Treatment of ACL interface...

Similar Questions

• ACL interface or subinterface

  I have an ACL that is applied to an interface that contains a subinterface. The interface has no assigned IP address, but is in place. The ACL does not seem to capture all traffic, a sh ip access-list 101 shows no match. I guess my question is, the ACL should apply to the subinterface to be emotional.

  Serial0/0 is up, line protocol is up

  The material is PQUICC with fractional T1 CSU/DSU

  MTU 1500 bytes, BW 1536 Kbit, DLY 20000 usec,

  reliability 255/255, txload 1/255, rxload 1/255

  Encapsulation FRAME - RELAY IETF, loopback not set

  Serial0/0.2 is up, line protocol is up

  The material is PQUICC with fractional T1 CSU/DSU

  Description: Address Internet of Verizon Business MPLS Circuit atlanta-ga is x.x.x.x/30

  set the ACL on the subinterface.

• ACL IPSEC - CRYPTO vs Interface

  Hello

  Where an IOS device is connected to a PIX 6.3, with a VPN IPSec site to site with ipsec connection allowed sysopt

  Thinking that it would be simpler to apply the required ACL, I created the ACL crypto to the entire subnet with the thought I would create ACL interface for nailing to specific hosts inside the subnet.  I see now that I need to disable the connection of sysopt permit-ipsec for the ACL interface to apply.

  1. is it more common for crypto ACL to be more host specific vs specific subnet and the necessary ACL ONLY (with the active sysopt)? I have a true Swiss cheese of the armies on either side of the vpn that need access and I didn't want to maintain such a complicated in meaning OPPOSITE ACL.

  2 or it is more common for both - crypto ACL (allow a simpler ACL) then apply ACL interface?

  3. I see the issue with the realization of the interface & crypto ACL, there is more that can get sent THEN denied to the remote interface, or even blocked traffic on the local side.  If the ACL interface should be used, what is the best practice here?

  4. I see the interface that acl work when sysopt allowed ipsec connection is enabled, but only on outbound traffic. Is it because traffic has not struck the crypto ACL again?

  Any pointers in the right direction would be appreciated.

  Thank you

  Dan Foxley

  Dan

  Much depends on whether the VPN device also acts as a firewall. If this isn't ie. Once the traffic has been decrypted, it is then passed on the firewall then allowed sysopt of active ipsec connection is a logical choice.

  In response to your questions, speak from my personal experience-

  (1) crypto ACL tend to be more subnet than host-based, but it depends on your specific needs.

  (2) Yes, in general the crypto acl is more general, the acl interface is where you attach.

  (3) don't know, I followed. If you want to limit this subnet traffic is sent through the tunnel then you would with an acl interface but on a different interface IE. the interface more near the source of the traffic.

  (4) it is to do with the order of treatment IE. which is done first. Not really used an acl outgoing on the same interface as endpoint vpn but I suspect you're right.

  Note that you do not need to apply the acl on the actual interface the VPN ends, at least with the code v7.x and beyond. You can terminate the VPN on the external interface, and then use an outbound acl on the interface that is sent unencrypted traffic. Yes, that means he has to go through the firewall, but it can make the management of your ACLs easier.

  Jon

• ASA "route inside 0 0 192.168.1.1 by tunnel" interface ACL question

  Hello

  Small question around the road inside 0.0.0.0 0.0.0.0 192.168.1.2 in tunnel command.

  Do you need to add a u-turn traffic within the ACL interfaces (for example internet related http traffic) or 'same-security-traffic permit intra-interface' negates the need of this?

  So if my site remote vpn outside is 10.1.1.0/24 should I add entering permitted statements for the 10.1.1.0/24 inside my interface.

