Tunnel VPN site to Site - aggressive Mode

Similar Questions

• Tunnel VPN site to Site with 2 routers Cisco 1921

  Hi all

  So OK, I'm stumped. I create much s2s vpn tunnels before, but this one I just can't go there. It's just a tunnel VPN Site to Site simple using pre-shared keys. I would appreciate it if someone could take a look at our configs for both routers running and provide a comment. This is the configuration for both routers running. Thank you!

  Router 1

  =======

  Current configuration: 4009 bytes

  !

  ! Last configuration change at 19:01:31 UTC Wednesday, February 22, 2012 by asiuser

  !

  version 15.0

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  SJWHS-RTRSJ host name

  !

  boot-start-marker

  boot-end-marker

  !

  !

  No aaa new-model

  !

  !

  !

  !

  No ipv6 cef

  IP source-route

  IP cef

  !

  !

  DHCP excluded-address 192.168.200.1 IP 192.168.200.110

  DHCP excluded-address IP 192.168.200.200 192.168.200.255

  !

  IP dhcp POOL SJWHS pool

  network 192.168.200.0 255.255.255.0

  default router 192.168.200.1

  10.10.2.1 DNS server 10.10.2.2

  !

  !

  no ip domain search

  IP-name 10.10.2.1 Server

  IP-name 10.10.2.2 Server

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki trustpoint TP-self-signed-236038042

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 236038042

  revocation checking no

  rsakeypair TP-self-signed-236038042

  !

  !

  TP-self-signed-236038042 crypto pki certificate chain

  certificate self-signed 01

  30820241 308201AA A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

  8B1E638A EC

  quit smoking

  license udi pid xxxxxxxxxx sn CISCO1921/K9

  !

  !

  !

  redundancy

  !

  !

  !

  !

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key presharedkey address 112.221.44.18

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

  !

  map CryptoMap1 10 ipsec-isakmp crypto

  defined by peer 112.221.44.18

  game of transformation-IPSecTransformSet1

  match address 100

  !

  !

  !

  !

  !

  interface GigabitEthernet0/0

  192.168.200.1 IP address 255.255.255.0

  automatic duplex

  automatic speed

  !

  !

  interface GigabitEthernet0/1

  Description wireless bridge

  IP 172.17.1.2 255.255.255.0

  automatic duplex

  automatic speed

  !

  !

  interface FastEthernet0/0/0

  Verizon DSL description for failover of VPN

  IP 171.108.63.159 255.255.255.0

  automatic duplex

  automatic speed

  card crypto CryptoMap1

  !

  !

  !

  Router eigrp 88

  network 172.17.1.0 0.0.0.255

  network 192.168.200.0

  redistribute static

  passive-interface GigabitEthernet0/0

  passive-interface FastEthernet0/0/0

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  local IP http authentication

  IP http secure server

  !

  IP route 0.0.0.0 0.0.0.0 172.17.1.1

  IP route 112.221.44.18 255.255.255.255 171.108.63.1

  !

  access-list 100 permit ip 192.168.200.0 0.0.0.255 10.10.0.0 0.0.255.255

  !

  !

  !

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  Synchronous recording

  local connection

  line to 0

  line vty 0 4

  exec-timeout 30 0

  Synchronous recording

  local connection

  transport input telnet ssh

  !

  Scheduler allocate 20000 1000

  end

  =======

  Router 2

  =======

  Current configuration: 3719 bytes

  !

  ! Last configuration change at 18:52:54 UTC Wednesday, February 22, 2012 by asiuser

  !

  version 15.0

  horodateurs service debug datetime msec

  Log service timestamps datetime msec

  no password encryption service

  !

  SJWHS-RTRHQ host name

  !

  boot-start-marker

  boot-end-marker

  !

  logging buffered 1000000

  !

  No aaa new-model

  !

  !

  !

  !

  No ipv6 cef

  IP source-route

  IP cef

  !

  !

  !

  !

  no ip domain search

  !

  Authenticated MultiLink bundle-name Panel

  !

  !

  Crypto pki trustpoint TP-self-signed-3490164941

  enrollment selfsigned

  name of the object cn = IOS - Self - signed - certificate - 3490164941

  revocation checking no

  rsakeypair TP-self-signed-3490164941

  !

  !

  TP-self-signed-3490164941 crypto pki certificate chain

  certificate self-signed 01

  30820243 308201AC A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

  2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

  EA1455E2 F061AA

  quit smoking

  license udi pid xxxxxxxxxx sn CISCO1921/K9

  !

  !

  !

  redundancy

  !

  !

  !

  !

  crypto ISAKMP policy 10

  md5 hash

  preshared authentication

  ISAKMP crypto key presharedkey address 171.108.63.159

  !

  86400 seconds, duration of life crypto ipsec security association

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

  !

  map CryptoMap1 10 ipsec-isakmp crypto

  defined by peer 171.108.63.159

  game of transformation-IPSecTransformSet1

  match address 100

  !

  !

  !

  !

  !

  interface GigabitEthernet0/0

  no ip address

  automatic duplex

  automatic speed

  !

  !

  interface GigabitEthernet0/0.1

  encapsulation dot1Q 1 native

  IP 10.10.1.6 255.255.0.0

  !

  interface GigabitEthernet0/1

  IP 172.17.1.1 255.255.255.0

  automatic duplex

  automatic speed

  !

  !

  interface FastEthernet0/0/0

  IP 112.221.44.18 255.255.255.248

  automatic duplex

  automatic speed

  card crypto CryptoMap1

  !

