Site to Site VPN Cisco 877

Similar Questions

• Order of operations NAT on Site to Site VPN Cisco ASA

  Hello

  I have a question about the order of operations NAT on Site to Site VPN Cisco ASA 8.2.x. I have a scenario where the internal IP address of the range 10.17.128.x are NATTED IP public 31.10.10.x. below is the config:

  Tunnel normally passes traffic to dmz - 31.10.11.10, 31.10.11.11 servers.

  But the servers NATTED (10.17.128.x <->31.10.10.x) does not work.

  inside_map crypto 50 card value transform-set ESP-3DES-SHA

  tunnel-group 100.1.1.1 type ipsec-l2l

  tunnel-group 100.1.1.1 General-attributes

  Group Policy - by default-PHX_HK

  IPSec-attributes tunnel-group 100.1.1.1

  pre-shared key *.

  internal PHX_HK group policy

  PHX_HK group policy attributes

  VPN-filter no

  Protocol-tunnel-VPN IPSec svc webvpn

  card crypto inside_map 50 match address outside_cryptomap_50

  peer set card crypto inside_map 50 100.1.1.1

  inside_map crypto 50 card value transform-set ESP-3DES-SHA

  inside_map crypto 50 card value reverse-road

  the PHX_Local object-group network

  host of the object-Network 31.10.11.10

  host of the object-Network 31.10.11.11

  host of the object-Network 31.10.10.10

  host of the object-Network 31.10.10.11

  host of the object-Network 31.10.10.12

  host of the object-Network 31.10.10.13

  host of the object-Network 10.17.128.20

  host of the object-Network 10.17.128.21

  host of the object-Network 10.17.128.22

  host of the object-Network 10.17.128.23

  the HK_Remote object-group network

  host of the object-Network 102.1.1.10

  inside_nat0_outbound list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

  ACL_INSIDE list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

  ACL_OUTSIDE list extended access permitted ip object-group HK_Remote-group of objects PHX_Local

  outside_cryptomap_50 list extended access permitted ip object-group PHX_Local-group of objects HK_Remote

  Route outside 102.1.1.10 255.255.255.255 30.1.1.1 1

  public static 31.10.10.10 (Interior, exterior) 10.17.128.20 netmask 255.255.255.255

  public static 31.10.10.11 (Interior, exterior) 10.17.128.21 netmask 255.255.255.255

  public static 31.10.10.12 (Interior, exterior) 10.17.128.22 netmask 255.255.255.255

  public static 31.10.10.13 (Interior, exterior) 10.17.128.23 netmask 255.255.255.255

  He started to work when I did another group of object by name PHX_Local1 and added to the list of access inside_nat0_outbound, instead of the object group PHX_Local, as below:

  the PHX_Local1 object-group network

  host of the object-Network 31.10.10.10

  host of the object-Network 31.10.10.11

  host of the object-Network 31.10.10.12

  host of the object-Network 31.10.10.13

  No inside_nat0_outbound access list extended only to allowed ip object-group PHX_Local-group of objects HK_Remote

  inside_nat0_outbound list extended access permitted ip object-group PHX_Local1-group of objects HK_Remote

  Can you please help me understand why group object PHX_Local failed with access-list inside_nat0_outbound, but he began to work with the Group of objects PHX_Local1.

  Also, if you could tell me the order of operations to NAT via VPN Site to Site, it would be useful.

  Thank you

  Kind regards

  Thomas

  Hello

  I think you could have said the original question in a way that could be missleading. In other words, if I understand now.

  From what I understand now, you have the DMZ set up the server that are measured with a public IP address on the real servers. And for those that you have configured NAT0.

  Then you have other servers that do not have public IP addresses themselves, but they are translated on the SAA.

  If this is the case, then the next question would be. The server with the NAT should attend the L2L VPN connection with their real IP or address IP NAT.

  Of course if you configure static NAT for the same servers and NAT0 the NAT0 will always win.

  You have these guests who were not able to use the VPN L2L

  31.10.10.10 10.17.128.20

  31.10.10.11 10.17.128.21

  31.10.10.12 10.17.128.22

  31.10.10.13 10.17.128.23

  IF you want them to go to the VPN L2L with their original IP address then you must configure

  object-group, LAN

  host of the object-Network 10.17.128.20

  host of the object-Network 10.17.128.21

  host of the object-Network 10.17.128.22

  host of the object-Network 10.17.128.23

  object-group, REMOTE network

  host of the object-Network 102.1.1.10

  inside_nat0_outbound list extended access allowed ip-group of objects LOCAL object-group remote

  outside_cryptomap_50 list extended access allowed ip-group of objects LOCAL object-group remote

  IF you want to use the L2L VPN with the public IP address, then you must configure

  object-group, LAN

  host of the object-Network 31.10.10.10

  host of the object-Network 31.10.10.11

  host of the object-Network 31.10.10.12

  host of the object-Network 31.10.10.13

  object-group, REMOTE network

  host of the object-Network 102.1.1.10

  outside_cryptomap_50 list extended access allowed ip-group of objects LOCAL object-group remote

  EDIT: in this case you naturally do not configure any NAT0 for actual IP addresses we want precisely the IP addresses to be visible to the L2L VPN with the IP NAT address.

  Or you can of course use the same "object-group" as currently but change the content in an appropriate manner

  Be sure to mark it as answered if it was answered.

  Ask more if necessary

  -Jouni

• 2 one-Site VPN Cisco 2801 and with crossing NAT

  Hi guys,.

  I would like to configure two Cisco 2801 using IPSEC/IKE. Both routers are connected to the internet through DSL lines. The DSL line have RFC1918 address side LAN where routers connected to the internet face. I can do NAT on DSL modems.

  Cisco IOS 2801 routers allow to configure site-2-site VPN with NAT crossing?

  Here is a model of physics/IP configuration:

  LAN<->2801 Modem DSL<-Internet->DSL modem<-Priv ip-=""> 2801<-Priv ip-=""><-> LAN

  Thank you

  Gonçalo

  Yes, you're good to go only if one or both of the sites has an IP address which is natted with private IP address statically. The implementation of IPSec on SRI NAT support in most crosses so that shouldn't be a concern

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Site to Site VPN Cisco IOS 1941 15.0 (1) M1

  Hello

  I am currently developing a Site VPN site between an ASA and a router in 1941. Configuring VPN on the SAA seems to be ok, because it works without problem with router 1841 with IOS 12.4 to the other site. The same VPN configuration on the new router in 1941 with M1 IOS 15.0 (1) does not work. It seems that the access to the crypto map list is the problem. The router never start the VPN connection. When the ASA attempts to establish the VPN, the debugging of the router log shows:

  ...

  * 14:37:52.263 may 5: ISAKMP: (1007): proposal of IPSec checking 1
  * 14:37:52.263 may 5: ISAKMP: turn 1, ESP_3DES
  * 14:37:52.263 may 5: ISAKMP: attributes of transformation:
  * 14:37:52.263 may 5: ISAKMP: type of life in seconds
  * 14:37:52.263 may 5: ISAKMP: life of HIS (basic) of 28800
  * 14:37:52.263 may 5: ISAKMP: type of life in kilobytes
  * 14:37:52.263 may 5: ISAKMP: service life of SA (IPV) 0x0 0 x 46 0 50 x 0 x 0
  * 14:37:52.263 may 5: ISAKMP: program is 1 (Tunnel)
  * 14:37:52.263 may 5: ISAKMP: authenticator is HMAC-SHA
  * 14:37:52.263 may 5: ISAKMP: group is 2
  * 14:37:52.263 may 5: ISAKMP: (1007): atts are acceptable.
  * 5 May 14:37:52.263: ISAKMP: (1007): IPSec policy invalidated proposal with error 32
  * 5 May 14:37:52.263: ISAKMP: (1007): politics of ITS phase 2 is not acceptable! (local... remote control...)

