PAP authentication protocol

Similar Questions

• Toshiba Wireless Manager - not possible to choose the authentication protocol

  Hello

  I use for my Toshiba Wireless Manager mobile broadband connections. In a connection profile, it is not possible for me to choose what authentication protocol to use. In the Advanced Settings tab, the authentication section is grayed out. Using the program is mentioned that you can change the authentication settings.

  Concerning

  Post edited by: malo

  Hello

  As far as I know to create a new profile.
  Then you could add the APN, user name, password and authentication protocol
  But my knowledge in most of the cases, the SIM card is detected automatically and no manual work is required. If you do not need to choose the authentication protocol

  Welcome them

• The code of failure of the authentication protocol Kerberos was "the user account has been automatically locked because too many attempts to invalid login or password change attempts have been requested.

  Hello

  I use Windows 7 (32-bit) with SP1.

  Quite often (at least three times a day) I am to be locked of my PC and cannot connect to 30 mts each time. I've analyzed carefully and there is absolutely nothing wrong with my ID on the front of Windows AD or group etc. policy.

  I am getting event ID 40690 in my observer of events and here are the details...

  WARNING on 09/06/2011 09:07:54 lsasrv 40960 any

  Log name: System

  Source: lsasrv with

  Date: 09/06/2011 09:07:54

  Event ID: 40960

  Task category: no

  Level: WARNING

  Keywords:

  User: SYSTEM

  Computer: workstation.companyname.com

  Description:

  The security system detected an authentication for the HTTP/http-proxy server error - nom_societe.com. The code of failure of the authentication protocol Kerberos was "the user account has been automatically locked because too many attempts to invalid login or password change attempts have been requested.

  (0xc0000234).

  I searched all possible sites and cannot find an appropriate solution.

  As it is causing a lot of inconvenience would appreciate a miracle solution as soon as POSSIBLE.

  See you soon,.

  bcshekar

  Hi bcshekar,

  The question you have posted is related to the area and would be better suited to the net Tech community. Please visit the link below to find a community that will provide the support you want.
  http://social.technet.Microsoft.com/forums/en-us/w7itprosecurity/threads

• Cisco supports strong remote network authentication protocols?

  Hello world

  To the best of my knowledge IOS and IOS - XE nothing better than PAP support for authenticating users to network devices remotely. Is there a solution more concentrated than PAP, perhaps CHAP or P/EAP-based? Given the fact that OpenSSL already installed in these devices, I'm surprised that EAP-TTLS has not been adopted as a secure alternative.

  Any ideas?

  Hey Hod,

  As far as I'm concerned, I don't know of any technology readily available to protect RAY sessions between the authenticator and the RADIUS server. The need for this is may be minimized by the fact that common applications of RADIUS (i.e., PPP, 802. 1 X and wireless authentication) establish a secure channel "supplicant" - RADIUS and use EAP to carry any authentication the begging and RADIUS is supported, with the authenticator, being relegated to a minor role of reconditioning of EAP messages in pairs of RAY - V and vice versa. This whole chain carrying identification user information can be protected by TLS, the actual communication between a RADIUS server and her authenticators is not protected by itself.

  Many sources often States in a flippant remark that a VPN tunnel, such as IPsec, could be used to protect RAY sessions. It is hardly feasible, however, because many features in the role of authenticator (for example, switches) have no support for IPsec, either. It seems that RADIUS has been recently extended with TLS support - the "RadSec" is described in RFC 6614 but I've not supported by devices yet seen - honestly, I learned about this was now alone as I looking for some details during the drafting of this response.

  Protect the old RADIUS protocol is always a challenge, it would seem.

  Best regards
  Peter

• safety notice: vulnerability of the Extensible Authentication Protocol

  On this notice, no idea if the version of the software 12.1 (13) EW2 is vulnerable? Because the opinion doesn't give much info on the affected versions. (Bug ID: CSCsb45696 )

  Like many, I know, the specified bug is not listed under the affected versions. So you can keep the same version and study other ways.

• ORA-28040: no authentication protocol for

  
  Hi, I have recently updated my 11.2.0.3 to 12.1.0.1 database using DBUA who went even if it is ok.

  Accesses the database normally on the server, I am unable to access it using a client (in the case of TOAD).

  After doing a search online

  It seems to indicate a problem with the sqlnet.ora - but I sqlnet.ora installed on the server (do I really need?)