  !

  !

  Router eigrp 88

  Network 10.10.0.0 0.0.255.255

  network 172.17.1.0 0.0.0.255

  redistribute static

  passive-interface GigabitEthernet0/0

  passive-interface GigabitEthernet0/0.1

  !

  IP forward-Protocol ND

  !

  no ip address of the http server

  local IP http authentication

  IP http secure server

  !

  IP route 0.0.0.0 0.0.0.0 112.221.44.17

  !

  access-list 100 permit ip 10.10.0.0 0.0.255.255 192.168.200.0 0.0.0.255

  !

  !

  !

  !

  !

  !

  control plan

  !

  !

  !

  Line con 0

  Synchronous recording

  local connection

  line to 0

  line vty 0 4

  exec-timeout 30 0

  Synchronous recording

  local connection

  transport input telnet ssh

  !

  Scheduler allocate 20000 1000

  end

  When the GRE tunnel carries your traffic to private ip range, your ACL must contain address of the host of point to point the IPSec tunnel.

  Since then, both routers are running EIGRP in the corporate network, let the EIGRP Exchange routes via GRE tunnel, which is a good practice, rather than push the ip ranges private individual through the IPSec tunnel.

  Let me know, if that's what you want.

  Thank you

• How to restrict the tunnel VPN Site to site traffic thrue

  Hello

  I have a tunnel from site to site, where Site 1 is the local site and main site.  and 2 the site is the remote site.

  How to limit the traffic of site 2, so that they can only reach a few IPS on the lokal site.

  But since the lokal site all IP addresses must be able to reach all of the IP addresses to site 2 (remotely).

  an access list to the 'inside' interface does not work, since all the acl is bypassed for the interfaces for IPSEC traffic.

  Then, I tried to make a political group where I only allow traffic to servers specifik, but site 2 can still reach everything on the lokal site.

  Am I missing here?

  Best regards

  Erik

  Hi Erik,

  Unfortunately, the only options that we have are VPN filters that are two-way and disabling the sysopt feature.

  If you have a core switch/router we can block traffic on this device by using the access list or null routes.

  See you soon,.

  Nash.

• Split tunneling VPN site-to-site

  Dear all,

  I have two ASA 5510 with VPN site-to-site, I can send all Internet traffic to the central site (HQ),

  How to set the split tunneling to access Campus LAN (192.168.2.0/24) of LAN2.

  Thank you in advance.

  Best regards

  Zoltan

  You can have 'decline' instruction on your ACL crypto and he will deviate the traffic is encrypted to the site-to-site VPN tunnel.

  For ASA 1:

  access-list extended 100 permit ip 10.10.16.192 255.255.255.192 10.10.16.128 255.255.255.192

  access-list extended 100 permit ip 10.0.0.0 255.0.0.0 10.10.16.128 255.255.255.192

  access-list extended 100 deny ip 192.168.2.0 255.255.255.0 10.10.16.128 255.255.255.192

  access-list extended 100 permit ip any 10.10.16.128 255.255.255.192

  For ASA 2:

  access-list extended 100 permit ip 10.10.16.128 255.255.255.192 10.10.16.192 255.255.255.192

  access-list extended 100 permit ip 10.10.16.128 255.255.255.192 10.0.0.0 255.0.0.0

  access-list extended 100 deny ip 10.10.16.128 255.255.255.192 192.168.2.0 255.255.255.0

  access-list extended 100 permit ip 10.10.16.128 255.255.255.192 all

  Hope that helps.

• 2 tunnels vpn site-to-site location A to B

  Hello

  Current:

  I have an ASA 5505 (8.2.x) deployed on a client site with a public ip address provided by the customer.

  I have a tunnel from site to site between us (site A) and client (site B).

  ASA (at the client) has been installed with 2 VLAN by default (one for outside, one for the Interior using the 2-7 ports).

  Future:

  The customer wants another tunnel from site to site for a separate project, but they want to use the same ASA but uses another port configured for a schema from a different ip address for this new project. (which means the same ip address public, but different vlan IP).

  My Actions:

  (A) my first reaction was that I could not do that, but since it's customer and I must find a way, if I can reconfigure client (site B) ASA to take a port and configure it to a vlan different (using the system of intellectual property for this project) and set up a second tunnel from site to site using this vlan?

  (B) can even reconfigure a port for a third vlan on this SAA? (customer ASA 5505, 8.2.x, per seat 10 credits).

  What is the best approach to accomplish this task?

  Thank you...

  It's a strange question - technically, you could - I think that the place where you will fall short is that it uses the same peer address at its end.  I don't think that it will eventually operate favorably... never tried.

  I don't really understand the need for "another site to site tunnel" however.  Theoretically, I could be wrong here, there is only need a tunnel of the phase 1 of IKE.  There may be several IKE tunnels phase 2, communicating through the tunnel at the same time, however.

  Why not let the equal relationship as it is, expand your (and his) internal/external cryptos and go from there.  8.4 ASA supports twice nat - which could be a solution if he has questions on its end.

  And to be honest, even the ASA 5505 that I helped set up were all on the remote site, and I'm sure that each of them exists only for the purposes of a single site to my organization.

  Perhaps explain WHY he wants to do what he wants to do it too?

• Tunnel of IOS Interface IKE aggressive mode

  I had a pen test scan on a few of my routers and she claims that IKE aggressive Mode of operation are my IOS routers.

