SRP547W VPN site to site with L2TP in ADSL

Hello world

I am installing a new SRP547W for a customer and will have trouble to configure a site to site vpn. They use the ADSL WAN1 interface for their internet connection. When I add an interface under him, I am unable to see the 'Connection Type' fall as I can see on a void WAN2 ethernet interface. I followed the instructions on page 29 provided here:

http://www.Cisco.com/en/us/docs/routers/srp520_series/srp521w/administration/srp500_admin.PDF

All good suggestions on how I can get a site vpn to set up on the router using PPTP or L2TP via the ADSL interface would be very useful.

Thank you

Benn

Hi Ben,

Unfortunately, we currently only allow PPTP/L2TP sessions is configured for major WAN - i.e. not ADSL or Ethernet interfaces interfaces.

Kind regards

Andy

Tags: Cisco Support

Similar Questions

  • Cisco 877 + VPN Site to Site

    Hello

    I'm new im this forum.
    I've set up a Site VPN site with 2 Cisco 877.

    SITE A:

    Address IP Adreess public: static
    Internal IP Adrees: 192.168.0.XXX
    Mask: 255.255.255.0

    SITE B:

    IP address public Adreess: Dynamics
    Internal IP address: 192.168.2.XXX
    Mask: 255.255.255.0

    I managed to do a ping on both sides, but I can't access file shares, and could rdp on any server in site A, by the internal IP address.

    Fix, is the SITES A and B SITE startup configs.

    Could you please someone help me?

    Hi Marcos,

    Really happy to know that the problem is solved. There is no need to apologize. Please mark this message as answered if there is nothing more.

    Rregards,

    Assia

  • Problem with the VPN site to site for the two cisco asa 5505

    Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

    Cisco Config asa1

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 172.xxx.xx.4 255.255.240.0
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.60.2 255.255.255.0
    !
    passive FTP mode
    network of the Lan_Outside object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
    network of the Lan_Outside object
    NAT (inside, outside) interface dynamic dns
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.60.0 255.255.255.0 inside
    http 96.xx.xx.222 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 96.88.75.222
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0
    inside access management

    dhcpd address 192.168.60.50 - 192.168.60.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_96.xx.xx.222 group strategy
    attributes of Group Policy GroupPolicy_96.xx.xx.222
    VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 96.xx.xx.222 type ipsec-l2l
    tunnel-group 96.xx.xx.222 General-attributes
    Group - default policy - GroupPolicy_96.xx.xx.222
    96.XX.XX.222 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error

    ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

    Cisco ASA 2 config

    interface Ethernet0/0
    switchport access vlan 1
    !
    interface Ethernet0/1
    switchport access vlan 2
    !
    interface Vlan1
    nameif outside
    security-level 0
    IP address 96.xx.xx.222 255.255.255.248
    !
    interface Vlan2
    nameif inside
    security-level 100
    IP 192.168.1.254 255.255.255.0
    !
    passive FTP mode
    permit same-security-traffic inter-interface
    permit same-security-traffic intra-interface
    network of the Lan_Outside object
    subnet 192.168.1.0 255.255.255.0
    network of the NETWORK_OBJ_192.168.60.0_24 object
    192.168.60.0 subnet 255.255.255.0
    network of the NETWORK_OBJ_192.168.1.0_24 object
    subnet 192.168.1.0 255.255.255.0
    object-group Protocol DM_INLINE_PROTOCOL_1
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_2
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_3
    ip protocol object
    icmp protocol object
    object-group Protocol DM_INLINE_PROTOCOL_4
    ip protocol object
    icmp protocol object
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
    Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
    Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
    Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    don't allow no asdm history
    ARP timeout 14400
    no permit-nonconnected arp
    NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
    !
    network of the Lan_Outside object
    dynamic NAT (all, outside) interface
    Access-group Outside_access_in in interface outside
    Inside_access_in access to the interface inside group
    Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
    Timeout xlate 03:00
    Pat-xlate timeout 0:00:30
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    Floating conn timeout 0:00:00
    dynamic-access-policy-registration DfltAccessPolicy
    identity of the user by default-domain LOCAL
    AAA authentication http LOCAL console
    Enable http server
    http 192.168.1.0 255.255.255.0 inside
    http 172.xxx.xx.4 255.255.255.255 outside
    No snmp server location
    No snmp Server contact
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto Outside_map 1 corresponds to the address Outside_cryptomap
    card crypto Outside_map 1 set peer 172.110.74.4
    card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    Outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH stricthostkeycheck
    SSH timeout 5
    SSH group dh-Group1-sha1 key exchange
    Console timeout 0

