Several VPN site to Site

Similar Questions

• Several VPN site to site on the same ASA

  I need to set up an IPSEC tunnel to allow a provider to the remote site printing to a printer on my network.  I intend to use an ASA 5520 to do this.  The architecture is fairly simple:

  [Remote]-[Remote FW] --[FW Local]-[Local routing]-[printer]

  The downside is that there is finally more than a seller who needs to do.  Each will have a different destination but mena there will be more than a VPN to ASA at my end.  It seems that the ASA 5520 can be supported more than a VPN site to site, but I need to assign an IP address for different endpoint in each tunnel?

  I searched and found no a design guide for the VPN site - to-many.  If so, I'd appreciate a pointer.

  --

  Stephen

  You can do several tunnels VPN site to site.  As a general rule, you would have a card encryption applied to the interface in the face of internet.  Each crypto map entry has a sequence number. You simply have to create all the necessary configurations (tunnel-group for the remote peer IP, ACL to set interesting traffic, etc.) and increment the entry card crypto.

   Example: crypto map outside_map 1 match address s2s-VPN-1 crypto map outside_map 1 set pfs crypto map outside_map 1 set peer 1.2.3.4 crypto map outside_map 1 set transform-set ESP-3DES-SHA tunnel-group 1.2.3.4 type ipsec-l2l tunnel-group 1.2.3.4 ipsec-attributes  ikev1 pre-shared-key SomeSecureKey$ crypto map outside_map 2 match address s2s-VPN-2 crypto map outside_map 2 set pfs crypto map outside_map 2 set peer 4.5.6.7 crypto map outside_map 2 set transform-set ESP-3DES-SHA tunnel-group 4.5.6.7 type ipsec-l2l tunnel-group 4.5.6.7 ipsec-attributes ikev1 pre-shared-key SomeSecureKey2$

• How to configure the site for several vpn site

  Hello

  We are in the process of upgrading the IT infrastructure n/w. Our headquarters is home to all servers. I want to establish a vpn between our head office and our 4 stores connectivity.

  Head offfice LAN - 192.168.1.0/24

  Remote Desktop

  1 LAN 1 - 10.1.1.0/24

  2 LAN 2 - 10.1.2.0/24

  3 LAN 3 - 10.1.3.0/24

  4 LAN 4-10.1.5.0/24

  I want to implement the ipsec through our internet vpn. An example of a config would be useful. Thank you

  Not very easy to find an example of a config...

  http://www.Cisco.com/en/us/Partner/Tech/tk583/TK372/technologies_configuration_example09186a0080094525.shtml

  But you have to ORC.

  Federico.

• Configure VPN site to site with CCP

  Hello

  I have several VPN site to site of small offices, at Headquarters.

  Is possible to make a single configuration for all virtual private networks on the "vpn server"(ISR 1801) or I still need to add an entry for each VPN subnet? ". If Yes, is possible with the CCP?

  Kind regards

  Nuno

  You can then configure the VPN using CCP.

  I prefer the command line, and if there are many VPN from Site to Site, you can have a model, and what's happening to one VPN to another is interesting traffic, the INVESTIGATION period by peers and the pre-shared key.

  It depends on the policy.

  Federico.

• VPN site-to-Site: several remote networks

  Examples of VPN Site to Site ASA configuration that I have met has only a single network at both sites.

  If the network/remote site multi-network for example DMZ1, DMZ2, etc. from the INSIDE how can it be added via the wizard of Site to Site VPN ASDM.

  Thank you.

  Hello

  I have not seen an example of specific configuration with the addition of several networks for tunnel l2l IPSEC via ASDM.

  Generally speaking, you would just follow the same process in the Sub URL, but add all the multiple networks local and remote networks that you want to be protected IPSEC.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00805a87f7.shtml

  http://www.Cisco.com/en/us/docs/security/ASDM/6_1/user/guide/vpn_wiz.html#wp999348

  Kind regards

  Arul

  * Rate pls if it helps *.