  Thank you

  same-security-traffic permit intra-interface allows then-input-output traffic on a single interface

  allowed incoming 10.1.1.0/24 statement in the list ACL allows traffic (output - then-) penetration on a single interface, but you must disable the RPF check

• Amount of the ACLs on an interface of the PIX

  Hi all

  I just wanted to know how much group-access entry (s) that you can attached to a 515ER PIX interface? I wonder if it's the same rule as the router, IE 1 ACL/interface/direction. En thank you your help.

  Hi Vincent,.

  You can apply to a single group-access on any pix interface... is not like in a router in a router, you can apply groups of incoming/outgoing access... On a pix you can apply only inbound access-groups...

  I hope this helps... all the best...

  REDA

• ACL LocalFW Vs pushed Firesight ACL

  Hi guys

  If we have a strategy pushed Firesight to ASA network and it has a local policy on the interface, which would override?

  Also is there a way we could check on the SAA what policy he received from Firesight?

  How do you push a policy to the Firesight ASA?

  Do you mean that you have a policy thrust to the firepower of the ASA service module?

  In this case, these are quite different things. The ASA evaluates the passage of the ACL interface occupants when the package is presented to the interface. The service module evaluates the flow against its policies when it receives the package from the ASA parent under the policy-map.

  Is not one or the other, is both and the net result is their cumulative policy when it is applied in the series (as a Boolean 'AND' logical).

  See this link for a picture:

  https://CCIE-or-null.NET/2014/12/10/packet-flow-with-firepower/

• ASA - same-security-traffic allowed inter VS permit/deny access-list interface

  Hi people,

  I wonder if I use the same-security-traffic permits inter-interface order to ASA and I have 2 separate interfaces with the same level of security and ACL with a few rules explicit allow , if not covered by these statements to allow traffic will be blocked by implicit deny at the end of the ACL or am I completely wrong in my thinking?

  That is right.

  But then if you have an interface with an ACL and another interface without an ACL and you want to pass traffic between the two interfaces, then the interface without an ACL will rely on the level of security while configured with the ACL interface will rely on configured ACL entries.

  --

  Please do not forget to select a correct answer and rate useful posts

• IPS/ACL/ZBF precedence on router IOS

  I have a number of 891 routers deployed for VPN connectivity to a central site. Routers have an ACL so focused on the area of firewall and IPS/IPS configured on their public interfaces. They run IOS universal 15.1.1. They have been for more than six months.

  Last week I started having newspapers like that of the instance of IPS:

  Jan 12 09:51:21 ss260 378: Jan 12 15:51:20.551: % 4-IPS-SIGNATURE: Sig:3041 Subsig:0 SEV:100 package of TCP SYN/DEF [Source that I can't identify me - MY-ROUTER:25-> IP - IP:25] VRF: NONE RiskRating:100

  I know that the ACL interface is processed before the ZBF. I was assuming that IPS happens after the ACL as well, but this package should never have gotten past my ACL. The ACL only allows ESP, IKE, SSH and pings and then only if they are from about a half dozen source IPs. The source of the trigger package is NOT among those permitted.

  Because my ACL does not all traffic not encrypted (with the exception of the pings I generate), I really didn't expect the instance of IPS to see whatever it is likely to trigger an alert, and until last week, it was true.

  So far, all the newspapers are for the same signature SYN/DEF. It is a type of special cases for some reason signature any or can I wait to see alerts whenever a packet that will block anyway, the ACL matches a signature?

  Hello

  First of all, I noticed that packages fell by IPS have the port source and destination 25 - weird ;-)

  If you are interested in the operation with new code CEF order you can check 'show cef interface INTERFACE_NAME IFC_NUMBER', it is reliable and in order, they are done, but perhaps more detail you need ;-)

  Router#sh cef interface fa0/0
  
  FastEthernet0/0 is down (if_number 4)
  
    Corresponding hwidb fast_if_number 4
  
    Corresponding hwidb firstsw->if_number 4
  
    Internet address is 10.1.1.1/24
  
    ICMP redirects are always sent
  
    Per packet load-sharing is disabled
  
    IP unicast RPF check is disabled
  
    Input features: Access List
  
    Output features: Firewall (NAT), Firewall (inspect)
  
