Outgoing Microsoft VPN via a device ASA 5505

Hi all

I installed an ASA 5505 device for a client just now and they were delighted by improving stability VPN, he provided them, as they work for the most distance and VPN in all day to access their servers at the office. Recently, however, some staff members have spent more time at the office and where they discovered that they are unable to establish a VPN out to customers that are running Microsoft based on virtual private networks. The nature of their activity forced him to regularly establish the VPN to the servers of their customers to download data. They can establish successful Cisco VPN clients when they are in the office or working remotely, but they are not able to connect to the MS VPNs outside the office. What configuration changes I have to do on the ASA 5505 in order to solve this problem for them? Any help would be greatly appreciated.

See you soon,.

John

Hello

If the clients are connecting to a Microsoft VPN through the ASA using PPTP, you need to allow outgoing traffic (if there is an ACL that is applied to the inside interface) and also to activate the inspection of PPTP.

Policy-map global_policy
class inspection_default

inspect the pptp

Let us know how it goes.

Federico.

Tags: Cisco Security

Similar Questions

connect Cisco VPN client v5 to asa 5505

I have remote vpn configuration issues between ASA5505 and Cisco VPN client v5. Successfully, I can establish a connection between the client Vpn and ASA and receive the IP address of the ASA. Statistical customer VPN windows shows that packets are sent and encrypted but none of the packages is received/decrypted.

Cannot ping asa 5505

Any ideas on what I missed?

Try adding...

ISAKMP nat-traversal crypto

In addition, you cannot ping the inside interface of the ASA vpn without this command...

management-access inside

Please evaluate the useful messages.

VPN tunnel between 2 ASA 5505 with the same default gateway

Hello

Is it possible to create a vpn ipsec site to site (laboratory environment) between two 5505 (ASA IOS 8.2 (5) & asdm-645-206) with the same default gateway. That is a VPN tunnel or a back to back-to-one site that I have to deploy a router and hang each 5505 out a different interface? We have a lot of public IP but only one gateway our ISP (Internet). Any suggestions or recommendations are very appeciated!

d

Yes - you can even do it with a xover cable and a 30 ip on both external interfaces.

Client VPN Cisco ASA 5505 Cisco 1841 router

Hello. I'm doing a connection during a cisco vpn client and a vpn on one server asa 5505 behind a 1841 router (internet adsl2 + and NAT router).

My topology is almost as follows

customer - tunnel - 1841 - ASA - PC

ASA is the endpoint vpn (outside interface) device. I forward udp port 500 and 4500 on my router to the ASA and the tunnel rises. I exempt nat'ting on the asa and the router to the IP in dhcp vpn pool. I can connect to my tunnel but I can't "see" anything in the internal network. I allowed all traffic from the outside inwards buy from the ip vpn pool and I still send packets through the tunnel and I get nothing. I take a look at the statistics on the vpn client and I 2597 bytes (ping traffic) and there are no bytes. Any idea?

Where you you logged in when you took the "crypto ipsec to show his"? If this isn't the case then try again, also this option allows IPSEC over UDP 4500 and it is disabled, enable it.

ISAKMP nat-traversal crypto

Just enter the command as it is, then try to connect again after activation of this option and get the same result to see the.

Error of customer Cisco VPN connection ASA 5505

I am unable to connect to the vpn I created on my ASA 5505 using the Cisco VPN Client on a Windows machine. The log of the vpn client and the config of the ASA 5505 is lower. Any help to solve this is appreciated.

CISCO VPN CLIENT LOG

Cisco Systems VPN Client Version 5.0.06.0160

Copyright (C) 1998-2009 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.1.7600

Config files directory: C:\Program Cisco Systems Client\

1 09:34:23.030 13/04/11 Sev = Info/4 CM / 0 x 63100002

Start the login process

2 09:34:23.061 13/04/11 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

3 09:34:23.061 13/04/11 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "71.xx.xx.253".

4 09:34:23.061 13/04/11 Sev = Info/6 IKE/0x6300003B

Attempts to establish a connection with 71.xx.xx.253.

5 09:34:23.061 13/04/11 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

6 09:34:23.077 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) at 71.xx.xx.253

7 09:34:23.170 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

8 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

9 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

10 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

11 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

12 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

13 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

14 09:34:23.170 13/04/11 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

15 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) at 71.xx.xx.253

16 09:34:23.170 13/04/11 Sev = Info/6 IKE / 0 x 63000055

Sent a keepalive on the IPSec Security Association

17 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xEB07, Remote Port = 0 x 1194

18 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is behind a NAT device

19 09:34:23.170 13/04/11 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

20 09:34:23.170 13/04/11 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

21 09:34:23.186 13/04/11 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

22 09:34:23.186 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to 71.xx.xx.253

23 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

24 09:34:23.248 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

25 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 172.26.6.1

26 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.0.0

27 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 172.26.0.250

28 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 172.26.0.251

29 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000000

30 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = TLCUSA

31 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

32 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc. ASA5505 Version 8.2 (1) built by manufacturers on Wednesday 5 May 09 22:45

33 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

34 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = received and by using the NAT - T port number, value = 0 x 00001194

35 09:34:23.248 13/04/11 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

36 09:34:23.264 13/04/11 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 172.26.6.1, GW IP = 71.xx.xx.253, Remote IP = 0.0.0.0

37 09:34:23.264 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > QM ISAKMP OAK * (HASH, SA, NO, ID, ID) to 71.xx.xx.253

38 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

39 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

40 09:34:23.326 13/04/11 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

41 09:34:23.326 13/04/11 Sev = Info/5 IKE / 0 x 63000047

This AA is already living from 0 seconds, setting the expiration to 86400 seconds right now

42 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

43 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">

44 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO *(HASH, DEL) to 71.xx.xx.253

45 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000049

IPsec security association negotiation made scrapped, MsgID = 89EE7032

46 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000017

Marking of IKE SA delete (I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED

47 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

48 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000058

Received an ISAKMP for a SA message no assets, I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8

49 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(dropped)="" from="">

50 09:34:26.696 13/04/11 Sev = Info/4 IKE/0x6300004B

IKE negotiation to throw HIS (I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED

51 09:34:26.696 13/04/11 Sev = Info/4 CM / 0 x 63100012

ITS phase 1 deleted before first Phase 2 SA is caused by "DEL_REASON_IKE_NEG_FAILED". Crypto 0 Active IKE SA, 0 IKE SA authenticated user in the system

52 09:34:26.696 13/04/11 Sev = Info/5 CM / 0 x 63100025

Initializing CVPNDrv

53 09:34:26.696 13/04/11 Sev = Info/6 CM / 0 x 63100046

Set indicator established tunnel to register to 0.

54 09:34:26.696 13/04/11 Sev = Info/4 IKE / 0 x 63000001

Signal received IKE to complete the VPN connection

----------------------------------------------------------------------------------------

ASA 5505 CONFIG

: Saved

:

ASA Version 8.2 (1)

!

ciscoasa hostname

domain masociete.com

activate tdkuTUSh53d2MT6B encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 172.26.0.252 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

IP address 71.xx.xx.253 255.255.255.240

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone IS - 5

clock to summer time EDT recurring

DNS server-group DefaultDNS

domain masociete.com

access-list LIMU_Split_Tunnel_List note the network of the company behind the ASA

Standard access list LIMU_Split_Tunnel_List allow 172.26.0.0 255.255.0.0

outside_access_in list extended access permit icmp any one

outside_access_in list extended access udp allowed any any eq 4500

outside_access_in list extended access udp allowed any any eq isakmp

outside_access_in list extended access permit tcp any host 71.xx.xxx.251 eq ftp

outside_access_in list extended access permit tcp any host 71.xx.xxx.244 eq 3389

inside_outbound_nat0_acl list of allowed ip extended access all 172.26.5.192 255.255.255.240

inside_outbound_nat0_acl list of allowed ip extended access all 172.26.6.0 255.255.255.128

pager lines 24

Enable logging

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

local pool VPN_POOL 172.26.6.1 - 172.26.6.100 255.255.0.0 IP mask

ICMP unreachable rate-limit 1 burst-size 1

enable ASDM history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_outbound_nat0_acl