  On the client ive checked and the sqlnet.ora is as follows:

  NAMES. Domaine_par_defaut = ukabs

  .local

  SQLNET. AUTHENTICATION_SERVICES = (NTS)

  NAMES. DIRECTORY_PATH = (ONAMES)

  Ive has never even looked in sqlnet.ora before ive never needed to. Other databases (versions 10.2 and 11.2) have always run fine.

  I use an old customer, as one of our applications 9.2.0.1.0 cannot currently run on something higher than current time.

  Listener seems ok. Any ideas?

  Thank you

  Adam

  PL see MOS Doc 207303.1

  You will need a version of the client which is at least 10.2.0.2

• Problem of authenticating users on L2TP over IPSec tunnel

  I have a client with an old PIX-515e firewall with firmware 7.2 (4), and due to certain circumstances, I'm trying to configure L2TP over IPSec. I'm stuck at a "Error 691: the remote connection has been deinied because the user name and password combination, you have provided is not recognized, or the selected authentication protocol is not permitted on the remote access server." I have local installation of authentication for this connection, and I tried to use ms-chap-v2, chap and pap, and give the same results. I have confirmed the username and the password, but I can't after that.

  The PIX, I don't see "AAA user authenticaton rejected: reason = invalid password: local database: user = tetstuser". I can still see the password unencrypted on the screen, so I can copy and paste the username and password in the appropriate fields, and I still have this error.

  Does anyone have an idea where the problem lies perhaps? Thank you.

  Can you please change the user as described in the doc, I shared and as indicated by the Rohan peers and share the results of the tests?

  Kind regards

  Dinesh Moudgil

  PS Please rate helpful messages.

• Search for host ISE MAB - PAP or EAP - MD5

  In the docs, it is said that MAB uses PAP/ASCII or EAP - MD5 for the MAC as a username / password.

  In the configuration of the attached, MAB talking place successfully from an iPhone, without going through PAP or EAP - MD5 enabled as allowed protocols.

  Is the "host search" under the allowed protocols, provides the MAC address to be spent in PAP / EAP - MD5, even if these two protocols are not enabled below in the section Configuring authentication protocols?

  How could dictate us our switch to start the use of EAP - MD5 for the MAC?  If you look at the details of authentication attached output, it indicates in the AV pair an EAP-key.  Isn't it?

  Thank you.

  Cath.

  Hello Cath-

  Question #1: Yes, I think you're right. I think that the "host search" is kind of 'Protocol', used to treat the MAB. If you look at the top of the authentication session of do you by virtue of the ' authentication protocol? My guess is that you see "Lookup" (see screenshot)

  Question #2: You can force the switch to use EAP - MD5 by adding "EAP" to the "MAB" command under the individual ports:

  interface fa0/1

  MAB eap

  Things to conisider:

  1) if you make this change the condition by default/built-in in ISE "Wired-MAB" will have to be modified since the

  the service type radius attribute will be of "Check call" to "box. So your MAB devices can easily ignore the rule of authentication of the MAB and be denied on the network

  2) because the MAC address is sent in clear text "Attribute 31" (Calling-Station-Id), MAB EAP offers additional security by encrypting the MAC address in the password

  3) because the service for MAB EAP type is identical to a request from IEEE 802. 1 X, RADIUS server will not be able to easily differentiate requests for MAB EAP requests IEEE 802. 1 X

  This is a good document that you can reference as well:

  http://www.Cisco.com/en/us/prod/collateral/iosswrel/ps6537/ps6586/ps6638/config_guide_c17-663759.html

  I hope this helps...

  Thanks for the note!

• Firefox MAC v30 with proxy must authenticate "Cache Access Denied" sorry, you are not allowed to ask: this cover until you have authenticated

  Firefox functioned perfectly until we have updated to version 30.0. It seems that the new version does not like our Proxy Configuration that requires users to auth with their AD accounts.

  In the latest version, Firefox will appear a box that allow you to type the user name and password that works perfectly. However, this is not pop up anymore and gives me this error message.

  The following error was encountered:
  

     Cache Access Denied.
  

  Sorry, you are not allowed to ask:

     http://www.google.com.au/url?
  

  This cache until you have yourself authenticated.

  I try to configure the username into a key ring and allow firefox to access manually, but Firefox seems does not access this key chain at all.

  Is that someone has a problem with the proxy server that needs to authenticate in Firefox30.0? Does anyone know the possible solutions?