• VPN site-to-site to package tracers

  Hello

  I configured both local networks with NAT. There is an ISP router inbetween these routers to emulate the internet.

  I would like to set up a VPN site-to site between these two routers.

  Here is the configuration of R1 and R3:

  R1:

  hostname R1

  no ip cef

  No ipv6 cef

  !

  crypto ISAKMP policy 1

  BA aes

  preshared authentication

  Group 2

  !

  ISAKMP crypto key 0 address 209.123.123.33

  !

  86400 seconds, duration of life crypto ipsec security association

  !

  Crypto ipsec transform-set aes - esp esp-sha-hmac yasser

  !

  auDA 100 ipsec-isakmp crypto map

  defined by peer 209.123.123.33

  PFS group2 Set

  86400 seconds, life of security association set

  Set transform-set yasser

  match address ramzy

  !

  pvst spanning-tree mode

  !

  interface FastEthernet0/0

  IP 172.16.1.21 255.255.248.0

  automatic duplex

  automatic speed

  !

  interface FastEthernet0/0.10

  encapsulation dot1Q 10

  IP 172.16.8.99 255.255.248.0

  IP nat inside

  !

  interface Serial0/3/0

  IP 209.123.123.1 255.255.255.240

  NAT outside IP

  clock speed of 128000

  auda crypto card

  !

  router ospf 1

  router ID - 15.15.15.15

  Log-adjacency-changes

  network of 172.16.8.0 0.0.7.255 area 1

  209.123.123.0 network 0.0.0.15 area 0

  !

  IP nat inside source list ADDRESSES interface Serial0/3/0 overload

  IP classless

  !

  IP flow-export version 9

  !

  standard access IP ADDRESSES list

  permit of 172.16.8.0 0.0.7.255

  ramzy extended IP access list

  172.16.8.0 IP allow 0.0.7.255 172.16.40.0 0.0.7.255

  !

  Line con 0

  !

  line to 0

  !

  line vty 0 4

  opening of session

  !

  end

  R3:

  p, li {white-space: pre wrap ;}}

  hostname R3

  !

  no ip cef

  No ipv6 cef

  !

  crypto ISAKMP policy 1

  BA aes

  preshared authentication

  Group 2

  !

  ISAKMP crypto key 0 address 209.123.123.1

  !

  86400 seconds, duration of life crypto ipsec security association

  !

  Crypto ipsec transform-set aes - esp esp-sha-hmac yasser

  !

  auDA 100 ipsec-isakmp crypto map

  defined by peer 209.123.123.1

  PFS group2 Set

  86400 seconds, life of security association set

  Set transform-set yasser

  match address ramzy

  !

  pvst spanning-tree mode

  !

  interface FastEthernet0/0

  IP 172.16.1.22 255.255.248.0

  automatic duplex

  automatic speed

  !

  interface FastEthernet0/0.40

  encapsulation dot1Q 40

  IP 172.16.40.99 255.255.248.0

  IP nat inside

  !

  interface Serial0/3/1

  IP 209.123.123.33 255.255.255.240

  NAT outside IP

  auda crypto card

  !

  router ospf 1

  router ID - 25.25.25.25

  Log-adjacency-changes

  network 172.16.40.0 0.0.7.255 area 2

  209.123.123.32 network 0.0.0.15 area 0

  !

  IP nat inside source list ADDRESSES interface Serial0/3/1 overload

  IP classless

  !

  IP flow-export version 9

  !

  standard access IP ADDRESSES list

  172.16.40.0 permit 0.0.7.255

  ramzy extended IP access list

  IP 172.16.40.0 allow 0.0.7.255 172.16.8.0 0.0.7.255

  !

  Line con 0

  !

  line to 0

  !

  line vty 0 4

  opening of session

  !

  end

  Try to ping of PC - A (172.16.8.1) PC - C (172.16.40.1) does not work.

  I tried several times to get the traffic through the tunnel with no success. Can someone tell me where I'm wrong?