NAT (inside) 1 0.0.0.0 0.0.0.0

static (inside, outside) 71.xx.xxx.251 172.26.5.9 netmask 255.255.255.255

static (inside, outside) 71.xx.xxx.244 172.26.0.136 netmask 255.255.255.255

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 71.xx.xxx.241 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

Enable http server

http 172.26.0.0 255.255.0.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_MD5

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS_ESP_3DES_MD5

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

no basic threat threat detection

no statistical access list - a threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server WINS 172.26.0.250 172.26.0.251

value of 172.26.0.250 DNS server 172.26.0.251

Protocol-tunnel-VPN IPSec l2tp ipsec svc

value by default-field TLCUSA

internal LIMUVPNPOL1 group policy

LIMUVPNPOL1 group policy attributes

value of 172.26.0.250 DNS server 172.26.0.251

VPN-idle-timeout 30

Protocol-tunnel-VPN IPSec l2tp ipsec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list LIMU_Split_Tunnel_List

the address value VPN_POOL pools

internal TLCVPNGROUP group policy

TLCVPNGROUP group policy attributes

value of 172.26.0.250 DNS server 172.26.0.251

Protocol-tunnel-VPN IPSec l2tp ipsec svc

Re-xauth disable

enable IPSec-udp

value by default-field TLCUSA

barry.julien YCkQv7rLwCSNRqra06 + QXg password user name is nt encrypted privilege 0

username barry.julien attributes

VPN-group-policy TLCVPNGROUP

Protocol-tunnel-VPN IPSec l2tp ipsec

bjulien bhKBinDUWhYqGbP4 encrypted password username

username bjulien attributes

VPN-group-policy TLCVPNGROUP

attributes global-tunnel-group DefaultRAGroup

address VPN_POOL pool

Group Policy - by default-DefaultRAGroup

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key *.

tunnel-group DefaultRAGroup ppp-attributes

no authentication ms-chap-v1

ms-chap-v2 authentication

type tunnel-group TLCVPNGROUP remote access

attributes global-tunnel-group TLCVPNGROUP

address VPN_POOL pool

Group Policy - by default-TLCVPNGROUP

IPSec-attributes tunnel-group TLCVPNGROUP

pre-shared-key *.

ISAKMP ikev1-user authentication no

tunnel-group TLCVPNGROUP ppp-attributes

PAP Authentication

ms-chap-v2 authentication

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:b94898c163c59cee6c143943ba87e8a4

: end

enable ASDM history

can you try to change the transformation of dynamic value ESP-3DES-SHA map.

for example

remove the encryption scheme dynamic-map outside_dyn_map 20 transform-set TRANS_ESP_3DES_MD5

and replace with

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

ASA 5505 VPN cannot access inside the host

I have access remote VPN configuration on an ASA 5505, but cannot access the host or the AAS when I connect through the VPN. I can connect with the Cisco VPN client and the VPN is on on the SAA and it shows that I am connected. I have the correct Ip address, but I can't ping or you connect to one of the internal addresses. I can't find what I'm missing. I have the VPN without going through the ACL interface. Because I can connect but not going anywhere I'm sure I missed something.

framework for configuration below

interface Vlan1

nameif inside

security-level 100

10.1.1.1 IP address 255.255.255.0

IP local pool xxxx 10.1.1.50 - 10.1.1.55 mask 255.255.255.0

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto-map dynamic outside_dyn_map 20 set pfs

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

PFS set 40 crypto dynamic-map outside_dyn_map

Crypto-map dynamic outside_dyn_map 40 value transform-set ESP-3DES-SHA

Crypto-map dynamic inside_dyn_map 20 set pfs

Crypto-map dynamic inside_dyn_map 20 the value transform-set ESP-3DES-SHA

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

map inside_map 65535-isakmp ipsec crypto dynamic inside_dyn_map

inside crypto map inside_map interface

crypto ISAKMP allow inside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

global service-policy global_policy

XXXXXXX strategy of Group internal

attributes of the strategy group xxxxxxx

banner value xxxxx Site Recovery

WINS server no

24.xxx.xxx.xx value of DNS server

VPN-access-hour no

VPN - connections 3

VPN-idle-timeout 30

VPN-session-timeout no

VPN-filter no

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelall

by default no

disable secure authentication unit

disable authentication of the user

user-authentication-idle-timeout no

disable the IP-phone-bypass

disable the leap-bypass

disable the NEM

disable the NAC

NAC-sq-period 300

NAC-reval-period 36000

NAC-by default-acl no

the address value xxxxxx pools

enable Smartcard-Removal-disconnect

the firewall client no

WebVPN

url-entry functions

Free VPN of CNA no

No vpn-addr-assign aaa

No dhcp vpn-addr-assign

tunnel-group xxxx type ipsec-ra

tunnel-group xxxx general attributes

xxxx address pool

Group Policy - by default-xxxx

blountdr group of tunnel ipsec-attributes

pre-shared-key *.

Missing nat exemption for vpn clients. Add the following and you should be good to go.

inside_nat0_outbound list of allowed ip extended access any 192.168.10.0 255.255.255.0

NAT (inside) 0-list of access inside_nat0_outbound

Install two the separate IPSec VPNS on ASA 5505

Hello

I'll have set up a second tunnel IPSec VPN on my Cisco ASA 5505 to another office. I was able to configure one without problem through the ASDM, but were not able to get the second.

The IPSec tunnel connects to a WRVS4400N router to the other office. I tried the debug crypto isakmp and ipsec crypto, but I get nothing. Here is the config. Something seems wrong on my end? I've also attached a screenshot of the configuration settings on the remote router.

Output of the command: "show run".

: Saved
:
ASA Version 8.2 (5)
!
hostname WayneASA

!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP 70.91.18.205 255.255.255.252
!
interface Vlan5
Shutdown
No nameif
security-level 50
IP 192.168.10.1 255.255.255.0
!
passive FTP mode
clock timezone IS - 5
clock to summer time EDT recurring
DNS lookup field inside
DNS domain-lookup outside
DNS server-group DefaultDNS
75.75.75.75 server name
75.75.76.76 server name
domain 3gtms.com
object-group Protocol TCPUDP
object-protocol udp
object-tcp protocol
inside_access_in of access allowed any ip an extended list
IPSec_Access to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.224
inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
inside_nat0 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
TunnelSplit1 list standard access allowed 192.168.10.0 255.255.255.224
TunnelSplit1 list standard access allowed 192.168.1.0 255.255.255.0
outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0
outside_2_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
outside_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0
RemoteTunnel_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
RemoteTunnel_splitTunnelAcl_1 list standard access allowed 192.168.1.0 255.255.255.0

pager lines 24
Enable logging
Within 1500 MTU
Outside 1500 MTU
IP mask 255.255.255.224 local pool VPNPool 192.168.10.1 - 192.168.10.30
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0
NAT (inside) 1 0.0.0.0 0.0.0.0

inside_access_in access to the interface inside group
Access-group out_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 70.91.18.206 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
Enable http server
http 0.0.0.0 0.0.0.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set esp-3des esp-md5-hmac VPNTransformSet
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
card crypto IPSec_map 1 corresponds to the address IPSec_Access
card crypto IPSec_map 1 set peer 50.199.234.229
card crypto IPSec_map 1 the transform-set VPNTransformSet value
card crypto IPSec_map 2 corresponds to the address outside_2_cryptomap
card crypto IPSec_map 2 set pfs Group1
card crypto IPSec_map 2 set peer 98.101.139.210
card crypto IPSec_map 2 the transform-set VPNTransformSet value
card crypto IPSec_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
IPSec_map interface card crypto outside
card crypto outside_map 1 match address outside_1_cryptomap
peer set card crypto outside_map 1 50.199.234.229

crypto ISAKMP allow outside
crypto ISAKMP policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 43200
Telnet 192.168.1.0 255.255.255.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 inside
SSH timeout 60
Console timeout 0
management-access inside
dhcpd outside auto_config
!
dhcpd address 192.168.1.100 - 192.168.1.199 inside
dhcpd dns 75.75.75.75 75.75.76.76 interface inside
dhcpd allow inside
!

