RV180W syslog logging

Similar Questions

• the 0-7 syslog logging level

  Hello Sir,

  I want to set up a syslog server and switches will send the log file to the analyst syslog server.

  Please Veuileez share with me level 0 (emergency) to level 7 (debug mode).

  What level I put only then can trace changes of username and user on the switch configuration?

  or any configuration which able to follow it and send to syslog server?

  Hello

  Would the following that you are looking to have something?

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t4/feature/guide/gtconlog.html

• Remote Syslog logging - need help

  Hi guys.

  Im making my way through the hardening guide and im currently stuck on logging of syslog remote.

  Ive updated/etc/syslog.conf to show the following

  local6. / Var/log/vmkernel *.*@10.1.1.5 notice

  issued esxcfg-firewall - o 514, udp, outside, syslog

  and said to syslogd reread the configuration file with kill - SIGHUP 'cat /var/run/syslogd.pid '.

  But I'm not logging information of seeeing vmkernel on the source appear in the vmkernel destination host log file using tail-f/var/log/vmkernel

  Any ideas guys?

  Logging remotely to another ESX makes no sense.

  I created a linux VM for purposes of looging and now syslog-ng works very well for me.

  ---

  VMware vExpert 2009

  http://blog.vadmin.ru

• Impossible to get the specific features of cisco in LMS syslogs

  Hello

  It's about a problem that we face with our LMS 3.2.1. We cannot get specific cisco devices syslogs, while we are able to get the rest devices syslogs. one you suggest what would be the exact reason for this and the troubleshooting steps.

  Thanks in advance,

  Raja

  Hello

  The first thing I would say is to make sure that you have these devices configured to send the syslogs to that specific server. See config below:

  3725B - CR - NMS (config) #logging host?
  Host name or A.B.C.D IP address of the syslog server

  If that is already set up, please make sure that syslog messages are on the server. Create a message simple syslog and check the syslog.log file located in NMSROOT/CSCOpx/log to make sure it's written there. You can also run a capture of packages to confirm the foregoing. If you have this installed on Linux/Solaris, check the syslog_info file (/ var/log /).

  You can generate a test syslog as shown below:

  3725 B-CR-NEM #conf t
  Enter configuration commands, one per line.  End with CNTL/Z.
  3725B - CR - NMS (config) #exit
  B-CR-NMS 3725 #.
  * 03:35:42.613 13 Oct: % SYS-5-CONFIG_I: configured from console by admin on vty1 (192.168.10.197)

  NMSROOT is the LMS installation directory

  Let me know the results.

  Allen has.

• The issue of logging of access control list name.

  Hello

  I've used ACL for many years and had not too many questions. I am a new client site and a project of Port authentication that we planned on using extanded access control lists to control traffic entirely open to help write the correct ACL for services using the ACL. The issue I have found is using the ACL below-> syslog logging does not show the port number which is exactly what we are after. We have not named ACL extended that record the port number as well.

  Running: Cisco IOS Software, s72033_rp (s72033_rp-IPSERVICESK9_WAN-M), Version 12.2 (33) SXH3a, RELEASE SOFTWARE (fc1)

  IP extended Access-list-example access list

  IP enable any any newspaper
  deny ip any any newspaper

  The log output:

  Mar 22 11:23:46: % s-6-IPACCESSLOGP: the list of access-list-example permit tcp nnn.nnn.nnn.nnn (0)-> xxx.xxx.xxx.xxx (0), 1 packet

  On a normal extended access list, we get this in a log output:

  access-list 120 allow host ip nnn.nnn.nnn.nnn xxx.xxx.xxx.0 0.0.0.7 Journal

  Mar 22 09:31:46: % s-6-IPACCESSLOGP: list 120 permit tcp nnn.nnn.nnn.nnn (3874)-> xxx.xxx.xxx.xxx (5001), 1 packet

  This shows the port numbers - I was wondering what small thing that I missed on logging for what I checked: http://www.cisco.com/web/about/security/intelligence/acl-logging.html and I see that the use of the switch of newspaper should do this because it shows the port numbers in their example.

  I'm sure it'll be something simple but I can't figure it out - I searched all odd Cisco cautions for ACL named which connect to port numbers, but can't find anything easily. Just wondering if anyone else has experienced this.

  Thank you

  Z.

  For the port number appear in the newspapers, you must create the list of access as follows:

  IP extended Access-list-example access list

       permit tcp any gt 0 any gt 0 log
  
       permit udp any gt 0 any gt 0 log
  
  Hope that helps.
  
  

• A multiple marking in Syslog Configuration

  Good day to all!

  I am struggling to find an appropriate response to make if the FireSIGHT v5.4.1.1 can support multiple marking in an alert configuration single syslog and hoped someone here can give me a solution if there is.

  The scenario is that my end user will like to have several political intrusion in each different segments who I am control using the ACP.

  Scenario:

  X-access control policy rule:

  Segment 1 - Intrusion policy 1 - Interface s1p1 - marking S1IP1

  Stream 2 - Intrusion policy 2 - Interface s1p2 - marking S2IP2

  Section 3 - Intrusion policy 3 - Interface s2p1 - marking S3IP3

  So the above is using using "X-Access Control Policy" rule "Intrusion policies 1-3" on 3 different interfaces to differentiate areas of their segment. " Each segment would have different marking "SxIPx" when sending of syslog logs would be easier to identify their records respectively.

