SETP setp ASA 5505 configuration to inspect traffic

I have,

I m strugling with the correct procedure to configure ASA to inspect traffic and only allow traffic any inside out and DMZ.

Fix my not if necessary:

  1. Configure the interfaces

    • IP address
    • Nameif
    • Security level
  2. Configure the NAT
    • Translation on the inside to the outside
    • Trasnlation from inside the DMZ
    • Static translation from the outside to the DMZ
  3. Create ACLs
    • ACL to allow traffic between the inside and outside
    • ACL to allow traffic from inside the DMZ
    • ACL to form of traffic outside DMZ
  4. Create inspect policy
    1. Class creat card
    2. Create political map
    3. Define type of traffic to be inspected
    4. Associate the policy with the interface

After that I shoul http ping server and access from outside the network.

Rigth?

Greetings from King,

Antonio

Hello

Firstly, the route you created is false. It should be a default route that points to a destination 'ANY' and 'ANY' destination mask. For example, Road outside 0 62.28.190.65 0.

Second, you don't have politically at the moment because there is a map of default policy already configured with the most important protocols. As a result, ICMP is inspected by default.

In the third place, to test the traffic between hosts no ICMP routers. Maybe the ISP router blocking an incoming ICMP packets to itself. This means that you will need to create an ACL that applies to the ISP router to allow ICMP to himself. Then, to save all these hassle, just add two hosts as mentioned.

If you insist on working with routers, do a trace of package for me as shown below:

entry packet-trace inside 8 0 and post the result.

Kind regards

AM

Tags: Cisco Security

Similar Questions

  • Ipsec/ipad ASA 5505 configuration

    Hey had a few problems when configuring IPSEC/VPN on the asa 5505. I want to connect from the ipad with built in IPSec client...

    Get these errors when I run the debug crypto isakmp

    Jan 28 22:03:26 [IKEv1]: Group = VPN_ipad, username = Haq, IP = x.x.x.x, Tunnel rejected: conflicting protocols specified by tunnel-group and political group

    Jan 28 22:03:26 [IKEv1]: Group = VPN_ipad, username = Haq, IP = x.x.x.x, fault QM WSF (P2 struct & 0xd5d5f3d8, mess id 0x295bc3a).

    Jan 28 22:03:26 [IKEv1]: Group = VPN_ipad, username is Haq, IP = x.x.x.x, withdrawal homologous of correlator table failed, no match!

    There are a lot of site-to-site vpn and ipsec vpn profiles configuration and these works very well... ?

    Here is the config running sh run crypto:

    Crypto ipsec transform-set of des-esp esp-md5-hmac

    Crypto ipsec transform-set esp-3des esp-sha-hmac 3DES-TRANS

    mode crypto ipsec transform-set 3DES-TRANS transport

    Crypto ipsec transform-set AES aes - esp esp-sha-hmac

    Crypto ipsec transform-set esp-3des esp-md5-hmac 3des

    Crypto ipsec transform-set esp-3des esp-sha-hmac IPAD-IPSEC

    Crypto ipsec transform-set IPAD IPSEC transport mode

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Crypto-map dynamic Plandent 10 set transform-set ESP-AES-128-SHA ESP-AES-256-SHA ESP-AES-128-MD5 ESP-AES-256-MD5 OF THE 3des 3DES-TRANS

    Crypto dynamic-map Plandent 10 the duration value of security-association seconds 84600

    cryptographic kilobytes 300000 of life of the set - the security of Plandent 10 of the dynamic-map association

    set of 5 IPAD-card dynamic-map crypto IPAD-IPSEC transform-set

    Crypto 5 IPAD-card dynamic-plan the duration value of security-association seconds 28800

    cryptographic kilobytes 4608000 life of the set - the association of security of the IPAD-card dynamic-map 5

    card crypto PD_VPN 10 corresponds to the address ToGoteborg

    card crypto PD_VPN 10 set peer PixGoteborg

    card crypto PD_VPN 10 the transform-set value OF

    card crypto PD_VPN set 10 security-association life seconds 84600

    card crypto PD_VPN 10 set security-association kilobytes of life 4608000

    card crypto PD_VPN 20 corresponds to the address ToMalmo

    card crypto PD_VPN 20 set peer PixMalmo

    card crypto PD_VPN 20 the transform-set value OF

    card crypto PD_VPN 20 defined security-association life seconds 84600

    card crypto PD_VPN 20 set security-association kilobytes of life 4608000

    card crypto PD_VPN 30 corresponds to the address ToPlanmeca

    PD_VPN 30 value crypto map peer ASA_HKI ASA_HKI_BACKUP

    PD_VPN 30 value transform-set AES crypto card

    card crypto PD_VPN 30 defined security-association life seconds 86400

    card crypto PD_VPN 30 set security-association kilobytes of life 4608000

    card crypto PD_VPN 100-isakmp dynamic ipsec Plandent

    PD_VPN interface card crypto outside

    crypto isakmp identity address

    crypto ISAKMP allow outside

    crypto ISAKMP policy 5

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP policy 10

    preshared authentication

    aes encryption

    sha hash

    Group 2

    lifetime 28800

    crypto ISAKMP policy 30

    preshared authentication

    the Encryption

    md5 hash

    Group 2

    life 86400

    Anyone have tips and tricks on what may be the problem here, will be really appreciated

    Thank you

    Shane

    Karsten, Shane,

    Honestly thos MAY be from miconfig TG/GP, but I would check the full debugging of:

    ------

    debugging cry isakmp 127

    Debug aaa 100 Commons

    -------

    The reason for being quite a few questions, we saw some time where users were pushing class or group-AAA lock (which is the substitution of CLI).

    M.

  • the ASA 5505 configuration

    Hey guys

    I have a server that accepts traffic on a port within my network and external clients need to access this server. the nat and accesslist works well, but it is a matter of wait time and connection failed... Note that without the client server asa directly works fine... and note also that the traffic is encrypted (ssl)... are there additional provisions that I have to configure? y is it expire? Packet Capture see traffic from the outside to reach inside the interface but no response from the inside to the outside...

    I don't have that only one access list reloads the traffic from the outside to the server and a nat rule.

    advice needed...

    Thank you

    Hello

    So from what I understand

    "inside the xxx.114 interface the default route on the server is xxx.1 which is one interface on another asa.

    This means that the default route on the server is an another ASA. It won't work unless you apply TCP statebypass.

    ASA is a statefull firewall. This means for the TCP IP, always see two way traffic. If SYN crosses an ASA should see SYN/ACK back. If an ASA did not syn and sees syn/ack due to asymmetric routing, is wrong in the wok.

    Change the default route in the same ASA server or configure TCP statebypass (which is not recommended however).

    Thank you

  • VPN site to site thanks to a pair of asa 5505 does not pass traffic

    the configurations are fairly simple. Ping between the two lan pc fails. "show isakmp crypto his" and "crypto ipsec to show his" got out, if.

    Please refer to the attached text and diagram files.

    I'm pre-configures the ASA, for external interfaces have ip addresses private for the moment.

    all entries are welcome.

    Thank you!

    Your look simple configurations.

    As the Phase 1 and Phase 2 SAs are coming, the VPN seems correct.

    We see program leaving ASA1 and decaps ASA2, but no return traffic seems to come in.

    I suspect a problem with the host 192.168.102.5. Can you capture the top packages and check that it receives traffic initiated from the host 192.168.101.5 (side ASA1) and he answers with the ASA2 as its default gateway?

