VPN failover between the ASA

I do a search in the search of the best solution for switching between two ASA and hoped that someone wants to point me in the right direction.

The situation is this, we got:

-Head Office 2:

Each is equipped with an ASA 5505

-10 branches

Each is equipped with a 887 integrated services router.

Each is BranchOffice must have a redundant VPN connection at the headquarters of these two, and they all need to use the first person as main and the other in high school. In case of failure, all branches need to use the second connection VPN going the second seat.

In my research, I'm looking for the best possible solution, with faster failover, but have no idea where to start my research.

I hope someone has a good answer for this one.

Thank you very much in advance,

Kind regards

Dwayne

I do not understand why people continue to use ASA devices for VPN endpoint. the ASA is NOT designed for complex VPN scenarios. It is designed for simple scenarios. In terms of VPN by using comparison, ASA is a person with a basic education while Cisco IOS is like a person with a college degree.

For the scenario, you will be much better using Cisco IOS routers everywhere, where you can implement the GRE/IPSec or DMVPN. Both cases will be sastify to your needs.

Tags: Cisco Security

Similar Questions

VPN tunnel between the concentrator 3005 and router Cisco 827

I am trying to establish a VPN tunnel between the Central Office with VPN 3005 and controller branch Cisco 827 router.

There is a router of perimeter with access set up in front of the 3005 list.

I quote the ACLs on the Central perimeter router instructionsuivante to allow traffic to permit ip 3005 - acl 101 all 193.188.X.X (address of the hub)

I get the following message appears when I try to ping a local host in the Central site.

Can Anyoune give me the correct steps to 827 and 3005.

Thank you

CCNP Ansar.

------------------------------------------------------------------------------------------------------

Debug crypto ISAKMP

encryption of debugging engine

Debug crypto his

debug output

------------------

1d20h: IPSEC (sa_request):,.

(Eng. msg key.) Local OUTGOING = 172.22.113.41, distance = 193.188.108.165.

local_proxy = 202.71.244.160/255.255.255.240/0/0 (type = 4),

remote_proxy = 128.128.1.78/255.255.255.255/0/0 (type = 1),

Protocol = ESP, transform = esp - esp-md5-hmac.

lifedur = 3600 s and KB 4608000,

SPI = 0x83B8AC1B (2209917979), id_conn = 0, keysize = 0, flags = 0x400D

1d20h: ISAKMP: ke received message (1/1)

1d20h: ISAKMP: 500 local port, remote port 500

1d20h: ISAKMP (0:1): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

Former State = new State IKE_READY = IKE_I_MM1

1d20h: ISAKMP (0:1): early changes of Main Mode

1d20h: ISAKMP (0:1): lot of 193.188.108.165 sending (I) MM_NO_STATE

1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE...

1d20h: ISAKMP (0:1): will increment the error counter on his: retransmit the phase 1

1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE

1d20h: ISAKMP (0:1): lot of 193.188.108.165 sending (I) MM_NO_STATE

1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE...

1d20h: ISAKMP (0:1): will increment the error counter on his: retransmit the phase 1

1d20h: ISAKMP (0:1): retransmission phase 1 MM_NO_STATE

1d20h: ISAKMP (0:1): lot of 193.188.108.165 sending (I) MM_NO_STATE

1d20h: IPSEC (key_engine): request timer shot: count = 1,.

You must also allow the esp Protocol in your ACL.

access-list 101 permit esp any host x.x.x.x (address of the hub)

Hope this helps,

-Nairi

FAILOVER OF THE ASA

What is the reference of the item required to activate the failover of the asa?

you first need to safety over the license to enable failover if you run of ASA 5510, otherwise if you're running 5520's and higher then follow the steps in the example located here:

http://www.Cisco.com/en/us/customer/products/ps6120/prod_configuration_examples_list.html

Problem with Tunnel VPN L2L between 2 ASA´s

Hi guys,.