  Thank you very much!

  Shuopan

  Trouble Shooting - update

  Interestingly enough, Firefox works for 1 minute after I use Safari with proxy Auth. However, if I get Safari for 1 or 2 minutes, Firefox will be stop working and displays similar error message.

  tried network.http.use - cache = false but does not work

  Thank you

  We find the solution of Philipp is useful.

  "Hello, this is perhaps due to the deactivation of some insecure authentication protocols in firefox 30: https://www.mozilla.org/en-US/firefox/30.0/releasenotes/#whatsnew .

  You can try to enter: config in the firefox address bar (confirm the message information where it appears) and search for the preference named network.negotiate - auth.allow - insecurity-ntlm-v1. Double-click it and change its value to true. »

  https://www.Mozilla.org/en-us/Firefox/30.0/releasenotes/#whatsnew

• Cisco ISE 1.3 using 802.1 x authentication for wireless clients

  Hello

  I fell into a strange question attempts to authenticate a user more wireless. I use as PEAP authentication protocol. I have configured my strategy of authentication and authorization, but when I come to authenticate the selected authorization policy are by default that denies access.

  I used the 802. 1 x conditions made up to match the computer authentication, then the user authentication

  AUTHENTICATION OF THE COMPUTER

  football match

  Box

  Wireless

  Group of ads (machine)

  AUTHENTICATING USERS

  football match

  Box

  Wireless

  Ad (USER) group

  has been authenticated = true

  Here are the measures taken to authenticate any ideas would be great.

  Request for access received RADIUS 11001
  11017 RADIUS creates a new session
  15049 evaluating Policy Group
  Service evaluation 15008 selection policy
  15048 questioned PIP
  15048 questioned PIP
  15048 questioned PIP
  15006 set default mapping rule
  11507 extract EAP-response/identity
  12300 prepared EAP-request with PEAP with challenge
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12302 extracted EAP-response containing PEAP challenge-response and accepting as negotiated PEAP
  12318 has successfully PEAP version 0
  12800 first extract TLS record; TLS handshake began
  12805 extracted TLS ClientHello message
  12806 prepared TLS ServerHello message
  12807 prepared the TLS certificate message
  12810 prepared TLS ServerDone message
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  12318 has successfully PEAP version 0
  12812 extracted TLS ClientKeyExchange message
  12804 message retrieved over TLS
  12801 prepared TLS ChangeCipherSpec message
  12802 completed TLS prepared message
  12816 TLS handshake succeeded
  12310 full handshake PEAP completed successfully
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  12313 PEAP inner method started
  11521 prepared EAP-request/identity for inner EAP method
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  11522 extract EAP-Response/Identity for EAP method internal
  11806 prepared EAP-internal method call offering EAP-MSCHAP VERSION challenge
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  11808 extracted EAP-response containing EAP - MSCHAP VERSION challenge response to the internal method and accepting of EAP - MSCHAP VERSION such as negotiated
  15041 assessment political identity
  15006 set default mapping rule
  Source sequence 22072 Selected identity
  15013 selected identity Source - AD1
  24430 Authenticating user in Active Directory
  Identity resolution 24325
  24313 is looking to match accounts at the junction
  24315 account in the domain
  24323 identity resolution detected single correspondent account
  Application for CPP 24343 successful logon
  24402 user Active Directory authentication succeeded
  Authentication 22037 spent
  EAP-MSCHAP VERSION 11824 passed authentication attempt
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  11810 extract EAP-response to the internal method containing MSCHAP stimulus / response
  11814 inner EAP-MSCHAP VERSION successful authentication
  11519 prepared EAP-success for the inner EAP method
  12314 PEAP inner method completed successfully
  prepared 12305 EAP-request another challenge PEAP
  11006 returned Challenge RADIUS access
  Request for access received RADIUS 11001
  11018 RADIUS re - use an existing session
  12304 extract EAP-response containing PEAP stimulus / response
  ISE 24423 was not able to confirm the successful previous machine authentication
  15036 assessment authorization policy
  15048 questioned PIP
  15048 questioned PIP
  Looking 24432 user in Active Directory - xxx\zzz Support
  24355 fetch LDAP succeeded
  Recovery of user 24416 of Active Directory groups succeeded
  15048 questioned PIP
  15048 questioned PIP
  15004 Matched rule - default
  15016 selected the authorization - DenyAccess profile
  15039 rejected by authorization profile
  12306 successful PEAP authentication
  11503 prepared EAP-success
  11003 returned RADIUS Access-Reject
  Endpoint 5434 conducted several failed authentications of the same scenario

  Windows will only be machine authentication when you start, then test you can't just disconnect/connect the pc, you will need to restart. The solution is called cisco anyconnect nam and eap-chaining.