  • Cisco ASA 5505 - Configuration VPN

    I'm trying to configure a VPN connection to allow customers access to the internal network. I have tried to use time Wizard VPN & repeatedly but customer connect but can get out to the internet and communicate with any host on the network. I tried to use a vpn in the 192.x.x.x or 10.10.1.X network dhcp pool but no luck.

    Comments or suggestions appreciated.

    What is the reason for these commands?

    NAT (outside) 0-list of access policyPAT

    NAT (outside) 5 10.10.1.0 255.255.255.0

    If this isn't spicific reason remove

    and put the following command:

    Permitted connection ipsec sysopt

    in global configuration mode to enable the VPN traffic to work around interface access lists

    Good luck

    If useful rates

  • ASA 5505 transparent mode dosnt pass traffic

    Hi all

    need help

    ASA 5505 do not pass traffic as a cordon of brewing, how do you get traffic?

    ciscoasa # sh ver

    Cisco Adaptive Security Appliance Version 8.2 software (5)

    Version 6.4 Device Manager (5)

    Updated Saturday, May 20, 11 16:00 by manufacturers

    System image file is "disk0: / asa825 - k8.bin.

    The configuration file to the startup was "startup-config '.

    ciscoasa until 55 minutes 31 seconds

    Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor

    Internal ATA Compact Flash, 128 MB

    BIOS Flash Firmware Hub @ 0xffe00000, 1024 KB

    Hardware encryption device: Cisco ASA-5505 Accelerator Board (revision 0 x 0)

    Start firmware: CN1000-MC-BOOT - 2.00

    SSL/IKE firmware: CNLite-MC-Smls-PLUS - 2.03

    Microcode IPSec:-CNlite-MC-IPSECm-HAND - 2.05

    0: Int: internal-Data0/0: the address is e4d3.f193.9486, irq 11

    1: Ext: Ethernet0/0: the address is e4d3.f193.947e, irq 255

    2: Ext: Ethernet0/1: the address is e4d3.f193.947f, irq 255

    3: Ext: Ethernet0/2: the address is e4d3.f193.9480, irq 255

    4: Ext: Ethernet0/3: the address is e4d3.f193.9481, irq 255

    5: Ext: Ethernet0/4: the address is e4d3.f193.9482, irq 255

    6: Ext: Ethernet0/5: the address is e4d3.f193.9483, irq 255

    7: Ext: Ethernet0/6: the address is e4d3.f193.9484, irq 255

    8: Ext: Ethernet0/7: the address is e4d3.f193.9485, irq 255

    9: Int: internal-Data0/1: the address is 0000.0003.0002, irq 255

    10: Int: not used: irq 255

    11: Int: not used: irq 255

    The devices allowed for this platform:

    The maximum physical Interfaces: 8

    VLAN: 3, restricted DMZ

    Internal guests: 10

    Failover: disabled

    VPN - A: enabled

    VPN-3DES-AES: enabled

    SSL VPN peers: 2

    The VPN peers total: 10

    Double ISP: disabled

    Junction ports VLAN: 0

    Sharing license: disabled

    AnyConnect for Mobile: disabled

    AnyConnect Cisco VPN phone: disabled

    AnyConnect Essentials: disabled

    Assessment of Advanced endpoint: disabled

    Proxy sessions for the UC phone: 2

    Total number of Sessions of Proxy UC: 2

    Botnet traffic filter: disabled

    This platform includes a basic license.

    Registry configuration is 0x1

    Modified configuration of enable_15 to 20:34:47.689 UTC Wednesday 5 December 2012

    ciscoasa #.

    ciscoasa #.

    ciscoasa # sh run

    : Saved

    :

    ASA Version 8.2 (5)

    !

    transparent firewall

    ciscoasa hostname

    activate 8eeGnt0NEFObbH6U encrypted password

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    !

    I haventerface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    Shutdown

    !

    interface Ethernet0/3

    Shutdown

    !

    interface Ethernet0/4

    Shutdown

    !

    interface Ethernet0/5

    Shutdown

    !

    interface Ethernet0/6

    Shutdown

    !

    interface Ethernet0/7

    Shutdown

    !

    interface Vlan1

    nameif inside

    security-level 100

    !

    interface Vlan2

    nameif outside

    security-level 0

    !

    passive FTP mode

    outs_in of access allowed any ip an extended list

    outs_in list extended access permit icmp any one

    pager lines 24

    Within 1500 MTU

    Outside 1500 MTU

    no ip address

    ICMP unreachable rate-limit 1 burst-size 1

    don't allow no asdm history

    ARP timeout 14400

    outs_in access to the interface inside group

    Access-group outs_in in interface outside

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    no remote anonymous reporting call

    Cryptochecksum:234e9b9c6c9c941a89e37011325b6d5e

    : end

    ciscoasa #.

    ciscoasa #.

    ciscoasa #.

    ciscoasa # sh - access list

    access cached list the ACL log stream: total 0, 0 (deny-flow-max 4096) denied

    alert interval 300

    outs_in list of access; 2 elements; hash name: 0xd6c65ba5

    permit for access list 1 outs_in line ip scope any a (hitcnt = 0) 0x7d210842

    allowed to Access-list outs_in line 2 extended icmp any a (hitcnt = 0) 0x5532fcc5

    ciscoasa #.

    Hello

    Exactly... Good to know it works now.

    Do you know why he needs the IP address (such as a transparent firewall)?

    The ASA will act as a transparent layer 2 on the right device to the network, but what happens when the ASA does not have a particular destination mac address... What would be the source ip address of the package? Ip address of the ASA. So that's the main reason why we need that.

    We use it also for traffic management and for AAA services (if authentication is used the ASA will send the AAA authentication request to the server) with the IP address of this source.

    Please check the question as answered, so future users can pull of this

    Julio Carvajal

    Costa Rica

  • Problem with remote access VPN on ASA 5505

    I currently have a problem of an ASA 5505 configuration to connect via VPN remote access by using the Cisco VPN Client 5.0.07.0440 under Windows 8 Pro x 64. The VPN client will prompt you for the user name and password during the connection process, but fails soon after.

    The VPN client connects is as follows:

    ---------------------------------------------------------------------------------------------------------------------------------------

    Cisco Systems VPN Client Version 5.0.07.0440

    Copyright (C) 1998-2010 Cisco Systems, Inc.. All rights reserved.

    Customer type: Windows, Windows NT

    Running: 6.2.9200

    2 15:09:21.240 11/12/12 Sev = Info/4 CM / 0 x 63100002

    Start the login process

    3 15:09:21.287 11/12/12 Sev = Info/4 CM / 0 x 63100004

    Establish a secure connection

    4 15:09:21.287 11/12/12 Sev = Info/4 CM / 0 x 63100024

    Attempt to connect with the server "*." **. ***. *** »

    5 15:09:21.287 11/12/12 Sev = Info/6 IKE/0x6300003B

    Try to establish a connection with *. **. ***. ***.

    6 15:09:21.287 11/12/12 Sev = Info/4 IKE / 0 x 63000001

    From IKE Phase 1 negotiation

    7 15:09:21.303 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) to *. **. ***. ***

    8 15:09:21.365 11/12/12 Sev = Info/6 GUI/0x63B00012

    Attributes of the authentication request is 6: 00.

