Sheep síntax for ASA version 9.1

Similar Questions

• ASA Version 9.0 (1) - Ping works both inside and outside, WWW does not work for remote VPN

  I am at a loss, I can connect VIA VPN and Ping inside the IPs (192.168.1.2) and outside (4.2.2.2) IPs of the remote VPN client, but can't surf WWW. Inside the network, all users have WWW access and the network is fine. I'm new on the revisions to ver 8.3 and don't see what I'm missing?

  Info:

  ASA-A # sh xl
  in use, the most used 12 4
  Flags: D - DNS, e - extended, I - identity, i - dynamics, r - portmap,
  s - static, T - twice, N - net-to-net
  NAT inside:192.168.1.0/24 to outside:24.180.x.x/24
  flags s idle 0:10:46 timeout 0:00:00
  NAT outside:192.168.2.0/24 to outside:24.180.x./24
  flags s idle 0:00:59 timeout 0:00:00
  NAT inside:192.168.1.0/24 to any:192.168.1.0/24
  sitting inactive flags 0:11:51 timeout 0:00:00
  NAT any:192.168.2.0/24 to inside:192.168.2.0/24
  sitting inactive flags 0:11:51 timeout 0:00:00
  ASA-A #.

  ASA-A # sh nat
  Manual NAT policies (Section 1)
  1 (inside) to destination of (all) Inside_Net Inside_Net the VPN-NET VPN static static
  translate_hits = 3, untranslate_hits = 3

  Auto NAT policies (Section 2)
  1 (inside) (outside) static source Inside_Net 24.180.x.x
  translate_hits = 3, untranslate_hits = 184
  2 (outdoor) (outdoor) static source VPN-net 24.180.x.x
  translate_hits 97, untranslate_hits = 91 =
  ASA-A #.

  Journal of the Sho:

  % 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection for udp src outside:192.168.2.10/137(LOCAL\User) dst outside:192.168.2.255/137 refused due to path failure reverse that of NAT
  % ASA-609002 7: duration of outside local host: 192.168.2.255 disassembly 0:00:00
  % ASA-609001 7: built outside local host: 192.168.2.255

  % 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection for udp src outside:192.168.2.10/137(LOCAL\User) dst outside:192.168.2.255/137 refused due to path failure reverse that of NAT
  % ASA-609002 7: duration of outside local host: 192.168.2.255 disassembly 0:00:00

  Current config:

  ASA Version 9.0 (1)
  !
  ASA-A host name
  domain a.local
  enable the encrypted password xxxxx
  XXXXX encrypted passwd
  names of
  IP local pool vpnpool 192.168.2.10 - 192.168.2.20
  !
  interface Ethernet0/0
  Inet connection description
  switchport access vlan 2
  !
  interface Ethernet0/1
  LAN connection description
  switchport access vlan 3
  !
  interface Ethernet0/2
  switchport access vlan 3
  !
  interface Ethernet0/3
  switchport access vlan 3
  !
  interface Ethernet0/4
  switchport access vlan 3
  !
  interface Ethernet0/5
  switchport access vlan 3
  !
  interface Ethernet0/6
  switchport access vlan 3
  !
  interface Ethernet0/7
  switchport access vlan 3
  !
  interface Vlan1
  No nameif
  no level of security
  no ip address
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP address 24.180.x.x 255.255.255.248
  !
  interface Vlan3
  nameif inside
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  banner exec   ********************************************
  banner exec   *                                          *
  exec banner * ASA-A *.
  banner exec   *                                          *
  exec banner * CISCO ASA5505 *.
  banner exec   *                                          *
  exec banner * A Services Inc.              *
  exec banner * xxx in car Street N. *.
  exec banner * city, ST # *.
  banner exec   *                                          *
  banner exec   ********************************************
  exec banner ^
  passive FTP mode
  DNS server-group DefaultDNS
  domain a.local
  permit same-security-traffic intra-interface
  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  network of the Inside_Net object
  subnet 192.168.1.0 255.255.255.0
  network of the VPN-net object
  Subnet 192.168.2.0 255.255.255.0
  access-list extended sheep permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
  allowed incoming access extended gre a whole list
  inbound udp allowed extended access list any host 24.180.x.x eq 1723
  list of allowed inbound tcp extended access any host 24.180.x.x eq pptp
  list of allowed inbound tcp extended access any host 24.180.x.x eq smtp
  list of allowed inbound tcp extended access any host 24.180.x.x eq www
  list of allowed inbound tcp extended access any host 24.180.x.x eq https
  list of allowed inbound tcp extended access any host 24.180.x.x eq 987
  inbound udp allowed extended access list any host 24.180.x.x eq 25
  inbound udp allowed extended access list any host 24.180.x.x eq 443
  inbound udp allowed extended access list any host 24.180.x.x eq www
  inbound udp allowed extended access list any host 24.180.x.x eq 987
  pager lines 24
  Enable logging
  debug logging in buffered memory
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow all outside
  ICMP allow any inside
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  public static Inside_Net Inside_Net destination NAT (inside, all) static source VPN-NET VPN
  !
  network of the Inside_Net object
  NAT static 24.180.x.x (indoor, outdoor)
  network of the VPN-net object
  24.180.x.x static NAT (outdoors, outdoor)
  Access-group interface incoming outside
  Route outside 0.0.0.0 0.0.0.0 24.180.x.x 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Enable http server
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec transform-set ikev1 VPN remote esp-3des esp-md5-hmac
  Crypto ipsec ikev2 VPN ipsec-proposal-remotetest
  Protocol esp encryption aes - 256, aes - 192, aes, 3des and
  Esp integrity sha-1 protocol
  Crypto ipsec pmtu aging infinite - the security association
  Crypto-map dynamic dyn1 1jeu ikev1 transform-set remote VPN
  Crypto-map dynamic dyn1 1jeu reverse-road
  map VPN - map 1-isakmp ipsec crypto dynamic dyn1
  VPN-card interface card crypto outside
  Crypto ca trustpoint _SmartCallHome_ServerCA
  Configure CRL
  trustpool crypto ca policy
  Crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
  308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
  010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
  30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
  13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
  0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
  20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
  65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
  65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
  30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
  30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
  496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
  74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
  68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
  302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
  63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
  010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
  a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
  9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
  7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
  15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
  1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
  18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
  4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
  81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
  082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
  7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
  ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
  45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
  2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
  1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
  03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
  69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
  02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
  6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
  c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
  69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
  1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
  445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
  1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
  2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
  4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
  b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
  99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018
  481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
  b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
  5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
  6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
  6c2527b9 deb78458 c61f381e a4c4cb66
  quit smoking
  Crypto ikev1 allow outside
  IKEv1 crypto policy 1
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 43200
  Telnet timeout 5
  SSH timeout 5
  Console timeout 0