• VPN 3000 Concentrator authentication failure.

  Hi team,

  I am facing the error of authentication in the hub.

  Scenario: -.

  Hub is integrated with AD.

  Error: -.

  ---

  2451 11/22/2009 13:20:35.550 SEV = 3 RPT AUTH/5 = 19132 86.62.198.251
  Authentication was rejected: reason = Unspecified
  manage 396, server = 172.27.1.13 =, user = 23733, area =

  Hi subashmbi,

  I have more questions for you: -.

  1. which authentication protocol is used with AD?

  2. by chance "23733" user which you see the authentication error, part of several groups defined in AD?

  As a quick test, try to switch the VPN group to NT domain authentication and let me know how it goes...

  If NT does not work then try LOCAL authentication.

  Waiting for your answer, the answers to the questions posed above and the results of the test with NT and LOCAL...

  Concerning

  M

• UCS Manager 2.2 - LDAP authentication

  Hello

  I have some general questions about authentication LDAP and UCS Manager.

  I hope it's unterstandable...

  We have the following structure:

  • DC = Company.domain.com
    • OU = Domain Administration
      • OU =Administrators
        • UO = Germany
          • CN = User1-SMA
          • CN = SMA-user2
      • OU = Test-UO
        • CN = ucstestuser
        • CN = ucsadmingroup--> Member = SMA-user1, user2-SMA
          

  I added an LDAP provider

  binduser is the SMA-User1

  Base DN = OU = Domain Administration, DC = company, DC = domain, DC = com

  attribute = empty

  filter = sAMAccountName = $userid

  password for User1 SMA

  group permission / recursive enabled.

  I have not add some attributes or map the group. Now I can connect with ucstestuser (read-only), but not with SMA-user1 user2 SMA oder.

  If I add ucstestuser to ucsadmingroup a map of this group, ucstestuser can access and have right to admin, ADM-user1 and user2-adm cannot access (user authentication failed).

  I don't understand, why ucstestuser can access and other users in a different OU not. Unique database name is domain Administration, so that UCSM should see all three users, not?

  Can anyone help? Thank you.

  / Danny

  With UCS remote authentication when a user connects using a temporary account on the FI as a UCS-MyAuthDomain\myusername, which is limited to a total of 32 characters.  If you shorten the name of domain authentication defined in UCSM domain.com to a shorter name as AD, it will allow for the use of a username any longer.

  Note

  For systems using the remote authentication protocol, the authentication domain name is considered to be part of the user name and the limit of 32 characters for usernames created locally. Because Cisco UCS inserts 5-character formatting, the authentication will fail if the name and the user character domain name combined total is greater than 27.

  http://www.Cisco.com/c/en/us/TD/docs/unified_computing/UCS/SW/GUI/config/Guide/2-2/b_UCSM_GUI_Configuration_Guide_2_2/b_UCSM_GUI_Configuration_Guide_2_1_chapter_01000.html

• Authentication RADIUS with ISE - a wrong IP address

  Hello

  We use ISE for radius authentication.  I have setup a new Cisco switch stack to one of our branches and set up the device network in ISE.  Unfortunately, in trying to authenticate, ISE logs show a lack of "Impossible to locate device network or Client AAA" the reason for this failure is that the log shows that it comes from a bad IP address.  The IP address of the switch is 10.xxx.aaa.241, but the logs show that it is 10.xxx.aaa.243.  I removed and added the configs of RADIUS on ISE and the switch, but it is always so que.243.  There is another switch battery location (same model, IOS etc), which works correctly.