    9 15:09:21.334 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    10 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

    11 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

    Peer is a compatible peer Cisco-Unity

    12 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

    Peer supports XAUTH

    13 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

    Peer supports the DPD

    14 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

    Peer supports NAT - T

    15 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000001

    Peer supports fragmentation IKE payloads

    16 15:09:21.334 11/12/12 Sev = Info/6 IKE / 0 x 63000001

    IOS Vendor ID successful construction

    17 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) to *. **. ***. ***

    18 15:09:21.334 11/12/12 Sev = Info/6 IKE / 0 x 63000055

    Sent a keepalive on the IPSec Security Association

    19 15:09:21.334 11/12/12 Sev = Info/4 IKE / 0 x 63000083

    IKE port in use - Local Port = 0xFBCE, Remote Port = 0 x 1194

    20 15:09:21.334 11/12/12 Sev = Info/5 IKE / 0 x 63000072

    Automatic NAT detection status:

    Remote endpoint is NOT behind a NAT device

    This effect is behind a NAT device

    21 15:09:21.334 11/12/12 Sev = Info/4 CM/0x6310000E

    ITS established Phase 1.  1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

    22 15:09:21.365 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    23 15:09:21.365 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

    24 15:09:21.365 11/12/12 Sev = Info/4 CM / 0 x 63100015

    Launch application xAuth

    25 15:09:21.474 11/12/12 Sev = Info/4 IPSEC / 0 x 63700008

    IPSec driver started successfully

    26 15:09:21.474 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    27 15:09:27.319 11/12/12 Sev = Info/4 CM / 0 x 63100017

    xAuth application returned

    28 15:09:27.319 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

    29 15:09:27.365 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    30 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

    31 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

    32 15:09:27.365 11/12/12 Sev = Info/4 CM/0x6310000E

    ITS established Phase 1.  1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

    33 15:09:27.365 11/12/12 Sev = Info/5 IKE/0x6300005E

    Customer address a request from firewall to hub

    34 15:09:27.365 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to *. **. ***. ***

    35 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    36 15:09:27.397 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

    37 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 192.168.2.70

    38 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.255.0

    39 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 192.168.2.1

    40 15:09:27.397 11/12/12 Sev = Info/5 IKE / 0 x 63000010

    MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 8.8.8.8

    41 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000001

    42 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000E

    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = NCHCO

    43 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

    44 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000E

    MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc. ASA5505 Version 8.2 (5) built by manufacturers on Saturday, May 20, 11 16:00

    45 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

    MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

    46 15:09:27.397 11/12/12 Sev = Info/5 IKE/0x6300000D

    MODE_CFG_REPLY: Attribute = received and by using the NAT - T port number, value = 0 x 00001194

    47 15:09:27.397 11/12/12 Sev = Info/4 CM / 0 x 63100019

    Data in mode Config received

    48 15:09:27.412 11/12/12 Sev = Info/4 IKE / 0 x 63000056

    Received a request from key driver: local IP = 192.168.2.70, GW IP = *. **. ***. remote IP address = 0.0.0.0

    49 15:09:27.412 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK QM * (HASH, SA, NO, ID, ID) to *. **. ***. ***

    50 15:09:27.444 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    51 15:09:27.444 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

    52 15:09:27.444 11/12/12 Sev = Info/5 IKE / 0 x 63000045

    Answering MACHINE-LIFE notify has value of 86400 seconds

    53 15:09:27.444 11/12/12 Sev = Info/5 IKE / 0 x 63000047

    This SA was already alive for 6 seconds, setting expiration 86394 seconds now

    54 15:09:27.459 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    55 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">

    56 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000013

    SEND to > ISAKMP OAK INFO *(HASH, DEL) to *. **. ***. ***

    57 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000049

    IPsec security association negotiation made scrapped, MsgID = CE99A8A8

    58 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000017

    Marking of IKE SA delete (I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

    59 15:09:27.459 11/12/12 Sev = Info/5 IKE/0x6300002F

    Received packet of ISAKMP: peer = *. **. ***. ***

    60 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000058

    Received an ISAKMP for a SA message no assets, I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924

    61 15:09:27.459 11/12/12 Sev = Info/4 IKE / 0 x 63000014

    RECEIVING< isakmp="" oak="" info="" *(dropped)="" from="">

    62 15:09:27.490 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    63 15:09:30.475 11/12/12 Sev = Info/4 IKE/0x6300004B

    IKE negotiation to throw HIS (I_Cookie = A3A341F1C7606AD5 R_Cookie = F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

    64 15:09:30.475 11/12/12 Sev = Info/4 CM / 0 x 63100012

    ITS phase 1 deleted before first Phase 2 SA is caused by "DEL_REASON_IKE_NEG_FAILED".  Crypto 0 Active IKE SA, 0 IKE SA authenticated user in the system

    65 15:09:30.475 11/12/12 Sev = Info/5 CM / 0 x 63100025

    Initializing CVPNDrv

    66 15:09:30.475 11/12/12 Sev = Info/6 CM / 0 x 63100046

    Set indicator established tunnel to register to 0.

    67 15:09:30.475 11/12/12 Sev = Info/4 IKE / 0 x 63000001

    Signal received IKE to complete the VPN connection

    68 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    69 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    70 15:09:30.475 11/12/12 Sev = Info/4 IPSEC / 0 x 63700014

    Remove all keys

    71 15:09:30.475 11/12/12 Sev = Info/4 IPSEC/0x6370000A

    IPSec driver successfully stopped

    ---------------------------------------------------------------------------------------------------------------------------------------

    The running configuration is the following (there is a VPN site-to-site set up as well at an another ASA 5505, but that works perfectly):

    : Saved

    :

    ASA Version 8.2 (5)

    !

    hostname NCHCO

    Select hTjwXz/V8EuTw9p9 of encrypted password

    hTjwXz/V8EuTw9p9 of encrypted passwd

    names of

    description of NCHCO name 192.168.2.0 City offices

    name 192.168.2.80 VPN_End

    name 192.168.2.70 VPN_Start

    !

    interface Ethernet0/0

    switchport access vlan 2

    Speed 100

    full duplex

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.2.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP address **. ***. 255.255.255.248

    !

    boot system Disk0: / asa825 - k8.bin

    passive FTP mode

    access extensive list ip NCHCO 255.255.255.0 outside_nat0_outbound allow 192.168.1.0 255.255.255.0

    access extensive list ip NCHCO 255.255.255.0 inside_nat0_outbound allow 192.168.1.0 255.255.255.0

    inside_nat0_outbound list of allowed ip extended access all 192.168.2.64 255.255.255.224

    access extensive list ip NCHCO 255.255.255.0 outside_1_cryptomap allow 192.168.1.0 255.255.255.0

    access extensive list ip NCHCO 255.255.255.0 outside_1_cryptomap_1 allow 192.168.1.0 255.255.255.0

    Standard access list LAN_Access allow NCHCO 255.255.255.0

    LAN_Access list standard access allowed 0.0.0.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    mask of VPN_Pool VPN_Start VPN_End of local pool IP 255.255.255.0

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 645.bin

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    NAT (outside) 0-list of access outside_nat0_outbound

    Route outside 0.0.0.0 0.0.0.0 74.219.208.49 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    network-acl outside_nat0_outbound

    WebVPN

    SVC request to enable default svc

    Enable http server

    http 192.168.1.0 255.255.255.0 inside

    http *. **. ***. 255.255.255.255 outside

    http 74.218.158.238 255.255.255.255 outside

    http NCHCO 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set esp-3des esp-sha-hmac l2tp-transform

    Crypto ipsec transform-set l2tp-transformation mode transit

    Crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac

    Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

    Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

    Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5

    Crypto ipsec transform-set transit mode TRANS_ESP_3DES_MD5

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    crypto dynamic-map dyn-map 10 set pfs Group1

    crypto dynamic-map dyn-map transform 10-set, vpn l2tp-transformation-transformation

    dynamic-map encryption dyn-map 10 value reverse-road

    Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS_ESP_3DES_MD5

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set pfs Group1

    peer set card crypto outside_map 1 74.219.208.50

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    map outside_map 20-isakmp ipsec crypto dynamic outside_dyn_map