    dhcpd address 192.168.1.50 - 192.168.1.100 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN
    AnyConnect essentials
    internal GroupPolicy_172.xxx.xx.4 group strategy
    attributes of Group Policy GroupPolicy_172.xxx.xx.4
    L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
    username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
    tunnel-group 172.xxx.xx.4 type ipsec-l2l
    tunnel-group 172.xxx.xx.4 General-attributes
    Group - default policy - GroupPolicy_172.xxx.xx.4
    172.xxx.XX.4 group of tunnel ipsec-attributes
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    inspect the icmp error
    inspect the http

    For IKEv2 configuration: (example config, you can change to encryption, group,...)

    -You must add the declaration of exemption nat (see previous answer).

    -set your encryption domain ACLs:

    access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

    -Set the Phase 1:

    Crypto ikev2 allow outside
    IKEv2 crypto policy 10
    3des encryption
    the sha md5 integrity
    Group 5
    FRP sha
    second life 86400

    -Set the Phase 2:

    Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
    Esp aes encryption protocol
    Esp integrity sha-1 protocol

    -set the Group of tunnel

    tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
    REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
    IKEv2 authentication remote pre-shared-key cisco123


    IKEv2 authentication local pre-shared-key cisco123

    -Define the encryption card

    address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
    card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
    card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
    CRYPTOMAP interface card crypto outside
    crypto isakmp identity address

    On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

    Thank you

  • problem with users to access remote vpn site to site vpn network

    I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

    execution of the configuration of my asa 5510 is

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.4(2)
    
    !
    
    hostname asa5510
    
    domain-name dri.local
    
    enable password 8Ry2YjIyt7RRXU24 encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    !
    
    interface Ethernet0/0
    
    nameif outside
    
    security-level 0
    
    ip address x.x.x.178 255.255.255.248
    
    !
    
    interface Ethernet0/1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.10 255.255.255.0
    
    !
    
    interface Ethernet0/2
    
    description Mreza za virtualne masine- mail server, wsus....
    
    nameif DMZ
    
    security-level 50
    
    ip address 172.16.20.1 255.255.255.0
    
    !
    
    interface Ethernet0/3
    
    shutdown
    
    no nameif
    
    no security-level
    
    no ip address
    
    !
    
    interface Management0/0
    
    nameif management
    
    security-level 100
    
    ip address 192.168.1.1 255.255.255.0
    
    management-only
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    dns server-group DefaultDNS
    