  ...

  Any clue?

  Concerning

  Claudia

  The configuration of the router:

  version 15.0
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname Cisco1941
  !
  No aaa new-model
  !
  No ipv6 cef
  no ip source route
  IP cef
  !
  IP domain name xyz.de
  !
  Authenticated MultiLink bundle-name Panel
  !
  Crypto pki trustpoint TP-self-signature-...
  !
  TP-self-signature-... crypto pki certificate chain
  quit smoking
  license udi pid CISCO1941/K9 sn...
  !
  username privilege 15 secret 5 xyz $1$...
  !
  redundancy
  !
  session of crypto consignment
  !
  crypto ISAKMP policy 10
  BA 3des
  preshared authentication
  Group 2
  ISAKMP crypto key... address 1.2.3.4
  invalid-spi-recovery crypto ISAKMP
  !
  Crypto ipsec transform-set esp-3des esp-sha-hmac tsAsa
  !
  ASA 10 ipsec-isakmp crypto map
  defined peer 1.2.3.4
  Set transform-set tsAsa
  PFS group2 Set
  match address 100
  !
  interface GigabitEthernet0/0
  Description * inside *.
  IP 10.100.100.1 255.255.255.0
  automatic duplex
  automatic speed
  !
  !
  interface GigabitEthernet0/1
  IP 5.6.7.8 255.255.255.240
  IP access-group 111 to
  no ip-cache cef route
  no ip route cache
  automatic duplex
  automatic speed
  card crypto asa
  !
  !
  ATM0/0/0 interface
  no ip address
  Shutdown
  No atm ilmi-keepalive
  !
  !
  IP forward-Protocol ND
  !
  IP route 0.0.0.0 0.0.0.0 1.2.3.5
  !
  access-list 100 permit ip 10.100.100.0 0.0.0.255 10.10.10.0 0.0.0.255
  access-list 111 allow esp 1.2.3.4 host 5.6.7.8
  access-list 111 permit udp host 1.2.3.4 host 5.6.7.8 eq isakmp
  access-list 111 allow ahp host 1.2.3.4 5.6.7.8
  access-list 111 deny ip any any newspaper

  ....

  end

  Try to do this:

  IP route 10.10.10.0 255.255.255.0 interface Ge0/1

  Route IP 1.2.3.4 255.255.255.255 by default-gateway-to-Ge0/1

  The rest of your config looks very good.

• site to site vpn cisco 1811

  Hi guys

  Two sites are on connection MPLS and things work fine. Is now looking to connect a second ISP and create a failover site-to-site VPN. If the main ISP goes down (in the case of a power failure full at the ISP level which is unlikely, but just in case) then MPLS should failover site to site VPN which will be completely on a different secondary ISP. Can someone provide me with options as if I have to use ospf, bgp and ip sla? If the follow-up involved how can I follow the MPLS? is it even that track just interface or any special routing required? etc and... your help is greatly appreciated... Thank you...

  Hello

  It actually depends on what is already at work.

  I usually do with IP SLA is not running Routing Protocol, OSPF, BGP are always my first option.

  IP SLA parameters should be the same, just point to an available IP address accessible through the main connection and follow your routes using this instance.

  In terms of VPN, make sure the encryption card is on the secondary interface, and it should do.

  HTH.

  Portu.

  Please note all useful messages.

• Problem with ping VPN cisco 877

  Hi all!

  I have a working VPN between a fortigate and a Cisco.

  I have a problem with ping network behind the cisco of the network behind the forti.

  When I ping to vlan2 cisco without problem (192.168.252.1) interface, but I can't ping a server in the vlan2 (192.168.252.2) behind the cisco.

  However the Cisco I can ping the server. In the forti, I see that ping to the interface vlan2 and server in vlan2 take in the same way, and I can see package.

  I post my config could see it it as blocking the ping from 10.41.2.36 to 192.168.252.2 while 192.168.252.1 ping is OK?

  IPSEC #show run
  Building configuration...

  Current configuration: 3302 bytes
  !
  ! Last modification of the configuration at 14:42:17 CEDT Friday, June 25, 2010
  ! NVRAM config update at 14:42:23 CEDT Friday, June 25, 2010
  !
  version 12.4
  no service button
  horodateurs service debug datetime msec
  Log service timestamps datetime localtime show-time zone
  encryption password service
  !
  IPSEC host name
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered 1000000
  enable secret 5 abdellah
  !
  No aaa new-model
  clock timezone GMT 1
  clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00
  !
  !
  dot11 syslog
  IP cef
  No dhcp use connected vrf ip
  DHCP excluded-address IP 192.168.254.0 192.168.254.99
  DHCP excluded-address IP 192.168.254.128 192.168.254.255
  !
  IP dhcp DHCP pool
  network 192.168.254.0 255.255.255.0
  router by default - 192.168.254.254
  Server DNS A.A.A.A B.B.B.B
  !
  !
  no ip domain search
  name of the IP-server A.A.A.A
  name of the IP-server B.B.B.B
  !
  !
  !
  !
  !
  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 5
  ISAKMP crypto key ciscokey address IP_forti
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac vpntest
  !
  myvpn 10 ipsec-isakmp crypto map
  defined by peer IP_forti
  Set transform-set vpntest
  match address 101
  !
  Archives
  The config log
  hidekeys
  !
  !
  !
  !
  !
  interface Tunnel0
  IP 2.2.2.1 255.255.255.252
  source of Dialer0 tunnel
  destination of IP_forti tunnel
  myvpn card crypto
  !
  ATM0 interface
  bandwidth 320
  no ip address
  load-interval 30
  No atm ilmi-keepalive
  DSL-automatic operation mode
  !
  point-to-point interface ATM0.1
  MTU 1492
  bandwidth 160
  PVC 8/35
  VBR - nrt 160 160
  PPPoE-client dial-pool-number 1
  !
  !
  interface FastEthernet0
  switchport access vlan 2
  !
  interface FastEthernet1
  !
  interface FastEthernet2
  !
  interface FastEthernet3
  switchport access vlan 2
  !
  interface Vlan1
  IP 192.168.20.253 255.255.255.0
  IP nat inside
  no ip virtual-reassembly
  !
  interface Vlan2
  IP 192.168.252.1 255.255.255.0
  IP nat inside
  IP virtual-reassembly
  !
  interface Dialer0
  bandwidth 128
  the negotiated IP address
  NAT outside IP
  no ip virtual-reassembly
  encapsulation ppp
  load-interval 30
  Dialer pool 1
  Dialer-Group 1
  KeepAlive 1 2
  Authentication callin PPP chap Protocol
  PPP chap hostname [email protected] / * /
  PPP chap password 7 abdelkrim
  myvpn card crypto
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 Dialer0
  IP route 10.41.2.32 Tunnel0 255.255.255.240
  !
  no ip address of the http server
  no ip http secure server
  The dns server IP
  translation of nat IP tcp-timeout 5400
  no ip nat service sip 5060 udp port
  overload of IP nat inside source list NAT interface Dialer0
  !
  IP access-list standard BROADCAST
  permit of 0.0.0.0
  deny all
  !
  NAT extended IP access list
  IP enable any host IP_cisco
  deny ip 192.168.252.0 0.0.0.255 10.41.2.32 0.0.0.31
  !
  access-list 101 permit ip 192.168.252.0 0.0.0.255 10.41.2.32 0.0.0.31
  public RO SNMP-server community
  3 RW 99 SNMP-server community
  SNMP-server community a RO
  SNMP-Server RO community oneCommunityRead
  not run cdp
  !
  !
  !
  control plan
  !
  !
  Line con 0
  password 7 abdelkrim
  opening of session
  no activation of the modem
  line to 0
  line vty 0 4
  password 7 aaaaa
  opening of session
  escape character 5
  !
  max-task-time 5000 Planner
  NTP-period clock 17175037
  Server NTP B.B.B.B
  Server NTP A.A.A.A

  end

  Alex,

  It's your GRE tunnel:

  interface Tunnel0
  IP 2.2.2.1 255.255.255.252
  source of Dialer0 tunnel
  destination of IP_forti tunnel
  myvpn card crypto

  You also have routing set by it.