  dhcpd outside auto_config
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  user name UName encrypted password privilege 15 xxxxxxxxx
  type tunnel-group remote VPN remote access
  attributes global-tunnel-group VPN-remote controls
  address vpnpool pool
  tunnel-group, ipsec VPN-remote controls-attributes
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  anonymous reporting remote call
  Cryptochecksum:43db9ab2d3427289fb9a0fdb22b551fa
  : end

  Hello

  Its propably because you do not have a DNS server configured for VPN users. Try this command:

   group-policy DfltGrpPolicy attributes dns-server value 8.8.8.8

• ASA version 8.4 for GNS3 IOS

  Hi all

  I test new IOS Cisco ASA version 8.4 in my LAB GNS3. Please help me and provide the link to download the same.

  I do not have access to direct download from cisco.com.

  Kind regards
  Saurabh

  Hello Slim,

  Please do some research on the subject,

  Here is a guide that you can use for GNS3,

  This will do for you

  http://www.xerunetworks.com/2012/02/Cisco-ASA-84-on-GNS3/

  Kind regards

• Cisco Anyconnect/WebVPN license for ASA 5510

  Hello

  Someone could please check the licenses for ASA 5510 attachment and let me know. We currently have ASA 5510 with basic license. According to the table attached under VPN sessions, he mentions that "250 combined SESSIONS IPSec and WebVPN" and to "Max box of WebVPN Session" it is mentioned that 2nd meeting, exceeding that we must buy license optional webvpn. While we the 250 combined license for IPSec and webVPN. We must purchase additional anyconnect license to set up remote access for users who want to use the internal resources from outside the network. OrElse, we don't have to purchase license and can configure webvpn/anyconnect of existing combined license existing users basic ASA license? Waiting for your response. Thank you.

  You are welcome.

  1 Yes

  2 AnyConnect requires no Java, but it can he use when connecting to one AnyConnect SSL VPN client and launch the Web browser option start Java-based. There was a bug with the AnyConnect old versions had later who should have addresses. You also have the option to launch via IE and using ActiveX or simply throw AnyConnect directly - neither of these two methods require Java.

  Here is a document TAC on the Java questions if you want more details.

  Please take a moment to note the useful messages and mark your answers questions.

• 12.5.1 iTunes for the version of older video cards will be deployed?

  My iTunes version 12.4.3.1 don't is not upgraded to 12.5.1 because it is the 32-bit version aka "for older video cards.

  12.5.1 for older versions of cards video ever be used?

  Apple's declining support for this version?

  Hmm, it is possible that the one who was supposed to update this page has dropped the ball. I have dug a link for correct setup of the main iTunes download page. You can get section more information for troubleshooting problems with iTunes for Windows updates which I try update after each output.

  TT2

• Firefox ESR 31.0 is still supported? Can we still have critical security updates for this version?

  We would like to know if Firefox ESR 31.0 is still a supported version. If this isn't the case, then it is always possible to obtain critical security updates for this version? When this version is full not taken in charge or the end of life?

  31 Firefox. 8.0esr was the last 31 update of esr and EOL with no more updates since the release of 31.8.0esr back on 2 July.