    domain-name dri.local
    
    object network VPN-POOL
    
    subnet 192.168.50.0 255.255.255.0
    
    description VPN Client pool
    
    object network LAN-NETWORK
    
    subnet 192.168.0.0 255.255.255.0
    
    description LAN Network
    
    object network NETWORK_OBJ_192.168.0.0_24
    
    subnet 192.168.0.0 255.255.255.0
    
    object network 192.168.0.10
    
    host 192.168.0.10
    
    object service ssl
    
    service tcp destination eq 465
    
    object service tls
    
    service tcp destination eq 995
    
    object network mail_server
    
    host 172.16.20.201
    
    object service StartTLS
    
    service tcp destination eq 587
    
    object service admin_port
    
    service tcp destination eq 444
    
    object service ODMR
    
    service tcp destination eq 366
    
    object service SSL-IMAP
    
    service tcp destination eq 993
    
    object network remote
    
    host 172.16.20.200
    
    object network test
    
    host 192.168.0.22
    
    object network mail
    
    host 172.16.20.200
    
    object network DMZ
    
    host 172.16.20.200
    
    object network Inside_DMZ
    
    host 192.168.0.20
    
    object service rdp
    
    service tcp destination eq 3389
    
    object network DRI_PS99
    
    host 192.168.0.54
    
    object service microsoft_dc
    
    service tcp destination eq 445
    
    object service https448
    
    service tcp destination eq 448
    
    object network mail_server_internal
    
    host 172.16.20.201
    
    object service Acronis_remote
    
    service tcp destination eq 9876
    
    object service Acronis_25001
    
    service tcp destination eq 25001
    
    object service HTTP3000
    
    service tcp destination eq 3000
    
    object network VPNPOOL
    
    subnet 192.168.50.0 255.255.255.0
    
    object-group network PAT-SOURCE-NETWORKS
    
    description Source networks for PAT
    
    network-object 192.168.0.0 255.255.255.0
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object object admin_port
    
    service-object object ssl
    
    service-object object tls
    
    service-object object https448
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object object tls
    
    service-object tcp destination eq pop3
    
    service-object tcp destination eq smtp
    
    object-group service DM_INLINE_SERVICE_3
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object tcp destination eq smtp
    
    service-object object tls
    
    service-object object Acronis_remote
    
    service-object tcp destination eq www
    
    service-object object Acronis_25001
    
    service-object object microsoft_dc
    
    object-group protocol DM_INLINE_PROTOCOL_1
    
    protocol-object ip
    
    protocol-object tcp
    
    object-group service DM_INLINE_SERVICE_4
    
    service-object object Acronis_25001
    
    service-object object Acronis_remote
    
    service-object object microsoft_dc
    
    service-object tcp destination eq www
    
    service-object tcp
    
    service-object ip
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
    
    access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
    
    access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
    
    access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
    
    access-list DMZ extended deny tcp any any eq smtp
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    mtu outside 1500
    
    mtu inside 1500
    
    mtu DMZ 1500
    
    mtu management 1500
    
    ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
    
    !
    
    object network mail_server
    
    nat (DMZ,outside) static x.x.x.179
    
    object network mail
    
    nat (DMZ,outside) static x.x.x.180
    
    access-group outside_access_in in interface outside
    
    access-group DMZ in interface DMZ
    
    route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    timeout floating-conn 0:00:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    action terminate
    
    dynamic-access-policy-record dripolisa
    
    aaa-server DRI protocol ldap
    
    aaa-server DRI (inside) host 192.168.0.20
    
    ldap-base-dn DC=dri,DC=local
    
    ldap-scope subtree
    
    ldap-naming-attribute sAMAccountName
    
    ldap-login-password *****
    
    ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
    
    server-type microsoft
    
    user-identity default-domain LOCAL
    
    aaa authentication enable console LOCAL
    
    aaa authentication http console LOCAL
    
    aaa authentication serial console LOCAL
    
    aaa authentication telnet console LOCAL
    
    aaa authorization command LOCAL
    
    http server enable
    
    http 192.168.1.0 255.255.255.0 management
    
    http 192.168.0.0 255.255.255.0 inside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    
    virtual telnet 192.168.1.12
    
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    
    crypto ipsec ikev2 ipsec-proposal DES
    
    protocol esp encryption des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal 3DES
    
    protocol esp encryption 3des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES
    
    protocol esp encryption aes
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES192
    
    protocol esp encryption aes-192
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES256
    
    protocol esp encryption aes-256
    
    protocol esp integrity sha-1 md5
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 match address outside_cryptomap
    
    crypto map outside_map 1 set peer 195.222.96.223
    
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    
    crypto map outside_map interface outside
    
    crypto ikev2 policy 1
    
    encryption aes-256
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 10
    
    encryption aes-192
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 20
    
    encryption aes
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 30
    
    encryption 3des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 40
    
    encryption des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 enable outside
    
    crypto ikev1 enable outside
    
    crypto ikev1 policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    
    dhcpd address 192.168.0.14-192.168.0.45 inside
    