  Thank you

  Josh

  Hi Josh,.

  Around this deployment, you will not be able to ping or reach the other side because of the NAT, NATting is dynamically IP addresses, you must do the following:

  R! :

  no nat ip inside source list ADDRESSES interface Serial0/3/0 overload

  no standard ip access list ADDRESSES

  permit of 172.16.8.0 0.0.7.255

  IP extended access.list ADDRESSES_NAT

  refuse the 172.16.8.0 ip 0.0.7.255 172.16.40.0 0.0.7.255

  overload of IP nat inside source list ADDRESSES_NAT interface Serial0/3/0

  R3:

  no nat ip inside the overload of source list ADDRESSES interface Serial0/3/1

  no standard ip access list ADDRESSES

  172.16.40.0 permit 0.0.7.255

  ADDRESSES_NAT extended IP access list

  deny ip 172.16.40.0 0.0.7.255 172.16.8.0 0.0.7.255

  IP nat inside source list ADDRESSES Overload: NAT interface Serial0/3/1

  with this show commands you make to phase 1 and phase 2 is in place and work:

  -show crypto isakmp his

  -show crypto ipsec his

  I hope this helps!

  Please note and mark it as correct the helpful post!

  David Castro,

  Concerning

• VPN site-to-site between 3 dynamic ip site to ip address static site

  Hi all

  I have a scenario,

  I have a static ip address in the headquarters and I have 4 office locations of all offices of construction site have dynamic ip.

  I created a site to site vpn between HO perfect work for 1 site office

  but I create a second profile in HO ASA for site office 2 config, I have created does not work.

  I use HO ASA 5520 and branches 5505 all site offices is ADSL connection

  I enclose my config HO

  Can u sat down just how dynamic config several profile in the HO

  Thank you

  Zeus

  It's just a suggestion...

  You want to get 3 dynamic sites connected with the HO, right?

  HO:

  As the branch have dynamic ip, you must use the DefaultL2LGroup profile (the same shared key for all three BO).

  The crypto-plan should be dynamic with the right soure/destination NET configured. Exempt NAT with the same source/destination NET as well.

  BO:

  Configured as a VPN Site-2-Site normal with the HO. The IPSEC Wizard is very useful.

  To connect to HO Bo, the branch must initiate the tunnel. After that, you have 2 full functional site site VPN.

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a00805733df.shtml

  Welcome,

  Norbert

• Router VPN site-to-site recommendations

  Hello

  I have to configure a VPN tunnel between the main and branch offices of a (very) small business. Is there a broadband internet access in both sites through cablemodems ethernet. ISPS assign the two dynamic cablemodems IP addresses public, which means that they are accessible from anywhere.
  In fact, it is a very simple task. My question is:

  What is best Linksys/Cisco equipment for this configuration of small businesses, as both routers should have in addition to the functionality of server VPN wireless capabilities?

  I thought to of the Linksys WRTxxxN, but they don't VPN (they are public devices in any case). Then I thought of the RV042 appreciated, but there is no wireless unfortunately.

  I'll highly appreciate recommendations. Remember that routers are for a very small company, so they should be prices accordingly.

  Thanks in advance,
  Fernando Ronci

  E-mail: [email protected] / * /

  Cisco Small Business has several VPN wireless routers, that supports site to site VPN.

  WRV210 and WRVS4400N are older models, while R120W and RV220W are of newer models. You can find pricing information on the sites of e-commerce as CEP, newegg, amazon or buy.com.

  If you have the double condition of WAN, for example, the increased reliability of internet connectivity, adding a point of access (for example WAP4410N) wireless R042 might be a good choice.

• [VPN Site-to-Site] Network that overlap

  Hello

  We have a Cisco ASA 9.1 and many VPN clients that work very well to this topic.

  Now, he must connect to a partner with VPN Site to Site site.

  We have a few problems:

  • Duplication of IP address (we use 10.145.0.0/16 10.0.0.0/8 and partner use)
  • Partner cannot use NAT on the router

  What are the best solutions to configure the VPN Site to Site?