a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal RemoteTunnel group strategy
attributes of Group Policy RemoteTunnel
value of server DNS 75.75.75.75 75.75.76.76
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list RemoteTunnel_splitTunnelAcl_1
3gtms.com value by default-field
eric 0vcSd5J/TLsFy7nU password user name encrypted privilege 15
username password encrypted URsSXKLozQMSeCBk privilege 5 lestofts
username lestofts attributes
type of remote access service
algobel lBWy5eNbHMCDPzuL encrypted password username
username algobel attributes
type of remote access service
type tunnel-group RemoteTunnel remote access
attributes global-tunnel-group RemoteTunnel
address pool VPNPool
Group Policy - by default-RemoteTunnel
IPSec-attributes tunnel-group RemoteTunnel
pre-shared key *.
tunnel-group 50.199.234.229 type ipsec-l2l
IPSec-attributes tunnel-group 50.199.234.229
pre-shared key *.
tunnel-group 98.101.139.210 type ipsec-l2l
IPSec-attributes tunnel-group 98.101.139.210
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the icmp
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the netbios
inspect the tftp
Review the ip options
inspect the dns
inspect the pptp
inspect the sip
!
global service-policy global_policy
context of prompt hostname
anonymous reporting remote call
Cryptochecksum:a86adc4b23977672679b6fb72d0bc187
: end

You are also missing the NAT0 rule

inside_nat0 to access extended list ip 192.168.2.0 allow 255.255.255.0 192.168.5.0 255.255.255.0

-Jouni

RV042 inside Asa 5505

I have a RV042 VPN router inside an ASA 5505 running version 7.2. I am trying to connect from the outside to the RV042. I have read for 2 days now and tried everything I found and had no success. I can connect from the network for the RV042 inside so I don't know which is configured correctly. I found links on several posts to the official Cisco support documents, but they have no meaning to me. It is my first experience with a Cisco Firewall.

We also have a network of security cameras which we can access outside and I managed to set up the port forwarding for that.

Here is my current setup running. Inside the RV042 ip address is 192.168.168.25. I had passed, GRE has opened, the port 1723 and have Setup PPTP inspection. I removed port forwarding at this time.

Can anyone help?

Thank you

Todd

Output from the command: 'show running-config '.

: Saved

:

ASA Version 7.2 (3)

!

suite host name

domain hivermont.com

activate vwiH3D2KQdqR57As encrypted password

names of

!

interface Vlan1

nameif inside

security-level 100

192.168.168.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan2

nameif outside

security-level 0

IP 75.144.147.155 255.255.255.248

OSPF cost 10

!

interface Vlan3

Description reviews network

prior to interface Vlan1

nameif guestlan

security-level 50

IP 192.168.2.1 255.255.255.0

OSPF cost 10

!

interface Vlan13

network of Aloha description

nameif aloha

security-level 75

IP 192.168.1.1 255.255.255.0

OSPF cost 10

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 3

!

interface Ethernet0/3

switchport access vlan 13

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

vwiH3D2KQdqR57As encrypted passwd

passive FTP mode

DNS server-group DefaultDNS

domain hivermont.com

network VPN - TCP object-group

host of the object-Network 192.168.168.25

network-object 75.144.147.152 255.255.255.248

object-group Protocol DM_INLINE_PROTOCOL_1

object-protocol gre

access extensive list ip 192.168.168.0 inside_nat0_outbound allow 255.255.255.0 192.168.167.0 255.255.255.0

outside_access_in list extended access permit tcp any interface outside eq 81

outside_access_in list extended access permit tcp any interface outside eq 6036

outside_access_in_1 list extended access allowed grateful if any host 192.168.168.25

Note to access list TCP VPN connection outside_access_in_1

Comment from outside_access_in_1-access VPN UDP connection list

Note to access list TCP VPN connection outside_access_in_1

Comment from outside_access_in_1-access VPN UDP connection list

inside_nat_outbound of access allowed any ip an extended list

pager lines 24

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

guestlan MTU 1500

Aloha 1500 MTU

IP local pool dial_pool 192.168.167.100 - 192.168.167.110

no failover

the monitor inside interface

interface of the monitor to the outside

the interface of the monitor guestlan

the aloha monitor interface

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 523.bin

don't allow no asdm history

ARP timeout 14400

NAT-control

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 access-list inside_nat_outbound

NAT (guestlan) 1 0.0.0.0 0.0.0.0

NAT (aloha) 1 0.0.0.0 0.0.0.0

public static tcp (indoor, outdoor) interface 81 192.168.168.20 81 netmask 255.255.255.255

public static tcp (indoor, outdoor) interface 6036 192.168.168.20 6036 netmask 255.255.255.255

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 75.144.147.158 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

Enable http server

http 192.168.1.0 255.255.255.0 inside

http 192.168.168.0 255.255.255.0 inside

http 192.168.167.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-sha-hmac dial_set

Crypto dial_map dynamic-map 10 transform-set dial_set

map vpn_map 65535-isakmp ipsec crypto dynamic dial_map

vpn_map interface card crypto outside

crypto isakmp identity address

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

ISAKMP crypto 10 nat-traversal

Telnet 192.168.167.0 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.168.0 255.255.255.0 inside

SSH 192.168.167.0 255.255.255.0 inside

SSH timeout 20

Console timeout 0

management-access inside

dhcpd address 192.168.2.100 - 192.168.2.199 guestlan

dhcpd dns 68.87.71.226 68.87.73.242 interface guestlan

dhcpd lease 14400 interface guestlan

guestlan enable dhcpd

!

priority queue inside

!

Global class-card class

match default-inspection-traffic

Interior-class class-map

match any

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

World-Policy policy-map

Global category

inspect the ctiqbe

inspect the dcerpc

inspect the dns

inspect esmtp

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the http

inspect the icmp

inspect the icmp error

inspect the they

inspect the amp-ipsec

inspect the mgcp

inspect the netbios

inspect the rsh

inspect the rtsp

inspect the sip

inspect the skinny

inspect the snmp

inspect sqlnet

inspect sunrpc

inspect the tftp

inspect the waas

inspect xdmcp

class inspection_default

inspect the pptp

political inner-political map

internal category

priority

!

service-policy-international policy global

service-policy domestic-policy interface inside

WebVPN

CSD image disk0:/securedesktop-asa-3.1.1.29-k9.pkg

enable CSD

internal remote group strategy

Group remote attributes policy

value of 68.87.71.226 DNS server 68.87.73.242

VPN-idle-timeout 30

Protocol-tunnel-VPN IPSec

username, encrypted Tbridges boO63YoQ/XbbOab8 password

username Tbridges attributes

Strategy-Group-VPN remote

todd YmIbsl9a0Do623E2Fipr5w password user name is nt encrypted privilege 15

IPSec-attributes tunnel-group DefaultRAGroup

ISAKMP retry threshold 10 keepalive 2

tunnel-group type remote ipsec-ra

tunnel-group remote General attributes

address dial_pool pool

tunnel-group remote ipsec-attributes

pre-shared-key *.

context of prompt hostname

Cryptochecksum:6aa5f44393e8771d4cd28186e18e5618

: end

Are you trying to connect to RV042 with PPTP VPN?

If you are, then here is the configuration:

public static tcp 1723 interface (inside, outside) 192.168.168.25 1723 netmask 255.255.255.255

outside_access_in list extended access permit tcp any interface outside eq 1723

and you have already the "inspect pptp" set up, it should be OK.

When you try to connect, it connects successfully but you cannot pass all the data, or you can't even connect? In addition, this error message do you receive?

Finally, if you do 'show access-list outside_access_in', you get any number of access on tcp/1723 line?