  I'm having a problem to know how to disable this option in the version of IOS 12.4 (24) T. I can find it on other platforms, but not of IOS. Can someone tell me please in the right direction?

  Thank you

  You can turn off with

  disable ISAKMP aggressive mode crypto

• Tunnel VPN Site to Site PIX

  I'm having a terrible time linking two Site to Site VPN PIX. I don't spin all VPN Clients, nor will I in the future. When I start debugging on the VPN connection, it gives me this result:

  Peer VPN: ISAKMP: approved new addition: ip:xxx.xxx.xxx.3 Total VPN peer: 1

  Peer VPN: ISAKMP: ip:xxx.xxx.xxx.3 Ref cnt is incremented to peers: 1 Total peer VPN: 1

  ISAKMP (0): early changes of Main Mode

  crypto_isakmp_process_block: CBC xxx.xxx.xxx.3, dest xxx.xxx.xxx.246

  Exchange OAK_MM

  ISAKMP (0): treatment ITS payload. Message ID = 0

  ISAKMP (0): audit ISAKMP transform 1 against the policy of priority 10

  ISAKMP: DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0 x 0 0 x 1 0 x 51 0x80

  ISAKMP (0): atts are not acceptable. Next payload is 0

  ISAKMP (0): audit ISAKMP transform 1 against 20 priority policy

  ISAKMP: DES-CBC encryption

  ISAKMP: MD5 hash

  ISAKMP: default group 2

  ISAKMP: preshared auth

  ISAKMP: type of life in seconds

  ISAKMP: lifespan (IPV) 0 x 0 0 x 1 0 x 51 0x80

  ISAKMP (0): atts are acceptable. Next payload is 0

  ISAKMP (0): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

  to return to the State is IKMP_NO_ERROR

  crypto_isakmp_process_block: CBC xxx.xxx.xxx.3, dest xxx.xxx.xxx.246

  Exchange OAK_MM

  ISAKMP (0): processing KE payload. Message ID = 0

  ISAKMP (0): processing NONCE payload. Message ID = 0

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): provider v6 code received xauth

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): Peer Remote supports dead peer detection

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): load useful treatment vendor id

  ISAKMP (0): addressing another box of IOS!

  ISAKMP (0): ID payload

  next payload: 8

  type: 1

  Protocol: 17

  Port: 500

  Length: 8

  ISAKMP (0): the total payload length: 12

  to return to the State is IKMP_NO_ERROR

  ISAKMP (0): retransmission of phase 1... IPSEC (key_engine): request timer shot: count = 1,.

  local (identity) = xxx.xxx.xxx.246, distance = xxx.xxx.xxx.3,

  local_proxy = 192.168.0.0/255.255.255.0/0/0 (type = 4),

  remote_proxy = 10.1.1.0/255.255.255.0/0/0 (type = 4)

  ISAKMP (0): retransmission of phase 1...

  ISAKMP (0): delete SA: src xxx.xxx.xxx.246 dst xxx.xxx.xxx.3

  ISADB: Reaper checking HIS 0x814265e8, id_conn = 0 DELETE IT!

  If I run an isakmp crypto see the his

  Total: 1

  Embryonic: 1

  Src DST in the meantime created State

  xxx.xxx.xxx.3 xxx.xxx.xxx.246 MM_KEY_EXCH 0 0

  He won't let the State (other than to take down the tunnel) MM_KEY_EXCH. I'm positive 99% that correspond to public keys. Is there something else that could cause it to give the MM_KEY_EXCH message and do not create the tunnel? Public keys are case-sensitive? What is the message of "talking with another box of IOS"? Here is a copy of the configuration:

  name 192.168.0.0 vpn

  permit access ip 10.0.0.0 list inside_outbound_nat0_acl 255.0.0.0 255.255.0.0 vpn

  permit access ip 10.0.0.0 list outside_cryptomap_20 255.0.0.0 255.255.0.0 vpn

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  outside_map 20 ipsec-isakmp crypto map

  card crypto outside_map 20 match address outside_cryptomap_20

  card crypto outside_map 20 peers set xxx.xxx.xxx.246

  outside_map card crypto 20 the transform-set ESP-DES-MD5 value

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP key * address xxx.xxx.xxx.246 netmask 255.255.255.255 No.-xauth-no-config-mode

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Any help would be greatly appreciated.

  Daryl,

  You can post a new ISAKMP debug output. You can test the remote peer? Don't you see the on the ACL crypto access numbers? You will see the 'talk to another box of IOS' on output debugging because the two boxes are running IOS - this isn't a mistake!

  Let me know-

  Jay

• Default route inside the tunnel VPN Site to site

  We want to carry the default traffic within the site to site VPN tunnel, our goal is to route all traffic including default branch road and HO HO help branch for surfing the internet.

  I have due to difficulties

  1. cannot configure dynamic NAT for the router in the branch on the ASA HO, I know configuration for 8.2, but know not about 8.4

  This is the configuration for the 8.2, if someone can translate to 8.4, which would be a great help

  NAT (outside) 1 192.168.230.0

  2. I do not know how to write the default route on the branch office router to send all traffic within the VPN tunnel

  Hello

  As I understand it then you want to route ALL traffic from the Remote Site to the Central Site and manage Internet traffic there.

  I suppose you could define "interesting traffic" in configuring VPN L2L ACL / access-list in the following way

  Branch router

  extended IP access list

  allow an ip

  ASA central

  ip access list allow one

  The idea behind the type of ACL for the VPN L2L above configurations is that, for example, the branch office router has a rule that sets connection coming from the local LAN for 'any' destination address must be sent to the VPN L2L connection. So, it would be in such a way that all the traffic will be sent to the Central Site via VPN L2L.