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    inside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    inside crypto map inside_map interface

    card crypto vpn-map 1 match address outside_1_cryptomap_1

    card crypto vpn-card 1 set pfs Group1

    set vpn-card crypto map peer 1 74.219.208.50

    card crypto vpn-card 1 set of transformation-ESP-3DES-SHA

    dynamic vpn-map 10 dyn-map ipsec isakmp crypto map

    crypto isakmp identity address

    crypto ISAKMP allow inside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    md5 hash

    Group 2

    life 86400

    crypto ISAKMP policy 15

    preshared authentication

    aes-256 encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP policy 35

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP ipsec-over-tcp port 10000

    enable client-implementation to date

    Telnet 192.168.1.0 255.255.255.0 inside

    Telnet NCHCO 255.255.255.0 inside

    Telnet timeout 5

    SSH 192.168.1.0 255.255.255.0 inside

    SSH NCHCO 255.255.255.0 inside

    SSH timeout 5

    Console timeout 0

    dhcpd address 192.168.2.150 - 192.168.2.225 inside

    dhcpd dns 216.68.4.10 216.68.5.10 interface inside

    lease interface 64000 dhcpd inside

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    internal DefaultRAGroup group strategy

    attributes of Group Policy DefaultRAGroup

    value of server DNS 192.168.2.1

    Protocol-tunnel-VPN IPSec l2tp ipsec

    nchco.local value by default-field

    attributes of Group Policy DfltGrpPolicy

    value of server DNS 192.168.2.1

    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

    allow password-storage

    enable IPSec-udp

    enable dhcp Intercept 255.255.255.0

    the address value VPN_Pool pools

    internal NCHVPN group policy

    NCHVPN group policy attributes

    value of 192.168.2.1 DNS Server 8.8.8.8

    Protocol-tunnel-VPN IPSec l2tp ipsec

    value by default-field NCHCO

    admin LbMiJuAJjDaFb2uw encrypted privilege 15 password username

    username privilege 15 encrypted password yB1lHEVmHZGj5C2Z 8njferg

    username, encrypted NCHvpn99 QhZZtJfwbnowceB7 password

    attributes global-tunnel-group DefaultRAGroup

    address (inside) VPN_Pool pool

    address pool VPN_Pool

    authentication-server-group (inside) LOCAL

    authentication-server-group (outside LOCAL)

    LOCAL authority-server-group

    authorization-server-group (inside) LOCAL

    authorization-server-group (outside LOCAL)

    Group Policy - by default-DefaultRAGroup

    band-Kingdom

    band-band

    IPSec-attributes tunnel-group DefaultRAGroup

    pre-shared key *.

    NOCHECK Peer-id-validate

    tunnel-group DefaultRAGroup ppp-attributes

    No chap authentication

    no authentication ms-chap-v1

    ms-chap-v2 authentication

    tunnel-group DefaultWEBVPNGroup ppp-attributes

    PAP Authentication

    ms-chap-v2 authentication

    tunnel-group 74.219.208.50 type ipsec-l2l

    IPSec-attributes tunnel-group 74.219.208.50

    pre-shared key *.

    type tunnel-group NCHVPN remote access

    attributes global-tunnel-group NCHVPN

    address pool VPN_Pool

    Group Policy - by default-NCHVPN

    IPSec-attributes tunnel-group NCHVPN

    pre-shared key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    no remote anonymous reporting call

    Cryptochecksum:15852745977ff159ba808c4a4feb61fa

    : end

    ASDM image disk0: / asdm - 645.bin

    ASDM VPN_Start 255.255.255.255 inside location

    ASDM VPN_End 255.255.255.255 inside location

    don't allow no asdm history

    Anyone have any idea why this is happening?

    Thank you!

    Add, crypto dynamic-map outside_dyn_map 20 value reverse-road.

    With respect,

    Safwan

  • ASA 5505 VPN Site to site with several networks

    Hello

    I have a Cisco ASA 5505 configuration problem and hope you can help me.

    Our company created a second facility, which must be connected using VPN to our headquarters.

    I used the ASDM "Wizard of Site to site VPN" to create a connection, which works very well with our main network.

    Following structure:

    Headquarters:

    Cisco ASA 5505, firmware 9.1, ASDM version 7.1

    Outside: Fixed IP

    Inside: IP address of the interface is 192.168.0.1/24 (data network)

    Now I have a second network 192.168.1.0/24 (VoIP network), PBX address is 192.168.1.10.

    The two networks should be accessible through the VPN.

    New installation:

    Cisco ASA 5505, firmware 9.1, ASDM version 7.1

    Outside: Fixed IP

    Inside: IP address of the interface is 192.168.2.1/24

    I have already created a connection until a PC of the new plant reaches the data network. For example, a ping from 192.168.2.100 to 192.168.0.100 is possible.

    Now, I want to add some VoIP phones to the new facility, which can reach the PBX on 192.168.1.10.

    In the link, I have already added the two networks as remote network:

    object-group network Testgroup network-object 192.168.0.0 255.255.255.0 network-object 192.168.1.0 255.255.255.0 access-list outside_cryptomap extended permit ip object-group Testgroup object Remote-Network

    My problem now is, I don't know what to define as 'Bridge' on my PBX.

    I can't use 192.168.0.1 because it's a different subnet. Also, I can not put a second IP 192.168.1.1 to the interface of the ASA.

    You have any ideas, how can I accomplish this, so that the two subnets are accessed through the VPN and all devices have a defined gateway?

    Could a "Easy VPN Remote" in "Network Mode" you help me?

    What is the difference between 'Site-to-site' and 'extended network '?

    Kind regards

    Daniel condition, look for the solution GmbH

    You can optionally configure a new LAN VIRTUAL (VLAN PBX) on the SAA and connect this interface to the voice network.

    If you do not have a spare on the ASA port, then Yes, you have a router to route traffic from the PBX to the ASA via the data network.

  • ASA 5505 Split Tunneling configured but still all traffic Tunneling

    Hello

    I installed an ASA 5505 running 8.3.2 and Cisco AnyConnect Client 2.5.2017.

    There are the DefaultRAGroup and a newly configured Group called SplitTunnelNets.

    I have 1 internal subnet (192.168.223.0/24) which has a matching ACL/AS configured on the DefaultRAGroup and the custom group policy called SSLClientPolicy.

    When I start the VPN with the ASA, I can indeed reach internal resources, but when I look at the routing table, I see a new default gateway route 0.0.0.0 / 0-> 192.168.25.2 (that is in the IP pool) with a metric of 2.  The default route before the start of the session AnyConnect now has a higher metric, so the 192.168.25.2 next hop is a priority.

    I don't see the routes in the routing table for 192.168.223.0/24 as I expect to see.  In the diagnosis of AnyConnect, I see that 0.0.0.0/0 is the policy applied to the client.

    Here's my setup.  Please tell me if you see something that I'm missing.