  You don't need a GRE tunnel, nor do you need the road to tunnel if you want just IPsec tunnel.

• % 7-ASA-710005: request TCP thrown error in the Client VPN Site to CISCO ASA 5510

  Hi friends,

  I am trying to built customer to site VPN CISCO ASA 5510 8.4 (4) and get error below when connecting to a cisco VPN client software. Also, I'm below ASA, log. Please help me to reslove.

  Error in CISCO VPN Client software:

  Secure VPN connection terminated locally by the client.

  Reason: 414: unable to establish a TCP connection.

  Error in CISCO ASA 5510

  7-ASA-710005%: TCP request and eliminated from 49276 outward: 10000

  The ASA configuration:

  XYZ # sh run
  : Saved
  :
  ASA Version 8.4 (4)
  !
  hostname XYZ
  domain XYZ
  activate the password encrypted 3uLkVc9JwRA1/OXb N3
  activate the encrypted password of R/x90UjisGVJVlh2
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  !
  interface Ethernet0/0
  nameif outside_rim
  security-level 0
  IP 1.1.1.1 255.255.255.252
  !
  interface Ethernet0/1
  full duplex
  nameif XYZ_DMZ
  security-level 50
  IP 172.1.1.1 255.255.255.248
  !
  interface Ethernet0/2
  Speed 100
  full duplex
  nameif outside
  security-level 0
  IP address 2.2.2.2 255.255.255.252
  !
  interface Ethernet0/3
  Speed 100
  full duplex
  nameif inside
  security-level 100
  IP 3.3.3.3 255.255.255.224
  !
  interface Management0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  boot system Disk0: / asa844 - k8.bin
  passive FTP mode
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  Server name xx.xx.xx.xx
  Server name xx.xx.xx.xx
  Server name xx.xx.xx.xx
  Server name xx.xx.xx.xx
  domain XYZ
  network object obj - 172.17.10.3
  Home 172.17.10.3
  network object obj - 10.1.134.0
  10.1.134.0 subnet 255.255.255.0
  network object obj - 208.75.237.0
  208.75.237.0 subnet 255.255.255.0
  network object obj - 10.7.0.0
  10.7.0.0 subnet 255.255.0.0
  network object obj - 172.17.2.0
  172.17.2.0 subnet 255.255.255.0
  network object obj - 172.17.3.0
  172.17.3.0 subnet 255.255.255.0
  network object obj - 172.19.2.0
  172.19.2.0 subnet 255.255.255.0
  network object obj - 172.19.3.0
  172.19.3.0 subnet 255.255.255.0
  network object obj - 172.19.7.0
  172.19.7.0 subnet 255.255.255.0
  network object obj - 10.1.0.0
  10.1.0.0 subnet 255.255.0.0
  network object obj - 10.2.0.0
  10.2.0.0 subnet 255.255.0.0
  network object obj - 10.3.0.0
  10.3.0.0 subnet 255.255.0.0
  network object obj - 10.4.0.0
  10.4.0.0 subnet 255.255.0.0
  network object obj - 10.6.0.0
  10.6.0.0 subnet 255.255.0.0
  network object obj - 10.9.0.0
  10.9.0.0 subnet 255.255.0.0
  network object obj - 10.11.0.0
  10.11.0.0 subnet 255.255.0.0
  network object obj - 10.12.0.0
  10.12.0.0 subnet 255.255.0.0
  network object obj - 172.19.1.0
  172.19.1.0 subnet 255.255.255.0
  network object obj - 172.21.2.0
  172.21.2.0 subnet 255.255.255.0
  network object obj - 172.16.2.0
  172.16.2.0 subnet 255.255.255.0
  network object obj - 10.19.130.201
  Home 10.19.130.201
  network object obj - 172.30.2.0
  172.30.2.0 subnet 255.255.255.0
  network object obj - 172.30.3.0
  172.30.3.0 subnet 255.255.255.0
  network object obj - 172.30.7.0
  172.30.7.0 subnet 255.255.255.0
  network object obj - 10.10.1.0
  10.10.1.0 subnet 255.255.255.0
  network object obj - 10.19.130.0
  10.19.130.0 subnet 255.255.255.0
  network of object obj-XXXXXXXX
  host XXXXXXXX
  network object obj - 145.248.194.0
  145.248.194.0 subnet 255.255.255.0
  network object obj - 10.1.134.100
  Home 10.1.134.100
  network object obj - 10.9.124.100
  Home 10.9.124.100
  network object obj - 10.1.134.101
  Home 10.1.134.101
  network object obj - 10.9.124.101
  Home 10.9.124.101
  network object obj - 10.1.134.102
  Home 10.1.134.102
  network object obj - 10.9.124.102
  Home 10.9.124.102
  network object obj - 115.111.99.133
  Home 115.111.99.133
  network object obj - 10.8.108.0
  10.8.108.0 subnet 255.255.255.0
  network object obj - 115.111.99.129
  Home 115.111.99.129
  network object obj - 195.254.159.133
  Home 195.254.159.133
  network object obj - 195.254.158.136
  Home 195.254.158.136
  network object obj - 209.164.192.0
  subnet 209.164.192.0 255.255.224.0
  network object obj - 209.164.208.19
  Home 209.164.208.19
  network object obj - 209.164.192.126
  Home 209.164.192.126
  network object obj - 10.8.100.128
  subnet 10.8.100.128 255.255.255.128
  network object obj - 115.111.99.130
  Home 115.111.99.130
  network object obj - 10.10.0.0
  subnet 10.10.0.0 255.255.0.0
  network object obj - 115.111.99.132
  Home 115.111.99.132
  network object obj - 10.10.1.45
  Home 10.10.1.45
  network object obj - 10.99.132.0
  10.99.132.0 subnet 255.255.255.0
  the Serversubnet object-group network
  object-network 10.10.1.0 255.255.255.0
  network-object 10.10.5.0 255.255.255.192
  the XYZ_destinations object-group network
  object-network 10.1.0.0 255.255.0.0
  object-network 10.2.0.0 255.255.0.0
  network-object 10.3.0.0 255.255.0.0
  network-object 10.4.0.0 255.255.0.0
  network-object 10.6.0.0 255.255.0.0
  network-object 10.7.0.0 255.255.0.0
  network-object 10.11.0.0 255.255.0.0
  object-network 10.12.0.0 255.255.0.0
  object-network 172.19.1.0 255.255.255.0
  object-network 172.19.2.0 255.255.255.0
  object-network 172.19.3.0 255.255.255.0
  object-network 172.19.7.0 255.255.255.0
  object-network 172.17.2.0 255.255.255.0
  object-network 172.17.3.0 255.255.255.0
  object-network 172.16.2.0 255.255.255.0
  object-network 172.16.3.0 255.255.255.0
  host of the object-Network 10.50.2.206
  the XYZ_us_admin object-group network
  network-object 10.3.1.245 255.255.255.255
  network-object 10.5.33.7 255.255.255.255
  network-object 10.211.5.7 255.255.255.255
  network-object 10.3.33.7 255.255.255.255
  network-object 10.211.3.7 255.255.255.255
  the XYZ_blr_networkdevices object-group network
  object-network 10.200.10.0 255.255.255.0
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 145.248.194.0 255.255.255.0
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host 172.16.2.21
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host 172.16.2.22
  access list XYZ extended ip 10.19.130.0 allow 255.255.255.0 host XXXXXXXX
  Access extensive list ip 10.19.130.0 XYZ_PAT allow 255.255.255.0 any
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 195.254.159.133
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 195.254.158.136
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 any
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 209.164.192.0 255.255.224.0
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 209.164.208.19
  Access extensive list ip 10.1.134.0 XYZ_PAT allow 255.255.255.0 host 209.164.192.126
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 208.75.237.0 255.255.255.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.7.0.0 255.255.0.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.17.2.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.17.3.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.2.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.3.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.7.0 255.255.255.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.1.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.2.0.0 255.255.0.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.3.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.4.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.6.0.0 255.255.0.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.9.0.0 255.255.0.0
  Allow Access-list extended sheep 255.255.255.0 10.1.134.0 IP 10.11.0.0 255.255.0.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 10.12.0.0 255.255.0.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.19.1.0 255.255.255.0
  IP 10.1.134.0 allow Access-list extended sheep 255.255.255.0 172.21.2.0 255.255.255.0
  10.1.134.0 IP Access-list extended sheep 255.255.255.0 allow 172.16.2.0 255.255.255.0