  I must say however, that the VPN router configurations side are not more familiar to me because I manage especially with ASA Firewall (and to some extent still PIX and FWSMs)

  I guess that on the ASA Central you will PAT translation to "outside" so that the host can access the Internet?

  You would probably do something like this

  object-group network to REMOTE-SITE-PAT-SOURCE

  network-object

  interface of REMOTE-SITE-PAT-SOURCE dynamic NAT (outside, outside) after auto source

  If you don't want to use the 'outside' IP address, then you will have to create a 'network of object' for address IP of PAT and use it in the line of NAT configuration above instead of "interface".

  Alternate configuration might be

  network of the REMOTE-SITE-PAT object

  subnet

  dynamic NAT interface (outdoors, outdoor)

  You also need to enable

  permit same-security-traffic intra-interface

  To allow traffic to enter and exit the same interface on the ASA

  All these answers are naturally suggestion on what you have to do. I don't know what kind of configurations you have right now.

  Hope this helps in some way

  -Jouni

  Post edited by: Jouni Forss

• Tunnel VPN site to Site with DDNS

  I have a hub site that has a static ip address and a remote site with DDNS.  I am building a Site to Site tunnel between them, I can do this with the static ip address, but when he changes the tunnel breaks down, so I need a way to the ASA to know when this ip address changes.  How can I do this?

  Thank you

  To my knowledge, DDNS for VPN is supported only on router IOS not on ASA.

  If you use ASA on the head of network, you may need to use EasyVPN

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a0080912cfd.shtml

  EasyVPN VPN must be started from the remote site.

• Static - VPN Site to Site DMVPN Tunnel

  Hello

  I have two sites, Site-a with Cisco ASA 5505 static IP Configuration & Site-B 1841 Cisco ISR with dynamic IP Configuration.

  See the diagram attached for a glimpse.

  The goal is to have the tunnel VPN Site to Site between the site of two so that desktop sitting in Site B can access the server applications residing in the Site-A.

  Please suggest

  Concerning

  @Mohammed

  Hello

  A site to Site IPSec, the ASA is the static side and he should have the 'dynamic' configuration, and the side Dynamics SRI 1841 should have the static side:

  I'll give an example configuration to achieve, but you can use a different encryption algorithms:

  ASA 5505:

  Phase 1:

  crypto ISAKMP policy 1

  3des encryption

  md5 hash

  preshared authentication

  Group 2

   
  IPSec-attributes tunnel-group DefaultL2LGroup

  pre-shared-key cisco123

   

• Tunnel from site to site VPN that overlap within the network

  Hi all

  I need to connect 2 networks via a tunnel VPN site to site. On the one hand, there is a 506th PIX by the termination of the VPN. The other side, I'm not too sure yet.

  However, what I know, is that both sides of the tunnel using the exact same IP subnet 192.168.1.0/24.

  This creates a problem when I need to define the Routing and the others when it comes to VPN and what traffic should be secure etc.

  However, read a lot for the review of CERT. Adv. Cisco PIX and noticed that outside NAT can solve my 'small' problem.

  That's all it is said, but I'd really like to see an example of configuration of this or hear from someone who has implemented it.

  Anyone?

  Steffen

  How is it then?

  http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00800949f1.shtml

• Tunnel VPN from Site to Site dynamic

  I spent the last 2 days, try to set up a dynamic tunnel VPN site to site of a Cisco 5510 to a Cisco SA540. The 540 is a dynamic supplier that can not be changed. There a dyndns account.

  I was lucky that the other 10 sites are all static and the ADSM Assistant creates these tunnels without problems.

  What I try to do is:

  Is it possible to do it VIA ADSM?

  If this isn't the case, someone please in detail can help with orders.

  Kind regards

  PP

  Hello Paul,

  This is possible thanks to the ASDM, but you do have to use some advanced settings:

  Configuration > VPN Site to Site > advanced > Tunnel groups

  It change the group called "DefaultL2LGroup" and add the brightness button before the SA540 (Note: all of your sites with dynamic IP addresses will have the same key communicated in advance, if you have IPSec VPN clients, it will be a good idea to use a different key).

  

  Click ok and then apply.

  Then go to Configuration > VPN Site to Site > advanced > Crypto Maps and add a new entry dynamic

  

  Make sure that you match the phase 2 are on your SA540 (pictured ESP-AES-128-SHA), select a dynamic strategy and make the last sequence number (65535) then ok, apply.

  Then go to Configuration > VPN Site to Site > advanced > IKE policies and make sure you have corresponding policies of the phase 1.

  

  If no corresponding policy is found, add them.

  Through CLI:

  IKEv1 crypto policy 1

  preshared authentication

  aes encryption

  sha hash

  Group 2

  Crypto-map dynamic outside_dyn_map 65535 set transform-set ESP-AES-128-SHA ikev1

  CARD crypto ipsec-isakmp 65535 dynamic outside_dyn_map

  IPSec-attributes tunnel-group DefaultL2LGroup

  IKEv1 pre-shared-key *.

  I hope this helps.

• Cisco ASA 5505 VPN Site to Site

  Hi all

  First post on the forums. I have worked with Cisco ASA 5505 for a few months and I recently bought a 2nd ASA to implement tunnel VPN Site to Site. It seems so simple in the number of videos watched on the internet. But when I did he surprise it did work for me... I've removed the tunnels, a number of times and tried to recreate. I use the VPN Wizard in the SMA to create the tunnel. Both the asa 5505 of are and have the same firmware even etc..