    Inbound access list is 101
  
    Outbound access list is not set
  
    IP policy routing is disabled
  
    BGP based policy accounting on input is disabled
  
    BGP based policy accounting on output is disabled
  
    Hardware idb is FastEthernet0/0
  
    Fast switching type 1, interface type 18
  
    IP CEF switching enabled
  
    IP CEF switching turbo vector
  
    IP CEF turbo switching turbo vector
  
    IP prefix lookup IPv4 mtrie 8-8-8-8 optimized
  
    Input fast flags 0x1, Output fast flags 0x0
  
    ifindex 3(3)
  
    Slot  Slot unit 0 VC -1
  
    Transmit limit accumulator 0x0 (0x0)
  
    IP MTU 1500
  
  

  HTH,

  Marcin

• In/Out ACL by VPN on SAA

  Is it possible to do it on an ASA? I don't understand how a router can do a better job with control of asymmetric flow as an ASA.

  168 VPN ipsec-isakmp crypto map
  LongRidge-CareOne-CUST Site-to-Site Description
  defined by peer 108.170.125.242
  ip access-group VPNCryptoMap168_in-ACL set in
  ip access-group VPNCryptoMap168_out-ACL set on
  game of transformation-AES256_SHA
  match address VPNCryptoMap168-ACL

  IP VPNCryptoMap168-ACL extended access list
  Note CUST-CareOne-LongRidge VPN Site-to-Site
  IP 10.61.0.0 allow 0.0.255.255 172.18.61.0 0.0.0.255
  IP VPNCryptoMap168_in-ACL extended access list
  Note CUST-CareOne-LongRidge VPN Site-to-Site
  allow any object-group CareOne_Somerset_restrict-og-response to icmp echo
  allow any host eq snmp 10.61.23.101 udp
  allow any host 10.61.23.101 eq tftp udp
  allow tcp any a Workbench
  allow any host 10.61.202.88 eq www lpd 5357 5800 and 5900 tcp telnet
  IP VPNCryptoMap168_out-ACL extended access list
  Note CUST-CareOne-LongRidge VPN Site-to-Site
  object-group CareOne_Somerset_restrict-og ip permit any

  Unfortunately, the "vpn-filter option" under the group policy on the Cisco ASA applies only the VPN filter in the incoming direction and automatically configures the outbound direction. Refer to this link. There is an improvement that has been opened to support VPN filters in each direction, but it is not yet applied.

  The only way I see is to modify the default behavior and configure ASA to submit VPN traffic to ACL interface using the command of not sysopt connection VPN-enabled and then configure ACL interface accordingly. I don't know if it's worth to you.

• ACL ASA5540 does not not for VPN access.

  I'm under code 8,03 and have a simple VPN L2L configured between two sites. It is in fact a test config in my lab, but I'm unable to restrict traffic using an ACL inside.

  I used the VPN Wizard to do the config initial and then added an Interior (out) ACL to restrict traffic once the tunnel rises.

  The encryption card is as follows:

  access extensive list ip 164.72.1.128 outside_1_cryptomap allow 255.255.255.240 host SunMed_pc

  Then I have an ACL to limit traffic to ping GHC_laptop, telnet to GHC_switch and denying the rest:

  inside_access_out list extended access allowed icmp host host SunMed_pc GHC_Laptop

  inside_access_out list extended access permit tcp host SunMed_pc host GHC_switch eq telnet

  inside_access_out deny ip extended access list a whole

  However SunMed_pc can also ping at GHC_switch and can FTP to GHC_laptop even if the 3rd entrance to deny any meter increases when I do this.

  I have attached a Word document that has the entire config with a screenshot showing the ACL and the shots.

  Should I configured incorrectly, or is ACL ACL actually does not work as expected?