  The config of RADIUS on the switch:

  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authentication login Comm group local RADIUS
  the AAA authentication enable default
  RADIUS group AAA authorization exec default authenticated if

  radius of the IP source-interface Vlanyy
  10.xxx.yyy.zzz RADIUS server
  10.xxx.yyy.zzz auth-port 1812 acct-port 1813 ipv4 address
  abcdefg 7 key

  The journal of ISE:

  Overview
  5405 RAY lost event
  Username
  ID of the endpoint
  Profile of endpoint
  The authorization profile

  Details of authentication
  Source Timestamp 2014-07-30 08:48:51.923
  Receipt 08:48:51.923 Timestamp 2014-07-30
  Policy Server ise
  5405 RAY lost event
  11007 failure reason could not locate device network or Client AAA
  Resolution check if the device network or AAA client is configured in: Administration > network resources > network devices
  Root cause could not find the network device or the AAA Client while accessing NAS by IP during authentication.
  Username
  Type of user
  ID of the endpoint
  Profile of endpoint
  IP address
  Identity store
  Membership group
  ID of Session verification
  Authentication method
  Authentication Protocol
  Type of service
  Network device
  Type of device
  Location
  10.xxx.AAA.243 address IP NAS
  ID of Port NAS tty2
  Virtual NAS Port Type
  The authorization profile
  Status of the posture
  Security group
  Response time

  Other attributes
  ConfigVersionId 107
  Device port 1645
  DestinationPort 1812
  Radius protocol
  NAS-Port 2
  AcsSessionID ise1/186896437/1172639
  IP address of the device 10.xxx.aaa.243
  CiscoAVPair

  Measures
  Request for access received RADIUS 11001
  11017 RADIUS creates a new session
  11007 could locate no device network or Client AAA
  5405

  As a test, I set up a device that uses the adresse.243.  While ISE claims that it authenticates, it really doesn't.  I have to use my local account to access the device.

  Any advice on how to solve this problem would be appreciated.  Please let me know if you need more information.

  Beth

  Remove your (RADIUS-server host 10.x.x.x... ect) tele-health and try this command and see if the problem goes away. The new section is the non-standard expression allows to see if that helps.

  RADIUS-server host non-standard key of acct-port of the auth-port 1645 10.xxx.xxx.xxx 1646 *.

• Using PEAP get "authentication failed" in the event log

  I'm trying to set up a server RADIUS and PEAP on a CISCO ARI-AP1242AG-A-K9 and I get an authentication failure message in the event log.

  First of all, I see 10.209.128.61:1645, 1646 RADIUS server does not respond.

  Then I see 10.209.128.61:1645, 1646 RADIUS server is back.

  Then, I get the message "failure of authentication station.

  The association tab shows the status of the client as 'treatment of the association.

  Customers are a Flint MX-560 and a windows XP SP2 laptop HP with a intel PRO/Wireless 3945ABG Network card internal.

  I was able to get the Flint to work using JUMP, but no luck at all either with the PEAP Protocol.

  Can someone help me?

  Thank you!

  PEAP allows to authenticate wireless users without requiring that they have USER certificates, but we still need a ROOT certificate.

  Here are some more specific details on PEAP:

  ... 'the protected '.

  Extensible Authentication Protocol (PEAP) Version 2, which provides

  a tunnel encrypted and authenticated, based on the transport layer

  Security (TLS) that encapsulates the EAP authentication mechanisms.

  PEAPv2 uses TLS security to protect against rogue authenticators, to protect

  against various attacks on confidentiality and the integrity of the method internal EAP Exchange and provide the EAP peer for the protection of privacy. »

  "In negotiating TLS, the server presents a certificate of.

  the peer. The peer MUST verify the validity of the EAP server

  certificate and SHOULD also consider the name of the EAP server presented in

  the certificate to determine if the EAP server can be

  of trust. »

  http://Tools.ietf.org/ID/draft-josefsson-PPPEXT-EAP-TLS-EAP-10.txt

  •PEAP uses the side authentication server of digital certification PKI public key Infrastructure-based.

  •PEAP uses TLS to encrypt all sensitive user authentication information.

  http://www.Cisco.com/en/us/docs/wireless/technology/PEAP/technical/reference/PEAP_D.html#wp998638

• VPN with AD authentication fails Error 691

  Hello

  I have configured my asa 5510 use AD for authentication of the vpn users.  Although I am using l2tp ipsec I used the following document as a line manager https://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808c3c45.shtml#prereq

  .  When testing within the ASDM AD connection is successful.

  .  When you try to connect with a microsoft vpn client I get error 691: the remote connection was denied because the user name and password combination, you have provided is not recognized or the selected authentication protocol is not permitted on the remote access server.  On the vpn client, I have only active MSCHAPv2 and I require encryption.