  access-list extended sheep allowed host ip 10.19.130.201 172.30.2.0 255.255.255.0
  access-list extended sheep allowed host ip 10.19.130.201 172.30.3.0 255.255.255.0
  access-list extended sheep allowed host ip 10.19.130.201 172.30.7.0 255.255.255.0
  access-list extended sheep allowed ip object-group Serversubnet-group of objects XYZ_destinations
  10.10.1.0 IP Access-list extended sheep 255.255.255.0 allow 10.2.0.0 255.255.0.0
  10.19.130.0 IP Access-list extended sheep 255.255.255.0 allow host XXXXXXXX
  IP 10.19.130.0 allow Access-list extended sheep 255.255.255.0 145.248.194.0 255.255.255.0
  Access extensive list ip 10.8.108.0 Guest_PAT allow 255.255.255.0 any
  CACIB list extended access permitted ip 10.8.100.128 255.255.255.128 145.248.194.0 255.255.255.0
  Access extensive list ip 10.8.100.128 Cacib_PAT allow 255.255.255.128 all
  Access extensive list ip 10.1.134.0 New_Edge allow 255.255.255.0 208.75.237.0 255.255.255.0
  Allow XYZ_global to access extended list ip 10.7.0.0 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.7.0.0 255.255.0.0
  Access extensive list ip 172.17.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.17.3.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.3.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.7.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.0.0 XYZ_global allow 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list 10.2.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Allow XYZ_global to access extended list ip 10.3.0.0 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list 10.4.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Access extensive list 10.6.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Access extensive list ip 10.9.0.0 XYZ_global allow 255.255.0.0 10.1.134.0 255.255.255.0
  Allow XYZ_global to access extended list ip 10.11.0.0 255.255.0.0 10.1.134.0 255.255.255.0
  Access extensive list 10.12.0.0 ip XYZ_global 255.255.0.0 allow 10.1.134.0 255.255.255.0
  Access extensive list ip 172.19.1.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 172.21.2.0 XYZ_global allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.17.2.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.17.3.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.2.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.3.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.7.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.1.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.2.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.3.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.4.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.6.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.9.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.11.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 10.12.0.0 255.255.0.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.19.1.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.21.2.0 255.255.255.0
  XYZ_global to access extended list ip 172.16.2.0 allow 255.255.255.0 10.1.134.0 255.255.255.0
  Access extensive list ip 10.1.134.0 XYZ_global allow 255.255.255.0 172.16.2.0 255.255.255.0
  Access extensive list ip 172.30.2.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
  XYZ_global list extended access allowed host ip 10.19.130.201 172.30.2.0 255.255.255.0
  Access extensive list ip 172.30.3.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
  XYZ_global list extended access allowed host ip 10.19.130.201 172.30.3.0 255.255.255.0
  Access extensive list ip 172.30.7.0 XYZ_global allow 255.255.255.0 host 10.19.130.201
  XYZ_global list extended access allowed host ip 10.19.130.201 172.30.7.0 255.255.255.0
  XYZ_global list extended access permitted ip object-group Serversubnet-group of objects XYZ_destinations
  XYZ_global list extended access permitted ip object-group XYZ_destinations-group of objects Serversubnet
  ML_VPN list extended access allowed host ip 115.111.99.129 209.164.192.0 255.255.224.0
  permit access list extended ip host 115.111.99.129 ML_VPN 209.164.208.19
  permit access list extended ip host 115.111.99.129 ML_VPN 209.164.192.126
  permit access list extended ip host 10.9.124.100 Da_VPN 10.125.81.88
  permit access list extended ip host 10.9.124.101 Da_VPN 10.125.81.88
  permit access list extended ip host 10.9.124.102 Da_VPN 10.125.81.88
  Da_VPN list extended access allowed host ip 10.9.124.100 10.125.81.0 255.255.255.0
  Da_VPN list extended access allowed host ip 10.9.124.101 10.125.81.0 255.255.255.0
  Da_VPN list extended access allowed host ip 10.9.124.102 10.125.81.0 255.255.255.0
  Sr_PAT to access extended list ip 10.10.0.0 allow 255.255.0.0 any
  Da_Pd_VPN list extended access allowed host ip 10.9.124.100 10.125.80.64 255.255.255.192
  Da_Pd_VPN list extended access allowed host ip 10.9.124.100 10.125.64.0 255.255.240.0
  permit access list extended ip host 10.9.124.100 Da_Pd_VPN 10.125.85.46
  permit access list extended ip host 10.9.124.100 Da_Pd_VPN 10.125.86.46
  Da_Pd_VPN list extended access allowed host ip 10.9.124.101 10.125.80.64 255.255.255.192
  Da_Pd_VPN list extended access allowed host ip 10.9.124.101 10.125.64.0 255.255.240.0
  permit access list extended ip host 10.9.124.101 Da_Pd_VPN 10.125.85.46
  permit access list extended ip host 10.9.124.101 Da_Pd_VPN 10.125.86.46
  Da_Pd_VPN list extended access allowed host ip 10.9.124.102 10.125.80.64 255.255.255.192
  Da_Pd_VPN list extended access allowed host ip 10.9.124.102 10.125.64.0 255.255.240.0
  permit access list extended ip host 10.9.124.102 Da_Pd_VPN 10.125.85.46
  permit access list extended ip host 10.9.124.102 Da_Pd_VPN 10.125.86.46
  Access extensive list ip 10.19.130.0 XYZ_reliance allow 255.255.255.0 145.248.194.0 255.255.255.0
  access-list coextended permit ip host 2.2.2.2 XXXXXXXX
  access-list coextended allow the host ip XXXXXXXXhost 2.2.2.2
  permitted this access list extended ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
  permitted this access list extended ip 208.75.237.0 255.255.255.0 10.1.134.0 255.255.255.0
  access list acl-outside extended permit ip host 57.66.81.159 172.17.10.3
  access list acl-outside extended permit ip host 80.169.223.179 172.17.10.3
  access list acl-outside scope permit ip any host 172.17.10.3
  access list acl-outside extended permitted tcp any host 10.10.1.45 eq https
  access list acl-outside extended permit tcp any any eq 10000
  access list acl-outside extended deny ip any any newspaper
  pager lines 10
  Enable logging
  debug logging in buffered memory
  outside_rim MTU 1500
  MTU 1500 XYZ_DMZ
  Outside 1500 MTU
  Within 1500 MTU
  IP pool local XYZ_c2s_vpn_pool 172.30.10.51 - 172.30.10.254
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow all outside
  ICMP allow any inside
  don't allow no asdm history
  ARP timeout 14400
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 208.75.237.0 obj - 208.75.237.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.7.0.0 obj - 10.7.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.17.2.0 obj - 172.17.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.17.3.0 obj - 172.17.3.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.2.0 obj - 172.19.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.3.0 obj - 172.19.3.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.7.0 obj - 172.19.7.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.1.0.0 obj - 10.1.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.2.0.0 obj - 10.2.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.3.0.0 obj - 10.3.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.4.0.0 obj - 10.4.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.6.0.0 obj - 10.6.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.9.0.0 obj - 10.9.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.11.0.0 obj - 10.11.0.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 10.12.0.0 obj - 10.12.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.19.1.0 obj - 172.19.1.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.21.2.0 obj - 172.21.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.1.134.0 obj - 10.1.134.0 destination static obj - 172.16.2.0 obj - 172.16.2.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.2.0 obj - 172.30.2.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.3.0 obj - 172.30.3.0 no-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.201 obj - 10.19.130.201 destination static obj - 172.30.7.0 obj - 172.30.7.0 no-proxy-arp-search to itinerary