    !
    
    dhcpd address 172.16.20.2-172.16.20.150 DMZ
    
    dhcpd dns x.x.x.177 interface DMZ
    
    dhcpd auto_config outside interface DMZ
    
    dhcpd option 6 ip x.x.x.177 interface DMZ
    
    dhcpd enable DMZ
    
    !
    
    dhcpd address 192.168.1.2-192.168.1.254 management
    
    dhcpd enable management
    
    !
    
    threat-detection basic-threat
    
    threat-detection statistics port
    
    threat-detection statistics protocol
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    group-policy GroupPolicy_x.x.x.223 internal
    
    group-policy GroupPolicy_x.x.x.223 attributes
    
    vpn-tunnel-protocol ikev1 ikev2
    
    group-policy drivpn internal
    
    group-policy drivpn attributes
    
    dns-server value 192.168.0.20 192.168.0.254
    
    vpn-simultaneous-logins 10
    
    vpn-idle-timeout 30
    
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    
    split-tunnel-network-list value Split_Tunnel_List
    
    default-domain value dri.local
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group drivpn type remote-access
    
    tunnel-group drivpn general-attributes
    
    address-pool vpnadrese
    
    authentication-server-group DRI
    
    default-group-policy drivpn
    
    tunnel-group drivpn ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    tunnel-group x.x.x.223 type ipsec-l2l
    
    tunnel-group x.x.x.223 general-attributes
    
    default-group-policy GroupPolicy_x.x.x.223
    
    tunnel-group x.x.x.223 ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    ikev2 remote-authentication pre-shared-key *****
    
    ikev2 local-authentication pre-shared-key *****
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum client auto
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect tftp
    
      inspect ip-options
    
      inspect netbios
    
      inspect icmp
    
      inspect http
    
    !
    
    service-policy global_policy global
    
    prompt hostname context
    
    no call-home reporting anonymous
    
    Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
    
    : end

    running config asa 5505

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.2(1)
    
    !
    
    hostname ciscoasa
    
    enable password csq7sfr0bQJqMGET encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    name 192.168.5.0 PALATA
    
    !
    
    interface Vlan1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.17 255.255.255.0
    
    !
    
    interface Vlan2
    
    nameif outside
    
    security-level 0
    
    ip address 10.13.74.33 255.255.255.0
    
    !
    
    interface Ethernet0/0
    
    switchport access vlan 2
    
    !
    
    interface Ethernet0/1
    
    !
    
    interface Ethernet0/2
    
    !
    
    interface Ethernet0/3
    
    !
    
    interface Ethernet0/4
    
    !
    
    interface Ethernet0/5
    
    !
    
    interface Ethernet0/6
    
    !
    
    interface Ethernet0/7
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object ip
    
    service-object tcp
    
    service-object icmp echo
    
    service-object icmp echo-reply
    
    service-object tcp eq domain
    
    service-object tcp eq ldap
    
    service-object tcp eq smtp
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object ip
    
    service-object tcp eq domain
    
    service-object tcp eq www
    
    service-object tcp eq https
    
    service-object tcp eq smtp
    
    object-group service Sharepoint8080 tcp
    
    port-object eq 8080
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
    
    access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
    
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    logging mail errors
    
    logging from-address
    
    logging recipient-address  level debugging
    
    mtu inside 1500
    
    mtu outside 1500
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    global (outside) 1 interface
    
    nat (inside) 0 access-list inside_nat0_outbound_1
    
    nat (inside) 1 192.168.0.0 255.255.255.0
    
    static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
    
    static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
    
    access-group inside_access_in in interface inside
    
    access-group outside_access_in in interface outside
    
    route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
    
    route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    aaa authentication telnet console LOCAL
    
    http server enable
    
    http 10.13.74.0 255.255.255.0 outside
    
    http 192.168.0.0 255.255.255.0 inside
    
    http 10.15.100.0 255.255.255.0 outside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    
    virtual telnet 192.168.0.53
    