  I went through the Setup and cannot attach a single syslog configuration to satisfy the criteria for labelling multiple syslog configuration.

  I missed something completely?

  Appreciate any comments!

  Thank you!

  You can do it with corrleation rules.  In the example above, here are the steps.

  1 create three syslog alerts (Actions-> answers-> alerts) each of them with the desired tag, name them appropriately as "Syslog S1IP1", "S2IP1", etc.

  2. create three rules of correlation (policies-> correlation-> State Management tab).  For each rule set the event type of "intrusion event.  in conditions selects "entry interface" and choose the appropriate interface.

  3 create a strategy of corrleation with your three rules included.  Add the appropriate response syslog already created for each rule. Select new policy.

  You now get syslog messages with tag customized for selected interfaces corresponding events.

• Cisco ASA5505 logging

  This is probably a very basic question...

  I have a new Cisco ASA5505 and I'm seeing newspapers at the level of the console. Currently when I make a record sh I just get the below. I expect, or I saw on messages system other PIX / ASA.

  Any ideas on what command I need to run in order to allow these messages?

  mipsasa01 # sh logging

  Syslog logging: enabled

  Installation: 20

  Logging timestamp: disabled

  Logging shall: disabled

  Refuse the Conn which full queue: disabled

  Recording console: disabled

  Monitor logging: disabled

  Logging buffer: disabled

  Logging trap: disabled

  A history record: disabled

  Device ID: disabled

  Logging of mail: disabled

  Logging ASDM: informational level, 7108 messages saved

  The "journal to see the" displays what is called the journal of the buffer. The registration of your buffer is disabled. Use cmd "logging buffered stored" config to activate it. You can adjust the size of the buffer with "logging buffer-size '. I think that buffer memory space is allocated in memory, so don't go overboard.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/L2.html#wp1729451

• How to set up the SRI 4000-4331 to enable logging of rsyslog facilitated by using the console admin GigabitEthernet0 port

  Does not work?  Pleas advise

  Run the following on the SRI 4331.

  ntmhomes #configurer t
  Enter configuration commands, one per line. End with CNTL/Z.
  ntmhomes (config) #service timestamps log datetime localtime
  ntmhomes (config) #.
  ntmhomes (config) #.
  ntmhomes (config) #logging host 192.168.20.5
  #logging ntmhomes (config) trap inform
  ntmhomes (config) #logging trap information
  FAC #logging ntmhomes (config)
  ntmhomes (config) #logging facility local7
  ntmhomes (config) #end
  ntmhomes #.

  ntmhomes (config) #logging facility local7
  ntmhomes (config) #end

  ntmhomes #show logging
  Syslog logging: activated (0 messages fell, 11 messages limited rate, 0 flashes of heat, 0 overruns, xml disabled, filtering of persons with reduced mobility)

  No discriminator Message Active.

  No discriminator inactive Message.

  Recording console: level of debugging, 50 messages, xml, disabled,.
  filtering of persons with reduced mobility
  Monitor logging: debug, 0 messages level, xml, disabled,.
  filtering of persons with reduced mobility
  Logging buffer: level of debugging, 64 recorded messages, xml, disabled,
  filtering of persons with reduced mobility
  Exception logging: size (4096 bytes)
  County and logging messages timestamp: disabled
  Persistent logging: disabled

  No active filter module.

  Logging trap: information level, 66 lines of journaled message
  Connection to 192.168.20.5 (514, auditing disabled, udp port
  (link to top),
  5 lines of message logged,
  0 message rate lines limited.
  0 message lines a dropped-by-MD,.
  Sequence number of XML disabled, disabled
  filtering of persons with reduced mobility
  Interface-logging Source: VRF name:

  Log buffer (4096 bytes):
  g to host 192.168.20.5 port 0 CLI request Triggered
  * 9 January 17:45:27: % SYS-5-CONFIG_I: configured from the system memory
  * 9 January 17:45:27: % IOSXE_OIR-6-REMSPA: SPA removed from subslot 0/0, disabled interfaces
  * 9 January 17:45:27: % IOSXE_OIR-6-REMSPA: SPA removed from subslot 0/1, interfaces disabled
  * 9 January 17:45:27: % SPA_OIR-6-OFFLINECARD: SPA (ISR4331-3x1GE) offline in subslot 0/0
  -More-

  I think you need to tell the system that you are using the management interface

  Try

  host 192.168.20.5 record vrf Mgmt-intf

  See the link below the section on management tasks common gigabit ethernet

  http://www.Cisco.com/c/en/us/TD/docs/routers/access/4400/software/config...

• Pitfalls of Logging IOS - default configuration?

  Log configured by default on IOS 12.1 and above traps? If so, the default debug value? for example, if you don't see 'logging trap' in the config file - this does not mean logging is NOT enabled. Opening session, logging traps are by default configs - logging in buffered memory is not. Answer please if you can confirm this - thank you!