I have some problems with my VPN Site to site tunnel between 2 ASA (5520/5505).

I watched a lot of videos on youtube, but I can't find out why the tunnel does not...

Both devices can ping eachothers WAN IP address (outside interfaces), but I don't see any traffic between the 2 sites. It seems that the tunnel is not open to everyone. When i PING from the local to the Remote LAN (which should be an interesting traffic for the tunnel...), the its IKEv1 remains empty...

Am I missing something? I can't understand it more why same phase 1 is not engaged.

You NAT won't. In your config file traffic is NATted initially and then does not match any more crypto ACL. You must move the rule dynamic NAT/PAT until the end of the table on two ASAs NAT:
```
 no nat (INSIDE,OUTSIDE) source dynamic any interface nat (INSIDE,OUTSIDE) after-auto source dynamic any interface
```

Problems with site-to-site vpn with of the asa 2

I tried different ways so that this works, but failed. After 8 hours, I literally have a bad headache and have to step away for a minute. I realize I need to ping between the tunnels mentioned, but still can not to. can someone take a look and tell me where I have gone wrong? Im trying to configure a site to site vpn between:

ASA_A

external interface 5.179.17.66

inside the interface 10.1.1.1

ASA B

external interface 5.81.57.19

inside the 10.1.2.1 interface

Frist why do you have two DGs on box -

Route outside 0.0.0.0 0.0.0.0 5.179.121.65 1

Route outside 0.0.0.0 0.0.0.0 5.179.17.65 1

Attach the two end then it should work.

Thank you

Ajay

Multiple VPN groups on the ASA firewall

I have a remote VPN configured in my ASA firewall with a group of users configured on the external ACS VPN. The group called VPNASA to authenticate via the ACS server and the server ip pool is on the firewall of the SAA. Now, my boss asked me to set up a second VPN group called VPNSALES on the ACS server for the same remote VPN on the ASA firewall. How to configure the firewall for the ASA to accept both the Group and authenticate on the same ACS server? I've never done this before so I need help.

Thank you very much!

Hello

all you need to do is create another group strategy and attach it to a group of tunnel: -.

internal vpnsales group policy

attributes of the strategy of group vpnsales

banner - VPN access for the sales team

value x.x.x.x DNS server

split tunnel political tunnelspecified

Split-tunnel-network-list split-sales value

address-pools sales-pool

value by default-domain mydomain.com

type tunnel-group vpnsales remote access

tunnel-group vpnsales General-attributes

authentication-server-group vpnsales

Group Policy - by default-vpnsales

vpnsales ipsec tunnel - group capital

pre-share-key @.

you will also create a map of the attribute named vpnsales for acs auth.

Thank you

Manish

VPN tunnel between 2 ASA 5505 with the same default gateway

Hello

Is it possible to create a vpn ipsec site to site (laboratory environment) between two 5505 (ASA IOS 8.2 (5) & asdm-645-206) with the same default gateway. That is a VPN tunnel or a back to back-to-one site that I have to deploy a router and hang each 5505 out a different interface? We have a lot of public IP but only one gateway our ISP (Internet). Any suggestions or recommendations are very appeciated!

d

Yes - you can even do it with a xover cable and a 30 ip on both external interfaces.

Tunnel GRE / IP Sec VPN firewall between the router Cisco and Fortigate

Hello

Can I do GRE Tunnel / VPN IP Sec between Cisco router and Fortigate Firewall?

Thank you

Hi zine,.

As long as the Fortigate device support GRE over IPSEC, you will be able to create the tunnel between these 2 devices.

Here is the config for the Cisco Site:

https://supportforums.Cisco.com/document/16066/how-configure-GRE-over-IPSec-tunnel-routers

Happy holidays!

-Randy-

Site to Site VPN tunnel between two ASA

I use the Site Wizard to Site on an ASA 5520, and ASA 5505 of the ADSM. Both are using 8.4 (5). When you create configurations. You follow the wizard configurations with manual what ACL s to allow the traffic of every subnet connected to talk to each other? Or they are automatically generated in the configuration file? Have not been to school yet to understand how to create the CLI VPN tunnels and what to look for.