  NAT (inside, all) static source Serversubnet Serversubnet XYZ_destinations XYZ_destinations non-proxy-arp-search of route static destination
  NAT (inside, all) source static obj - 10.10.1.0 obj - 10.10.1.0 destination static obj - 10.2.0.0 obj - 10.2.0.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.0 obj - 10.19.130.0 destination static obj-XXXXXXXX XXXXXXXX - obj non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 10.19.130.0 obj - 10.19.130.0 destination static obj - 145.248.194.0 obj - 145.248.194.0 no-proxy-arp-search to itinerary
  NAT source (indoor, outdoor), obj static obj - 10.1.134.100 - 10.9.124.100
  NAT source (indoor, outdoor), obj static obj - 10.1.134.101 - 10.9.124.101
  NAT source (indoor, outdoor), obj static obj - 10.1.134.102 - 10.9.124.102
  NAT interface dynamic obj - 10.8.108.0 source (indoor, outdoor)
  NAT (inside, outside) source dynamic obj - 10.19.130.0 obj - 115.111.99.129
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 195.254.159.133 obj - 195.254.159.133
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 195.254.158.136 obj - 195.254.158.136
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.192.0 obj - 209.164.192.0
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.208.19 obj - 209.164.208.19
  NAT (inside, outside) source dynamic obj - 10.1.134.0 obj - 115.111.99.129 destination static obj - 209.164.192.126 obj - 209.164.192.126
  NAT (inside, outside) source dynamic obj - 10.8.100.128 obj - 115.111.99.130
  NAT (inside, outside) source dynamic obj - 10.10.0.0 obj - 115.111.99.132
  NAT source (indoor, outdoor), obj static obj - 10.10.1.45 - 115.111.99.133
  NAT (inside, outside) source dynamic obj - 10.99.132.0 obj - 115.111.99.129
  !
  network object obj - 172.17.10.3
  NAT (XYZ_DMZ, outside) static 115.111.99.134
  Access-group acl-outside in external interface
  Route outside 0.0.0.0 0.0.0.0 115.111.23.129 1
  Route outside 0.0.0.0 0.0.0.0 115.254.127.130 10
  Route inside 10.10.0.0 255.255.0.0 10.8.100.1 1
  Route inside 10.10.1.0 255.255.255.0 10.8.100.1 1
  Route inside 10.10.5.0 255.255.255.192 10.8.100.1 1
  Route inside 10.8.100.128 255.255.255.128 10.8.100.1 1
  Route inside 10.8.108.0 255.255.255.0 10.8.100.1 1
  Route inside 10.19.130.0 255.255.255.0 10.8.100.1 1
  Route inside 10.99.4.0 255.255.255.0 10.99.130.254 1
  Route inside 10.99.132.0 255.255.255.0 10.8.100.1 1
  Route inside 10.1.134.0 255.255.255.0 10.8.100.1 1
  Route outside 208.75.237.0 255.255.255.0 115.111.23.129 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication LOCAL telnet console
  LOCAL AAA authorization command
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn2
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-md5-hmac vpn6
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn5
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-md5-hmac vpn7
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn4
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn1
  Crypto ipsec transform-set esp-aes-256 ikev1, esp-sha-hmac vpn_reliance
  Crypto ipsec transform-set esp-3des esp-md5-hmac ikev1 c2s_vpn
  86400 seconds, duration of life crypto ipsec security association
  Crypto-map dynamic dyn1 ikev1 transform-set c2s_vpn 1 set
  Crypto-map dynamic dyn1 1jeu reverse-road
  card crypto vpn 1 corresponds to the address XYZ
  card 1 set of peer XYZ Peer IP vpn crypto
  1 set transform-set vpn1 ikev1 vpn crypto card
  card crypto vpn 1 lifetime of security set association, 3600 seconds
  card crypto vpn 1 set security-association life kilobytes 4608000
  correspondence vpn crypto card address 2 DON'T
  2 peer NE_Peer IP vpn crypto card game
  2 set transform-set vpn2 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 2 set security-association
  card crypto vpn 2 set security-association life kilobytes 4608000
  card crypto vpn 4 corresponds to the address ML_VPN
  card crypto vpn 4 set pfs
  vpn crypto card game 4 peers ML_Peer IP
  4 set transform-set vpn4 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 4 set - the security association
  card crypto vpn 4 set security-association life kilobytes 4608000
  vpn crypto card 5 corresponds to the address XYZ_global
  vpn crypto card game 5 peers XYZ_globa_Peer IP
  5 set transform-set vpn5 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 5 set - the security association
  card 5 security-association life set vpn crypto kilobytes 4608000
  vpn crypto card 6 corresponds to the address Da_VPN
  vpn crypto card game 6 peers Da_VPN_Peer IP
  6 set transform-set vpn6 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 6 set - the security association
  card crypto vpn 6 set security-association life kilobytes 4608000
  vpn crypto card 7 corresponds to the address Da_Pd_VPN
  7 peer Da_Pd_VPN_Peer IP vpn crypto card game
  7 set transform-set vpn6 ikev1 vpn crypto card
  3600 seconds, duration of life card crypto vpn 7 set - the security association
  card crypto vpn 7 set security-association life kilobytes 4608000
  vpn outside crypto map interface
  crypto map vpn_reliance 1 corresponds to the address XYZ_rim
  card crypto vpn_reliance 1 set of peer XYZ_rim_Peer IP
  card crypto 1 ikev1 transform-set vpn_reliance set vpn_reliance
  vpn_reliance card crypto 1 lifetime of security set association, 3600 seconds
  card crypto vpn_reliance 1 set security-association life kilobytes 4608000
  card crypto vpn_reliance interface outside_rim
  dynamic mymap 1 dyn1 ipsec-isakmp crypto map
  crypto isakmp identity address
  No encryption isakmp nat-traversal
  Crypto ikev1 enable outside_rim
  Crypto ikev1 allow outside
  IKEv1 crypto policy 1
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  lifetime 28800
  IKEv1 crypto policy 2
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  life 86400
  IKEv1 crypto policy 4
  preshared authentication
  aes-256 encryption
  sha hash
  Group 5
  life 28000
  IKEv1 crypto policy 5
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 43200
  IKEv1 crypto policy 65535
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 10.8.100.0 255.255.255.224 inside
  Telnet timeout 5
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  no basic threat threat detection
  no statistical access list - a threat detection
  no statistical threat detection tcp-interception
  internal XYZ_c2s_vpn group strategy
  username testadmin encrypted password oFJjANE3QKoA206w
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXXtype ipsec-l2l
  tunnel-group XXXXXXXXipsec-attributes
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  tunnel-group XXXXXXXX type ipsec-l2l
  tunnel-group ipsec-attributes XXXXXXXX
  IKEv1 pre-shared-key *.
  type tunnel-group XYZ_c2s_vpn remote access
  attributes global-tunnel-group XYZ_c2s_vpn
  address pool XYZ_c2s_vpn_pool
  IPSec-attributes tunnel-group XYZ_c2s_vpn
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the icmp
  Review the ip options
  !
  global service-policy global_policy
  level 3 privilege see the running-config command exec mode
  logging of orders privilege see the level 3 exec mode
  privilege see the level 3 exec mode command crypto
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:caa7476cd348ed89b95d37d4e3c9e1d8
  : end