  Hello

  Logging settings can vary with the version of IOS. I can tell you, "logging console debugging" is enabled by default in most of the IOS versions. 'consignment of information trap' and "no logging not stamped" may be the default with most of the versions.

  Rather than trying to look for documentation see what that default value to recovery with different versions parameter record, well, we recommend that you use the command 'Show log' to check the status of the different types of logging and it will look something like this.

  Journal of #show R1

  Syslog logging: activated (0 messages fell, 1 messages limited rate, 0 flashes,

  0 overruns, disabled xml)

  Recording console: level 34 messages saved, debugging, xml disabled

  Monitor logging: level 0 messages saved, debugging, xml disabled

  Logging buffer: disabled disabled xml

  Logging size Exception (4096 bytes)

  County and logging messages timestamp: disabled

  Logging trap: informational level, 38 lines of journaled message

  All of the above settings are by default in this router running IOS version 12.2.

  HTH

  Sundar

• Cisco 2611XM syslog errors

  Hello, I have these types of errors on a 2611XM router. Anyone got a clue?

  tell xak #sh connect

  Syslog logging: activated (0 messages dropped, rate limited, 2 messages

  vacuum of 0, 0 overruns, xml disabled, filtering of persons with reduced mobility)

  Recording console: level of debugging, 4812 messages, xml, disabled,.

  filtering of persons with reduced mobility

  Monitor logging: debug, 8 messages level, xml, disabled,.

  filtering of persons with reduced mobility

  Logging buffer: level of debugging, 4812 messages, xml, disabled,.

  filtering of persons with reduced mobility

  Logging size Exception (4096 bytes)

  County and logging messages timestamp: disabled

  Logging trap: notifications, lines of 1051 message logged level

  192.168.10.2, lines of 1051 journaled message, xml disabled, logging

  filtering of persons with reduced mobility

  Log buffer (100000 bytes):

  2y1w: rsa_create_handler: Invalid AVL (0x5ED3F88, 0x5ED3F90, 0x5ED3F98, 0x5ED3FA0, 0x5ED3FA8, 0x5ED3FB0, 0x5ED3FB8, 0x0)

  2y1w: IPSECcard: an error return 0x007F

  . June 7 03:32:11: % 3-SSH-KEYPAIR: attempt to generate keys of server failed - error code: hardware error

  -Process = "SSH event handler", PW = 0, pid = 3

  -Traceback = 8085F7C8 8156F154 C 8059, 338 8059F75C

  . June 7 03:32:11: % SSH-5-persons with DISABILITIES: SSH 2.0 has been disabled

  . 7 Jun 04:20:37: % CRYPTO-6-IKMP_MODE_FAILURE: fast processing mode has failed with the counterpart to 10.0.0.11

  . June 7 05:58:29: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty1 (192.168.0.108)

  . June 7 06:00:19: % SSH-5-ACTIVATED: SSH 2.0 has been activated

  . June 7 06:00:21: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty1 (192.168.0.108)

  . 7 June 06:03:07: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty1 (192.168.0.108)

  . 7 June 09:03:52: % CLEAR-5-COUNTERS: claire counter on interface Serial0/0 by lgcomsupport on vty1 (192.168.0.184)

  . June 7 09:09:31: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty0 (192.168.0.108)

  . 7 June 09:10:24: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty0 (192.168.0.108)

  . June 7 09:13:04: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty0 (192.168.0.108)

  . 7 June 09:15:02: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty0 (192.168.0.108)

  . 7 June 09:28:23: % SYS-5-CONFIG_I: configured from console by lgcomsupport on vty0 (192.168.0.108)

  2y1w: rsa_create_handler: Invalid AVL (0x5ED2D08, 0x5ED2D10, 0x5ED2D18, 0x5ED2D20, 0x5ED2D28, 0x0, 0x5ED2D38, 0x5ED2D40)

  2y1w: IPSECcard: an error return 0x007F

  . 7 Jun 20:00:26: % 3-SSH-KEYPAIR: attempt to generate keys of server failed - error code: hardware error

  -Process = "SSH event handler", PW = 0, pid = 3

  -Traceback = 8085F7C8 8156F154 C 8059, 338 8059F75C

  . 7 Jun 20:00:26: % SSH-5-persons with DISABILITIES: SSH 2.0 has been disabled

  . 8 Jun 02:20:38: % CRYPTO-6-IKMP_MODE_FAILURE: fast processing mode has failed with the counterpart to 10.0.0.11

  tell xak #sh worm

  Cisco IOS software, software C2600 (C2600-ADVSECURITYK9-M), Version 12.3 (11) T, VERSION of the SOFTWARE (fc2)

  Technical support: http://www.cisco.com/techsupport

  Copyright (c) 1986-2004 by Cisco Systems, Inc.

  Update sam 18-sept.-04 11:38 by eaarmas

  ROM: System Bootstrap, Version 12.2 (7r) [next 7r], RELEASE SOFTWARE (fc1)

  tell xak uptime is 2 years, 1 week, 5 days, 3 hours, 14 minutes

  System to regain the power ROM

  System restarted at 12:32:45 IS Wednesday, may 27, 2009

  System image file is "flash: c2600-advsecurityk9 - mz.123 - 11.T.bin.