    ASA 8.3 Version (2)
    !
    host name asa

    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.223.254 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP x.x.x.x 255.255.255.240
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    boot system Disk0: / asa832 - k8.bin
    passive FTP mode
    clock timezone IS - 5
    clock to summer time EDT recurring
    DNS lookup field inside
    DNS server-group DefaultDNS
    Server name 192.168.223.41
    domain Labs.com
    network obj_any object
    subnet 0.0.0.0 0.0.0.0
    vpn-client-net network object
    255.255.255.0 subnet 192.168.25.0
    network of the internal net object
    192.168.223.0 subnet 255.255.255.0
    the DM_INLINE_NETWORK_1 object-group network
    internal-net network object
    network-vpn-client-net object
    the DM_INLINE_NETWORK_2 object-group network
    internal-net network object
    network-vpn-client-net object
    SplitTunnelNets to access extensive ip list allow any 192.168.223.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    mask 192.168.25.1 - 192.168.25.50 255.255.255.0 IP local pool SSLClientPool
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any inside
    ASDM image disk0: / asdm - 635.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT (inside, all) static source internal-net net internal static destination vpn client vpn client-Net
    !
    network obj_any object
    NAT dynamic interface (indoor, outdoor)
    Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    Labs-AAA protocol ldap LDAP-server
    AAA-server Lab-LDAP (inside) host 192.168.223.41
    Server-port 636
    LDAP-base-dn dc = labs, dc = com
    LDAP-scope subtree
    LDAP-naming-attribute sAMAccountName
    LDAP-login-password *.
    LDAP-connection-dn [email protected] / * /
    enable LDAP over ssl
    microsoft server type
    Enable http server
    http 192.168.223.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Crypto ca trustpoint ASDM_TrustPoint0
    registration auto

    sslvpnkeypair key pair
    Configure CRL
    Crypto ca trustpoint ASDM_TrustPoint1
    ASDM_TrustPoint1 key pair
    Configure CRL
    string encryption ca ASDM_TrustPoint0 certificates

    Telnet 192.168.223.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 192.168.223.0 255.255.255.0 inside
    SSH timeout 5
    Console timeout 0
    dhcpd outside auto_config
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    NTP 192.5.41.41 Server
    NTP 192.5.41.40 Server
    SSL-trust outside ASDM_TrustPoint1 point
    WebVPN
    allow outside
    No anyconnect essentials
    SVC disk0:/anyconnect-win-2.5.2017-k9.pkg 1 image
    SVC disk0:/anyconnect-macosx-i386-3.0.0629-k9.pkg 2 image
    Picture disk0:/anyconnect-linux-3.0.0629-k9.pkg 3 SVC
    enable SVC
    tunnel-group-list activate
    internal SSLClientPolicy group strategy
    attributes of Group Policy SSLClientPolicy
    value of server DNS 192.168.223.41
    VPN-tunnel-Protocol svc
    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list SplitTunnelNets

    field default value Labs
    split dns value Labs.com
    the address value SSLClientPool pools
    WebVPN
    SVC Dungeon-Installer installed
    attributes of Group Policy DfltGrpPolicy
    value of server DNS 192.168.223.41
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list SplitTunnelNets
    coyotelabs.com value by default-field
    type of remote access service
    type tunnel-group SSLClientProfile remote access
    attributes global-tunnel-group SSLClientProfile
    CoyoteLabs-LDAP authentication-server-group
    Group Policy - by default-SSLClientPolicy
    tunnel-group SSLClientProfile webvpn-attributes
    allow group-alias CoyoteLabs
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname
    Cryptochecksum:95b7ff58b54e02948a14b225eec1a990
    : end

    The split tunnel access list must be standard access-list, not extended access list.

    You must change the following:
    FROM: SplitTunnelNets access-list extended ip to allow all 192.168.223.0 255.255.255.0
    To: SplitTunnelNets standard access list allows 192.168.223.0 255.255.255.0

    You should be able to reconnect again and will be able to access the Internet after you set up the standard access-list split tunnel.

    Hope that helps.

  • Site to site VPN upward but not pass traffic (ASA 5505 8.3.1 and 9.2.3 version)

    Hello

    I'll put up a tunnel vpn site-to-site between two locations.  Both have cisco ASA 5505 running a different version, I'll explain in more detail below.  so far, I was able to get the tunnel to come but I can't seem to pass traffic, I work at this for days now and have not been able to understand why he will not pass traffic.  Needless to say that the customer's PO would be on the fact that their VPN is not upward and they had to do by hand.  I'll put the configs below, if possible can someone help me as soon as POSSIBLE, I really want to get this site up and running so that we do not lose the customer.

    An IP address of 0.0.0.0 = site
    Site B IP = 1.1.1.1

    A Version of the site = 8.3.1
    Version of the site B = 9.2.3

    __________________________

    _________

    A RACE OF THE SITE CONFIGURATION

    Output of the command: "sh run".

    : Saved
    :
    ASA Version 8.3 (1)
    !
    hostname SDMCLNASA01
    SDMCLNASA01 domain name. LOCAL
    Select 5E8js/Fs7qxjxWdp of encrypted password
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    the IP 192.168.0.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    the IP 0.0.0.0 255.255.255.252
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    passive FTP mode
    clock timezone CST - 6
    clock to summer time recurring CDT
    DNS lookup field inside
    DNS domain-lookup outside
    DNS server-group DefaultDNS
    SDMCLNASA01 domain name. LOCAL
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network of the NETWORK_OBJ_192.168.0.0_24 object
    192.168.0.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network lan_internal object
    192.168.0.0 subnet 255.255.255.0
    purpose of the smtp network
    Home 192.168.0.245
    Network http object
    Home 192.168.0.245
    rdp network object
    Home 192.168.0.245
    network ssl object
    Home 192.168.0.245
    network camera_1 object
    host 192.168.0.13
    network camerahttp object
    host 192.168.0.13
    service object 8081
    source eq 8081 destination eq 8081 tcp service
    Dvr description
    network camera-http object
    host 192.168.0.13
    network dvr-http object
    host 192.168.0.13
    network dvr-mediaport object
    host 192.168.0.13
    object-group Protocol DM_INLINE_PROTOCOL_1
    object-protocol udp
    object-tcp protocol
    object-group Protocol TCPUDP
    object-protocol udp
    object-tcp protocol
    DM_INLINE_TCP_1 tcp service object-group
    EQ port 3389 object
    port-object eq www
    EQ object of the https port
    EQ smtp port object
    DM_INLINE_TCP_2 tcp service object-group
    port-object eq 34567
    port-object eq 34599
    EQ port 8081 object
    permit access ip 192.168.0.0 scope list outside_1_cryptomap 255.255.255.0 192.168.1.0 255.255.255.0
    outside_access_in list extended access permit tcp any any eq smtp
    outside_access_in list extended access permit tcp any any DM_INLINE_TCP_1 object-group
    outside_access_in list extended access permit tcp any any DM_INLINE_TCP_2 object-group
    permit access ip 192.168.0.0 scope list inside_nat0_outbound 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any inside
    ICMP allow all outside
    don't allow no asdm history
    ARP timeout 14400
    NAT (inside, outside) static static source NETWORK_OBJ_192.168.1.0_24 destination NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.1.0_24
    NAT (exterior, Interior) static static source NETWORK_OBJ_192.168.0.0_24 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.0.0_24
    !


    network lan_internal object
    NAT dynamic interface (indoor, outdoor)
    purpose of the smtp network
    NAT (all, outside) interface static tcp smtp smtp service
    Network http object
    NAT (all, outside) interface static tcp www www service
    rdp network object
    NAT (all, outside) interface static service tcp 3389 3389
    network ssl object
    NAT (all, outside) interface static tcp https https service
    network dvr-http object
    NAT (all, outside) interface static 8081 8081 tcp service
    network dvr-mediaport object
    NAT (all, outside) interface static 34567 34567 tcp service
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 71.42.194.209 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    http server enable 8080
    http 192.168.0.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 outside
    http 71.40.221.136 255.255.255.252 inside
    http 71.40.221.136 255.255.255.252 outside
    http 192.168.0.0 255.255.255.0 outside
    http 97.79.197.42 255.255.255.255 inside
    http 97.79.197.42 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    card crypto outside_map 1 match address outside_1_cryptomap
    card crypto outside_map 1 set peer 1.1.1.1
    card crypto outside_map 1 set of transformation-ESP-3DES-SHA
    outside_map interface card crypto outside
    crypto isakmp identity address
    crypto ISAKMP allow outside
    crypto ISAKMP policy 65535
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    dhcpd address 192.168.0.50 - 192.168.0.150 inside
    dhcpd dns 192.168.0.245 209.18.47.62 interface inside
    dhcpd SDMCLNASA01 field. LOCAL inside interface
    dhcpd allow inside
    !