  I'd appreciate any help that can be directed to this problem please.  Slowly losing my mind

  Please see details below:

  Two ADMS are 7.1

  IOS

  ASA 1

  Nadia

  :

  ASA Version 9.0 (1)

  !

  hostname PAYBACK

  activate the encrypted password of HSMurh79NVmatjY0

  volatile xlate deny tcp any4 any4

  volatile xlate deny tcp any4 any6

  volatile xlate deny tcp any6 any4

  volatile xlate deny tcp any6 any6

  volatile xlate deny udp any4 any4 eq field

  volatile xlate deny udp any4 any6 eq field

  volatile xlate deny udp any6 any4 eq field

  volatile xlate deny udp any6 any6 eq field

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  local pool VPN1 192.168.50.1 - 192.168.50.254 255.255.255.0 IP mask

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  link Trunk Description of SW1

  switchport trunk allowed vlan 1,10,20,30,40

  switchport trunk vlan 1 native

  switchport mode trunk

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  No nameif

  no level of security

  no ip address

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 92.51.193.158 255.255.255.252

  !

  interface Vlan10

  nameif inside

  security-level 100

  IP 192.168.10.1 255.255.255.0

  !

  interface Vlan20

  nameif servers

  security-level 100

  address 192.168.20.1 255.255.255.0

  !

  Vlan30 interface

  nameif printers

  security-level 100

  192.168.30.1 IP address 255.255.255.0

  !

  interface Vlan40

  nameif wireless

  security-level 100

  192.168.40.1 IP address 255.255.255.0

  !

  connection line banner welcome to the Payback loyalty systems

  boot system Disk0: / asa901 - k8.bin

  passive FTP mode

  summer time clock GMT/IDT recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS lookup field inside

  domain-lookup DNS servers

  DNS lookup domain printers

  DNS domain-lookup wireless

  DNS server-group DefaultDNS

  Server name 83.147.160.2

  Server name 83.147.160.130

  permit same-security-traffic inter-interface

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  ftp_server network object

  network of the Internal_Report_Server object

  Home 192.168.20.21

  Description address internal automated report server

  network of the Report_Server object

  Home 89.234.126.9

  Description of server automated reports

  service object RDP

  service destination tcp 3389 eq

  Description RDP to the server

  network of the Host_QA_Server object

  Home 89.234.126.10

  Description QA host external address

  network of the Internal_Host_QA object

  Home 192.168.20.22

  host of computer virtual Description for QA

  network of the Internal_QA_Web_Server object

  Home 192.168.20.23

  Description Web Server in the QA environment

  network of the Web_Server_QA_VM object

  Home 89.234.126.11

  Server Web Description in the QA environment

  service object SQL_Server

  destination eq 1433 tcp service

  network of the Demo_Server object

  Home 89.234.126.12

  Description server set up for the product demo

  network of the Internal_Demo_Server object

  Home 192.168.20.24

  Internal description of the demo server IP address

  network of the NETWORK_OBJ_192.168.20.0_24 object

  subnet 192.168.20.0 255.255.255.0

  network of the NETWORK_OBJ_192.168.50.0_26 object

  255.255.255.192 subnet 192.168.50.0

  network of the NETWORK_OBJ_192.168.0.0_16 object

  Subnet 192.168.0.0 255.255.0.0

  service object MSSQL

  destination eq 1434 tcp service

  MSSQL port description

  VPN network object

  192.168.50.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_192.168.50.0_24 object

  192.168.50.0 subnet 255.255.255.0

  service object TS

  tcp destination eq 4400 service

  service of the TS_Return object

  tcp source eq 4400 service

  network of the External_QA_3 object

  Home 89.234.126.13

  network of the Internal_QA_3 object

  Home 192.168.20.25

  network of the Dev_WebServer object

  Home 192.168.20.27

  network of the External_Dev_Web object

  Home 89.234.126.14

  network of the CIX_Subnet object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.10.0_24 object

  192.168.10.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_84.39.233.50 object

  Home 84.39.233.50

  network of the NETWORK_OBJ_92.51.193.158 object

  Home 92.51.193.158

  network of the NETWORK_OBJ_192.168.100.0_24 object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.1.0_24 object

  subnet 192.168.1.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_1

  the tcp destination eq ftp service object

  the purpose of the tcp destination eq netbios-ssn service

  the purpose of the tcp destination eq smtp service

  service-object TS

  the Payback_Internal object-group network

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.20.0 255.255.255.0

  object-network 192.168.40.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_3

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  service-object TS

  service-object, object TS_Return

  object-group service DM_INLINE_SERVICE_4

  service-object RDP

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  object-group service DM_INLINE_SERVICE_5

  purpose purpose of the MSSQL service

  service-object RDP

  service-object TS

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  object-group service DM_INLINE_SERVICE_6

  service-object TS

  service-object, object TS_Return

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  Note to outside_access_in to access list that this rule allows Internet the interal server.