ASA 5505 VPN works great but can't access internet via the tunnel to customers

We have an ASA 5505 ASA 8.2.1 running and using IPSec for Remote access clients in the main office. Remote access is a lot of work, with full access to network resources in the main office and the only thing I can't get to work is access to internet through the tunnel. I don't want to use split tunneling. I use ASDM 6.2.1 for configuration. Any help is appreciated. I'm probably missing something simple and it looked so much, I'm probably looking at right beyond the error. Thanks in advance for your time and help! Jim

Add a statement of nat for your segment of customer on the external interface

NAT (outside) - access list

then allow traffic routing back on the same interface, it is entered in the

permit same-security-traffic intra-interface

*

*

* more than information can be found here:

http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807...

On Wednesday, 27 January 2010, at 23:12, jimcanova

which product is right for the ssl vpn: asa 5505 cisco 1841 or

Hello

I want to install an outside link management related so that we can ssh to our cisco devices and microsoft RDP toour servers. It's my configuration (based on what I know):

Internet > DSL modem > ASA 5505 > management CONSOLES SWITCH > SWITCH CISCO or Windwos Server

or

Internet > 1841 with DSL HWIC > management CONSOLES SWITCH > SWITCH CISCO or Windwos Server

My questions are:

Should I go for ASA or 1841 router?

What options is better? and ASA will do the job?

Are there any technical support prior to purchase of products in Australia? I need technical advice on the choice of the right products, not justs eiling me products.

Hello

Its strongly suggested to go with ASA 5505 in the first place, it is supposed to feature for the main functionality of ssl vpn server from 1841 which has this feature to be a vpn server.

ASDM also gives you the freedom to config box on your own based on your condition.

regds

Ikev1 ASA 5505 VPN connection error

Hello

I had previously defined our VPN using IPsec on our ASA 5505 via the ASDM. It was workign fine until an outtage power loses my settings on the device. (possibly a recording of order is not pressed)

Now when I try and put in place, once again I am recieveing an error to port binding. I have configured as normal using the wizard and activate split defintion and exempt the network inside.

The isssue when you apply the settings that I get is:

"[ERROR] crypto ikev 1 activate outdoors.

IkevReceiverInit, cannot bind the port. "

When I try to connect to the VPN I then get an error "the server cannot be reached" or something similar to that...

Could someone please shed some light on what can cause this problem?

Best regards, the Paris

William.

Hello

Thanks for the information!

We will need to know why this host using UDP 4500 and if this host really needs to use this port.

What type of application is running on this host?

What is a host internal or external?

You may also block the host on the SAA on the incoming interface to avoid the use of the UDP 4500 port using a group of access (outside or inside). Don't forget that you will need a ip to allow a at the end of the ACL to avoid any problems. Another option would be to use IKEv1/IPsec over TCP

IKEv1/IPsec over TCP allows a Cisco VPN client operate in an environment in which IKEv1 or standard ESP may not work or may work only with the change of the existing firewall rules. IPsec over TCP encapsulates IPsec protocols both IKEv1 in a TCP packet as and allows a tunnel secure two firewalls and NAT and PAT devices. This feature is disabled by default.

The default port is 10000.

HostName (config) # ikev1 crypto ipsec-over-tcp

You also need to activate on the VPN client under the profile.

Change > Transport > IPSec over TCP.

I hope this helps.

Luis.

Problem with ASA 5505 VPN remote access

After about 1 year to have the VPN Client from Cisco connection to an ASA 5505 with no problems, all of a sudden one day it stops working. The customer is able to get a connection to the ASA and browse the local network for only about 30 seconds after the connection. After that, no access is available to the network behind the ASA. I have tried everything I can think of to try to solve the problem, but at this point, I'm just banging my head against a wall. Anyone know what could cause this?

Here is the cfg running of the ASA

----------------------------------------------------------------------------------------

: Saved

:

ASA Version 8.4 (1)

!

hostname NCHCO

enable encrypted password xxxxxxxxxxxxxxx

xxxxxxxxxxx encrypted passwd

names of

description of NCHCO name 192.168.2.0 City offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address **. ***. 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

boot system Disk0: / asa841 - k8.bin

passive FTP mode

network of the NCHCO object

Subnet 192.168.2.0 255.255.255.0

network object obj - 192.168.1.0

subnet 192.168.1.0 255.255.255.0

network object obj - 192.168.2.64

subnet 192.168.2.64 255.255.255.224

network object obj - 0.0.0.0

subnet 0.0.0.0 255.255.255.0

network obj_any object

subnet 0.0.0.0 0.0.0.0

the Web server object network

the FINX object network

Home 192.168.2.11

rdp service object

source between 1-65535 destination eq 3389 tcp service

Rdp description

outside_nat0_outbound extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

outside_nat0_outbound extended access list permit ip object NCHCO 192.168.2.0 255.255.255.0

inside_nat0_outbound extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

inside_nat0_outbound list of allowed ip extended access all 192.168.2.64 255.255.255.224

permit access list extended ip 0.0.0.0 inside_nat0_outbound 255.255.255.0 192.168.2.64 255.255.255.224

outside_1_cryptomap extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

outside_1_cryptomap_1 extended access list permit ip object NCHCO 192.168.1.0 255.255.255.0

LAN_Access list standard access allowed 192.168.2.0 255.255.255.0

LAN_Access list standard access allowed 0.0.0.0 255.255.255.0

NCHCO_splitTunnelAcl_1 list standard access allowed 192.168.2.0 255.255.255.0

AnyConnect_Client_Local_Print deny ip extended access list a whole

AnyConnect_Client_Local_Print list extended access permit tcp any any eq lpd

Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 631

print the access-list AnyConnect_Client_Local_Print Note Windows port

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

AnyConnect_Client_Local_Print list extended access permit udp any host 224.0.0.251 eq 5353

AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

AnyConnect_Client_Local_Print list extended access permit udp any host 224.0.0.252 eq 5355

Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

AnyConnect_Client_Local_Print list extended access permit tcp any any eq 137

AnyConnect_Client_Local_Print list extended access udp allowed any any eq netbios-ns

outside_access_in list extended access permit tcp any object FINX eq 3389

outside_access_in_1 list extended access allowed object rdp any object FINX

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

mask of VPN_Pool VPN_Start VPN_End of local pool IP 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 649.bin

don't allow no asdm history

ARP timeout 14400

NAT (inside, all) static source NCHCO destination NCHCO static obj - 192.168.1.0 obj - 192.168.1.0

NAT (inside, all) static source any any destination static obj - 192.168.2.64 obj - 192.168.2.64

NAT (inside, all) source static obj - 0.0.0.0 0.0.0.0 - obj destination static obj - 192.168.2.64 obj - 192.168.2.64

!

network obj_any object

NAT dynamic interface (indoor, outdoor)

the FINX object network

NAT (inside, outside) interface static service tcp 3389 3389

Access-group outside_access_in_1 in interface outside

Route outside 0.0.0.0 0.0.0.0 69.61.228.177 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

network-acl outside_nat0_outbound

WebVPN

SVC request to enable default svc

Enable http server

http 192.168.1.0 255.255.255.0 inside

http *. **. ***. 255.255.255.255 outside

http *. **. ***. 255.255.255.255 outside

http NCHCO 255.255.255.0 inside

http 96.11.251.186 255.255.255.255 outside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac ikev1 l2tp-transform

IKEv1 crypto ipsec transform-set l2tp-transformation mode transit

Crypto ipsec transform-set vpn-transform ikev1 esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA ikev1

transport mode encryption ipsec transform-set TRANS_ESP_3DES_SHA ikev1

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5 ikev1

transport mode encryption ipsec transform-set TRANS_ESP_3DES_MD5 ikev1

Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set pfs Group1

crypto dynamic-map dyn-map 10 set transform-set l2tp vpn-transform processing ikev1

dynamic-map encryption dyn-map 10 value reverse-road

Crypto-map dynamic outside_dyn_map 20 set transform-set ESP-3DES-SHA ikev1

Crypto-map dynamic outside_dyn_map 20 the value reverse-road

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs Group1

peer set card crypto outside_map 1 74.219.208.50

card crypto outside_map 1 set transform-set ESP-3DES-SHA ikev1

map outside_map 20-isakmp ipsec crypto dynamic outside_dyn_map

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

inside crypto map inside_map interface

card crypto vpn-map 1 match address outside_1_cryptomap_1

card crypto vpn-card 1 set pfs Group1

set vpn-card crypto map peer 1 74.219.208.50

card crypto 1 set transform-set ESP-3DES-SHA ikev1 vpn-map

dynamic vpn-map 10 dyn-map ipsec isakmp crypto map

crypto isakmp identity address

Crypto ikev1 allow inside

Crypto ikev1 allow outside

IKEv1 crypto ipsec-over-tcp port 10000

IKEv1 crypto policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

IKEv1 crypto policy 15

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

IKEv1 crypto policy 35

preshared authentication

3des encryption

sha hash

Group 2

life 86400

enable client-implementation to date

Telnet 192.168.1.0 255.255.255.0 inside

Telnet NCHCO 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH NCHCO 255.255.255.0 inside