  XYZ #.

  Good news

  Follow these steps:

  network object obj - 172.30.10.0_24

  172.30.10.0 subnet 255.255.255.0

  !

  the LOCAL_NETWORKS_VPN object-group network

  object-network 1.1.1.0 255.255.255.0

  !

  NAT (inside, outside) 1 static source LOCAL_NETWORKS_VPN destination LOCAL_NETWORKS_VPN static obj - 172.30.10.0_24 obj - 172.30.10.0_24 - route search

  * Where 1.1.1.0/24 is the internal network that you want to reach through the tunnel.

  Keep me posted.

  Thank you.

  Please note all messages that will be useful.

• connect dynamic auto of site to site VPN

  Hi all, I need to configure a site to site vpn (cisco asa and router), but the connection to the remote router must be set to auto.

  Can someone help me?

  Thank you

  All have two IP addresses static or is on a dynamic ip?

  Please clarify what you mean by "auto".

• Cisco 877 + VPN Site to Site

  Hello

  I'm new im this forum.
  I've set up a Site VPN site with 2 Cisco 877.

  SITE A:

  Address IP Adreess public: static
  Internal IP Adrees: 192.168.0.XXX
  Mask: 255.255.255.0

  SITE B:

  IP address public Adreess: Dynamics
  Internal IP address: 192.168.2.XXX
  Mask: 255.255.255.0

  I managed to do a ping on both sides, but I can't access file shares, and could rdp on any server in site A, by the internal IP address.

  Fix, is the SITES A and B SITE startup configs.

  Could you please someone help me?

  Hi Marcos,

  Really happy to know that the problem is solved. There is no need to apologize. Please mark this message as answered if there is nothing more.

  Rregards,

  Assia

• PIX-Sonicwall Site-to-Site and Cisco VPN Client

  I have a firewall 506th PIX with a VPN site-to site for a firewall Sonicwall 330 Pro which works perfectly. I would like to add the functionality of remote users connecting to the network using the client VPN from Cisco PIX. I'm under the question of having only a single card encryption applied to the external interface. I need the feature to have the tunnel between the site to site VPN can be undertaken on other, so I can't use a dynamic encryption card. Does anyone have suggestions or knowledge on how to achieve this?

  Thank you.

  You don't need to add another card encryption to the external interface. You simply add customer information to your existing card for example:

  Crypto ipsec transform-set esp-3des esp-sha-hmac YOURSET

  YOURMAP 10 ipsec-isakmp crypto map

  card crypto YOURMAP 10 corresponds to 100 address

  card crypto YOURMAP 10 set counterpart x.x.x.x

  crypto YOURMAP 10 the transform-set YOURSET value card

  set of 10 CUSTOMERS crypto dynamic-map transform-set YOURSET

  card crypto YOURMAP 90-isakmp dynamic ipsec CLIENTS

• Cisco 3640 to the PIX 501 site 2 site VPN performance specifications.

  I intend on creating a site-2-site VPN in Star configuration with a Cisco 3640 as the hub and PIX 501 at the remote sites. My question is around the plug that I read.

  .

  The specifications for a PIX-501-BUN-K9 tell PIX 501 3DES Bundle (chassis, SW, 10 users, 3DES).

  .

  A question is what really "10 users. Which is the limit of the number of concurrent sessions, I have on the VPN at a given time, or that it means something else?

  .

  I also read the specs say that the Maximum number of VPN tunnels that can support a PIX 501 is 5. Because I'm not going to make a tunnel between the PIX 501 at the remote site and the 3640 on the central site, I think I would be OK. Is that correct or is the max value talk the maximum number of concurrent sessions on the tunnel tunnels?

  .

  Thank you.

  UDP traffic always creates a session in the PIX so that the return traffic will be allowed in. The UDP timeout is 2 minutes but IIRC. If you go around NAT with a statement of "nat 0" should not create an xlate I think.

  The real time is hard to say really, probably around 2 minutes for a UDP-only user, you would probably make a few 'local sho' orders on the PIX to really see for sure however.

• IPSec VPN Site-to-Site router Cisco 837 to Firewall FortiGate 200 has

  I had a challege for a site to site vpn scenario that may need some brainstorming you guys.

  So far, I have had a prior configuration planned for this scenario, but I'm not very sure if the tunnel I created will work because I did not test it before with this scenario. I'll go next week on this project and hopefully get a solution of brainstorming you guys. Thanks in advance!

  Network diagram:

  http://cjunhan.multiply.com/photos/hi-res/5/3?xurl=%2Fphotos%2Fphoto%2F5%2F3

  Challenge:

  (1) configure CISCO R3 IPSec Site to Site VPN between 172.20.10.0 and 10.20.20.0 using cryptographic cards

  (2) IKE Phase I MainMode, lifetime 28000, md5, DH-Group1

  IKE Phase II: des-esp, hmac-md5, tunnel mode

  PSK: sitetositevpn

  Here is my setup for review:

  crypto ISAKMP policy 10

  the BA

  preshared authentication

  Group 1

  md5 hash

  ISAKMP crypto key sitetositevpn address 210.x.x.66

  !

  Crypto ipsec transform-set esp - esp-md5-hmac ciscoset

  !

  infotelmap 10 ipsec-isakmp crypto map

  the value of 210.x.x.66 peer

  Set transform-set ciscoset

  match address 111

  !

  !

  interface Ethernet0

  3 LAN description

  IP 10.20.20.1 255.255.255.0

  IP nat inside

  servers-exit of service-policy policy

  Hold-queue 100 on

  !

  ATM0 interface

  no ip address

  ATM vc-per-vp 64

  No atm ilmi-keepalive

  DSL-automatic operation mode

  !

  point-to-point interface ATM0.1

  IP address 210.x.20.x.255.255.252

  no ip redirection<-- disable="">

  no ip unreachable<-- disable="" icmp="" host="" unreachable="">

  no ip proxy-arp<-- disables="" ip="" directed="">

  NAT outside IP

  PVC 8/35

  aal5snap encapsulation

  !

  !

  IP nat inside source list 102 interface ATM0.1 overload

  IP classless

  IP route 0.0.0.0 0.0.0.0 ATM0.1

  IP route 0.0.0.0 0.x.0.x.190.60.66

  no ip http secure server

  !

  Note access-list 102 NAT traffic

  access-list 102 permit ip 10.20.20.0 0.0.0.255 any

  !

  access-list 111 note VPN Site-to-Site 3 LAN to LAN 2 network

  access-list 111 allow 0.0.0.x.x.10.0 ip 10.20.20.0 0.0.0.255

  Kind regards

  Junhan

  Hello

  Three changes required in this configuration.

  (1) change the NAT-list access 102 as below:

  access-list 102 deny ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

  access-list 102 permit ip 10.20.20.0 0.0.0.255 any

  (2) place the card encryption on interface point-to-point ATM.

  (3) remote all of a default route.