  Thanks for your help,

  Patrick

  Hi Patrick,

  Best option here is that you can specify the required subnets only in the field of /encryption cryptomap...

  said in other 10.0.0.0/8 need access only a few subnets 10.1.0.0/24, 10.10.20.0/24... You can specify only in your crypto acl... Alternatively, you can use refuse instruction for the specific 10.145.0.0/16 crypto card but am not sure if this gives you the best result.

  If you have the required access is mixed with several 10.x.x.x/8 instructions... then you can have the crypto ACL like sub areas of encryption... Here you jump only 10.145.0.0/16 of the subnet range...

  10.0.0.0/9 to 10.145.0.0/16
  10.128.0.0/12 to 10.145.0.0/16
  10.146.0.0/15 to 10.145.0.0/16
  10.148.0.0/14 to 10.145.0.0/16
  10.152.0.0/13 to 10.145.0.0/16
  10.160.0.0/11 to 10.145.0.0/16

  10.192.0.0/10 to 10.145.0.0/16

  but make sure you have not all servers in 10.145.0.0/16 on your local network that the client requires access...

  Link to have refuse to crypto ACL'; s

  https://supportforums.Cisco.com/discussion/10909276/crypto-ACL-question

  Concerning

  Knockaert

• VPN site to Site, Phase2, ISAKMP problem

  Hi all

  I have a problem to Setup vpn site to site on two Cisco1841 ((C1841-ADVSECURITYK9-M) 12.4 routers (3i)) Version.

  I have seen several discussions with similar problems, but no help, and I couldn't find any problem solved also.

  Please see two attached documents, the first one with samples of itineraries config the remote and and the second with the debug output.

  I rechecked the configs on both routers, and it seems that both are very good.

  The strange is that tunnel comes up all the time, but I have only 50% by the pings of the networks the. Pings from the local and remote peers goes with 100%.

  Please see the errors on the document of debugging.

  Second thing, please pay attention to the subnet mask of the local interface of the local router (255.255.255.224). Maybe it's the root of a problem, it is not in line with the access list that is with wildcard 0.0.0.255?

  I think it's the only thing that I forgot to check today.

  Maybe it's a bug of ios or something?

  I appreciate any help to solve this problem.

  Thank you in advance,

  If your network is 255.255.255.224 255.255.255.224 should be in the ACL to change this in two ACLs of the interesting traffic.

  Check this

  * 6 sep 12:59:15.362: IPSEC (validate_transform_proposal): No IPSEC cryptomap is to address local y.y.y.y (local peer)

  * 6 sep 12:59:15.366: ISAKMP:(0:36:SW:1): IPSec policy invalidated proposal

  * 6 sep 12:59:15.366: ISAKMP:(0:36:SW:1): politics of ITS phase 2 is not acceptable! (local y.y.y.y (local peer) remote control (remote peer) x.x.x.x)

  This isn't a question about the phase I, but with the phase 2. The ACL must be changed

  LOCAL

  access-list 100 permit ip 192.168.0.0 0.0.0.31 192.168.2.0 0.0.0.255

  REMOTE

  access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.31

  Change that firs and then disable the SA and try again. I'm not sure why you receive only 50% of responses from the remote site

• VPN site to Site with a side PAT

  Hi all

  I created a VPN site-to site between two ASA 5505 s, with one side having a static public IP address and one side behind a device with PAT. UDP 500 is sent to the ASA.

  The tunnel works very well if the launched of the side behind the PAT, but may not be brought after on the other side.

  Here's what I see in the system log during initialization of the 'wrong' side:

  

  Is it still a problem with PAT?

  Best regards

  Tobias

  Hello

  To be honest, these are sometimes a little hard the problems especially when you do not have access to actual devices.

  For me the newspapers you shared seem to indicate a problem with the negotiation of Phase 1 where this local line sends proposals of Phase 1 to the remote device until he returned their enough responsible for negotiating to complete.