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec security-association lifetime seconds 28800
    
    crypto ipsec security-association lifetime kilobytes 4608000
    
    crypto map outside_map 1 match address outside_2_cryptomap
    
    crypto map outside_map 1 set pfs
    
    crypto map outside_map 1 set peer 10.15.100.15
    
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    
    crypto map outside_map interface outside
    
    crypto isakmp enable outside
    
    crypto isakmp policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    

    threat-detection basic-threat
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group 10.15.100.15 type ipsec-l2l
    
    tunnel-group 10.15.100.15 ipsec-attributes
    
    pre-shared-key *
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect esmtp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect netbios
    
      inspect tftp
    
      inspect icmp
    
    !
    
    service-policy global_policy global
    
    smtp-server 173.194.79.109
    
    prompt hostname context
    
    Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
    
    : end

    Thank you

    Hello

    I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

    EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

    So you don't really have any of those.

    Please mark the question answers and/or assess response

    Ask more if necessary

    -Jouni

  • VPN site to Site with restrictions (vpn-filter)

    VPN site to site, I installed and it works fine and two site can meet but I question after the vpn enforcement - run under Group Policy

    restrict users in the local site for dial-up networking with specific tcp ports, the vpn does not not like after order question «sh l2l vpn-sessiondb»

    This works but users can't access something in the remote site

    Note > after rising online in ACL at the end with this

    US_SITE ip access list allow a whole

    new to works well again

    example of a line of Access-List

    US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.23 HTTP_HTTPS object-group
    US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.24 HTTP_HTTPS object-group

    local network: 10.68.22.50

    remote network: 192.168.10.24

    is that correct or not?

    attributes of the strategy group x.x.x.x
    value of VPN-filer US_SITE

    tunnel-group General y.y.y.y
    x.x.x.x by default-group-policy

    Note: allowed sysopt active vpn connection

    The syntax on ACL that is used as a vpn-filter is different from what is normally expected. These VPN filters is not a direction, it should be noted the traffic we want to allow incoming and outgoing of the VPN in an ACL. The syntax for this is:

    access-list X permit/deny REMOTE-DEFINITION LOCAL-DEFINITION

    Example: You want to allow local users to access the RDP on the remote site:

    access-list VPN-ACL permit tcp host 192.168.10.24 eq 3389 10.68.22.0 255.255.255.0
    Disadvantage: This is all really confusing, and you can't afford things like Ping in one direction.

  • Problem with VPN Site-to-Site between RV215W and ASA5510

    The RV215W is intended to connect a new branch via 3G, but fail.

    But when connected to the internet via a cable modem VPN works.

    I have set up with the FULL domain name and remote ip address.

    Please help me soon as soon as you can.

    Thaks a lot.

    Henriux2412.

    Dear Henry;

    Thank you to the small community of Support Business.

    I doubt that this VPN site-to-site is compatible with the USB modem broadband Mobile 3 G, but I have when even suggest to verify that the Status field of the map will show your mobile card is connected (status > Mobile network). I've seen a similar problem with a Verizon USB modem where the solution was to change a few settings in their access Manager software ("NDIS Mode - connect manually" has been selected and change this option to "Modem Mode - connect manually fixed), but if this is not your case then I suggest you to check with your service provider about supported VPN site to site on the WAN configuration.

    Except that I advise you to contact the Small Business Support Center for more information on this subject, although I don't think they will support

    https://supportforums.Cisco.com/community/NetPro/small-business/sbcountrysupport

    Do not hesitate to contact me if there is anything I can help you with in the meantime.

    Kind regards

    Jeffrey Rodriguez S... : | :. : | :.
    Support Engineer Cisco client

    * Please rate the Post so other will know when an answer has been found.

  • Cisco ASA VPN Site to Site WITH NAT inside

    Hello!

    I have 2 ASA 5505 related to IPSEC Tunnel VPN Site to Site.