  Thank you

  Mustafa

• Site to site VPN works only on Cisco 881

  I have 2 problems with a cisco 881. The first problem is that Vlan2 (192.168.5.xx) cannot access the internet on the outside. But I know that the router has internet, because I can ping the external ip address. The 2nd problem is that I have a set of site to another upward, but when I test the Site to site I get this error:

  destination of traffic of the tunnel must be channelled through the crypto map interface. The destination following (s) doesn't have a routing entry in the routing table
  192.168.2.0

  I copied the config form this router from another cisco 881 work, where everything works. The only difference is that this router needs a site to site vpn connection.

  My question is how I can get internet on vlan2 and who can I solve the connection to site to site.

  Here's the running configuration:

  Building configuration...

  Current configuration: 12698 bytes
  !
  version 15.3
  horodateurs service debug datetime msec
  Log service timestamps datetime msec
  no password encryption service
  !
  hostname Cisco_881
  !
  boot-start-marker
  boot-end-marker
  !
  AQM-registry-fnf
  !
  logging buffered 51200 warnings
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  AAA authorization exec default local
  AAA authorization network default local
  !
  !
  !
  !
  !
  AAA - the id of the joint session
  !
  Crypto pki trustpoint TP-self-signed-1151531093
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 1151531093
  revocation checking no
  rsakeypair TP-self-signed-1151531093
  !
  Crypto pki trustpoint TP-self-signed-2011286623
  enrollment selfsigned
  name of the object cn = IOS - Self - signed - certificate - 2011286623
  revocation checking no
  rsakeypair TP-self-signed-2011286623
  !
  !
  TP-self-signed-1151531093 crypto pki certificate chain
  certificate self-signed 01
  3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
  69666963 31313531 35333130 6174652D 3933301E 170 3135 30343031 31363230
  34315A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
  4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 31353135 65642D
  33313039 3330819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
  8100AC6E E7FA8AFD 9D4E206C 2B23DFC1 990AFDB3 98CD84A7 37697253 A7EF2520
  0C45190E 298B6E9F E2711580 80DCFBFB 05A6A0BA 347B960B D9DA17FC B1543B9D
  FBC048F3 063EBBC5 02391432 F0232A73 EAC7278E 8CB83005 D13A1D47 BEF18198
  A 547469, 2 F65ED0E6 249BF517 1E74117D C94BE542 46EE487D A3843F12 364639B 4
  0B 090203 010001 HAS 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355
  551 2304 18301680 147996F4 3E6D0EE2 2D9065BB D726137C 2DF42ABE 01301D 06
  03551D0E 04160414 7996F43E 6D0EE22D 9065BBD7 26137C2D F42ABE01 300 D 0609
  2A 864886 F70D0101 8181002A 05050003 677B9BE6 CB60D188 73227C4B 2DC33101
  BD448017 EDEF0296 FF7438A3 4C46519B 144C775F 1429CF06 7DB29F2D EB16EE75
  22100B 63 0D75511A 98DC57DC EF87BED2 1C1635C8 B5352706 3963037A 4E9B739A
  3A1EC9BE 8431BD70 116D3B31 E4A2AC4C 0F934B3F 196AF829 AD537005 6935B 451
  EB31DB3F A9BA6D70 65B70D19 D00158
  quit smoking
  TP-self-signed-2011286623 crypto pki certificate chain
  no ip source route
  !
  !
  !
  !

  !
  DHCP excluded-address IP 10.10.10.1
  DHCP excluded-address IP 192.168.5.1 192.168.5.49
  DHCP excluded-address IP 192.168.5.150 192.168.5.254
  !
  DHCP IP CCP-pool
  import all
  Network 10.10.10.0 255.255.255.248
  default router 10.10.10.1
  Rental 2 0
  !
  IP dhcp Internet pool
  network 192.168.5.0 255.255.255.0
  router by default - 192.168.5.254
  DNS-Server 64.59.135.133 64.59.128.120
  lease 6 0
  !
  !
  !
  no ip domain search
  "yourdomain.com" of the IP domain name
  name of the IP-Server 64.59.135.133
  name of the IP-Server 64.59.128.120
  IP cef
  No ipv6 cef
  !
  !
  !
  !
  !
  Authenticated MultiLink bundle-name Panel
  !
  !
  !
  !
  !
  !
  !
  udi pid C881-K9 sn FTX18438503 standard license
  !
  !
  Archives
  The config log
  hidekeys
  username * privilege 15 secret 5 $1$IBY.$X5/iqYy47a5vAWWuG4/Oa/
  username * secret 5 $1$ 17 ST$ QzJMvQnZ9Q.1y7u0rYXFa0
  username * secret 5 $1$ L4W9$ zBKpawZ3i5nXxwyS9H6Lf1
  !
  !
  !
  !
  !
  no passive ftp ip
  !
  !
  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  !
  crypto ISAKMP policy 2
  BA 3des
  preshared authentication
  Group 2
  isakmp encryption key * address 208.98.212.xx
  !
  Configuration group crypto isakmp MPE client
  key *.
  pool VPN_IP_POOL
  ACL 100
  include-local-lan
  10 Max-users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is reserved for administrators of control systems.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.              ^ C
  !
  Configuration group customer crypto isakmp PALL
  key *.
  pool VPN_IP_POOL_PALL
  ACL 101
  include-local-lan
  Max - 1 users
  netmask 255.255.255.0
  banner ^ practive entered the field

  This area is limited to the PALL access only.

  If you are here by mistake, please disconnect immediately.