  You can still keep all the IP for your acl interesting traffic. If you delete the sysopt, then you would write access in your acl 'inside_access' like you did above.

  If you are going to have dozens of tunnels l2l and will limit all, then I just remove the sysopt and use the acl interface.

  There is another option. You can leave the sysopt and use a vpn-filter. It is explained here and can be applied to l2l.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080641a52.shtml

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/uz.html#wp1524559

• ACL and anyconnect ssl vpn

  Hello world

  I was testing the few things at my lab at home.

  PC - running ssl vpn - sw - router - ISP - ASA (anyconnect ssl)

  AnyConnect ssl works very well and I am also able to access the internet.

  I use full tunnel

  I have ACLs on the external interface of the ASA

  1

  True

  any

  any

  intellectual property

  Deny

  0

  By default

  []

  I know that the ACL is used to traffic passing by ASA.

  I need to understand the flow of traffic for internet via ssl vpn access. ?

  Concerning

  MAhesh

  As you correctly say, the ACL interface is not important for that because the VPN traffic is not inspected by the ACL. Of the at least not by default.

  You can control the traffic with a different ACL that is applied to the group policy with the command "vpn-filter". And of course you need a NAT rule that translates your traffic when running to the internet. This rule should work on the pair of interface (outside, outside).

• PIX ACL user downloadable issues

  Recently, I opened a TAC case on an issue that I had with user downloadable ACLs on a radius server. I use the user acl on an intranet pix firewall that protects some servers. We have programmers who need special access for them and tried to have the ACL of assigned dynamically. It turns out that TAC said even if I had the correct ACL and they were applied to the user, I must have the same ACL allowing traffic on the interface which runs incoming traffic. There is no sense to me due to the fact that my goal was to get rid of permanent acl and not have to worry about the use of IP source addresses. I could have just the connection of the user through http and it gets the acl. Then finally the active uauth timer and removes the ACL so do not leave a hole on the PIX. I totally miss the downloadable ACLs goal, so if someone could shed some light on the subject I would appreciate it :) I have that someone has a solution or another solution to the problem that I have please do not hesitate to post! Thanks advance!

  Tony

  For authentication and ACL downloadable works, you need two ACLs on the PIX, the ACL interface and authentication ACL. You can consider the ACL interface as a trigger for the ACL authentication should it allow traffic through to trigger authentication. It must also allow the same traffic that the auth acl which means it is sometimes easier to make more restrictive the more permissive acl interface and the auth acl.

  for example if you have users on 192.168.1.0 24 inside interface and you want to authenticate you to access Terminal Server services, you can if you want to configure the inside access list to allow all traffic to 192.168.1.0/24

  ! inside the 192.168.1.0 auth trigger

  permit 192.168.1.0 ip access list inside_access_in 255.255.255.0 any

  but deny all in the acl of authentication, which means that all traffic required authentication/authorization first.

  ! authentication for 192.168.1.0

  ! don't authenticate DNS and ICMP

  inside_authentication list access deny udp 192.168.1.0 255.255.255.0 any eq 53

  inside_authentication list access deny icmp 192.168.1.0 255.255.255.0 any

  ! authenticate everything.

  permit 192.168.1.0 ip access list inside_authentication 255.255.255.0

  ! apply access lists

  inside_access_in access to the interface inside group

  AAA game inside_authentication inside RADIUS authentication

  Your ACL ACS/RADIUS would be configured to

  ! term serv

  permit tcp 192.168.1.0 255.255.255.0 any eq 3389

  ! http

  permit tcp 192.168.1.0 255.255.255.0 any eq 80

  That would provide the term serv and http access to an authenticated user. Your logs show permission denied for all other access to this user after authentication.

  I hope this helps.

• Site to site VPN ASA2ASA funny crypto ACL behavior

  Hello

  I use a VPN site-to site between two ASAs. It works but it should not work, in my opinion, there is a bug. The thing is that when I set the traffic is encrypted in an ACL, this traffic is denied and the tunnel doen't work. If I remove the ACL entries, I'm really interested in encryption, it works...