  The current ESR is based on 38 Firefox and is at version 38.4.0esr, which was released when Fx 42.0 was released.

• Looking for an answer for a version of big business-ESR and auto updates more 300.00 machines

  I have problems to find answers on your website and in the online forum community. Our Organization has a significant user base, and we are going to deploy Firefox ESR to our network. The issue I'm running into is looking for options feature of automatic update for the version of ESR. We are looking for viable options for managing our deployment and make sure that it is the safest road. We are looking for a couple options. Is there is an option where supply you software so we can deploy ESR updated our server internally? Do you provide options to we turn off automatic updates? We can also use the features of automatic update via Internet is an option for ESR version. Any help would be appreciated most.

  Hi, it only is not directly supported by mozilla for businesses in and of itself.
  the best way to get in touch use Working Group (EWG) business mailing list that got referenced in the first link of jscher2000.

• I am told my Firefox version is outdated but on Firefox said I'm updating version 39.0 + solutions for older versions do not work

  I run Firefox version 39.0 but told me that my version of Firefox is outdated even by the Mozilla site.
  About Firefox said I'm updating version 39.0 + solutions for older versions do not seem to work.
  I tried to download the full installer and run it, https://www.mozilla.org/firefox/all/
  (he was supposed to detect my existing installation and update).
  Then reopen Firefox and go to this site.
  Yet this site advises again once update me my version of Firefox...
  I would appreciate your help.
  Keep up the good work,
  Thanks in advance,

                                 Gunter Von Breslau
  

  If you couldn't fix it by resetting the custom entries general.useragent subject: config as described in the article above, then you might also Update firefox that should address this issue as well...

• Is Kindle for Mac version upgrade available for El Capitan?

  Is Kindle for Mac version upgrade available for El Capitan?

  Contact Amazon's Kindle. They are Kindle owners

• Programs written for earlier versions of graphical calculators HP can run on the HP 50 g?

  Hello

  I've seen many programs on hpcalc.org which are written for the HP 49, but I want to know if they work on the HP 50g as well. Also, will be programs written for earlier versions of the HP calculators work?

  ~ Zekelegge ~.

  Hi!, zekelegge:

  All programs written for the HP49G run OK, in the series HP49G + / HP50G, but not in HP48S/G/G + / GX series. Remember what HP49G + / HP50G emule Saturn microprocessor, 4 Mhz.

• Where can I find support for html 5 tags for each version of Firefox?

  Where can I find support for html 5 tags for each version of Firefox?

  Thanks for the help.

  See:

  • http://developer.Mozilla.org/en/HTML/HTML5
  • http://developer.Mozilla.org/en/Firefox_4_for_developers
  • http://developer.Mozilla.org/en/Firefox_5_for_developers
  • http://developer.Mozilla.org/en/Firefox_6_for_developers
  • http://developer.Mozilla.org/en/Firefox_7_for_developers

• Software update for Xcode version 7.3... never blocks finished

  Software update for Xcode version 7.3... never blocks finished on my MAC Book Pro Mid 2010

  From the Store menu, please select

  Search the unfinished downloads...

• Toshiba AT330 - looking for the version 4.0.3

  I'm looking for sofware version 4.0.3 or tablet applications

  Waiting for Android (ICS) update?
  Well, in your case I would recommend at the gas station
  If this update would be released by Toshiba, you should get through Service Station

• controls silver for previous versions?

  Is there anyway to get the new controls of money for previous versions of LabVIEW?

  No, there is no way to make money controls in previous versions (or will there be).

  Although you can technically save files .ctl for an earlier version, that they will not make me properly in the old version. The rectangle rounded corners, gradients and shadows required that we adding new features in LabVIEW 2011 obviously will not there in other versions.

  Simon

• OfficeJet 4635 cancel the firmware update because my ink cartridges are for older versions of the product

  I was happy with my officejet 4635 until I clicked on ok to apply for the HP firmware update. He said that it would improve my printer. However, demand has not said that my ink cartridges may not work if I installed the update. I clicked on ok and the update has been successfully installed. Now I can't print anything because I get an error message saying the I have ink cartridges are designed for older versions of the product. I do not use the new HP cartridges because they cost too much. I used cartridges refilled abacus in Az. Phhoenix which worked fine up until I did the update of the firmware of HP. I need to go back to the old system, so I can print again. I am connected to a desktop computer HP envy running windows 8.1. I'm furious HP to try and force you to buy their new cartridges with an update of something. I think that whoever came up with this update should be fired. Any help with a solution would be appreciated.

  I was told that there is no way to undo the update of the firmware. HP did send me a few ink cartridges so I could print again, but I am still ticked about the way this has been ensured by HP. They have not told me that my old version cartridges would not more work after updating firmware. I think that it is simply dishonest on part of HP and I am sure that other customers have been captured by this update of the firmware. I am sure it was a HP effort going to force you to use their new cartridges. I'll be very careful on the acceptance of the updates from HP in the future.