SSH timeout 5

Console timeout 0

dhcpd address 192.168.2.150 - 192.168.2.225 inside

dhcpd dns 216.68.4.10 216.68.5.10 interface inside

lease interface 64000 dhcpd inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server DNS 192.168.2.1

L2TP ipsec VPN-tunnel-Protocol ikev1

nchco.local value by default-field

attributes of Group Policy DfltGrpPolicy

value of server DNS 192.168.2.1

L2TP ipsec VPN-tunnel-Protocol ikev1 ssl-clientless ssl-client

allow password-storage

enable IPSec-udp

enable dhcp Intercept 255.255.255.0

the address value VPN_Pool pools

internal NCHCO group policy

NCHCO group policy attributes

value of 192.168.2.1 DNS Server 8.8.8.8

Ikev1 VPN-tunnel-Protocol

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list NCHCO_splitTunnelAcl_1

value by default-field NCHCO.local

admin LbMiJuAJjDaFb2uw encrypted privilege 15 password username

username privilege 15 encrypted password yB1lHEVmHZGj5C2Z 8njferg

username NCHvpn99 password dhn. JzttvRmMbHsP encrypted

attributes global-tunnel-group DefaultRAGroup

address (inside) VPN_Pool pool

address pool VPN_Pool

authentication-server-group (inside) LOCAL

authentication-server-group (outside LOCAL)

LOCAL authority-server-group

authorization-server-group (inside) LOCAL

authorization-server-group (outside LOCAL)

Group Policy - by default-DefaultRAGroup

band-Kingdom

band-band

IPSec-attributes tunnel-group DefaultRAGroup

IKEv1 pre-shared-key *.

NOCHECK Peer-id-validate

tunnel-group DefaultRAGroup ppp-attributes

No chap authentication

no authentication ms-chap-v1

ms-chap-v2 authentication

tunnel-group DefaultWEBVPNGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

tunnel-group 74.219.208.50 type ipsec-l2l

IPSec-attributes tunnel-group 74.219.208.50

IKEv1 pre-shared-key *.

type tunnel-group NCHCO remote access

attributes global-tunnel-group NCHCO

address pool VPN_Pool

Group Policy - by default-NCHCO

IPSec-attributes tunnel-group NCHCO

IKEv1 pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

call-home

Profile of CiscoTAC-1

no active account

http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

email address of destination [email protected] / * /

destination-mode http transport

Subscribe to alert-group diagnosis

Subscribe to alert-group environment

Subscribe to alert-group monthly periodic inventory

monthly periodicals to subscribe to alert-group configuration

daily periodic subscribe to alert-group telemetry

Cryptochecksum:a2110206e1af06974c858fb40c6de2fc

: end

ASDM image disk0: / asdm - 649.bin

ASDM VPN_Start 255.255.255.255 inside location

ASDM VPN_End 255.255.255.255 inside location

don't allow no asdm history

---------------------------------------------------------------------------------------------------------------

And here are the logs of the Cisco VPN Client when sailing, then is unable to browse the network behind the ASA:

---------------------------------------------------------------------------------------------------------------

Cisco Systems VPN Client Version 5.0.07.0440

Copyright (C) 1998-2010 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.1.7601 Service Pack 1

Config files directory: C:\Program Files (x 86) \Cisco Systems\VPN Client\

1 09:44:55.677 01/10/13 Sev = Info/6 CERT / 0 x 63600026

Try to find a certificate using hash Serial.

2 09:44:55.677 01/10/13 Sev = Info/6 CERT / 0 x 63600027

Found a certificate using hash Serial.

3 09:44:55.693 01/10/13 Sev = Info/6 GUI/0x63B00011

RELOADED successfully certificates in all certificate stores.

4 09:45:02.802 10/01/13 Sev = Info/4 CM / 0 x 63100002

Start the login process

5 09:45:02.802 01/10/13 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

6 09:45:02.802 01/10/13 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "*." **. ***. *** »

7 09:45:02.802 10/01/13 Sev = Info/6 IKE/0x6300003B

Try to establish a connection with *. **. ***. ***.

8 09:45:02.818 10/01/13 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

9 09:45:02.865 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) to *. **. ***. ***

10 09:45:02.896 10/01/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

11 09:45:02.896 10/01/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

12 09:45:02.896 10/01/13 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

13 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

14 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

15 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

16 09:45:02.896 01/10/13 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

17 09:45:02.927 01/10/13 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

18 09:45:02.927 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) to *. **. ***. ***

19 09:45:02.927 01/10/13 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xDD3B, Remote Port = 0x01F4

20 09:45:02.927 01/10/13 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is NOT behind a NAT device

21 09:45:02.927 01/10/13 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

22 09:45:02.943 10/01/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

23 09:45:02.943 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

24 09:45:02.943 01/10/13 Sev = Info/4 CM / 0 x 63100015

Launch application xAuth

25 09:45:03.037 01/10/13 Sev = Info/6 GUI/0x63B00012

Attributes of the authentication request is 6: 00.

26 09:45:03.037 01/10/13 Sev = Info/4 CM / 0 x 63100017

xAuth application returned

27 09:45:03.037 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

28 09:45:03.037 10/01/13 Sev = Info/4 IPSEC / 0 x 63700008

IPSec driver started successfully

29 09:45:03.037 01/10/13 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

30 09:45:03.083 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

31 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

32 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

33 09:45:03.083 01/10/13 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

34 09:45:03.083 01/10/13 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

35 09:45:03.083 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

36 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

37 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="" **.**.***.***="" isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

38 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 192.168.2.70

39 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.255.0

40 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 192.168.2.1

41 09:45:03.146 01/10/13 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 8.8.8.8

42 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000001

43 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000001

44 09:45:03.146 10/01/13 Sev = Info/5 IKE/0x6300000F

SPLIT_NET #1

= 192.168.2.0 subnet

mask = 255.255.255.0

Protocol = 0

SRC port = 0

port dest = 0

45 09:45:03.146 10/01/13 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = NCHCO.local

46 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_UDP_NAT_PORT, value = 0 x 00002710

47 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

48 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = 8.4 (1) Cisco systems, Inc. ASA5505 Version built by manufacturers on Tuesday, January 31, 11 02:11

49 09:45:03.146 01/10/13 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

50 09:45:03.146 01/10/13 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

51 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 192.168.2.70, GW IP = *. **. ***. remote IP address = 0.0.0.0

52 09:45:03.146 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to *. **. ***. ***

53 09:45:03.177 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

54 09:45:03.177 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

55 09:45:03.177 01/10/13 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

56 09:45:03.177 01/10/13 Sev = Info/5 IKE / 0 x 63000047

This SA was already alive for 1 second, expiration of adjustment to 86399 seconds now

57 09:45:03.193 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

58 09:45:03.193 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" qm="" *(hash,="" sa,="" non,="" id,="" id,="" notify:status_resp_lifetime)="" from="">

59 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify is set to 28800 seconds

60 09:45:03.193 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH) to *. **. ***. ***

61 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000059

IPsec Security Association of loading (MsgID = SPI OUTBOUND SPI INCOMING = 0x3EBEBFC5 0xAAAF4C1C = 967A3C93)

62 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000025

OUTGOING ESP SPI support: 0xAAAF4C1C

63 09:45:03.193 01/10/13 Sev = Info/5 IKE / 0 x 63000026

Charges INBOUND ESP SPI: 0x3EBEBFC5

64 09:45:03.193 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

65 09:45:03.521 01/10/13 Sev = Info/6 CVPND / 0 x 63400001

Launch VAInst64 for controlling IPSec virtual card

66 09:45:03.896 01/10/13 Sev = Info/4 CM / 0 x 63100034

The virtual card has been activated:

IP=192.168.2.70/255.255.255.0

DNS = 192.168.2.1, 8.8.8.8

WINS = 0.0.0.0 0.0.0.0

Domain = NCHCO.local

Split = DNS names

67 09:45:03.912 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 0.0.0.0 0.0.0.0 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 0.0.0.0 0.0.0.0 261

68 09:45:07.912 01/10/13 Sev = Info/4 CM / 0 x 63100038

Were saved successfully road to file changes.