    A 192.168.1.0/24 'remotely' inside the network and a local "192.168.200.0/24' inside the network (you can see the diagram)

    The local host have 192.168.200.254 as default gateway.

    I can't add static route to all army and I can't add static route to 192.168.200.254.

    NAT the VPN entering as 192.168.200.1 or a 192.168.200.x free to connect my host correcly?

    If my host sends packet to exit to the default gateway.

    Thank you for your support

    Best regards

    Marco

    The configuration must be applied on the SAA with the 192.168.200.0 subnet it is inside, there must be something like this:

    permit 192.168.1.0 ip access list VPN_NAT 255.255.255.0 192.168.200.0 255.255.255.0

    NAT (outside) X VPN_NAT outside access list

    Global (inside) X Y.Y.Y.Y (where the Y.Y.Y.Y) is the ip address

    If you have other traffic on the vpn through the tunnel that requires no nat, then you must add external nat exemption rules since these lines above obliges all traffic through the asa to have a nat statement.

    See if it works for you, else post your config nat here.

  • VPN Site to Site ASA (only happens with interesting traffic)

    Is anyway to get an ASA to VPN site-to-site ASA addition interesting traffic?  I need to keep this tunnel independently of traffic is anyway to do this?

    Unfortunately, no such feature has been developed on the SAA. You need to deceive the ASA with a host located in the "interesting" part of the network to constantly generate interesting traffic. Here are a few suggestions:

    -Use the IP SLA on a Cisco device

    -Perform a host TCP ping

    -Setting up a host of the site has press site B as a NTP source ASA

    Thank you for evaluating useful messages!

  • Microsoft l2tp IPSec VPN site to site ASA on top

    I have a specialized applications casino that requires end-to-end encryption. I'm under the stack of Microsoft IPSec l2tp between my XP machine and my Windows 2003 server on the LAN. Can I use the same type of protocol stack Microsoft l2tp IPSec between my XP machine and the Windows Server 2003 a branch on the SAA to site to site ASA VPN tunnel? The VPN site-to site ASA is a type of key Preshare IPSec VPN tunnelle traffic between our head office and a branch in distance.

    In other words, the ASA site-to-site IPSec VPN will allow Microsoft l2tp through IPSec encrypted traffic? My ACL tunnel would allow full IP access between site. Something like:

    name 192.168.100.0 TexasSubnet

    name 192.168.200.0 RenoSubnet

    IP TexasSubnet 255.255.255.0 RenoSubnet 255.255.255.0 allow Access-list extended nat_zero

    Hello

    Yes, the L2TP can be encapsulated in IPSEC as all other traffic.

    However, make sure that no NAT is performed on each end. L2TP is a default header protection which will see NAT as a falsification of package and reject it.

    See you soon,.

    Daniel

  • Configure VPN site to site with CCP

    Hello

    I have several VPN site to site of small offices, at Headquarters.

    Is possible to make a single configuration for all virtual private networks on the "vpn server"(ISR 1801) or I still need to add an entry for each VPN subnet? ". If Yes, is possible with the CCP?

    Kind regards

    Nuno

    You can then configure the VPN using CCP.

    I prefer the command line, and if there are many VPN from Site to Site, you can have a model, and what's happening to one VPN to another is interesting traffic, the INVESTIGATION period by peers and the pre-shared key.

    It depends on the policy.

    Federico.

  • VPN site to Site with NAT (PIX 7.2)

    Hi all

    I hope for more help with config PIX.  TBH I would classify myself as a newb on PIX, only dabbling in it every 6 months or so...

    I have to configure a VPN site-to site between our UK and US Office, to replace our frame relay link.  I have configured multiple VPN site to site on the before PIX, so am reasonably okay with the appearance of the config of who.  What is a new concept for me is the needs of NAT'ing between the IPSEC tunnel.

    The U.S. Agency requires us to NAT source addresses (i.e. 192.168.1.0) usable on their side address (i.e. 143.102.89.0).  The tunnel must then be set to encrypt traffic between 143.102.89.0/24 and 172.24.0.0/14.