    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    attributes of Group Policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared key *.
    !
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    !
    context of prompt hostname
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:462428c25e9748896e98863f2d8aeee7
    : end

    ________________________________

    SITE B RUNNING CONFIG

    Output of the command: "sh run".

    : Saved
    :
    : Serial number: JMX1635Z1BV
    : Material: ASA5505, 512 MB RAM, 500 MHz Geode Processor
    :
    ASA Version 9.2 (3)
    !
    ciscoasa hostname
    activate qddbwnZVxqYXToV9 encrypted password
    volatile xlate deny tcp any4 any4
    volatile xlate deny tcp any4 any6
    volatile xlate deny tcp any6 any4
    volatile xlate deny tcp any6 any6
    volatile xlate deny udp any4 any4 eq field
    volatile xlate deny udp any4 any6 eq field
    volatile xlate deny udp any6 any4 eq field
    volatile xlate deny udp any6 any6 eq field
    names of
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP 1.1.1.1 255.255.255.252
    !
    passive FTP mode
    clock timezone CST - 6
    clock to summer time recurring CDT
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network camera_http object
    host 192.168.1.13
    network camera_media object
    host 192.168.1.13
    network of the NETWORK_OBJ_192.168.0.0_24 object
    192.168.0.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    outside_access_in list extended access permit tcp any any eq 9000
    outside_access_in list extended access permit tcp any any eq www
    outside_access_in list extended access permit icmp any one
    outside_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object NETWORK_OBJ_192.168.0.0_24
    pager lines 24
    Enable logging
    asdm of logging of information
    Within 1500 MTU
    Outside 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any inside
    ICMP allow all outside
    ASDM image disk0: / asdm - 732.bin
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static static source NETWORK_OBJ_192.168.0.0_24 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.0.0_24
    NAT (exterior, Interior) static static source NETWORK_OBJ_192.168.1.0_24 destination NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.1.0_24
    !
    network camera_http object
    NAT (all, outside) interface static tcp www www service
    network camera_media object
    NAT (all, outside) interface static 9000 9000 tcp service
    !
    NAT source auto after (indoor, outdoor) dynamic one interface
    Access-group outside_access_in in interface outside
    Route outside 0.0.0.0 0.0.0.0 71.40.221.137 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto outside_map 1 match address outside_cryptomap
    card crypto outside_map 1 peer set 0.0.0.0
    card crypto outside_map 1 set transform-set ESP-3DES-SHA ikev1
    outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev1 allow outside
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0

    dhcpd address 192.168.1.50 - 192.168.1.150 inside
    dhcpd dns 192.168.0.245 209.18.47.61 interface inside
    dhcpd SDPHARR field. LOCAL inside interface
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    attributes of Group Policy DfltGrpPolicy
    Ikev1 VPN-tunnel-Protocol
    internal GroupPolicy_0.0.0.0 group strategy
    attributes of Group Policy GroupPolicy_0.0.0.0
    VPN-tunnel-Protocol ikev1, ikev2
    tunnel-group 0.0.0.0 type ipsec-l2l
    tunnel-group 0.0.0.0 ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    !
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:19031ab1e3bae21d7cc8319fb7ecf0eb
    : end

    Sorry my mistake.

    Delete this if it's still there

    card crypto external_map 1 the value reverse-road

    Add this to both sides

    card crypto outside_map 1 the value reverse-road

    Sorry about that.

    Mike

  • Client VPN und Cisco asa 5505 tunnel work but no traffic

    Hi all

    I am new to this forum and Don t have a lot of experience with Cisco, so I hope I can get help from specialists.

    I have the following problem:

    I installed und konfigured ASA 5505 for use with vpn client. I would like to access the local network from outside through vpn.

    To test, I installed ASA 5505 with ADSL (pppoe) and tried to give access to the internal network.

    Of course whenever I have recive the supplier's different IP address, but it didn't is not a problem reconfigure in the vpn client.

    After the connection is established (vpn tunnel work) I can see my external network packets. But I Don t have any connection to the internal network.

    I erased my setup yesterday and tried to reconfigure ASA again. I didn t tested yesterday, because it was too late. And I know that I Don t have the authorization rule at present by the ACL. But I think I'm having the same problem again. (tunnel but no traffic).

    What I did wrong. Could someone let me know what I have to do today.

    With hope for your help Dimitri.

    ASA configuration after reset and basic configuration: works to the Internet from within the course.

    : Saved

    : Written by enable_15 to the CEDT 20:29:18.909 Sunday, August 29, 2010

    !

    ASA Version 8.2 (2)

    !

    ciscoasa hostname

    activate 2KFQnbNIdI.2KYOU encrypted password

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.1.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    PPPoE client vpdn group home

    IP address pppoe setroute

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    boot system Disk0: / asa822 - k8.bin

    passive FTP mode

    clock timezone THATS 1

    clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

    DNS domain-lookup outside

    DNS server-group DefaultDNS

    Server name 194.25.0.60

    Server name 194.25.0.68

    DM_INLINE_TCP_1 tcp service object-group

    port-object eq www

    EQ object of the https port

    inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 no matter what eq field open a debug session

    inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any object-group DM_INLINE_TCP_1 open a debug session

    inside_access_in list extended access deny ip any any debug log

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.0.0 255.255.0.0

    permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.10.0 255.255.255.128

    homegroup_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Outside 1500 MTU

    Within 1500 MTU

    IP local pool homepool 192.168.10.1 - 192.168.10.100 mask 255.255.255.0

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm-625 - 53.bin

    ASDM location 192.168.0.0 255.255.0.0 inside

    ASDM location 192.168.10.0 255.255.255.0 inside

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    inside_access_in access to the interface inside group

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    VPDN group home request dialout pppoe

    VPDN group House localname 04152886790

    VPDN group House ppp authentication PAP

    VPDN username 04152886790 password 1

    dhcpd outside auto_config

    !

    dhcpd address 192.168.1.5 - 192.168.1.36 inside

    dhcpd allow inside

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    TFTP server 192.168.1.5 inside c:/tftp-root

    WebVPN

    Group Policy inner residential group

    attributes of the strategy of group home group

    value of 192.168.1.1 DNS server

    Protocol-tunnel-VPN IPSec

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list homegroup_splitTunnelAcl

    username user01 encrypted password privilege 0 v5P40l1UGvtJa7Nn

    user01 username attributes

    VPN-strategy group home group

    tunnel-group home group type remote access

    attributes global-tunnel-group home group

    address homepool pool

    Group Policy - by default-homegroup

    tunnel-group group residential ipsec-attributes

    pre-shared-key ciscotest

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:930e6cddf25838e47ef9633dc2f07acb

    : end

    Hello

    Normally, you want a static public IP address on the ASA to allow it to receive connections from VPN clients (avoid to change the IP address all the time).

    If you connect via VPN, check the following:

    1. the tunnel is established:

    HS cry isa his

    Must say QM_IDLE or MM_ACTIVE

    2 traffic is flowing (encrypted/decrypted):

    HS cry ips its

    3. Enter the command:

    management-access inside

    And check if you can PING the inside ASA VPN client IP.