  So, I would try to confirm the device to remote site that this traffic is indeed allowed. For example, you can check the remote via a management connection VPN device when the VPN is NOT upward and see if there is no sign of VPN negotiating taking place when you start the other site traffic. That said if he still sees the initial messages in the direction that has problems with the opening of the tunnel.

  When you launch the negotiation this site VPN, what you see with the release of

  ISAKMP crypto to show his

  or with the latest software

  See ikev1 crypto his

  Try to take out several times while you generate the traffic to the VPN

  If the remote device does not respond at all you would see probably something like MM_WAIT_MSG2, which means that the local VPN device awaits the first response (second message to trading) of the remote VPN device.

  Maybe this will help you narrow down the problem a bit.

  -Jouni

• Have a vpn site to site of work, added second who has problems

  We've had a success vpn site to site working for several months now. It's a 5510 ASA to Headquarters for an ASA 5505 in a branch in another State. We add a second vpn site to site in another State this time of the AC to a Sonicwall TZ100. After connecting the Sonicwall to the Qwest modem in bridge mode tunnel came right up. I was unable to ping all off the coast of the private IPs to the HQ of the new branch, but was able to use the remote desktop in servers and workstations at Headquarters. Also, all computers appear when you browse the network of the new branch.

  The first part, we are able to ping both directions and use remote desktop in both directions.

  When using tracers of package in ASDM on the ASA HQ and rattling one of the IPs in HQ protected network to an IP address in the new network of agencies EXEMPT from NAT looks good, but when it hits the first NAT it fits on the "dynamic translation to the pool (10.1.255.254) 10 [Interface PAT]" (which is the default route to all VLAN access to Internet).

  Next NAT (subtype - host-limits) is more beautiful and this one goes to the IP address of the external interface of the ASA 5510 HQ, but then the third NAT (subtype - rpf-check) returns to the ' 10 (10.1.255.254) Interface PAT] "and the package is ABANDONED. Also there is no step VPN in Packet Tracer after NAT.

  So obviously the HQ ASA 5510 does not consider this to be interesting traffic but I don't know why.

  Here is the output of sh crypto ipsec his ffrom HQ ASA:

  Interface: outside
  Tag crypto map: outside_map, seq num: 30 local addr: 209.X.X.X

  access-list encrypt_acl-30 permit ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
  local ident (addr, mask, prot, port): (10.1.1.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.1.8.0/255.255.255.0/0/0)
  current_peer: 65.102.14.72

  #pkts program: 229450, #pkts encrypt: 229450, #pkts digest: 229450
  #pkts decaps: 172516, #pkts decrypt: 172516, #pkts check: 172516
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 229450, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 209.X.X.X, remote Start crypto. : 65.102.X.X

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: 91860025

  SAS of the esp on arrival:
  SPI: 0x88957B9C (2291497884)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 59068
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0xFFFFFFFF to 0xFFFFFFFF
  outgoing esp sas:
  SPI: 0 x 91860025 (2441478181)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 59068
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Tag crypto map: outside_map, seq num: 30 local addr: 209.X.X.X

  access-list encrypt_acl-30 permit ip 10.1.10.0 255.255.255.0 10.1.8.0 255.255.255.0
  local ident (addr, mask, prot, port): (10.1.10.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.1.8.0/255.255.255.0/0/0)
  current_peer: 65.102.x.x

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 209.X.X.X, remote Start crypto. : 65.102.X.X

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: A204BAE2

  SAS of the esp on arrival:
  SPI: 0xDA8C653A (3666634042)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 84670
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001
  outgoing esp sas:
  SPI: 0xA204BAE2 (2718218978)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 84621
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Here is the output of sh crypto isakmp his on HQ ASA:

  3 peer IKE: 65.102.x.x

  Type: L2L role: answering machine

  Generate a new key: no State: MM_ACTIVE

  Here is the config:

  ASA Version 8.0 (4)
  !
  hostname COMPASA
  domain COMPfirm.com
  activate the encrypted password of TMACBloMlcBsq1kp
  TMACBloMlcBsq1kp encrypted passwd
  names of
  DNS-guard
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 209.X.X.X 255.255.255.224
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  IP 10.1.255.254 255.255.255.248
  !
  interface Ethernet0/2
  nameif dmz
  security-level 50
  10.2.2.1 IP address 255.255.255.0
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  management only
  !
  boot system Disk0: / asa804 - k8.bin
  passive FTP mode
  clock timezone MDT - 7
  clock to summer time recurring MDT
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  Name-Server 4.2.2.1
  domain COMPfirm.com
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  list of allowed inbound tcp extended access any host 209.X.X.X eq www
  list of allowed inbound tcp extended access any host 209.X.X.X eq https
  list of allowed inbound tcp extended access any host 209.X.X.X eq ftp
  list of allowed inbound tcp extended access any host 209.X.X.X eq ftp - data
  list of allowed inbound tcp extended access any host 209.X.X.X eq ssh
  list of allowed inbound tcp extended access any host 209.X.X.X eq imap4
  list of allowed inbound tcp extended access any host 209.X.X.X eq pop3
  list of allowed inbound tcp extended access any host 209.X.X.X eq www
  list of allowed inbound tcp extended access any host 209.X.X.X eq https
  list of allowed inbound tcp extended access any host 209.X.X.X eq smtp
  list of extended inbound icmp permitted access a whole
  access list entering note MMS-1755
  list incoming extended access permit tcp any eq 1755 host inactive 209.X.X.X
  inbound access list notice MMS - UDP
  list of inbound udp allowed extended access all eq 1755 host inactive 209.X.X.X
  DMZ list extended access permit tcp host 10.2.2.2 10.1.1.11 host eq smtp
  DMZ list extended access permit tcp host 10.2.2.2 host 10.1.1.50 eq 8777
  access-list extended sheep allowed ip 10.1.0.0 255.255.0.0 172.16.22.0 255.255.255.0
  access-list sheep extended ip 10.1.10.0 allow 255.255.255.0 10.0.0.0 255.255.255.0
  access-list extended sheep allowed ip 10.1.1.0 255.255.255.0 10.0.0.0 255.255.255.0
  access-list sheep extended ip 10.1.10.0 allow 255.255.255.0 10.1.8.0 255.255.255.0
  access-list extended sheep allowed ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
  access extensive list ip 10.1.0.0 vpnsplit allow 255.255.0.0 172.16.22.0 255.255.255.0
  access extensive list ip 10.1.10.0 encrypt_acl allow 255.255.255.0 10.0.0.0 255.255.255.0
  permit encrypt_acl to access extended list ip 10.1.1.0 255.255.255.0 10.0.0.0 255.255.255.0
  global_mpc list extended access permitted tcp a whole
  access-list encrypt_acl-30 scope ip 10.1.10.0 allow 255.255.255.0 10.1.8.0 255.255.255.0
  access-list encrypt_acl-30 permit extended ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 dmz
  management of MTU 1500
  IP local pool vpnpool 172.16.22.1 - 172.16.22.254 mask 255.255.255.0
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any inside
  ASDM image disk0: / asdm - 61551.bin
  don't allow no asdm history
  ARP timeout 14400
  Global (outside) 10 209.X.X.X netmask 255.255.255.0
  Global interface (10 Interior)
  Global interface (dmz) 10
  NAT (inside) 0 access-list sheep
  NAT (inside) 10 0.0.0.0 0.0.0.0
  NAT (dmz) 10 0.0.0.0 0.0.0.0
  static (dmz, external) 209.X.X.X 10.2.2.2 netmask 255.255.255.255
  static (inside, outside) 209.X.X.X 10.1.1.11 netmask 255.255.255.255
  static (dmz, inside) 10.2.2.2 10.2.2.2 netmask 255.255.255.255
  static (inside, dmz) 10.1.1.11 10.1.1.11 netmask 255.255.255.255
  static (inside, dmz) 10.1.1.50 10.1.1.50 netmask 255.255.255.255
  Access-group interface incoming outside
  Access-group in interface dmz dmz
  Route outside 0.0.0.0 0.0.0.0 209.X.X.X 1
  Route inside 10.1.0.0 255.255.0.0 10.1.255.249 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  Ray of AAA-server vpn Protocol
  AAA-server vpn (inside) host 10.1.1.12
  key--> ZZZZZZ
  the ssh LOCAL console AAA authentication
  AAA authentication LOCAL telnet console