69 09:45:07.912 01/10/13 Sev = Info/5 CVPND / 0 x 63400013

Destination mask subnet Gateway Interface metric

0.0.0.0 0.0.0.0 96.11.251.1 96.11.251.149 261

**. **. ***. 255.255.255.255 96.11.251.1 96.11.251.149 100

96.11.251.0 255.255.255.0 96.11.251.149 96.11.251.149 261

96.11.251.149 255.255.255.255 96.11.251.149 96.11.251.149 261

96.11.251.255 255.255.255.255 96.11.251.149 96.11.251.149 261

127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306

127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306

127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

192.168.1.0 255.255.255.0 192.168.1.3 192.168.1.3 261

192.168.1.3 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.1.255 255.255.255.255 192.168.1.3 192.168.1.3 261

192.168.2.0 255.255.255.0 192.168.2.70 192.168.2.70 261

192.168.2.0 255.255.255.0 192.168.2.1 192.168.2.70 100

192.168.2.70 255.255.255.255 192.168.2.70 192.168.2.70 261

192.168.2.255 255.255.255.255 192.168.2.70 192.168.2.70 261

224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306

224.0.0.0 240.0.0.0 96.11.251.149 96.11.251.149 261

224.0.0.0 240.0.0.0 192.168.1.3 192.168.1.3 261

224.0.0.0 240.0.0.0 192.168.2.70 192.168.2.70 261

255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306

255.255.255.255 255.255.255.255 96.11.251.149 96.11.251.149 261

255.255.255.255 255.255.255.255 192.168.1.3 192.168.1.3 261

255.255.255.255 255.255.255.255 192.168.2.70 192.168.2.70 261

70 09:45:07.912 01/10/13 Sev = Info/6 CM / 0 x 63100036

The routing table has been updated for the virtual card

71 09:45:07.912 01/10/13 Sev = Info/4 CM/0x6310001A

A secure connection established

72 09:45:07.943 01/10/13 Sev = Info/4 CM/0x6310003B

Look at address added to 96.11.251.149. Current host name: psaserver, current address (s): 192.168.2.70, 96.11.251.149, 192.168.1.3.

73 09:45:07.943 01/10/13 Sev = Info/4 CM/0x6310003B

Look at address added to 192.168.2.70. Current host name: psaserver, current address (s): 192.168.2.70, 96.11.251.149, 192.168.1.3.

74 09:45:07.943 01/10/13 Sev = Info/5 CM / 0 x 63100001

Did not find the smart card to watch for removal

75 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

76 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700010

Creates a new key structure

77 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370000F

Adding key with SPI = 0x1c4cafaa in the list of keys

78 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700010

Creates a new key structure

79 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370000F

Adding key with SPI = 0xc5bfbe3e in the list of keys

80 09:45:07.943 01/10/13 Sev = Info/4 IPSEC/0x6370002F

Assigned WILL interface private addr 192.168.2.70

81 09:45:07.943 01/10/13 Sev = Info/4 IPSEC / 0 x 63700037

Configure the public interface: 96.11.251.149. SG: **.**.***.***

82 09:45:07.943 10/01/13 Sev = Info/6 CM / 0 x 63100046

Define indicator tunnel set up in the registry to 1.

83 09:45:13.459 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

84 09:45:13.459 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205276

85 09:45:13.474 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

86 09:45:13.474 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

87 09:45:13.474 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205276, seq # expected is 107205276

88 09:45:15.959 01/10/13 Sev = Info/4 IPSEC / 0 x 63700019

Activate key dating SPI = 0x1c4cafaa key with SPI = 0xc5bfbe3e

89 09:46:00.947 10/01/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

90 09:46:00.947 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205277

91 09:46:01.529 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

92 09:46:01.529 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

93 09:46:01.529 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205277, seq # expected is 107205277

94 09:46:11.952 01/10/13 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO * (HASH, NOTIFY: DPD_REQUEST) to *. **. ***. ***

95 09:46:11.952 01/10/13 Sev = Info/6 IKE/0x6300003D

Upon request of the DPD to *. **. ***. , our seq # = 107205278

96 09:46:11.979 01/10/13 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

97 09:46:11.979 01/10/13 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:dpd_ack)="" from="">

98 09:46:11.979 01/10/13 Sev = Info/5 IKE / 0 x 63000040

Receipt of DPO ACK to *. **. ***. seq # receipt = 107205278, seq # expected is 107205278

---------------------------------------------------------------------------------------------------------------

Any help would be appreciated, thanks!

try to refuse the ACL (access-list AnyConnect_Client_Local_Print extended deny ip any one) at the end of the ACL.

ASA 5505 IPSEC VPN connected but cannot access the local network

ASA: 8.2.5

ASDM: 6.4.5

LAN: 10.1.0.0/22

Pool VPN: 172.16.10.0/24

Hi, we purcahsed a new ASA 5505 and try to configure IPSEC VPN via ASDM; I simply run the wizards, installation vpnpool, split tunnelling, etc.

I can connect to the ASA using the cisco VPN client and internet works fine on the local PC, but it can not access the local network (can not impossible. ping remote desktop). I tried the same thing on our Production ASA(those have both Remote VPN and Site-to-site VPN working), the new profile, I created worked very well.

Here is my setup, wrong set up anything?

ASA Version 8.2 (5)

!

hostname asatest

domain XXX.com

activate 8Fw1QFqthX2n4uD3 encrypted password

g9NiG6oUPjkYrHNt encrypted passwd

names of

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 10.1.1.253 255.255.252.0

!

interface Vlan2

nameif outside

security-level 0

address IP XXX.XXX.XXX.XXX 255.255.255.240

!

passive FTP mode

clock timezone PST - 8

clock summer-time recurring PDT

DNS server-group DefaultDNS

domain vff.com

vpntest_splitTunnelAcl list standard access allowed 10.1.0.0 255.255.252.0

access extensive list ip 10.1.0.0 inside_nat0_outbound allow 255.255.252.0 172.16.10.0 255.255.255.0

pager lines 24

Enable logging

timestamp of the record

logging trap warnings

asdm of logging of information

logging - the id of the device hostname

host of logging inside the 10.1.1.230

Within 1500 MTU

Outside 1500 MTU

IP local pool 172.16.10.1 - 172.16.10.254 mask 255.255.255.0 vpnpool

no failover

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

AAA-server protocol nt AD

AAA-server host 10.1.1.108 AD (inside)

NT-auth-domain controller 10.1.1.108

Enable http server

http 10.1.0.0 255.255.252.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH 10.1.0.0 255.255.252.0 inside

SSH timeout 20

Console timeout 0

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal group vpntest strategy

Group vpntest policy attributes

value of 10.1.1.108 WINS server

Server DNS 10.1.1.108 value

Protocol-tunnel-VPN IPSec l2tp ipsec

disable the password-storage

disable the IP-comp

Re-xauth disable

disable the PFS

IPSec-udp disable

IPSec-udp-port 10000

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list vpntest_splitTunnelAcl

value by default-domain XXX.com

disable the split-tunnel-all dns

Dungeon-client-config backup servers

the address value vpnpool pools

admin WeiepwREwT66BhE9 encrypted privilege 15 password username

username user5 encrypted password privilege 5 yIWniWfceAUz1sUb

the encrypted password privilege 3 umNHhJnO7McrLxNQ util_3 username

tunnel-group vpntest type remote access

tunnel-group vpntest General attributes

address vpnpool pool

authentication-server-group AD

authentication-server-group (inside) AD

Group Policy - by default-vpntest

band-Kingdom

vpntest group tunnel ipsec-attributes

pre-shared-key BEKey123456

NOCHECK Peer-id-validate

!