  Thus, for example.

  I affermirai a tunnel between the two ASAs and specify

  access allowed extended VPN ip host 172.16.0.60 list 172.20.24.60

  colt_map card crypto 20 matches the VPN address

  card crypto test_map 20 peers set 1.1.1.1
  test_map crypto 20 card value transform-set TEST
  3600 seconds, duration of life card crypto test_map 20 set - the security association
  card crypto test_map 20 set security-association life kilobytes 4608000

  When I have it, there is no traffic allowed between 172.16.0.60 and 172.20.24.60. And when I do:

  VPN access list extended deny ip host 172.16.0.60 172.20.24.60

  access allowed extended VPN ip host 172.16.0.59 list 172.20.24.59

  Can I get a communication between 172.16.0.60 172.20.24.60 of the host, but not between 172.16.0.59 the host 172.20.24.59.

  It seems very weird to me. I was wondering if anyone had this behaviour before or she could explain it?

  Thanks in advance.

  Yes.

  In Janan all traffic VPN is not checked against the external ACL because of a single command: sysopt connection permit VPN

  You can see if this command is enabled by practice: sh run all the sysopt

  If you remove this command: no sysopt permit vpn connection

  then, all VPN traffic is checked against the ACL interface (and you can only allow what you need).

  A better approach is to let the sysopt connection permit-vpn default and create a vpn-filter ACL that is applied to group policy for tunnel groups you need.

  Federico.

• debugging of router acl

  Hello, what is the best method to debug specific router access control lists in IOS 12.2? I would like to see if everything works as expected. I'm active on the acl interface and tried debugging 'debug ip error access-list', but gives me output for ACL only. Thank you.

  Hello

  Best way to check is to put the newspaper at the end of the access list

  access-list 1 permit 5.6.0.0 0.0.255.255 connect

  Journal

  (Optional) Causes a message to record information on the package corresponding to the registration to be returned to the console. (The level of messages logged to the console is controlled by the console command record.)

  The message contains the access list number, whether the packet was permitted or denied, the source address and the number of packets. The message is generated for the first packet that matches, and then at 5 minute intervals, including the number of packets permitted or denied in the interval of 5 minutes before.

  Nilesh

• Question about ACL's with the 2621 when using site to site VPN

  I set up two site to site vpn. We have an ASA at our headquarters and branches will IOS routers - one is a 1811 and the other 2621. Both are running the latest versions of IOS, respectively. The two VPN site-to-site do not work. I have a list of inbound on the external interfaces of both routers, access that allows only the IP address of the ASA IP traffic. All other traffic is denied. I put NAT overload upward in the typical form, and I use ip outgoing inspection on the same interface, to allow incoming traffic back to surfing the internet. This configuration works very well with the 1811, where all traffic is blocked except traffic IP (IPSEC) coming from the ASA. Guests at our headquarters can reach hosts behind the 1811 and vice versa.

  Here's my problem: the 2621 is processing traffic encapsulated on the external interface and block this traffic because it does not match. I know because when I turn on logging / debugging on the 2621, I see inbound traffic blocked by the ACL. Technically, I guess that it does not, but to this interface, the traffic is always encapsulated so I think it fits to this access list and then go to the Cryptography decapsulation card and be sent to the destination host. Just as it does on the 1811. I have not 'wan' t to create another line in the access list for all subnets to Headquarters. Why is not it works the same way as it does on the 1811? Is there something else I need to activate?