  local AAA authentication attempts 16 max in case of failure
  Enable http server
  http 172.16.22.0 255.255.255.0 inside
  http 10.1.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Sysopt noproxyarp inside
  Sysopt noproxyarp dmz
  Sysopt noproxyarp management
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set esp-3des esp-md5-hmac HQset
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic outside_dyn_map 10 the transform-set ESP-3DES-MD5 value
  life together - the association of security crypto dynamic-map outside_dyn_map 10 28800 seconds
  Crypto-map dynamic outside_dyn_map 10 kilobytes of life together - the association of safety 4608000
  Crypto-map dynamic outside_dyn_map 10 the value reverse-road
  card crypto outside_map 20 match address encrypt_acl
  card crypto outside_map 20 game peers 67.42.X.X
  outside_map 20 game of transformation-HQset crypto card
  life safety association set card crypto outside_map 20 28800 seconds
  card crypto outside_map 20 set security-association life kilobytes 4608000
  card crypto 30 match address encrypt_acl-30 outside_map
  crypto outside_map 30 peer 65.102.X.X card game
  crypto outside_map 30 card value transform-set HQset
  86400 seconds, duration of life card crypto outside_map 30 set - the security association
  card crypto outside_map 30 set security-association life kilobytes 4608000
  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400
  Crypto isakmp nat-traversal 50
  Telnet 10.1.0.0 255.255.0.0 inside
  Telnet timeout 15
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH 10.1.0.0 255.255.0.0 inside
  SSH timeout 30
  Console timeout 0
  management-access inside
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  threat scan-threat detection
  threat detection statistics
  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
  Server NTP 192.43.244.18
  WebVPN
  allow outside
  SVC disk0:/anyconnect-win-2.3.0254-k9.pkg 1 image
  enable SVC
  tunnel-group-list activate
  internal Clients_VPN group strategy
  Group Policy Clients_VPN attributes
  value of server WINS 10.1.1.12
  value of server DNS 10.1.1.12
  Protocol-tunnel-VPN IPSec
  enable IPSec-udp
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list vpnsplit
  value by default-field COMPfirm.local
  Split-dns value COMPfirm.local
  the address value vpnpool pools
  internal clientgroup group policy
  attributes of the strategy of group clientgroup
  value of server WINS 10.1.1.12
  value of server DNS 10.1.1.12
  VPN-tunnel-Protocol svc webvpn
  Split-tunnel-policy tunnelall
  WebVPN
  SVC Dungeon-Installer installed
  time to generate a new key of SVC 30
  SVC generate a new method ssl key
  SVC request no svc default
  ssluser1 encrypted password username
  username bcurtis encrypted password privilege 0 v
  username privilege 15 WPDR encrypted password
  username admin privilege 15 encrypted password
  username privilege password encrypted XXXXXXX 0
  tunnel-group M & J type remote access
  tunnel-group M & J - global attributes
  address vpnpool pool
  Vpn server authentication group
  strategy - by default-group Clients_VPN
  tunnel-group M & J ipsec-attributes
  pre-shared-key *.
  type tunnel-group sslgroup remote access
  tunnel-group sslgroup General-attributes
  address vpnpool pool
  Vpn server authentication group
  Group Policy - by default-clientgroup
  tunnel-group sslgroup webvpn-attributes
  activation of the Group sslgroup_users alias
  tunnel-group 67.42.X.X type ipsec-l2l
  IPSec-attributes tunnel-group 67.42.X.X
  pre-shared-key *.
  tunnel-group 65.102.X.X type ipsec-l2l
  IPSec-attributes tunnel-group 65.102.X.X
  pre-shared-key *.
  !
  Global class-card class
  corresponds to the global_mpc access list
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns migrated_dns_map_1
  parameters
  message-length maximum 768
  Policy-map global_policy
  class inspection_default
  inspect the migrated_dns_map_1 dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Global category
  IPS inline sensor vs0 relief
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:ZZZZZZZZZZZZZZZZZZZZZ
  : end