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-list of FTP access

  Comment from outside_access_in-RDP access list

  Comment from outside_access_in-list of SMTP access

  Note to outside_access_in to access list Net Bios

  Comment from outside_access_in-SQL access list

  Comment from outside_access_in-list to access TS - 4400

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_1 any4 Internal_Report_Server

  access host access-list outside_access_in note rule internal QA

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-HTTP access list

  Comment from outside_access_in-RDP access list

  outside_access_in list extended access permitted tcp any4 object Internal_Host_QA eq www

  Notice on the outside_access_in of the access-list access to the internal Web server:

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-HTTP access list

  Comment from outside_access_in-RDP access list

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_3 any4 Internal_QA_Web_Server

  Note to outside_access_in to access list rule allowing access to the demo server

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-RDP access list

  Comment from outside_access_in-list to access MSSQL

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_4 any4 Internal_Demo_Server

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_5 any object Internal_QA_3

  Note to outside_access_in access to the development Web server access list

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_6 any object Dev_WebServer

  AnyConnect_Client_Local_Print deny any4 any4 ip extended access list

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq lpd

  Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 631

  print the access-list AnyConnect_Client_Local_Print Note Windows port

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 9100

  access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

  AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.251 any4 eq 5353

  AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

  AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.252 any4 eq 5355

  Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 EQ. 137

  AnyConnect_Client_Local_Print list extended access permitted udp any4 any4 eq netbios-ns

  Payback_VPN_splitTunnelAcl list standard access allowed 192.168.20.0 255.255.255.0

  permit outside_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0

  pager lines 24

  Enable logging

  information recording console

  asdm of logging of information

  address record

  [email protected] / * /.

  the journaling recipient

  [email protected] / * /.

  level alerts

  Outside 1500 MTU

  Within 1500 MTU

  MTU 1500 servers

  MTU 1500 printers

  MTU 1500 wireless

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm-711 - 52.bin

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) source Dynamics one interface

  NAT (wireless, outdoors) source Dynamics one interface

  NAT (servers, outside) no matter what source dynamic interface

  NAT (servers, external) static source Internal_Report_Server Report_Server

  NAT (servers, external) static source Internal_Host_QA Host_QA_Server

  NAT (servers, external) static source Internal_QA_Web_Server Web_Server_QA_VM

  NAT (servers, external) static source Internal_Demo_Server Demo_Server

  NAT (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

  NAT (servers, external) static source Internal_QA_3 External_QA_3

  NAT (servers, external) static source Dev_WebServer External_Dev_Web

  NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 92.51.193.157 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL
  the ssh LOCAL console AAA authentication
  Enable http server
  http 192.168.10.0 255.255.255.0 inside
  http 192.168.40.0 255.255.255.0 wireless
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto outside_map 1 match address outside_cryptomap
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 84.39.233.50
  card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  Crypto ikev2 activate out of service the customer port 443
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH 77.75.100.208 255.255.255.240 outside
  SSH 192.168.10.0 255.255.255.0 inside
  SSH 192.168.40.0 255.255.255.0 wireless
  SSH timeout 5
  Console timeout 0

  dhcpd 192.168.0.1 dns
  dhcpd outside auto_config
  !
  dhcpd address 192.168.10.21 - 192.168.10.240 inside
  dhcpd dns 192.168.20.21 83.147.160.2 interface inside
  paybackloyalty.com dhcpd option 15 inside ascii interface
  dhcpd allow inside
  !
  dhcpd address 192.168.40.21 - 192.168.40.240 Wireless
  dhcpd dns 192.168.20.21 83.147.160.2 wireless interface
  dhcpd update dns of the wireless interface
  dhcpd option 15 ascii paybackloyalty.com wireless interface
  dhcpd activate wireless
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal Payback_VPN group strategy
  attributes of Group Policy Payback_VPN
  VPN - 10 concurrent connections
  Ikev1 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list Payback_VPN_splitTunnelAcl
  attributes of Group Policy DfltGrpPolicy
  value of 83.147.160.2 DNS server 83.147.160.130
  VPN-tunnel-Protocol ikev1, ikev2 clientless ssl
  internal GroupPolicy_84.39.233.50 group strategy
  attributes of Group Policy GroupPolicy_84.39.233.50
  VPN-tunnel-Protocol ikev1, ikev2
  Noelle XB/IpvYaATP.2QYm username encrypted password
  Noelle username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username Éanna encrypted password privilege 0 vXILR9ZZQIsd1Naw
  Éanna attributes username
  VPN-group-policy Payback_VPN
  type of remote access service
  Michael qpbleUqUEchRrgQX of encrypted password username
  user name Michael attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username, password from Danny .7fEXdzESUk6S/cC encrypted privilege 0
  user name Danny attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Aileen tytrelqvV5VRX2pz encrypted password privilege 0 username
  user name Aileen attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Aidan aDu6YH0V5XaxpEPg encrypted password privilege 0 username
  Aidan username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
  shane.c iqGMoWOnfO6YKXbw encrypted password username
  username shane.c attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Shane uYePLcrFadO9pBZx of encrypted password username
  user name Shane attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username, encrypted James TdYPv1pvld/hPM0d password
  user name James attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Mark yruxpddqfyNb.qFn of encrypted password username
  user name brand attributes
  type of service admin
  username password of Mary XND5FTEiyu1L1zFD encrypted
  user name Mary attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Massimo vs65MMo4rM0l4rVu encrypted password privilege 0 username
  Massimo username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  type tunnel-group Payback_VPN remote access
  attributes global-tunnel-group Payback_VPN
  VPN1 address pool
  Group Policy - by default-Payback_VPN
  IPSec-attributes tunnel-group Payback_VPN
  IKEv1 pre-shared-key *.
  tunnel-group 84.39.233.50 type ipsec-l2l
  tunnel-group 84.39.233.50 General-attributes
  Group - default policy - GroupPolicy_84.39.233.50
  IPSec-attributes tunnel-group 84.39.233.50
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  Global class-card class
  match default-inspection-traffic
  !
  !
  World-Policy policy-map
  Global category
  inspect the dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the pptp
  inspect the rsh
  inspect the rtsp
  inspect the sip
  inspect the snmp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect xdmcp
  inspect the icmp error
  inspect the icmp
  !
  service-policy-international policy global
  192.168.20.21 SMTP server
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1

  ASA 2

  ASA Version 9.0 (1)

  !