Thank you

Carlos

Hello

First, I would like to say that I don't personally use ASDM for the configuration.

But you should be able to configure all the necessary elements for a connection VPN L2L base through the wizard.

I guess that typical problems to do so could relate to the lack of configuration NAT exempt or might not choose the setting "Bypass Interface Access List" that would mean you would allow traffic from the remote site in the 'external' ACL of ASA local interface. Like all other traffic coming from behind the 'outer' interface

If you share format CLI configurations and say what networks must be able to connect via VPN L2L then I could give the required CLI format configurations.

-Jouni

Administration of the ASA via IPSec VPN

Recently, I upgraded my ASA5505 8.2.1 7.2 and curiously lost the ability to manage a VPN (via ASDM or SSH) unit. Before the upgrade, I was able to connect via a method without problem through the VPN. Internally, I still have no problem.

The fault on the ASDM client message when I try to connect to remote is "Impossible to launch the 10.x.x.x:4444 Device Manager." If I look at the output of the console mode of information, I see later that there is a "completed by interception TCP Flow' regarding the conversation between ASA and my system remotely.

The config lines are (I've got running on 443 webvpn):

http server enable 4444

255.x.x.x http inside 10.x.x.x

http 192.x.x.x outside 255.x.x.x

The 192 is located the beach DHCP VPN that get VPN clients (and I checked) such that these systems are able to connect to the ASDM or SSH management interface.

Is there another ACL I need to make this work? Not sure why it worked without problem on 7.2 and as soon as I upgraded to 8.2.1, he stopped, without changing the config (manual).

Thanks in advance for the help!

Point VPN network ssh interface inside rather than the outside, should work, while vpn - ssh to the asa inside the ip address of the interface.

without ssh 192.x.x.x 255.x.x.x outdoors.

SSH 192.x.x.x 255.x.x.x inside.

Concerning

Transfer between Cisco ASA VPN Tunnels

Hi Experts,

I have a situation where I need to set up the transfer between two VPN Tunnels completed in the same box ASA. A VPN Tunnel will incoming traffic and that traffic should be sent to the bottom of the other VPN Tunnel to the ASA. The two VPN Tunnels are from the Internet and speak with the same IP address of the ASA peers.

Retail

Tunnel A

Source: 192.168.1.0/25

Destination: 10.1.1.0/25

Local counterpart: 170.252.100.20 (ASA in question)

Remote peer: 144.36.255.254

Tunnel B

Source: 192.168.1.0/25

Destination: 10.1.1.0/25

Local peer IP: 170.252.100.20 (box of ASA in question)

Distance from peer IP: 195.75.75.1

Can this be achieved? what configurations are needed in the ASA apart cryptographic ACL entries?

Thanks in advance for your time.

Believed that, in this case your config is good, and you can avoid using routes on your asa since it must route based on its default gateway, make sure you have good sheep in place rules and the inter-to interface same-security-interface allowed return you will need.

Help with a VPN tunnel between ASA 5510 and Juniper SSG20

Hello

We have a customer wanting to configure a VPN Site to Site tunnel between a new purchased 5510 of ASA located in his direction with its Juniper SSG20 Office, located in the main office. We contacted HP and they send us a Cisco professional to do the job.

After 2 days from 16:00 to 22:00 and error and countless hours of research online and nunerous calls, we are still unable to get traffic from the network of agencies to enter the tunnel.

Main branch
1.1.1.2                                 1.1.1.1
-----                                               -----------
192.168.8.0/24 | ASA|-----------------------------------| Juniper |    192.168.1.0/24
-----                                               -----------
192.168.8.254 192.168.1.254

According to Cisco professionals, the tunnel is now in place but no traffic through. We are unable to ping anything on the network on the other side (192.168.1.0/24). We receive timeout ping all the time. The Cisco professional told us it's a routing or NAT problem and he's working on a solution!