  Cisco 2611XM (MPC860P) processor (revision 0 x 100) with 94450K / 3854K bytes of memory.

  Card processor ID JAE071800DF (3191415314)

  M860 processor: Ref. 5, mask 2

  2 FastEthernet interfaces

  2 serial interfaces

  1 module of virtual private network (VPN)

  32K bytes of NVRAM memory.

  32768 K bytes of processor onboard flash system (read/write)

  Configuration register is 0 x 2102

  Hello

  You probably have a hardware problem with your VPN module.

  Kind regards.

  Alain.

• Log Insight (v3.0.1) Linux Agent Install on VCSA v6?

  Documentation has information contradictory to decide or not to install the Agent of Linux Journal Insight on a version to 6U1 vCenter device.

  Within the Insight v3.0.1 journal the following statement indicates the Agent Insight of the newspaper must be installed:

  

  In the documentation of Log Insight 3.0 the following shows it takes to just install the syslog server in vCenter to transmit to the server of Log Insight.  No mention of the version of vCenter and no mention of the installation of the Agent of the Linux Journal Insight on the vCSA.

  

  So I turn to google, which only adds to the confusion...

  William Lam blog «a glimpse of native syslog support in VCSA 6.0» presents Preview setup of vCSA version 6 transfer of syslog logs and Log Insight.

  However, Steve Flanders blog ' newspaper the Agent: Linux Configurations for Common Applications " refers to the installation of the Agent of Linux Journal Insight.

  Anyone would provide clarification?  Is there a better method of practice?  If the Agent installation is the best practice that the agent provides on the native syslog in vCSA v6U1?

  Thanks in advance!

  Two books - the goal is just to get syslog to LI. The reason why LI says that you must use the agent is that vSphere content pack, and more particularly the dashboard "vCenter Server - Application" requires that the agent is stopped working. If you use syslog-ng, you will always receive the events, but this dashboard vSphere content pack will not work. I hope this helps!

• VMware syslog collector

  After you have configured remote syslog collector, I see only one type of log file as syslog.log for all ESXi hosts.

  What every newspaper he holds usually check if the logs locally on an ESXi we are looking for hostd.log, vmkernel.log, vmkwarning.log and so on?

  So, where are all these newspapers in syslog.log ending remotely?

  Yes it is to combine your logs in the syslog.log file that you look for each host.

  I can confirm from a glance at the mine-

  to d

  vpxa

  vmkernal

  pass

  FDM

  vmkwarning

  rhttpproxy

  snmpd

  spend-probe

  I also looked for the same document you have exploded this information in the past.  This indicates that all the log files are included.

  "To preserve newspapers more, ESXi can be configured to place these log files in a location of alternative storage disk and send the logs on the network to a syslog server."

  -----

  VMware KB: Location of ESXi 5.1 and 5.5 log files

  ESXi host 5.1 log files

  A 5.1 ESXi host logs are grouped according to the source component:

  • /var/log/auth.log: Shell ESXi authentication success and failure.
  • /var/log/dhclient.log: DHCP service to customers, including discovery, rental of addresses applications and renewals.
  • /var/log/esxupdate.log: ESXi Setup patch and update logs.
  • /var/log/lacp.log: Link Aggregation Control Protocol to connect.
  • /var/log/hostd.log: Organize the management of maintenance records, including VM and host of task and events, communication with the Client vSphere and vCenter Server vpxa and connections SDK agent.
  • /var/log/hostd-probe.log: Reactivity of host management service auditor.
  • /var/log/rhttpproxy.log: Connections HTTP proxy on behalf of other webservices to ESXi host.
  • /var/log/shell.log: ESXi Shell, including toggle usage logs and each command is entered. For more information, seecommand-line vSphere 5.5 Documentation and audit ESXi Shell connections and controls in ESXi 5.x (2004810).
  • /var/log/sysboot.log: Beginning VMkernel startup and module loading.
  • /var/log/boot.gz: a compressed file that contains the information of the newspaper to start and can be read with zcat var/log/boot.gz|more.
  • /var/log/syslog.log: Initialization of the service management, watchdogs, the scheduled tasks and DCUI use.
  • /var/log/usb.log: Events of peripheral USB arbitration, such as the discovery and transmission to the virtual machines.
  • /var/log/vobd.log: Similar to VMkernel Observation eventsvob.component.event.
  • /var/log/vmkernel.log: Core VMkernel logs, including starting the virtual machine, storage and device networking and events of the driver and the discovery.
  • /var/log/vmkwarning.log: A summary of the messages of warning and alert the journal extracted the VMkernel logs.
  • /var/log/vmksummary.log: A summary of ESXi host start and stop and a time pulse with availability, number of virtual machines running and services of consumption of resources. For more information, see Format of the logfile vmksummary ESXi 5.0 (2004566).
  • /var/log/Xorg.log: Video acceleration.