    4. check that the default gateway for the LAN internal ASA within intellectual property (or there is a road to the ASA to send traffic to the VPN clients).

    Federico.

  • ASA 5505 Tunnel No. traffic

    Hi all

    I am new to the forums and the configuration of the SAA.

    I have two 5505 we currently setup the wizard of ipsec.

    One of them is our main office and is able to communicate with other ASA configured for it.

    The tunnel is up, but we are not able to communicate on networks the.

    I have had to deal with this for two days and out of ideas.

    Network (hand): 192.168.1.0/24

    Network 192.168.3.0/24 B:

    A running of the network configuration

    : Saved

    :

    ASA Version 8.2 (1)

    !

    ciscoasa hostname

    activate the password

    passwd

    names of

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.1.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    static IP from ISP 255.255.255.248

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    passive FTP mode

    permit same-security-traffic inter-interface

    permit same-security-traffic intra-interface

    outside_access_in list extended access permit icmp any one

    outside_access_in list extended access permit tcp any interface outside eq 3389

    outside_access_in list extended access permit tcp any interface outside eq ftp

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.3.0 255.255.255.0

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.4.0 255.255.255.0

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.6.0 255.255.255.0

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.2.0 255.255.255.0

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.7.0 255.255.255.0

    outside_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.3.0 255.255.255.0

    outside_2_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.3.0 255.255.255.0

    outside_3_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.4.0 255.255.255.0

    outside_4_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.5.0 255.255.255.0

    outside_5_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.6.0 255.255.255.0

    outside_6_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.7.0 255.255.255.0

    outside_7_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.3.0 255.255.255.0

    outside_8_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.3.0 255.255.255.0

    access-list no. - NAT allowed extended ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

    inside_access_in of access allowed any ip an extended list

    111 extended access-list allow ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

    pager lines 24

    Enable logging

    recording of debug console

    monitor debug logging

    debug logging in buffered memory

    logging of debug asdm

    recording of debug messages

    Within 1500 MTU

    Outside 1500 MTU

    IP audit name IP_Attack attack action fall

    Check IP alarm action info IP_Information

    verification of IP within the IP_Information interface

    verification of IP within the IP_Attack interface

    interface IP outside the IP_Information check

    interface IP outside the IP_Attack check

    disable signing verification IP 2000

    disable signing verification IP 2004

    ICMP unreachable rate-limit 1 burst-size 1

    ICMP allow any inside

    ICMP allow all outside

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) - 0 111 access list

    NAT (inside) 1 0.0.0.0 0.0.0.0

    public static interface 3389 192.168.1.4 (indoor, outdoor) tcp 3389 netmask 255.255.255.255

    public static tcp (indoor, outdoor) interface ftp 192.168.1.4 netmask 255.255.255.255 ftp

    inside_access_in access to the interface inside group

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 (Gateway ISP)

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 0.0.0.0 0.0.0.0 inside

    http 0.0.0.0 0.0.0.0 outdoors

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set pfs Group1

    outside_map game 1 card crypto peer network C

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    card crypto outside_map 2 match address outside_2_cryptomap

    card crypto outside_map 2 pfs Group1 set

    crypto outside_map 2 peer network D E network card game

    card crypto outside_map 2 game of transformation-ESP-3DES-SHA

    card crypto outside_map 3 match address outside_3_cryptomap

    card crypto outside_map pfs Group1 3 set

    set outside_map 3 card crypto peer network F

    card crypto outside_map 3 game of transformation-ESP-3DES-SHA

    card crypto 4 correspondence address outside_4_cryptomap outside_map

    card crypto outside_map pfs Group1 4 set

    peer set network card crypto outside_map 4 G

    card crypto outside_map 4 game of transformation-ESP-3DES-SHA

    card crypto outside_map 5 match address outside_5_cryptomap

    card crypto outside_map pfs Group1 5 set

    crypto 5 peer network: outside_map card game

    card crypto outside_map 5 the value transform-set ESP-3DES-SHA

    card crypto outside_map 6 correspondence address outside_6_cryptomap

    card crypto outside_map pfs Group1 6 set

    card crypto outside_map 6 set peer network I

    card crypto outside_map 6 game of transformation-ESP-3DES-SHA

    card crypto outside_map 7 match address outside_7_cryptomap

    card crypto outside_map pfs Group1 7 set

    outside_map 7 peer Network J crypto card game

    card crypto outside_map 7 game of transformation-ESP-3DES-SHA

    card crypto outside_map 8 correspondence address outside_8_cryptomap

    card crypto outside_map pfs set 8 Group1

    crypto outside_map 8 peer network K card game

    card crypto outside_map 8 game of transformation-ESP-3DES-SHA

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP policy 30

    preshared authentication

    the Encryption

    sha hash

    Group 1

    life 86400

    Telnet 0.0.0.0 0.0.0.0 inside

    Telnet timeout 30

    SSH 0.0.0.0 0.0.0.0 inside

    SSH 0.0.0.0 0.0.0.0 outdoors

    SSH timeout 30

    Console timeout 0

    management-access inside

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    attributes of Group Policy DfltGrpPolicy

    value of VPN-filter 111

    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

    OMIS

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    inspect the pptp

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:2b13e2781cf6be80bd5d7c2998d78bdf

    : end

    don't allow no asdm history

    and it's B network running config:

    : Saved

    :

    ASA Version 8.2 (5)

    !

    ciscoasa hostname

    activate the password

    names of

    Trinity name 192.168.1.0

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    security-level 100

    address 192.168.3.1 IP 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    static IP from ISP 255.255.255.0

    !

    passive FTP mode

    DNS lookup field inside

    DNS server-group DefaultDNS

    Server name 68.105.28.16

    Server name 68.105.29.16

    permit same-security-traffic inter-interface

    permit same-security-traffic intra-interface

    outside_1_cryptomap to access extended list ip 192.168.3.0 allow Trinity 255.255.255.0 255.255.255.0

    inside_nat0_outbound to access extended list ip 192.168.3.0 allow Trinity 255.255.255.0 255.255.255.0

    inside_access_in of access allowed any ip an extended list

    outside_access_in list extended access permit icmp any one

    outside_access_in list extended access permit tcp any interface outside eq 3389

    outside_access_in list extended access permit tcp any interface outside eq ftp

    pager lines 24

    Enable logging

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    ICMP unreachable rate-limit 1 burst-size 1

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) - 0 111 access list

    NAT (inside) 1 0.0.0.0 0.0.0.0

    inside_access_in access to the interface inside group

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 70.168.245.161 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 192.168.3.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set pfs Group1

    card crypto outside_map 1 set of peer main office

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    crypto ISAKMP policy 30

    preshared authentication

    the Encryption

    sha hash

    Group 1

    life 86400

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    dhcpd outside auto_config

    !

    dhcpd address 192.168.3.5 - 192.168.3.254 inside

    dhcpd dns 68.105.28.16 68.105.29.16 interface inside

    dhcpd allow inside

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    attributes of Group Policy DfltGrpPolicy

    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

    Office main tunnel-group type ipsec-l2l

    tunnel-group office main ipsec-attributes

    pre-shared key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    no remote anonymous reporting call

    Cryptochecksum:cd079382c64a4046125089b766c0334f

    : end

    ASDM location 255.255.255.0 inside Trinity

    don't allow no asdm history

    Thank you

    Mike

    Hello Mike,.

    outside_1_cryptomap to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

    local ident (addr, mask, prot, port): (192.168.3.0/255.255.255.0/0/0)

    Remote ident (addr, mask, prot, port): (trinity/255.255.255.0/0/0)

    current_peer:xx.XX.XX.170

    #pkts program: 106, #pkts encrypt: 106, #pkts digest: 106

    #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0

    If no package received!