Through research, I came across a post on Experts-Exchange (here) [the 1st comment on the original post] which States "...". that both sides of the VPN must have a different class of LAN for the VPN to work... " Would that be our problem?

It has become a critical issue to the point that he had to replace the Cisco ASA with a temporary Juniper SSG5 on another subnet (192.168.7.0/24) to get the tunnel upward and through traffic until the ASA VPN issue is resolved and I didn't need to say that the client is killing us!

Help is very appreciated.

Thank you

1. Yes, ping package from the interface of the ASA is considered valuable traffic to the LAN of Juniper.

SAA, need you traffic from the interface source ASA's private, because interesting to determine by crypto ACL MYLIST traffic between 192.168.8.0/24 and 192.168.1.0/24.

You will also need to add the following configuration to be able to get the ping of the interface of the ASA:

management-private access

To initiate the ping of the private interface ASA:

ping 192.168.1.254 private

2. the default time before the next generation of new key is normally 28800 seconds, and if there is no interesting traffic flowing between 2 subnets, he'll tear the VPN tunnel down. As soon as there is interesting traffic, the VPN tunnel will be built automatically into the next generation of new key. However, if there is traffic before generating a new key, the new tunnel will be established, and VPN tunnel will remain standing and continue encrypt and decrypt traffic.

Currently, your configuration has been defined with ITS lifetime of 3600 seconds GOLD / 4608000 kilobytes of traffic before the next generate a new key (it will be either 3600 seconds, or 4608000 kilobytes period expires first). You can certainly change it by default to 28800 seconds without configuring kilobytes. SA life is negotiated between the ASA and Juniper, and whatever is the lowest value will be used.

Hope that helps.

ASA 5500 SSL VPN Failover license

Hello

I have a partner who request assistance with SSL VPN licenses on the ASA 5500 firewall sharing:

His question is:

Both SSL, provided with the firewall of the SAA, licenses can be shared across a couple active / standby? I would therefore have a total of (4) licenses of SSL VPN to use?

This would also be true for two security contexts that are included with the firewall?

For example, I buy two base ASA 5520 firewall, running active / standby, that each machine is supplied with SSL VPN licenses (2) and (2) licensing of security contexts? In version 8.3, the licenses are cumulative by failover pairs, so I should a total SSL VPN (4) and (4) security contexts?

Here is my response to his request:

Based on this link (http://www.cisco.com/en/US/partner/docs/security/asa/asa83/license_standalone/license_management/license.html#wp1449664)

It was mentioned that:

"You can have one active license type, either the AnyConnect Essentials license or the AnyConnect Premium license. By default, the Adaptive security apparatus includes an AnyConnect Premium license for 2 sessions. If you install the AnyConnect Essentials license, it is used by default. See not anyconnect-essentials control or in ASDM Configuration > remote access VPN > network (Client) access > advanced > component AnyConnect Essentials to activate the Premium license instead. »

It will be able to share the included license on the ASA 5500 4. It will be able to share these licenses, but I'm not sure the security context. My answer would be, it can use only 2 context Security licenses since only the VPN licenses are shared on the version 8.3 and other licenses not characteristic. My understanding is correct? or there are other explanations on my customer survey?

Thanks in advance!

Ice Flancia

Cisco partner Helpline Tier 2 team

Only from ASA 8.3 version and following, the license can be combined on a failover pair active / standby.

2 SSL included license on SAA in failover pair is combined as 4 license SSL.

2 license of background on ASA in failover pair is combined as license frame 4.

Here's the URL on ASA combined license failover:

http://www.Cisco.com/en/us/partner/docs/security/ASA/asa83/license_standalone/license_management/license.html#wp1450094

Hope that helps.

VPN hairpin on the OUTSIDE interface

Hairping VPN on the OUTSIDE interface

What I currently have is SSL Anyconnect VPN connections to the ASA that works very well.