  ------

  VMware KB: Configure syslog on ESXi 5.x and 6.0

  VMware vSphere, ESXi 5.x and 6.0 hosts running a syslog service ( vmsyslogd ) that provides one mechanism standard for the recording of the VMkernel messages and other system components. In ESXi, by default these log files is placed on a local volume scratch or a virtual disk. To preserve newspapers more, ESXi can be configured to put these log files in a location of alternative storage disk and send the logs on the network to a syslog server.

  Retention, rotation and splitting the logs received and managed by a syslog server are fully controlled by this syslog server. ESXi 5.x and 6.0 can not configure or control the management of newspapers to a remote syslog server. For more information, see the documentation for the syslog server.

  Regardless of the specified additional syslog configuration using these options, newspapers continue to be placed on the default locations on the ESXi host. For more information, see location of ESXi 3.5 - 4.1 log files (1021801).

  A previous version of vSphere, ESXi are configured differently. For more information, see Enabling syslog on ESXi 3.5 and 4.x (1016621).

  If vSphere Syslog Collector will be used to receive logs of ESXi hosts, see Install or Upgrade vSphere Syslog Collector in Guide of installation and Installation of vSphere.

• What type of newspapers are captured by vmware server syslog collector...

  Dear team,

  Yesterday I install the application "VMware Syslog Collector", after the installation I contract new syslog configuration on ESXihost server and reload the syslog service.

  It doesn't create syslog.log file, I just want to confirm y I m not able to see vmkernel / vmkwarning / etc... logs on a syslog server.

  need your help on the same.

  concerning

  Mr. VMware

  You can use text editors advanced such as Ultraedit or Notepad ++

  Attached example using Notepad ++. I searched and marked all the lines containing lines marked vmkernel, copied and opened it in a new file.

• 317012 ASA instead of 622001

  Hello

  I'm under 9.4 (3) ASA and backup ISP link. With the help of manual, made changes of configuration below. Works fine, except one: I do not log in my syslog messages. Sources said that there must be some 622001 message, but all I get is "% ASA-3-317012: Interface IP road negative counter - GigabitEthernet0/1" what MAIN link crashes. The strangest thing is that I can't find information about 317012 on cisco.com... Waiting for any advice, thanks.

  Route 0.0.0.0 EXTERNAL_MAIN 0.0.0.0 10.0.0.1 1 track 1
  Route 0.0.0.0 EXTERNAL_BACKUP 0.0.0.0 11.0.0.1 200

  monitor SLA 123
  interface type echo protocol ipIcmpEcho 213.180.193.3 EXTERNAL_MAIN
  NUM-package of 5
  frequency 30

  Annex ALS life monitor 123 to always start-time now

  track 1 rtr 123 accessibility

  M5 (config) # sh logging
  Syslog logging: enabled
  Installation: 20
  Logging timestamp: enabled
  Hide user name registration: enabled
  Logging shall: disabled
  Logging of debugging-tracking: disabled
  Recording console: disabled
  Monitor logging: disabled
  Logging buffer: disabled
  Logging trap: level warnings, installation 20, 13243 messages saved
  192.168.15.4 INTERNAL logging
  Record of the permit-hostdown: enabled
  A history record: disabled
  Device ID: hostname "m5".
  Logging of mail: disabled
  Logging ASDM: level of information, 8363649 messages saved

  % ASA-6-622001 is a level 6 log message.  You can either increase your registration (and you'll get a bunch of other things) or 'promote' a message of level 3.

  logging message 622001 level 3

• VPN site-to-site between ASA 5505 and 2911

  Hi all

  I'm trying to setup VPN S2S. A.a.a.a of ip for the router 2911 office, remote office ASA 5505 8.4 (3) with ip b.b.b.b, but no luck.

  2911 config:

  !

  version 15.2

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  encryption password service

  !

  host name 2911

  !

  boot-start-marker

  Boot system flash c2900-universalk9-mz. Spa. 152 - 2.T.bin

  boot-end-marker

  !

  !

  Min-length 10 Security passwords

  logging buffered 51200 warnings

  !

  No aaa new-model

  !

  !

  min-threshold queue spd IPv6 62

  Max-threshold queue spd IPv6 63

  No ipv6 cef

  the 5 IP auth-proxy max-login-attempts

  max-login-attempts of the IP 5 admission

  !

  !

  !

  DHCP excluded-address IP 192.168.10.1 192.168.10.99

  DHCP excluded-address IP 192.168.22.1 192.168.22.99

  DHCP excluded-address IP 192.168.33.1 192.168.33.99

  DHCP excluded-address IP 192.168.44.1 192.168.44.99

  DHCP excluded-address IP 192.168.55.1 192.168.55.99

  192.168.10.240 IP dhcp excluded-address 192.168.10.254

  DHCP excluded-address IP 192.168.22.240 192.168.22.254

  DHCP excluded-address IP 192.168.33.240 192.168.33.254

  DHCP excluded-address IP 192.168.44.240 192.168.44.254

  DHCP excluded-address IP 192.168.55.240 192.168.55.254

  !

  desktop IP dhcp pool

  import all

  network 192.168.33.0 255.255.255.0

  router by default - 192.168.33.254

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  wi - fi IP dhcp pool

  import all

  network 192.168.44.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.44.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  DMZ IP dhcp pool

  import all

  network 192.168.55.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.55.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  IP dhcp pool voip

  import all

  network 192.168.22.0 255.255.255.0

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  router by default - 192.168.22.254

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  IP dhcp pool servers

  import all

  network 192.168.10.0 255.255.255.0

  default router 192.168.10.254

  192.168.10.10 DNS server 202.50.246.41 202.50.246.42

  local domain name

  -192.168.10.10 NetBIOS name server

  h-node NetBIOS node type

  !

