.0 255.255.0.0 subnet mask}

  range 10.10.128.0 10.10.255.254;

  option broadcast-address 10.10.255.255;

  option domain-name-servers 10.10.0.2.

  option domain-name localdomain.

  by default-lease-time 1800;                # default is 30 minutes

  Max-lease-time 7200;                    # default is 2 hours

  option netbios-name-servers 10.10.0.2.

  routers option 10.10.0.2.

  }

  host vmnet2 {}

  Hardware ethernet 00:50:56:C0:00:02;

  fixed-address 10.10.0.1;

  option domain-name-servers 0.0.0.0.

  option domain-name ";

  routers option 0.0.0.0.

  }

  And I'm changing the gateway to 10.10.0.2 to 10.10.1.250.  Maybe VMWare requires that the first IP address as the host and the second either the entry door and rewritten if not?

  Thanks in advance,

  Dave

  I found a way to do this.  Not sure if it's official, or if it will continue to work in the future.  In addition changes nat.conf, if you simply duplicate the part of the section "DON'T CHANGE" dhcpd.conf below, then the second version of the settings will cancel and replace the first.  Here is my solution:

  # Configuration file for ISC 2.0 vmnet-dhcpd operating on vmnet2.

  #

  # This file was generated automatically by Setup of VMware.

  # See Instructions below if you want to change.

  #

  # Define us domain-name-servers to satisfy some DHCP clients

  # (dhclient such as configured in SuSE, TurboLinux, etc..).

  # We also provide a domain name to the pump (Red Hat 6.x) happy.

  #

  # VMNET DHCP Configuration. Beginning of "DO NOT EDIT ARTICLE" #.

  # Instructions change: this section of the configuration file contains

  # News generated by the Setup program. Do not change it

  # section.

  # You are free to change to everything else. In addition, this section must start

  # on a new line

  # This file will get saved under a different name in the same directory

  # If this section is edited and you try to set up DHCP again.

  # Written on the: 04/11/2015-21:15:15

  allow unknown-clients;

  by default-lease-time 1800;                # default is 30 minutes

  Max-lease-time 7200;                    # default is 2 hours

  subnet 10.10.0.0 255.255.0.0 subnet mask}

  range 10.10.128.0 10.10.255.254;

  option broadcast-address 10.10.255.255;

  option domain-name-servers 10.10.0.2.

  option domain-name localdomain.

  by default-lease-time 1800;                # default is 30 minutes

  Max-lease-time 7200;                    # default is 2 hours

  option netbios-name-servers 10.10.0.2.

  routers option 10.10.0.2.

  }

  host vmnet2 {}

  Hardware ethernet 00:50:56:C0:00:02;

  fixed-address 10.10.0.1;

  option domain-name-servers 0.0.0.0.

  option domain-name ";

  routers option 0.0.0.0.

  }

  # VMNET DHCP Configuration. End of "DO NOT EDIT ARTICLE" #.

  subnet 10.10.0.0 255.255.0.0 subnet mask}

  range 10.10.128.0 10.10.255.254;

  option broadcast-address 10.10.255.255;

  option domain-name-servers 10.10.1.200.

  by default-lease-time 1800;                # default is 30 minutes

  Max-lease-time 7200;                    # default is 2 hours

  option netbios-name-servers 10.10.1.250.

  routers option 10.10.1.250;

  }

  -Dave