  You have full access to 192.168.125.0 / 0.0.0.255

  Support on continue to start your session.            ^ C
  ISAKMP crypto profile vpn_isakmp_profile
  game of identity EMT group
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 1
  ISAKMP crypto profile vpn_isakmp_profile_2
  match of group identity PALL
  client authentication list default
  Default ISAKMP authorization list
  client configuration address respond
  virtual-model 2
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac VPN_TRANSFORM
  tunnel mode
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  tunnel mode
  !
  Profile of crypto ipsec VPN_PROFILE_MPE
  Set the security association idle time 3600
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile Set isakmp-profile
  !
  Profile of crypto ipsec VPN_PROFILE_PALL
  Set the security association idle time 1800
  game of transformation-VPN_TRANSFORM
  vpn_isakmp_profile_2 Set isakmp-profile
  !
  !
  !
  map SDM_CMAP_1 1 ipsec-isakmp crypto
  Description Tunnel to208.98.212.xx
  the value of 208.98.212.xx peer
  game of transformation-ESP-3DES-SHA
  match address 102
  !
  !
  !
  !
  !
  !
  interface Loopback0
  IP 192.168.40.254 255.255.255.0
  !
  interface FastEthernet0
  no ip address
  !
  interface FastEthernet1
  no ip address
  !
  interface FastEthernet2
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet3
  switchport access vlan 2
  no ip address
  !
  interface FastEthernet4
  IP address 208.98.213.xx 255.255.255.224
  IP access-group 111 to
  NAT outside IP
  IP virtual-reassembly in
  automatic duplex
  automatic speed
  map SDM_CMAP_1 crypto
  !
  type of interface virtual-Template1 tunnel
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_MPE ipsec protection profile
  !
  tunnel type of interface virtual-Template2
  IP unnumbered Loopback0
  ipv4 ipsec tunnel mode
  Tunnel VPN_PROFILE_PALL ipsec protection profile
  !
  interface Vlan1
  Description of control network
  IP 192.168.125.254 255.255.255.0
  IP access-group CONTROL_IN in
  IP access-group out CONTROL_OUT
  IP nat inside
  IP virtual-reassembly in
  IP tcp adjust-mss 1452
  !
  interface Vlan2
  Description Internet network
  IP 192.168.5.254 255.255.255.0
  IP access-group INTERNET_IN in
  IP access-group out INTERNET_OUT
  IP nat inside
  IP virtual-reassembly in
  !
  local IP VPN_IP_POOL 192.168.40.100 pool 192.168.40.150
  local IP VPN_IP_POOL_PALL 192.168.40.151 pool 192.168.40.152
  IP forward-Protocol ND
  IP http server
  23 class IP http access
  local IP http authentication
  IP http secure server
  IP http timeout policy slowed down 60 life 86400 request 10000
  !
  !
  IP nat inside source static tcp 192.168.125.2 25000 25000 FastEthernet4 interface
  IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
  IP route 0.0.0.0 0.0.0.0 FastEthernet4 permanent 208.98.236.xx
  !
  CONTROL_IN extended IP access list
  Note the access control
  Note the category CCP_ACL = 17
  allow any host 192.168.125.254 eq non500-isakmp udp
  allow any host 192.168.125.254 eq isakmp udp
  allow any host 192.168.125.254 esp
  allow any host 192.168.125.254 ahp
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  IP 192.168.125.0 allow 0.0.0.255 192.168.40.0 0.0.0.255
  Note Access VNC
  permit tcp host 192.168.125.2 eq 25000 one
  Comment by e-mail to WIN911
  permit tcp host 192.168.125.2 any eq smtp
  Note DNS traffic
  permit udp host 192.168.125.2 host 64.59.135.133 eq field
  permit udp host 192.168.125.2 host 64.59.128.120 eq field
  Note Everything Else block
  refuse an entire ip
  CONTROL_OUT extended IP access list
  Note the access control
  IP 192.168.125.0 allow 0.0.0.255 192.168.125.0 0.0.0.255
  Note the VPN access
  ip permit 192.168.40.0 0.0.0.255 192.168.125.0 0.0.0.255
  Note Access VNC
  allow any host 192.168.125.2 eq 25000 tcp
  Comment by e-mail to WIN911
  allow any host 192.168.125.2 eq smtp tcp
  Note DNS responses
  allowed from any host domain eq 192.168.125.2 udp
  Note deny all other traffic
  refuse an entire ip
  INTERNET_IN extended IP access list
  Note Access VNC on VLAN
  allow any host 192.168.125.2 eq 25000 tcp
  Note block all other controls and VPN
  deny ip any 192.168.125.0 0.0.0.255
  deny ip any 192.168.40.0 0.0.0.255
  Note leave all other traffic
  allow an ip
  INTERNET_OUT extended IP access list
  Note a complete outbound Internet access
  allow an ip
  WAN_IN extended IP access list
  allow an ip host 207.229.14.xx
  Note PERMIT ESTABLISHED TCP connections
  allow any tcp smtp created everything eq
  Note ALLOW of DOMAIN CONNECTIONS
  permit udp host 64.59.135.133 eq field all
  permit udp host 64.59.128.120 eq field all
  Note ALLOW ICMP WARNING RETURNS
  allow all all unreachable icmp
  permit any any icmp parameter problem
  allow icmp all a package-too-big
  allow a whole icmp administratively prohibited
  permit icmp any any source-quench
  allow icmp all once exceed
  refuse a whole icmp
  allow an ip
  !
  auto discovering IP sla
  not run cdp
  !
  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 103
  !
  access-list 1 remark out to WAN routing
  Note CCP_ACL the access list 1 = 16 category
  access-list 1 permit 192.168.125.2
  access-list 1 permit 192.168.5.0 0.0.0.255
  Note access-list 23 SSH and HTTP access permissions
  access-list 23 permit 192.168.125.0 0.0.0.255
  access-list 23 permit 192.168.40.0 0.0.0.255
  access-list 23 allow one
  Note access-list 100 VPN traffic
  access-list 100 permit ip 192.168.125.0 0.0.0.255 any
  access-list 100 permit ip 192.168.40.0 0.0.0.255 any
  Note access-list 101 for PALL VPN traffic
  access-list 101 permit ip 192.168.125.0 0.0.0.255 any
  Note access-list 102 CCP_ACL category = 4
  Note access-list 102 IPSec rule
  access-list 102 permit ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  Note access-list 103 CCP_ACL category = 2
  Note access-list 103 IPSec rule
  access-list 103 deny ip 192.168.5.0 0.0.0.255 192.168.2.0 0.0.1.255
  access-list 103 allow ip 192.168.5.0 0.0.0.255 any
  access-list 103 allow the host ip 192.168.125.2 all
  Note access-list 111 CCP_ACL category = 17
  access-list 111 permit udp any host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp any host 208.98.213.xx eq isakmp
  access-list 111 allow esp any host 208.98.213.xx
  access-list 111 allow ahp any host 208.98.213.xx
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.5.0 0.0.0.255
  Note access-list 111 IPSec rule
  access-list 111 permit ip 192.168.2.0 0.0.1.255 192.168.4.0 0.0.1.255
  access-list 111 permit udp host 208.98.212.xx host 208.98.213.xx eq non500-isakmp
  access-list 111 permit udp host 208.92.12.xx host 208.92.13.xx eq isakmp
  access-list 111 allow esp host 208.92.12.xx host 208.92.13.xx
  access-list 111 allow ahp host 208.92.12.xx host 208.92.13.xx
  access-list 111 permit icmp any host 208.92.13.xx
  access-list 111 permit tcp any host 208.92.13.xx eq 25000
  access-list 111 permit tcp any host 208.92.13.xx eq 22
  access-list 111 permit tcp any host 208.92.13.xx eq telnet
  access-list 111 permit tcp any host 208.92.13.xx eq www
  !
  !
  !
  control plan
  !
  !
  !
  MGCP behavior considered range tgcp only
  MGCP comedia-role behavior no
  disable the behavior MGCP comedia-check-media-src
  disable the behavior of MGCP comedia-sdp-force
  !
  profile MGCP default
  !
  !
  !
  !
  exec banner ^ C
  % Warning of password expiration.
  -----------------------------------------------------------------------

  Unplug IMMEDIATELY if you are not an authorized user
  ^ C
  !
  Line con 0
  no activation of the modem
  line to 0
  line vty 0 4
  access-class 23 in
  password *.
  transport input telnet ssh
  transportation out all
  line vty 5 15
  access-class 160 in
  password *.
  transport of entry all
  transportation out all
  !
  max-task-time 5000 Planner
  Scheduler allocate 20000 1000
  !
  end

  Thank you.

  It seems that DNS has failed, because it is indeed happened to internet, but it does not work when internet DNS resolution.

  Go ahead and try to ping this 157.166.226.25, and it's on the browser http://157.166.226.25/, CNN.com. Let's try those. Also just in case where to configure a DNS SERVER on your router.

  - http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/2418...

  Disable any ZBF just in case.

  David Castro,

  Kind regards

• A Site VPN PIX501 and CISCO router

  Hello Experts,

  I have an at home test lab, I set up a site to site vpn using a router Cisco PIX501 and CISCO2691, for configurations, I have just a few links on the internet, because my background on VPN configuration is not too good, for the configuration of routers, I followed this link:

  www.Firewall.CX/Cisco-Technical-Knowledgebase/Cisco-Routers/867-Cisco-ro...

  and for configuring pIX I just use the VPN Wizard of pix. All confgurations but ping failed. Hope you can help me with this, don't know what to do here (troubleshooting).

  Joint here is the configuration of my router, topology, as well as the pix configuration. Hope you can help me with this. Thanks in advance.

  Hi Mark,

  I went in the Config of the ASA

  I see that the dispensation of Nat is stil missing there

  Please add the following

  access-list allowed sheep ip 192.168.1.0 255.255.255.0 172.21.1.0 255.255.255.0

  inside NAT) 0 access-list sheep

  Then try it should work

  Thank you

  REDA