!

privilege level 3 mode exec cmd command perfmon

privilege level 3 mode exec cmd ping command

mode privileged exec command cmd level 3

logging of the privilege level 3 mode exec cmd commands

privilege level 3 exec command failover mode cmd

privilege level 3 mode exec command packet cmd - draw

privilege show import at the level 5 exec mode command

privilege level 5 see fashion exec running-config command

order of privilege show level 3 exec mode reload

privilege level 3 exec mode control fashion show

privilege see the level 3 exec firewall command mode

privilege see the level 3 exec mode command ASP.

processor mode privileged exec command to see the level 3

privilege command shell see the level 3 exec mode

privilege show level 3 exec command clock mode

privilege exec mode level 3 dns-hosts command show

privilege see the level 3 exec command access-list mode

logging of orders privilege see the level 3 exec mode

privilege, level 3 see the exec command mode vlan

privilege show level 3 exec command ip mode

privilege, level 3 see fashion exec command ipv6

privilege, level 3 see the exec command failover mode

privilege, level 3 see fashion exec command asdm

exec mode privilege see the level 3 command arp

command routing privilege see the level 3 exec mode

privilege, level 3 see fashion exec command ospf

privilege, level 3 see the exec command in aaa-server mode

AAA mode privileged exec command to see the level 3

privilege, level 3 see fashion exec command eigrp

privilege see the level 3 exec mode command crypto

privilege, level 3 see fashion exec command vpn-sessiondb

privilege level 3 exec mode command ssh show

privilege, level 3 see fashion exec command dhcpd

privilege, level 3 see the vpnclient command exec mode

privilege, level 3 see fashion exec command vpn

privilege level see the 3 blocks from exec mode command

privilege, level 3 see fashion exec command wccp

privilege see the level 3 exec command mode dynamic filters

privilege, level 3 see the exec command in webvpn mode

privilege control module see the level 3 exec mode

privilege, level 3 see fashion exec command uauth

privilege see the level 3 exec command compression mode

level 3 for the show privilege mode configure the command interface

level 3 for the show privilege mode set clock command

level 3 for the show privilege mode configure the access-list command

level 3 for the show privilege mode set up the registration of the order

level 3 for the show privilege mode configure ip command

level 3 for the show privilege mode configure command failover

level 5 mode see the privilege set up command asdm

level 3 for the show privilege mode configure arp command

level 3 for the show privilege mode configure the command routing

level 3 for the show privilege mode configure aaa-order server

level mode 3 privilege see the command configure aaa

level 3 for the show privilege mode configure command crypto

level 3 for the show privilege mode configure ssh command

level 3 for the show privilege mode configure command dhcpd

level 5 mode see the privilege set privilege to command

privilege level clear 3 mode exec command dns host

logging of the privilege clear level 3 exec mode commands

clear level 3 arp command mode privileged exec

AAA-server of privilege clear level 3 exec mode command

privilege clear level 3 exec mode command crypto

privilege clear level 3 exec command mode dynamic filters

level 3 for the privilege cmd mode configure command failover

clear level 3 privilege mode set the logging of command

privilege mode clear level 3 Configure arp command

clear level 3 privilege mode configure command crypto

clear level 3 privilege mode configure aaa-order server

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:447bbbc60fc01e9f83b32b1e0304c6b4

: end

Captures we can see packets going from the pool to the internal LAN, but we do not reply back packages.

The routing must be such that for 172.16.10.0/24 packages should reach the inside interface of the ASA.

On client machines or your internal LAN switch, you need to add route for 172.16.10.0/24 pointing to the inside interface of the ASA.

ASA 5505 VPN Site to site with several networks

Hello

I have a Cisco ASA 5505 configuration problem and hope you can help me.

Our company created a second facility, which must be connected using VPN to our headquarters.

I used the ASDM "Wizard of Site to site VPN" to create a connection, which works very well with our main network.

Following structure:

Headquarters:

Cisco ASA 5505, firmware 9.1, ASDM version 7.1

Outside: Fixed IP

Inside: IP address of the interface is 192.168.0.1/24 (data network)

Now I have a second network 192.168.1.0/24 (VoIP network), PBX address is 192.168.1.10.

The two networks should be accessible through the VPN.

New installation:

Cisco ASA 5505, firmware 9.1, ASDM version 7.1

Outside: Fixed IP

Inside: IP address of the interface is 192.168.2.1/24

I have already created a connection until a PC of the new plant reaches the data network. For example, a ping from 192.168.2.100 to 192.168.0.100 is possible.

Now, I want to add some VoIP phones to the new facility, which can reach the PBX on 192.168.1.10.

In the link, I have already added the two networks as remote network:
```
object-group network Testgroup network-object 192.168.0.0 255.255.255.0 network-object 192.168.1.0 255.255.255.0 access-list outside_cryptomap extended permit ip object-group Testgroup object Remote-Network 
```
My problem now is, I don't know what to define as 'Bridge' on my PBX.

I can't use 192.168.0.1 because it's a different subnet. Also, I can not put a second IP 192.168.1.1 to the interface of the ASA.

You have any ideas, how can I accomplish this, so that the two subnets are accessed through the VPN and all devices have a defined gateway?

Could a "Easy VPN Remote" in "Network Mode" you help me?

What is the difference between 'Site-to-site' and 'extended network '?

Kind regards

Daniel condition, look for the solution GmbH

You can optionally configure a new LAN VIRTUAL (VLAN PBX) on the SAA and connect this interface to the voice network.

If you do not have a spare on the ASA port, then Yes, you have a router to route traffic from the PBX to the ASA via the data network.

Problem with remote access VPN on ASA 5505

I currently have a problem of an ASA 5505 configuration to connect via VPN remote access by using the Cisco VPN Client 5.0.07.0440 under Windows 8 Pro x 64. The VPN client will prompt you for the user name and password during the connection process, but fails soon after.

The VPN client connects is as follows:

---------------------------------------------------------------------------------------------------------------------------------------

Cisco Systems VPN Client Version 5.0.07.0440

Copyright (C) 1998-2010 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.2.9200

2 15:09:21.240 11/12/12 Sev = Info/4 CM / 0 x 63100002

Start the login process

3 15:09:21.287 11/12/12 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

4 15:09:21.287 11/12/12 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "*." **. ***. *** »

5 15:09:21.287 11/12/12 Sev = Info/6 IKE/0x6300003B

Try to establish a connection with *. **. ***. ***.

6 15:09:21.287 11/12/12 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

7 15:09:21.303 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) to *. **. ***. ***

8 15:09:21.365 11/12/12 Sev = Info/6 GUI/0x63B00012

Attributes of the authentication request is 6: 00.