    I added the following config and hoping to test it at the U.S. office happens online today.

    If I Ping from 192.168.1.0 to 172.24.x.x source and run a SH NAT inside, the NAT translation seems good.

    is the intellectual property inside 192.168.1.0 255.255.255.0 outside 172.24.0.0 255.252.0.0
    static translation at 143.102.89.0
    translate_hits = 4, untranslate_hits = 0

    Could someone please go through the following lines of config and comment if there is no error?

    Thank you very much

    Kevin

    / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

    IP 143.102.89.0 allow Access-list ipsec - dallas extended 255.255.255.0 172.24.0.0 255.252.0.0

    policy-nat-dallas-list of allowed extensive access ip 192.168.1.0 255.255.255.0 172.24.0.0 255.252.0.0

    public static 143.102.89.0 (inside, outside) - list of access policy-nat-dallas

    Crypto ipsec transform-set esp-3des esp-md5-hmac 3desmd5set

    card crypto map dyn 40 correspondence address ipsec - dallas

    set dyn-map 40 crypto map peer 143.101.6.141

    card crypto dyn-map 40 transform-set 3desmd5set

    dyn-map interface card crypto outside

    crypto isakmp identity address

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    md5 hash

    Group 2

    life 86400

    tunnel-group 143.101.6.141 type ipsec-l2l

    IPSec-attributes tunnel-group 143.101.6.141

    pre-shared-key *.

    You can configure NAT/Global pair for the rest of the users.

    For example:

    You can use the initially configured ACL:

    policy-nat-dallas-list of allowed extensive access ip 192.168.1.0 255.255.255.0 172.24.0.0 255.252.0.0
    NAT (inside) 1 access list policy-nat-dallas

    Global 1 143.102.89.x (outside)

    The static statement that you configured previously will take precedence over the above. So the printer gets statically using a NAT to 143.102.89.10, and the rest can do another ip address 143.102.89.x PATed.

    Please note that for PAT, traffic can only be initiated from 192.168.1.0/24 LAN to 172.24.0.0/14, not the other way around.

    Hope that helps.

  • Help with VPN site-to-site under another VPN

    Hello guys,.

    I need a help to this scenario.

    Branch--> HQ--> Remote Site, where:

    Branch: Internal = 192.168.50.0/24

    HQ: Internal = 192.168.40.0/24

    Distance from the site = 10.175.26.0/24

    Branch HQ plus the two ASA with ESP-3DES-MD5. (Here, we use the actual LAN IP range for field of encryption)

    HQ + remote place = my side ASA with ESP-AES-256-SHA. (Here, to reach the Remote Site 10.175.26.0/24 we are NAT our LAN IP range at 172.18.0.10, so the field of encryption is 172.18.0.10--> 10.175.26.0/24)

    Now we have this branch reachs the Remote Site, under the VPN with branch HQ HQ at Remote Site.

    My actions:

    Directorate-General for the firewall:

    -In the VPN Site to Site configuration, I added the 10.175.26.0/24 of the tunnel between the branch and the headquarters of the remote network.

    -J' added the EXEMPTION for 10.175.26.0/24 inside.

    HQ of firewall:

    -In the VPN Site to Site configuration, I added the 10.175.26.0/24 of the tunnel between the branch and the headquarters of the remote network.

    -J' have created a dynamic policy outside source = IP range of branch to Remote Site IP range = translated into 172.18.0.10.

    I already work for another Remote Site, but that the other has proposal IPsec ESP-3DES-MD5. (the same branch) I don't know if this is the problem, but I tried to use two proposal together, 3DES-MD5 and SHA-256-AES.

    Firewall rules are ok too.

    Where is the error in this configuration?