  !

  IP domain name of domain

  name-server IP 192.168.10.10

  IP cef

  connection-for block 180 tent 3-180

  Timeout 10

  VLAN ifdescr detail

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki token removal timeout default 0

  !

  Crypto pki trustpoint TP-self-signed-3956567439

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 3956567439

  revocation checking no

  rsakeypair TP-self-signed-3956567439

  !

  !

  TP-self-signed-3956567439 crypto pki certificate chain

  certificate self-signed 01 nvram:IOS - Self-Sig #1.cer

  license udi pid sn CISCO2911/K9

  !

  !

  the FULL_NET object-group network

  full range of the network Description

  192.168.10.0 255.255.255.0

  192.168.11.0 255.255.255.0

  192.168.22.0 255.255.255.0

  192.168.33.0 255.255.255.0

  192.168.44.0 255.255.255.0

  !

  object-group network limited

  description without servers and router network

  192.168.22.0 255.255.255.0

  192.168.33.0 255.255.255.0

  192.168.44.0 255.255.255.0

  !

  VTP version 2

  password username admin privilege 0 password 7

  !

  redundancy

  !

  !

  !

  !

  !

  no passive ftp ip

  !

  !

  crypto ISAKMP policy 10

  BA aes 256

  sha512 hash

  preshared authentication

  ISAKMP crypto key admin address b.b.b.b

  invalid-spi-recovery crypto ISAKMP

  !

  !

  Crypto ipsec transform-set esp - aes esp-sha-hmac SET

  !

  !

  !

  10 map ipsec-isakmp crypto map

  the value of b.b.b.b peer

  Set transform-set

  match address 160

  !

  !

  !

  !

  !

  Interface Port - Channel 1

  no ip address

  waiting-150 to

  !

  Interface Port - channel1.1

  encapsulation dot1Q 1 native

  IP 192.168.11.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.10

  encapsulation dot1Q 10

  IP address 192.168.10.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.22

  encapsulation dot1Q 22

  IP 192.168.22.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.33

  encapsulation dot1Q 33

  IP 192.168.33.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.44

  encapsulation dot1Q 44

  IP 192.168.44.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  Interface Port - channel1.55

  encapsulation dot1Q 55

  IP 192.168.55.254 255.255.255.0

  IP nat inside

  IP virtual-reassembly in

  !

  the Embedded-Service-Engine0/0 interface

  no ip address

  Shutdown

  !

  interface GigabitEthernet0/0

  Description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE $ 0/0

  no ip address

  Shutdown

  automatic duplex

  automatic speed

  !

  interface GigabitEthernet0/1

  no ip address

  automatic duplex

  automatic speed

  channel-group 1

  !

  interface GigabitEthernet0/2

  Description $ES_LAN$

  no ip address

  automatic duplex

  automatic speed

  channel-group 1

  !

  interface GigabitEthernet0/0/0

  IP address a.a.a.a 255.255.255.224

  NAT outside IP

  IP virtual-reassembly in

  automatic duplex

  automatic speed

  crypto map

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  23 class IP http access

  local IP http authentication

  IP http secure server

  IP http timeout policy slowed down 60 life 86400 request 10000

  !

  overload of IP nat inside source list NAT_INTERNET interface GigabitEthernet0/0/0

  IP nat inside source udp 500 interface GigabitEthernet0/0/0 500 a.a.a.a static

  IP route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx

  !

  NAT_INTERNET extended IP access list

  refuse the object-group ip FULL_NET 192.168.17.0 0.0.0.255

  refuse the object-group ip FULL_NET 192.168.1.0 0.0.0.255

  permit ip FULL_NET object-group everything

  !

  access-list 1 permit 192.168.44.100

  access-list 23 allow 192.168.10.7

  access-list 23 permit 192.168.44.0 0.0.0.255

  access-list 100 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

  access-list 160 permit ip 192.168.10.0 0.0.0.255 192.168.17.0 0.0.0.255

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  password password 7

  opening of session

  line to 0

  line 2

  no activation-character

  No exec

  preferred no transport

  transport of entry all

  transport output pad rlogin lapb - your MOP v120 udptn ssh telnet

  StopBits 1

  line vty 0 4

  access-class 23 in

  privilege level 15

  local connection

  entry ssh transport

  line vty 5 15

  access-class 23 in

  privilege level 15

  local connection

  entry ssh transport

  !