  Payback-CIX hostname

  activate the encrypted password of HSMurh79NVmatjY0

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  Description this port connects to the local network VIRTUAL 100

  switchport access vlan 100

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  switchport access vlan 100

  !

  interface Ethernet0/4

  switchport access vlan 100

  !

  interface Ethernet0/5

  switchport access vlan 100

  !

  interface Ethernet0/6

  switchport access vlan 100

  !

  interface Ethernet0/7

  switchport access vlan 100

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 84.39.233.50 255.255.255.240

  !

  interface Vlan100

  nameif inside

  security-level 100

  IP 192.168.100.1 address 255.255.255.0

  !

  banner welcome to Payback loyalty - CIX connection line

  passive FTP mode

  summer time clock gmt/idt recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS lookup field inside

  DNS server-group defaultDNS

  Name-Server 8.8.8.8

  Server name 8.8.4.4

  permit same-security-traffic inter-interface

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  network of the host-CIX-1 object

  host 192.168.100.2

  Description This is the VM server host machine

  network object host-External_CIX-1

  Home 84.39.233.51

  Description This is the external IP address of the server the server VM host

  service object RDP

  source between 1-65535 destination eq 3389 tcp service

  network of the Payback_Office object

  Home 92.51.193.158

  service object MSQL

  destination eq 1433 tcp service

  network of the Development_OLTP object

  Home 192.168.100.10

  Description for Eiresoft VM

  network of the External_Development_OLTP object

  Home 84.39.233.52

  Description This is the external IP address for the virtual machine for Eiresoft

  network of the Eiresoft object

  Home 146.66.160.70

  Contractor s/n description

  network of the External_TMC_Web object

  Home 84.39.233.53

  Description Public address to the TMC Web server

  network of the TMC_Webserver object

  Home 192.168.100.19

  Internal description address TMC Webserver

  network of the External_TMC_OLTP object

  Home 84.39.233.54

  External targets OLTP IP description

  network of the TMC_OLTP object

  Home 192.168.100.18

  description of the interal target IP address

  network of the External_OLTP_Failover object

  Home 84.39.233.55

  IP failover of the OLTP Public description

  network of the OLTP_Failover object

  Home 192.168.100.60

  Server failover OLTP description

  network of the servers object

  subnet 192.168.20.0 255.255.255.0

  being Wired network

  192.168.10.0 subnet 255.255.255.0

  the subject wireless network

  192.168.40.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_192.168.100.0_24 object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.10.0_24 object

  192.168.10.0 subnet 255.255.255.0

  network of the Eiresoft_2nd object

  Home 137.117.217.29

  Description 2nd Eiresoft IP

  network of the Dev_Test_Webserver object

  Home 192.168.100.12

  Description address internal to the Test Server Web Dev

  network of the External_Dev_Test_Webserver object

  Home 84.39.233.56

  Description This is the PB Dev Test Webserver

  network of the NETWORK_OBJ_192.168.1.0_24 object

  subnet 192.168.1.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_1

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_2

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_3

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_4

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_5

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_6

  service-object MSQL

  service-object RDP

  the Payback_Intrernal object-group network

  object-network servers

  Wired network-object

  wireless network object

  object-group service DM_INLINE_SERVICE_7

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_8

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_9

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_10

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_11

  service-object RDP

  the tcp destination eq ftp service object

  outside_access_in list extended access allow object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-host-1

  Note to access list OLTP Development Office of recovery outside_access_in

  outside_access_in list extended access allow DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP object-group

  Comment from outside_access_in-access Eiresoft access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver object-group

  Note to outside_access_in access to OLTP for target recovery Office Access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover object-group

  Note to outside_access_in access-list that's allowing access of the Eiresoft on the failover OLTP server

  outside_access_in list extended access allow DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover object-group

  Comment from outside_access_in-access list access for the 2nd period of INVESTIGATION of Eiresoft

  outside_access_in list extended access allow DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP object-group

  Note to outside_access_in access from the 2nd IP Eiresoft access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP object-group

  outside_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) source Dynamics one interface

  NAT (inside, outside) static source CIX-host-1 External_CIX-host-1

  NAT (inside, outside) static source Development_OLTP External_Development_OLTP

  NAT (inside, outside) static source TMC_Webserver External_TMC_Web

  NAT (inside, outside) static source TMC_OLTP External_TMC_OLTP

  NAT (inside, outside) static source OLTP_Failover External_OLTP_Failover

  NAT (inside, outside) static source Dev_Test_Webserver External_Dev_Test_Webserver

  NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 84.39.233.49 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  the ssh LOCAL console AAA authentication

  Enable http server

  http 92.51.193.156 255.255.255.252 outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit

  Crypto ipsec ikev2 ipsec-proposal OF

  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto outside_map 1 match address outside_cryptomap
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 92.51.193.158
  card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 1jeu ikev2 AES AES192 AES256 3DES ipsec-proposal
  outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH 77.75.100.208 255.255.255.240 outside
  SSH 92.51.193.156 255.255.255.252 outside
  SSH timeout 5
  Console timeout 0

  dhcpd outside auto_config
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal GroupPolicy_92.51.193.158 group strategy
  attributes of Group Policy GroupPolicy_92.51.193.158
  VPN-tunnel-Protocol ikev1, ikev2
  username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
  tunnel-group 92.51.193.158 type ipsec-l2l
  tunnel-group 92.51.193.158 General-attributes
  Group - default policy - GroupPolicy_92.51.193.158
  IPSec-attributes tunnel-group 92.51.193.158
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
  : end

  Hello

  There are some clear problems I see on a quick glance. These are not related to the actual VPN configuration but rather the NAT configurations.