  ------------------------------------------------------------------------

  Config of 1811:

  !
  version 12.4
  horodateurs service debug datetime msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  !
  hostname BranchVPN1
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered 51200 notifications
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  activate the default AAA authentication no
  authorization AAA console
  AAA authorization exec default local
  !
  AAA - the id of the joint session
  no ip source route
  IP cef
  !
  !
  IP inspect the audit trail
  inspect the IP dns-timeout 10
  inspect the name IP internet udp timeout 30
  inspect the name IP internet tcp timeout 30
  inspect the name IP internet ftp timeout 30
  inspect the name IP internet http timeout 30
  inspect the name firewall tcp IP
  inspect the name IP firewall udp
  inspect the name IP firewall icmp
  IP inspect the dns name of the firewall
  inspect the name IP firewall ftp
  inspect the name IP firewall http
  inspect the name IP firewall https
  inspect the IP firewall name ftps
  property intellectual auth-proxy max-nodata-& 3
  property intellectual admission max-nodata-& 3
  !
  !
  IP domain name xxxx
  !
  !
  !
  !
  username xxxxxxxxxx
  !
  !
  !
  class-map correspondence vpn_traffic
  police name of group-access game
  !
  !
  VPN policy-map
  class vpn_traffic
  in line-action police 2000000 37500 pass drop exceeds-action
  !
  !
  !
  crypto ISAKMP policy 10
  BA aes 256
  preshared authentication
  Group 2
  ISAKMP crypto key address xxxx xxxxxx
  ISAKMP crypto keepalive 10
  !
  life crypto ipsec security association seconds 28800
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac xxtransform
  !
  xxmap 10 ipsec-isakmp crypto map
  defined peer xxxx
  Set transform-set xxtransform
  PFS group2 Set
  match the address tunnelnetworks
  static inverse-road
  !
  !
  !
  interface Loopback0
  172.16.99.1 the IP 255.255.255.255
  !
  interface FastEthernet0/0
  Description Connection to Internet (DHCP)
  DHCP IP address
  IP access-group outside_in in
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  inspect the firewall on IP
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  No cdp enable
  xxmap card crypto
  !
  interface FastEthernet0/1
  Description of the connection to the local network
  address 172.20.1.1 IP 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  IP virtual-reassembly
  automatic duplex
  automatic speed
  No cdp enable
  VPN service-policy input
  !
  interface Serial0/0/0
  no ip address
  Shutdown
  No cdp enable
  !
  interface Serial0/1/0
  no ip address
  Shutdown
  !
  IP forward-Protocol ND
  IP route 0.0.0.0 0.0.0.0 dhcp
  !
  no ip address of the http server
  local IP http authentication
  no ip http secure server
  IP nat inside source list nat - acl interface FastEthernet0/0 overload
  !
  IP nat - acl extended access list
  refuse any 10.0.0.0 0.255.255.255 ip
  allow an ip
  outside_in extended IP access list
  allow udp any eq bootps host 255.255.255.255 eq bootpc
  allow an ip host (ASA IPADDR)
  deny ip any any newspaper
  IP extended access list police
  deny ip host xxxx any
  deny ip any host xxxx
  IP 172.20.1.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
  tunnelnetworks extended IP access list
  permit host 172.16.99.1 ip 10.0.0.0 0.255.255.255
  IP 172.20.1.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
  !
  recording of debug trap
  logging source-interface Loopback0
  exploitation forest xxxx
  access-list 160 note t is
  not run cdp
  !
  !
  control plan
  !
  Banner motd ^ CC

  Authorized technician!

  ^ C
  !
  Line con 0
  line to 0
  line vty 0 4
  exec-timeout 5 0
  Synchronous recording
  entry ssh transport
  line vty 5 15
  exec-timeout 5 0
  Synchronous recording
  entry ssh transport
  !
  Scheduler allocate 20000 1000
  end