9 15:09:21.334 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

10 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

11 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

12 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

13 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

14 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

15 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

16 15:09:21.334 11/12/12 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

17 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) to *. **. ***. ***

18 15:09:21.334 11/12/12 Sev = Info/6 IKE / 0 x 63000055

Sent a keepalive on the IPSec Security Association

19 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xFBCE, Remote Port = 0 x 1194

20 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is behind a NAT device

21 15:09:21.334 11/12/12 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

22 15:09:21.365 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

23 15:09:21.365 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

24 15:09:21.365 11/12/12 Sev = Info/4 CM / 0 x 63100015

Launch application xAuth

25 15:09:21.474 11/12/12 Sev = Info/4 IPSEC / 0 x 63700008

IPSec driver started successfully

26 15:09:21.474 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

27 15:09:27.319 11/12/12 Sev = Info/4 CM / 0 x 63100017

xAuth application returned

28 15:09:27.319 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

29 15:09:27.365 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

30 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

31 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

32 15:09:27.365 11/12/12 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

33 15:09:27.365 11/12/12 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

34 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

35 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

36 15:09:27.397 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

37 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 192.168.2.70

38 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.255.0

39 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 192.168.2.1

40 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 8.8.8.8

41 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000001

42 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = NCHCO

43 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

44 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc. ASA5505 Version 8.2 (5) built by manufacturers on Saturday, May 20, 11 16:00

45 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

46 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = received and by using the NAT - T port number, value = 0 x 00001194

47 15:09:27.397 11/12/12 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

48 15:09:27.412 11/12/12 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 192.168.2.70, GW IP = *. **. ***. remote IP address = 0.0.0.0

49 15:09:27.412 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to *. **. ***. ***

50 15:09:27.444 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

51 15:09:27.444 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

52 15:09:27.444 11/12/12 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

53 15:09:27.444 11/12/12 Sev = Info/5 IKE / 0 x 63000047

This SA was already alive for 6 seconds, setting expiration 86394 seconds now

54 15:09:27.459 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

55 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">

56 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO *(HASH, DEL) to *. **. ***. ***

57 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000049

IPsec security association negotiation made scrapped, MsgID = CE99A8A8

58 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000017

Marking of IKE SA delete (I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

59 15:09:27.459 11/12/12 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = *. **. ***. ***

60 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000058

Received an ISAKMP for a SA message no assets, I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924

61 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(dropped)="" from="">

62 15:09:27.490 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

63 15:09:30.475 11/12/12 Sev = Info/4 IKE/0x6300004B

IKE negotiation to throw HIS (I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

64 15:09:30.475 11/12/12 Sev = Info/4 CM / 0 x 63100012

ITS phase 1 deleted before first Phase 2 SA is caused by "DEL_REASON_IKE_NEG_FAILED". Crypto 0 Active IKE SA, 0 IKE SA authenticated user in the system

65 15:09:30.475 11/12/12 Sev = Info/5 CM / 0 x 63100025

Initializing CVPNDrv

66 15:09:30.475 11/12/12 Sev = Info/6 CM / 0 x 63100046

Set indicator established tunnel to register to 0.

67 15:09:30.475 11/12/12 Sev = Info/4 IKE / 0 x 63000001

Signal received IKE to complete the VPN connection

68 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

69 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

70 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

Remove all keys

71 15:09:30.475 11/12/12 Sev = Info/4 IPSEC/0x6370000A

IPSec driver successfully stopped

---------------------------------------------------------------------------------------------------------------------------------------

The running configuration is the following (there is a VPN site-to-site set up as well at an another ASA 5505, but that works perfectly):

: Saved

:

ASA Version 8.2 (5)

!

hostname NCHCO

Select hTjwXz/V8EuTw9p9 of encrypted password

hTjwXz/V8EuTw9p9 of encrypted passwd

names of

description of NCHCO name 192.168.2.0 City offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address **. ***. 255.255.255.248

!

boot system Disk0: / asa825 - k8.bin

passive FTP mode

access extensive list ip NCHCO 255.255.255.0 outside_nat0_outbound allow 192.168.1.0 255.255.255.0

access extensive list ip NCHCO 255.255.255.0 inside_nat0_outbound allow 192.168.1.0 255.255.255.0

inside_nat0_outbound list of allowed ip extended access all 192.168.2.64 255.255.255.224

access extensive list ip NCHCO 255.255.255.0 outside_1_cryptomap allow 192.168.1.0 255.255.255.0

access extensive list ip NCHCO 255.255.255.0 outside_1_cryptomap_1 allow 192.168.1.0 255.255.255.0

Standard access list LAN_Access allow NCHCO 255.255.255.0

LAN_Access list standard access allowed 0.0.0.0 255.255.255.0

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

mask of VPN_Pool VPN_Start VPN_End of local pool IP 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 645.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (outside) 0-list of access outside_nat0_outbound

Route outside 0.0.0.0 0.0.0.0 74.219.208.49 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

network-acl outside_nat0_outbound

WebVPN

SVC request to enable default svc

Enable http server

http 192.168.1.0 255.255.255.0 inside

http *. **. ***. 255.255.255.255 outside

http 74.218.158.238 255.255.255.255 outside

http NCHCO 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac l2tp-transform

Crypto ipsec transform-set l2tp-transformation mode transit

Crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_MD5

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set pfs Group1

crypto dynamic-map dyn-map transform 10-set, vpn l2tp-transformation-transformation

dynamic-map encryption dyn-map 10 value reverse-road

Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS_ESP_3DES_MD5

card crypto outside_map 1 match address outside_1_cryptomap

card crypto outside_map 1 set pfs Group1

peer set card crypto outside_map 1 74.219.208.50

card crypto outside_map 1 set of transformation-ESP-3DES-SHA

map outside_map 20-isakmp ipsec crypto dynamic outside_dyn_map

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

inside crypto map inside_map interface

card crypto vpn-map 1 match address outside_1_cryptomap_1

card crypto vpn-card 1 set pfs Group1

set vpn-card crypto map peer 1 74.219.208.50

card crypto vpn-card 1 set of transformation-ESP-3DES-SHA

dynamic vpn-map 10 dyn-map ipsec isakmp crypto map

crypto isakmp identity address

crypto ISAKMP allow inside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 15

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 35

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP ipsec-over-tcp port 10000

enable client-implementation to date

Telnet 192.168.1.0 255.255.255.0 inside

Telnet NCHCO 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH NCHCO 255.255.255.0 inside

SSH timeout 5

Console timeout 0

dhcpd address 192.168.2.150 - 192.168.2.225 inside

dhcpd dns 216.68.4.10 216.68.5.10 interface inside

lease interface 64000 dhcpd inside

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server DNS 192.168.2.1

Protocol-tunnel-VPN IPSec l2tp ipsec

nchco.local value by default-field

attributes of Group Policy DfltGrpPolicy

value of server DNS 192.168.2.1

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

allow password-storage

enable IPSec-udp

enable dhcp Intercept 255.255.255.0

the address value VPN_Pool pools

internal NCHVPN group policy

NCHVPN group policy attributes

value of 192.168.2.1 DNS Server 8.8.8.8

Protocol-tunnel-VPN IPSec l2tp ipsec

value by default-field NCHCO

admin LbMiJuAJjDaFb2uw encrypted privilege 15 password username

username privilege 15 encrypted password yB1lHEVmHZGj5C2Z 8njferg

username, encrypted NCHvpn99 QhZZtJfwbnowceB7 password

attributes global-tunnel-group DefaultRAGroup

address (inside) VPN_Pool pool

address pool VPN_Pool

authentication-server-group (inside) LOCAL

authentication-server-group (outside LOCAL)

LOCAL authority-server-group

authorization-server-group (inside) LOCAL

authorization-server-group (outside LOCAL)

Group Policy - by default-DefaultRAGroup

band-Kingdom

band-band

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared key *.

NOCHECK Peer-id-validate

tunnel-group DefaultRAGroup ppp-attributes

No chap authentication

no authentication ms-chap-v1

ms-chap-v2 authentication

tunnel-group DefaultWEBVPNGroup ppp-attributes

PAP Authentication

ms-chap-v2 authentication

tunnel-group 74.219.208.50 type ipsec-l2l

IPSec-attributes tunnel-group 74.219.208.50

pre-shared key *.

type tunnel-group NCHVPN remote access

attributes global-tunnel-group NCHVPN

address pool VPN_Pool

Group Policy - by default-NCHVPN

IPSec-attributes tunnel-group NCHVPN

pre-shared key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:15852745977ff159ba808c4a4feb61fa

: end

ASDM image disk0: / asdm - 645.bin

ASDM VPN_Start 255.255.255.255 inside location

ASDM VPN_End 255.255.255.255 inside location

don't allow no asdm history

Anyone have any idea why this is happening?

Thank you!

Add, crypto dynamic-map outside_dyn_map 20 value reverse-road.

With respect,

Safwan

Outgoing Microsoft VPN via a device ASA 5505

Similar Questions

Maybe you are looking for