  .  When debugging ldap 255 running I get the following output

  [26] starting a session
  [26] new application Session, framework 0xd8760198, reqType = authentication
  [26] the fiber began
  [26] Failed: the user name or password is empty
  [26] output fiber Tx = 0 bytes Rx = 0 bytes, status =-3
  [26] end of session

  Before you configure my conncetion VPN profile to use AD, I was able to connect using the LOCAL users.  When connected to the vpn, there is no access to the network.

  Here is the output of conf, see the

  name of host host1
  Select r2.d52YOdvbTM6/l encrypted password
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 100.100.100.178 255.255.255.240 watch 100.100.100.179
  !
  interface Ethernet0/1
  nameif Inside_1
  security-level 60
  IP 20.20.20.2 255.255.255.0 watch 20.20.20.3
  !
  interface Ethernet0/2
  nameif Inside_2
  security-level 90
  IP 30.30.30.2 255.255.255.0 watch 30.30.30.3
  !
  interface Ethernet0/3
  nameif DMZ
  security-level 30
  IP 10.10.3.2 255.255.255.0 watch 10.10.3.3
  !
  interface Management0/0
  Failover LAN Interface Description
  !
  passive FTP mode
  clock timezone THATS 1
  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00
  Standard access list DefaultRAGroup_splitTunnelAcl allow 20.20.20.0 255.255.255.0
  20.20.20.0 IP Access-list extended sheep 255.255.255.0 allow 10.0.5.0 255.255.255.0
  pager lines 24
  asdm of logging of information
  Outside 1500 MTU
  MTU 1500 Inside_1
  MTU 1500 Inside_2
  MTU 1500 DMZ
  IP local pool clientVPNpool 10.0.5.10 - 10.0.5.150 mask 255.255.255.0
  failover
  secondary failover lan unit
  failover lan interface failoverlink Management0/0
  failover interface ip failoverlink 90.0.0.2 255.255.255.0 ensures 90.0.0.3
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  Global (1 interface external)
  NAT 0 access-list sheep (Inside_1)
  NAT (Inside_1) 1 0.0.0.0 0.0.0.0
  Route outside 0.0.0.0 0.0.0.0 100.100.100.177 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  AAA-server ActiveDirectory ldap Protocol
  AAA-Server Active Directory (Inside_1) 20.20.20.24
  LDAP-base-dn OU = ouname, DC = domain_name, DC = local
  LDAP-scope subtree
  LDAP-naming-attribute sAMAccountName
  LDAP-login-password *.
  LDAP-connection-dn CN = cisco, OU = Service accounts, OR = ouname, DC = domain_name, DC = local
  microsoft server type
  the ssh LOCAL console AAA authentication
  Enable http server
  http 20.20.20.0 255.255.255.0 Inside_1
  http 30.30.30.0 255.255.255.0 Inside_2
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA
  Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set transport mode ESP-AES-256-SHA
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA mode transit
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5 TRANS_ESP_3DES_SHA
  card crypto Outside_map 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  Outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400
  crypto ISAKMP policy 20
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  crypto ISAKMP policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  Crypto isakmp nat-traversal 30
  Telnet timeout 5
  SSH 20.20.20.0 255.255.255.0 Inside_1
  SSH 30.30.30.0 255.255.255.0 Inside_2
  SSH timeout 5
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  allow outside
  internal DefaultRAGroup group strategy
  attributes of Group Policy DefaultRAGroup
  value of 20.20.20.24 DNS server 30.30.30.35
  Protocol-tunnel-VPN IPSec l2tp ipsec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl
  by default-field value NomDomaine.local
  username password test DLaUiAX3l78qgoB5c7iVNw is encrypted nt
  VPNtest2 password pXVGjB7BA7pQ4yNcDbuXkw user name is nt encrypted
  attributes global-tunnel-group DefaultRAGroup
  address clientVPNpool pool
  ActiveDirectory authentication-server-group
  Group Policy - by default-DefaultRAGroup
  IPSec-attributes tunnel-group DefaultRAGroup
  pre-shared-key *.
  tunnel-group DefaultRAGroup ppp-attributes
  No chap authentication
  ms-chap-v2 authentication
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  inspect the pptp
  World-Policy policy-map
  class inspection_default
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:756efffc44ac8f81f4f377567174c15f
  : end

  Hmmm what DPI only on ASA setting and customer?

  It is obviously one of the possibilities.