  ------------------------------------------------------------------------

  2621 Config:

  !
  version 12.3
  horodateurs service debug datetime msec
  Log service timestamps datetime localtime show-timezone msec
  encryption password service
  !
  hostname BranchVPN2
  !
  boot-start-marker
  boot-end-marker
  !
  logging buffered 51200 notifications
  no console logging
  !
  AAA new-model
  !
  !
  AAA authentication login default local
  activate the default AAA authentication no
  authorization AAA console
  AAA authorization exec default local
  AAA - the id of the joint session
  IP subnet zero
  no ip source route
  IP cef
  !
  !
  IP domain name xxxx
  !
  IP inspect the audit trail
  inspect the IP dns-timeout 10
  inspect the name IP internet udp timeout 30
  inspect the name IP internet tcp timeout 30
  inspect the name IP internet ftp timeout 30
  inspect the name IP internet http timeout 30
  inspect the name firewall tcp IP
  inspect the name IP firewall udp
  inspect the name IP firewall icmp
  inspect the name IP firewall ftp
  inspect the name IP firewall http
  Max-events of po verification IP 100
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  !
  username xxxxxxxxxxxx
  !
  !
  !
  class-map correspondence vpn_traffic
  police name of group-access game
  !
  !
  VPN policy-map
  class vpn_traffic
  in line-action police 2000000 37500 pass drop exceeds-action
  !
  !
  !
  crypto ISAKMP policy 10
  BA aes 256
  preshared authentication
  Group 2
  ISAKMP crypto key address xxxx xxxxx
  ISAKMP crypto keepalive 10
  !
  life crypto ipsec security association seconds 28800
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac xxtransform
  !
  xxmap 10 ipsec-isakmp crypto map
  defined peer xxxx
  Set transform-set xxtransform
  PFS group2 Set
  match the address tunnelnetworks
  reverse-road remote-peer
  !
  !
  !
  !
  interface Loopback0
  172.16.99.2 the IP 255.255.255.255
  !
  interface FastEthernet0/0
  Description Connection to Internet (DHCP)
  DHCP IP address
  IP access-group outside_in in
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  NAT outside IP
  inspect the firewall on IP
  automatic duplex
  automatic speed
  No cdp enable
  xxmap card crypto
  !
  interface Serial0/0
  no ip address
  Shutdown
  No cdp enable
  !
  interface FastEthernet0/1
  Description of the connection to the local network
  IP 172.20.2.1 255.255.255.0
  no ip redirection
  no ip unreachable
  no ip proxy-arp
  IP nat inside
  automatic duplex
  automatic speed
  No cdp enable
  VPN service-policy input
  !
  interface Serial0/1
  no ip address
  Shutdown
  No cdp enable
  !
  IP nat inside source list nat - acl interface FastEthernet0/0 overload
  no ip address of the http server
  local IP http authentication
  no ip http secure server
  IP classless
  IP route 0.0.0.0 0.0.0.0 dhcp
  !
  !
  !
  IP nat - acl extended access list
  refuse any 10.0.0.0 0.255.255.255 ip
  allow an ip
  outside_in extended IP access list
  allow udp any eq bootps host 255.255.255.255 eq bootpc
  allow an ip host (ASA IPADDR)
  deny ip any any newspaper
  IP extended access list police
  deny ip host xxxx any
  deny ip any host xxxx
  IP 172.20.2.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
  tunnelnetworks extended IP access list
  permit host 172.16.99.2 ip 10.0.0.0 0.255.255.255
  IP 172.20.2.0 allow 0.0.0.255 10.0.0.0 0.255.255.255
  recording of debug trap
  logging source-interface Loopback0
  exploitation forest xxxx
  not run cdp
  !
  !
  !
  !
  !
  Banner motd ^ CCC

  Authorized technician!

  ^ C
  !
  Line con 0
  line to 0
  line vty 0 4
  exec-timeout 5 0
  Synchronous recording
  entry ssh transport
  line vty 5 15
  exec-timeout 5 0
  Synchronous recording
  entry ssh transport
  !
  !
  end

  Please check if this helps:

  http://www.Cisco.com/en/us/docs/iOS/12_3t/12_3t8/feature/guide/gt_crpks.html

  Federico.