    Thank you

    Diego

    good

    be solved in this post

  • Problem VPN site to Site with overlapping networks

    We currently have a PIX 515E firewall as a headboard with many tunnels of site-to-site configured for her with the enpoints of PIX 506. Our internal LAN addressing scheme is 172.18.0.0 255.255.0.0. Addresses of local network in two of the remote networks with congigured VPN site-to-site are 172.18.107.0 255.255.255.224 and 172.18.107.32 255.255.255.0. Remote network access to all services on our internal network very well. We have 20 other network segments configured the same way. The 172.18.107.32.0 network needs to communicate with the 172.18.107.0 network for the services of file on the other remote PIX. Since the station PIX will not allow traffic to leave the same interface it came we thought with him we would just set up a tunnel from site to site between the two remote LAN. After the configuration of the site to another remote firewalls do not appear to try to establish tunnels when sending valuable traffic. I turned on debug for ISAKMP and nothing is either sent or received on a remote Firewall with regard to these tunnels. It's almost like since we already have a tunnel set to our 172.18.0.0 internal LAN that the remote PIX will not build specifically to 172.18.107.0 tunnel. I am able to ping each remote peer with each other and hear protection rules, but nothing has ever been established.

    Is what we are trying to do possible? Sorry for the long post but the kind of a strange scenario. Thanks in advance for any help.

    In what order are the numbers of seqence card crypto for configuring vpn on pix distance units? It could be that you are trying to install is a lot and will be checked later as head of pix. If this is the case, then yes the 172.18/16 road prevail the 172.18.107/24. Try to rebuild the entrance card crypto with a lower number so that traffic to 172.18.107/24 comes first.

    I would like to know how it works.

  • VPN site to Site with client access VPN

    I have a pix 500 series configured with access to the VPN client. When I set up a site to site vpn to a remote location, access to the customer no longer works. If I remove the vpn site to site, the vpn client works again. I tried the MDP and the CLI. Someone could look at my config and let me know what I'm missing. See the two configs attached.

    Thank you

    Lost in VPN

    Ah, I missed that. You can change the States of card crypto for virtual private networks to be on the same card encryption like this...

    mymap 20 ipsec-isakmp crypto map

    card crypto mymap 20 match address ipsecvpn

    card crypto mymap 20 peers set xxx.xxx.100.180

    transform-set set mymap 20 sha - crypto card game

    map mymap 65535-isakmp ipsec crypto dynamic outside_dyn_map

    client card crypto mymap RADIUS authentication

    mymap outside crypto map interface

    or

    outside_map 20 ipsec-isakmp crypto map

    card crypto outside_map 20 match address ipsecvpn

    card crypto outside_map 20 peers set xxx.xxx.100.180

    transform-set set sha - game card crypto outside_map 20

    map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

    outside_map the RADIUS client authentication card crypto

    outside_map interface card crypto outside

  • VPN site to Site with a side PAT

    Hi all

    I created a VPN site-to site between two ASA 5505 s, with one side having a static public IP address and one side behind a device with PAT. UDP 500 is sent to the ASA.

    The tunnel works very well if the launched of the side behind the PAT, but may not be brought after on the other side.

    Here's what I see in the system log during initialization of the 'wrong' side:

    Is it still a problem with PAT?

    Best regards

    Tobias

    Hello

    To be honest, these are sometimes a little hard the problems especially when you do not have access to actual devices.

    For me the newspapers you shared seem to indicate a problem with the negotiation of Phase 1 where this local line sends proposals of Phase 1 to the remote device until he returned their enough responsible for negotiating to complete.

    So, I would try to confirm the device to remote site that this traffic is indeed allowed. For example, you can check the remote via a management connection VPN device when the VPN is NOT upward and see if there is no sign of VPN negotiating taking place when you start the other site traffic. That said if he still sees the initial messages in the direction that has problems with the opening of the tunnel.

    When you launch the negotiation this site VPN, what you see with the release of

    ISAKMP crypto to show his

    or with the latest software

    See ikev1 crypto his

    Try to take out several times while you generate the traffic to the VPN

    If the remote device does not respond at all you would see probably something like MM_WAIT_MSG2, which means that the local VPN device awaits the first response (second message to trading) of the remote VPN device.

    Maybe this will help you narrow down the problem a bit.

    -Jouni

Maybe you are looking for