  Is the problem may be due to the fact that my 2 new ACL to fall "encrypt_acl-30" after "access-list extended global_mpc permit tcp any any" in the config and it flows into the implied all refuse?

  Thanks for looking at this.

  Rather than replace the static route, you can simply add a new static route to 10.1.8.0/24 as follows:

  outdoor 10.1.8.0 255.255.255.0 209.X.X.X 1

  Because it is more precise it will take precedence over your most generic static route from 10.1.0.0/16 inward.

  Good spot btw!

• VPN site to Site, as a part of the work of the ACL, why?

  I built a VPN site-to site IPsec from A to B, I have about 10 different subnets in the traffice interesting ACL, now, I can get some subnets don't talk to each other, no problem, but some may not.  For example, A to site B 10.1.0.1 subnet was not working, but 10.100.0.1 has functioned and 10.1.0.1 and 10.100.0.1 is actually two interfaces VLAN on a same router.

  Debugging of the ICMP has shown, when A ping to 10.1 and 10.100, the firewall at site B receives pings of echo from site A and also the echo of ping time reply 10.1 recevived and 10,100, but only the firewall received echo response from the 10,100.  looked like Firewall VPN B has no echo response 10.1 the site in some way

  Config enabled on both sites several times, is unable to identify the problems and the incompatibility. 10.1.0.0/24 and 10.100.0.0/24 are two network objects in the same ACL.

  The Super Cisco can provide some advice, what could go wrong, what I could use to troubleshoot...

  Thank you very much.

  PS everthing worked perfectly for a few days, then I had the problem of loss of package on the Web link, now the VPN tunnel is up, no config has been changed, but some just subnets not achieved through the VPN.

  W.

  Hello Yue,

  WOW, that's weard.

  Good thing is that now everything works now and believe me, it won't happen to you once again, you and I will know what to do next time... lol

  If possible please brand of answering the question as to future users with the same problem will know what to do based on your experience.

  Kind regards

  Julio

• Fields on several Internet sites have been changed in another language. The browser is set to English, and this problem does not occur with Chrome.

  Fields on several Internet sites have been changed in another language. The browser is set to English, and this problem does not occur with Chrome. Specifically, a large part of Tumblr and Facebook menu has been changed in another language (Russian, I think). I tried reinstall Firefox, clear the cache and reset firefox to its default state. None of them helped. Any suggestions on how to fix this?

  Hey again,

  Sometimes a problem with Firefox can be a result of malware installed on your computer, you may not be aware of.

  You can try these free programs to search for malicious software that work with your existing anti-virus software:

  • Microsoft safety scanner
  • MalwareBytes' Anti-Malware
  • TDSSKiller - AntiRootkit utility
  • Hitman Pro
  • ESET Online Scanner

  Microsoft Security Essentials is a good permanent antivirus for Windows 7/Vista/XP, if you do not already have one.

  More information can be found in the article troubleshooting Firefox problems caused by malware .

  I hope this helps!

  Curtis

• Is there a way to open a new window with a site when the House on Firefox setting has several Web sites?

  When you work in Firefox, is there a way to open a new window with a site when the House on Firefox setting has several Web sites?

  Firefox always opens a new window with the home page (s), you must use shift + left click on a link (bookmark) to open a page in a new window or just rip an existing tab by dragging the tab slightly downwards to open the tab in a new window.