  All your configuration of NAT CLI format above are configured as manual NAT / double NAT in Section 1. This means that the appliance NAT configurations have been added to the same section of the NAT configurations and scheduling of the NAT inside this Section rules is the cause of the problem for the L2L VPN connection for some.

  Here are a few suggestions on what to change

  ASA1

  Minimal changes

  the object of the LAN network

  192.168.10.0 subnet 255.255.255.0

  being REMOTE-LAN network

  255.255.255.0 subnet 192.168.100.0

  NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

  That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

  Finally, we remove the old rule that generated the ASDM. It would do the same thing if it has been moved to the top, but I generally find the creation of the 'object' with descriptive names easier on the eyes in the long term.

  Other suggestions

  These changes are not necessary with regard to the VPN L2L. Here are some suggestions how to clean a part of NAT configurations.

  PAT-SOURCE network object-group

  source networks internal PAT Description

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.20.0 255.255.255.0

  object-network 192.168.40.0 255.255.255.0

  NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

  No source (indoor, outdoor) nat Dynamics one interface

  no nat (wireless, outdoors) source Dynamics one interface

  no nat (servers, outside) no matter what source dynamic interface

  The above configuration creates a "object-group" that lists all internal networks that you have dynamic PAT configured so far. It then uses the ' object-group ' in a command unique 'nat' to manage the dynamic PAT for all internal networks (with the exception of printers who had nothing at first). Then we remove the old PAT dynamic configurations.

  Contains the command "nat" "car after" because it moving this "nat" configuration to the bottom of the NAT rules. For this reason its less likely to cause problems in the future.

  network of the SERVERS object

  subnet 192.168.20.0 255.255.255.0

  network of the VPN-POOL object

  192.168.50.0 subnet 255.255.255.0

  NAT (servers, external) 2 static static source of destination of SERVERS SERVERS VPN-VPN-POOL

  no nat (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

  The above configuration is supposed to create a NAT0 configuration for traffic between the network and the pool of Client VPN server. To my knowledge the old configuration that remove us is not used because the traffic would have matched PAT rule dynamic server yet rather than this rule which is later in the NAT configurations and would not be addressed.

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

  ASA2

  Minimal changes

  the object of the LAN network

  255.255.255.0 subnet 192.168.100.0

  being REMOTE-LAN network

  192.168.10.0 subnet 255.255.255.0

  NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

  That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

  Finally, we remove the old rule that generated the ASDM.

  Other suggestions

  PAT-SOURCE network object-group

  object-network 192.168.100.0 255.255.255.0

  NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

  No source (indoor, outdoor) nat Dynamics one interface

  The above configuration is supposed to do the same thing with the other ASA. Although given that this network contains only a single subnet it cleans the "nat" configurations exist that much. But the order of the "nat" configurations is changed to avoid further problems with the NAT order.

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

  I suggest trying the changes related to VPN L2L first NAT0 configurations and test traffic. So who gets the work of connectivity, then you could consider changing other NAT configurations. There are other things that could be changed also in what concerns THAT static NAT servers but that probably better left for another time.

  Hope this makes any sense and has helped

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• VPN site to Site using the router and ASA

  Hello

  I have a Cisco 1812 router that is configured for remote access VPN using IPSec (Cisco VPN Client), my question is if I can configure a Cisco ASA 5505 to connect to the router as a VPN from site to site.

  Thank you

  Karl

  Dear Karl,

  Yor are right, in this case you can create a tunnel vpn site-to-site between devices or you can configure your ASA as hardware VPN client. That is to say; Easy VPN.

  For the same thing, you can consult the document below.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml

  Kind regards

  Shijo.

• Cisco ASA VPN Site to Site WITH NAT inside

  Hello!

  I have 2 ASA 5505 related to IPSEC Tunnel VPN Site to Site.

  A 192.168.1.0/24 'remotely' inside the network and a local "192.168.200.0/24' inside the network (you can see the diagram)

  The local host have 192.168.200.254 as default gateway.

  I can't add static route to all army and I can't add static route to 192.168.200.254.

  NAT the VPN entering as 192.168.200.1 or a 192.168.200.x free to connect my host correcly?

  If my host sends packet to exit to the default gateway.

  Thank you for your support

  Best regards

  Marco

  The configuration must be applied on the SAA with the 192.168.200.0 subnet it is inside, there must be something like this:

  permit 192.168.1.0 ip access list VPN_NAT 255.255.255.0 192.168.200.0 255.255.255.0

  NAT (outside) X VPN_NAT outside access list

  Global (inside) X Y.Y.Y.Y (where the Y.Y.Y.Y) is the ip address

  If you have other traffic on the vpn through the tunnel that requires no nat, then you must add external nat exemption rules since these lines above obliges all traffic through the asa to have a nat statement.

  See if it works for you, else post your config nat here.