  Scheduler allocate 20000 1000

  !

  end

  The ASA config:

  : Saved : ASA Version 8.4(3) ! hostname C domain-name domain enable password password encrypted passwd passwd encrypted names ! interface Ethernet0/0 ! interface Ethernet0/1 shutdown ! interface Ethernet0/2 shutdown ! interface Ethernet0/3 shutdown ! interface Ethernet0/4 shutdown ! interface Ethernet0/5 switchport access vlan 100 ! interface Ethernet0/6 switchport trunk allowed vlan 2,6 switchport mode trunk ! interface Ethernet0/7 shutdown ! interface Vlan1 description INTERNET mac-address 1234.5678.0001 nameif WAN security-level 0 ip address b.b.b.b 255.255.255.248 standby c.c.c.c ospf cost 10 ! interface Vlan2 description OLD-PRIVATE mac-address 1234.5678.0102 nameif OLD-Private security-level 100 ip address 192.168.17.2 255.255.255.0 standby 192.168.17.3 ospf cost 10 ! interface Vlan6 description MANAGEMENT mac-address 1234.5678.0106 nameif Management security-level 100 ip address 192.168.1.2 255.255.255.0 standby 192.168.1.3 ospf cost 10 ! interface Vlan100 description LAN Failover Interface ! boot system disk0:/asa843-k8.bin ftp mode passive clock timezone NZST 12 clock summer-time NZDT recurring 1 Sun Oct 2:00 3 Sun Mar 2:00 dns domain-lookup WAN dns server-group DefaultDNS name-server 208.67.222.222 domain-name domain same-security-traffic permit intra-interface object network obj-192.168.17.0 subnet 192.168.17.0 255.255.255.0 object network obj-192.168.10.0 subnet 192.168.10.0 255.255.255.0 object network obj-192.168.2.0 subnet 192.168.2.0 255.255.255.0 object network obj-192.168.9.0 subnet 192.168.9.0 255.255.255.0 object network obj-192.168.33.0 subnet 192.168.33.0 255.255.255.0 object network obj-192.168.44.0 subnet 192.168.44.0 255.255.255.0 object network obj_any object network obj_any-01 object network NETWORK_OBJ_192.168.10.0_24 subnet 192.168.10.0 255.255.255.0 object network NETWORK_OBJ_192.168.17.0_24 subnet 192.168.17.0 255.255.255.0 object network subnet-00 subnet 0.0.0.0 0.0.0.0 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group service RDP tcp description RDP port-object eq 3389 object-group network DM_INLINE_NETWORK_1 network-object 192.168.17.0 255.255.255.0 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network DM_INLINE_NETWORK_2 network-object 192.168.10.0 255.255.255.0 network-object 192.168.33.0 255.255.255.0 network-object 192.168.44.0 255.255.255.0 object-group network subnet-17 network-object 192.168.17.0 255.255.255.0 object-group network subnet-2 network-object 192.168.2.0 255.255.255.0 object-group network subnet-9 network-object 192.168.9.0 255.255.255.0 object-group network subnet-10 network-object 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list LAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP standard permit 192.168.17.0 255.255.255.0 access-list WAN_access_in extended permit ip any any log debugging access-list WAN_access_in extended permit tcp any object-group RDP any object-group RDP log debugging access-list WAN_access_in extended permit icmp x.x.x.x 255.255.255.248 192.168.10.0 255.255.255.0 access-list MANAGEMENT_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit ip any any log debugging access-list OLD-PRIVATE_access_in extended permit icmp any object-group DM_INLINE_NETWORK_1 access-list 101 extended permit tcp host 192.168.10.7 any eq 3389 log debugging access-list WAN_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_1_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list CiscoVPNClient_splitTunnelAcl standard permit 192.168.17.0 255.255.255.0 access-list LAN_access_in extended permit ip any any log debugging access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list WAN_nat0_outbound extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.10.0 255.255.255.0 access-list WAN_2_cryptomap extended permit ip 192.168.17.0 255.255.255.0 192.168.9.0 255.255.255.0 access-list LAN_IP_inbound standard permit 192.168.10.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 access-list vpnusers_splitTunnelAcl extended permit ip 192.168.17.0 255.255.255.0 any access-list nonat-in extended permit ip 192.168.17.0 255.255.255.0 192.168.2.0 255.255.255.0 pager lines 24 logging enable logging buffer-size 52000 logging monitor informational logging trap informational logging asdm informational logging from-address syslog logging recipient-address admin level errors logging host OLD-Private 192.168.17.110 format emblem logging debug-trace logging permit-hostdown mtu WAN 1500 mtu OLD-Private 1500 mtu Management 1500 ip local pool VPN_Admin_IP 192.168.1.150-192.168.1.199 mask 255.255.255.0 ip local pool vpnclient 192.168.2.1-192.168.2.5 mask 255.255.255.0 failover failover lan unit primary failover lan interface failover Vlan100 failover polltime interface 15 holdtime 75 failover key ***** failover interface ip failover 192.168.100.1 255.255.255.0 standby 192.168.100.2 icmp unreachable rate-limit 1 burst-size 1 icmp permit 192.168.10.0 255.255.255.0 WAN icmp permit host x.x.x.x WAN icmp permit 192.168.17.0 255.255.255.0 WAN icmp permit host c.c.c.c WAN icmp permit host a.a.a.a WAN icmp deny any WAN icmp permit 192.168.10.0 255.255.255.0 OLD-Private icmp permit 192.168.17.0 255.255.255.0 OLD-Private icmp permit host a.a.a.a OLD-Private icmp permit host 192.168.10.0 Management icmp permit host 192.168.17.138 Management icmp permit 192.168.1.0 255.255.255.0 Management icmp permit host 192.168.1.26 Management icmp permit host a.a.a.a Management asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-10 subnet-10 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-2 subnet-2 no-proxy-arp nat (OLD-Private,any) source static subnet-17 subnet-17 destination static subnet-9 subnet-9 no-proxy-arp nat (Management,WAN) source static NETWORK_OBJ_192.168.17.0_24 NETWORK_OBJ_192.168.17.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup ! object network subnet-00 nat (OLD-Private,WAN) dynamic interface access-group WAN_access_in in interface WAN access-group OLD-PRIVATE_access_in in interface OLD-Private access-group MANAGEMENT_access_in in interface Management route WAN 0.0.0.0 0.0.0.0 x.x.x.x 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa local authentication attempts max-fail 10 http server enable http b.b.b.b 255.255.255.255 WAN http 0.0.0.0 0.0.0.0 WAN no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart service resetoutside crypto ipsec ikev1 transform-set OFFICE esp-aes esp-sha-hmac crypto map WAN_map 1 match address WAN_1_cryptomap crypto map WAN_map 1 set pfs crypto map WAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map Office 2 match address WAN_1_cryptomap crypto map Office 2 set peer a.a.a.a crypto map Office interface WAN crypto map MAP 10 set peer a.a.a.a crypto map MAP 10 set ikev1 transform-set OFFICE crypto ikev2 enable WAN crypto ikev1 enable WAN crypto ikev1 policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption des hash sha group 1 lifetime 86400 telnet timeout 5 ssh a.a.a.a 255.255.255.255 WAN ssh timeout 30 ssh version 2 console timeout 0 dhcpd auto_config OLD-Private ! threat-detection basic-threat threat-detection statistics host threat-detection statistics access-list threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200 ntp server 129.6.15.28 source WAN prefer webvpn group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 ssl-client ssl-clientless group-policy admin internal group-policy admin attributes dns-server value 208.67.222.222 156.154.70.1 vpn-tunnel-protocol ikev1 group-policy GroupPolicy_a.a.a.a internal group-policy GroupPolicy_a.a.a.a attributes vpn-tunnel-protocol ikev1 ikev2 group-policy CiscoVPNClient internal group-policy CiscoVPNClient attributes vpn-idle-timeout 30 vpn-session-timeout none vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value CiscoVPNClient_splitTunnelAcl username admin password password encrypted privilege 15 tunnel-group admin type remote-access tunnel-group admin general-attributes address-pool vpnclient authorization-server-group LOCAL default-group-policy admin tunnel-group a.a.a.a type ipsec-l2l tunnel-group a.a.a.a general-attributes default-group-policy GroupPolicy_a.a.a.a tunnel-group a.a.a.a ipsec-attributes ikev1 pre-shared-key ***** ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** tunnel-group CiscoVPNClient type remote-access tunnel-group CiscoVPNClient general-attributes address-pool vpnclient default-group-policy CiscoVPNClient tunnel-group CiscoVPNClient ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp ! service-policy global_policy global smtp-server 192.168.17.10 prompt hostname context no call-home reporting anonymous call-home contact-email-addr admin contact-name admin profile CiscoTAC-1   no active : end asdm image disk0:/asdm-647.bin asdm location c.c.c.c 255.255.255.255 WAN asdm location 192.168.17.2 255.255.255.255 WAN asdm location a.a.a.a 255.255.255.255 OLD-Private no asdm history enable 