    Site main do not encrypt or send the traffic via another card Crypto (see Jounni)

    #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0

    #pkts decaps: 101, #pkts decrypt: 101, #pkts check: 101

    Excellent work of Jounni,

    mark it as answered so future users can pull of this

    For more information about Core and network security, follow my Web site at http://laguiadelnetworking.com

    Any questions contact me at the [email protected] / * /

    See you soon,.

    Julio Segura Carvajal

  • ASA 5505 cannot configure FTP and I tried almost everything

    Not sure if my device is faulty or not, but I'm running on a base license and cannot establish an FTP connection for the life of me. Here is my config;

    Thanks in advance...

    ASA Version 7.2 (2)
    !
    ciscoasa hostname
    domain default.domain.invalid
    activate the encrypted password of TGFUt.AsMHJOyury
    names of
    !
    interface Vlan1
    nameif inside
    security-level 100
    IP 192.168.1.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    IP address dhcp setroute
    !
    interface Ethernet0/0
    switchport access vlan 2
    !
    interface Ethernet0/1
    !
    interface Ethernet0/2
    !
    interface Ethernet0/3
    !
    interface Ethernet0/4
    !
    interface Ethernet0/5
    !
    interface Ethernet0/6
    !
    interface Ethernet0/7
    !
    2KFQnbNIdI.2KYOU encrypted passwd
    passive FTP mode
    DNS server-group DefaultDNS
    domain default.domain.invalid
    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp
    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp - data
    pager lines 24
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    ICMP unreachable rate-limit 1 burst-size 1
    ASDM image disk0: / asdm - 522.bin
    don't allow no asdm history
    ARP timeout 14400
    Global 1 interface (outside)
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect
    Timeout, uauth 0:05:00 absolute
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Telnet 192.168.1.0 255.255.255.0 inside
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    dhcpd outside auto_config
    !
    dhcpd address 192.168.1.2 - 192.168.1.33 inside
    dhcpd allow inside
    !

    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    !
    global service-policy global_policy
    context of prompt hostname
    Cryptochecksum:641863a581e04222e46e2ab17a880147
    : end

    Where is the static nat translation, or configuration of port forwarding?

    you have bellows acl lines, these access lists is not yet applied to the external interface of the firewall.

    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp
    access-list extended 100 permit tcp any host 192.168.1.110 eq ftp - data

    How the outside internet hosts are able to connect to a non-public such as the 192.168.1.110 IP address?

    you need little things to fix in your configuration, your external interface is first attributed to dynamic ip for ISPS to provide the public IP seen in your config like:

    interface Vlan2
    nameif outside
    security-level 0
    IP address dhcp setroute

    Number 1- because we don't know what address IP of the ISP dynamically given the firewall, you must know what address is provided by the show on the asa show ip interface brief command line and take notes on the IP Vlan2... that Ip address will be the use of a single for hosts on the internet so you can connect to your FTP 192.168.1.110 server.

    Number 2 - because you do not spared a public IP address to use a one-to-one translation NAT for your server ftp within a public IP to the outside address, you must use the keyword interface on your translation of static port and the real access list 100 for the firewall to allow this connection and sends the request to the server ftp inside.

    public static tcp (indoor, outdoor) interface 192.168.1.110 ftp ftp netmask 255.255.255.255
    public static tcp (indoor, outdoor) interface ftp - data 192.168.1.110 ftp - data netmask 255.255.255.255

    Then re - configure acl 100 as below and apply it to the external interface

    access-list extended 100 permit tcp any which interface outside eq ftp
    access-list extended 100 permit tcp any which interface outside eq ftp_data

    Access-group 100 in external interface

    Finally, make sure you have your FTP server is running, don't forget not that from outside you will be using the public IP address you got output show ip interface brief , which will be the IP address that will be used to FTP from the outside to the inside.

  • How to configure ASDM Cisco ASA 5505

    I have a Cisco ASA 5505 firewall, and currently it is a command-line firewall. I want to configure ASDM so that I can use it as a Web based GUI interface.

    I don't really know what to do. Can someone help me please how I can configure ASDM on my firewall.

    Kind regards

    Naushad Khan

    Hi Naushad,

    First of all, must load the image ASSDM on SAA and then use the command:

    ASDM image dosk0: / asdm645.bin (if the image name is asdm645.bin)

    then:

    Enable http server

    http 10.0.0.0 255.0.0.0 inside (if your machine is 10.0.0.0 subnet behind inside the inetrafce)

    Go to the machine, open a browser and type:

    https://

    It will open the GUI.

    Thank you

    Varun

    Please evaluate the useful messages.

  • Block the specific IP traffic in ASA 5505

    Hi, we have an ASA 5505 in transparent mode and run a web service online. However, we notice a number of attempts to intrution from China and Korea and we need to block these IP traffic can anyone help please?

    config script is

    transparent firewall

    hostname xxyyASA

    Select msi14F/SlH4ZLjHH of encrypted password

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    !

    interface Ethernet0/0

    Description - the Internet-

    switchport access vlan 2

    !

    interface Ethernet0/1

    Description - connected to the LAN-

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    Shutdown

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    Bridge-Group 1

    security-level 100

    !

    interface Vlan2

    nameif outside

    Bridge-Group 1

    security-level 0

    !

    interface BVI1

    Description - for management only-

    IP address xxx.yyy.zzz.uuu 255.255.xxx.yyy

    !

    passive FTP mode

    network of the WWW-SERVER-OBJ object

    Home xxx.yyy.zzz.jjj

    Description - webserver-

    WWW-SERVER-SERVICES-TCP-OBJ tcp service object-group

    Description - Services published on the WEB server-

    WWW-SERVER-SERVICES-UDP-OBJ udp service object-group

    Description - Services published on the WEB server - UDP

    Beach of port-object 221 225

    1719-1740 object-port Beach

    OUTSIDE-IN-ACL scope tcp access list deny any any eq 3306

    OUTSIDE-IN-ACL scope tcp access list deny any any eq telnet

    OUTSIDE-IN-ACL scopes allowed icmp an entire access list

    OUTSIDE-IN-ACL scopes permitted tcp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-TCP-OBJ

    access list OUTSIDE-IN-ACL scopes permit tcp host xxx.yyy.zzz.uuu object WWW-SERVER-OBJ eq 3306

    OUTSIDE-IN-ACL scopes permitted udp access list any object WWW-SERVER-OBJ object-group WWW-SERVER-SERVICES-UDP-OBJ

    We need to block access of host say 64.15.152.208

    Just need the best step to follow and block access, without affecting the service or other host

    Thank you

    Insert a line like:

    OUTSIDE-IN-ACL scope access list deny host ip 64.15.152.208 all

    in front of your 3rd line "... to enable icmp a whole."

    If you have many of them, maybe do:

    object-group network blacklist

    host of the object-Network 64.15.152.208

    network-host another.bad.ip.here object

    object-network entire.dubious.subnet.here 255.255.255.0

    ...

    OUTSIDE-IN-ACL scope object-group BLACKLIST ip deny access list all

    If you want to take in scores of reputation on the outside, or the blacklist changes a lot, you might look into the Cisco ASA IPS module.

    Note that fleeing bad hosts help with targeted attacks, but not with denial of service; only, he moves to point decline since the application for the firewall server, without much effect on the net on your uplink bandwidth consumption.

    -Jim Leinweber, WI State Lab of hygiene

Maybe you are looking for