  ASA:

  # show crypto ipsec his

  There is no ipsec security associations

  # show crypto isakmp his

  There are no SAs IKEv1

  There are no SAs IKEv2

  2911:

  #show crypto ipsec his

  Interface: GigabitEthernet0/0/0

  Tag crypto map: map, addr a.a.a.a local

  protégé of the vrf: (none)

  local ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)

  Remote ident (addr, mask, prot, port): (192.168.17.0/255.255.255.0/0/0)

  current_peer b.b.b.b port 500

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0

  #pkts not unpacked: 0, #pkts decompress failed: 0

  Errors of #send 4, #recv errors 0

  local crypto endpt. : a.a.a.a, remote Start crypto. : b.b.b.b

  Path mtu 1500, mtu 1500 ip, ip mtu IDB GigabitEthernet0/0/0

  current outbound SPI: 0x0 (0)

  PFS (Y/N): N, Diffie-Hellman group: no

  SAS of the esp on arrival:

  -Other - arrival ah sas:

  -More-

  -More - CFP sas on arrival:

  -More-

  -More - outgoing esp sas:

  -More-

  -More - out ah sas:

  -More-

  -More - out CFP sas:

  Thanks for your time,

  Nick

  Please add

  map Office 2 set transform-set OFFICE ikev1 crypto

  If it is not helpful, please enable debug crypto ipsec 255 and paste here.
  
  HTH. Please rate if it was helpful. "Correct answer" will be also pleasant.