I want all networks through the ASA-tunnel.

All web connections will be donated to the ASA and hennard back to the interface from the OUTSIDE to get web access.

I have a static route on the ASA for setting up VPN

Route outside 0.0.0.0 0.0.0.0 PUBLIC_IP>

NAT exemption is in place for the creation of VPN

NAT (INSIDE, OUTSIDE) static source any destination of all public static VPN_POOL_OG VPN_POOL_OG

What I need is the configuration to create the VPN PIN for internet traffic.

Any help is greatly appeciated.

Hi Thomas,

You need the following:

1)

permit same-security-traffic intra-interface

2)

Pool = 192.168.3.0/24 VPN

object obj-vpnpool network

subnet 192.168.3.0 255.255.255.0

dynamic NAT interface (outdoors, outdoor)

!

Please let me know

The rate of any position that you be useful.

HTTPS protocol between the client vpn and host of the internet through tunnel ipsec-parody

Hello

We have a cisco ASA 5505 and try to get the next job:

ip (192.168.75.5) - connected to the Cisco ASA 5505 VPN client

the customer gets a specific route for an internet address (79.143.218.35 255.255.255.255 192.168.75.1 192.168.75.5 100)

When I try to access the url of the client, I get a syn sent with netstat

When I try trace ASA package, I see the following:

1

FLOW-SEARCH

ALLOW

Not found no corresponding stream, creating a new stream

2

ROUTE SEARCH

entry

ALLOW

in 0.0.0.0 0.0.0.0 outdoors

3

ACCESS-LIST

Journal

ALLOW

Access-group outside_access_in in interface outside

outside_access_in list extended access permitted tcp everything any https eq

access-list outside_access_in note hyperion outside inside

4

IP-OPTIONS

ALLOW

5

CP-PUNT

ALLOW

6

VPN

IPSec-tunnel-flow

ALLOW

7

IP-OPTIONS

ALLOW

8

VPN

encrypt

ALLOW

outdoors

upward

upward

outdoors

upward

upward

drop

(ipsec-parody) Parody of detected IPSEC

When I try the reverse (i.e. from the internet host to vpn client), it seems to work:

1

FLOW-SEARCH

ALLOW

Not found no corresponding stream, creating a new stream

2

ROUTE SEARCH

entry

ALLOW

in 192.168.75.5 255.255.255.255 outside

3

ACCESS-LIST

Journal

ALLOW

Access-group outside_access_in in interface outside

outside_access_in of access allowed any ip an extended list

4

IP-OPTIONS

ALLOW

5

VPN

IPSec-tunnel-flow

ALLOW

6

VPN

encrypt

ALLOW

My question is why this phenomenon happens and how solve us this problem?

Thanks in advance, Sipke

our running-config:

: Saved

:

ASA Version 8.0 (4)

!

ciscoasa hostname

domain somedomain

activate the password - encrypted

passwd - encrypted

names of

name 10.10.1.0 Hyperion

name 164.140.159.x xxxx

name 192.168.72.25 xxxx

name 192.168.72.24 xxxx

name 192.168.72.196 xxxx

name 192.168.75.0 vpn clients

name 213.206.236.0 xxxx

name 143.47.160.0 xxxx

name 141.143.32.0 xxxx

name 141.143.0.0 xxxx

name 192.168.72.27 xxxx

name 10.1.11.0 xxxx

name 10.1.2.240 xxxx

name 10.1.1.0 xxxx

name 10.75.2.1 xxxx

name 10.75.2.23 xxxx

name 192.168.72.150 xxxx

name 192.168.33.0 xxxx

name 192.168.72.26 xxxx

name 192.168.72.5 xxxx

name 192.168.23.0 xxxx

name 192.168.34.0 xxxx

name 79.143.218.35 inethost

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.72.254 255.255.255.0

OSPF cost 10

!

interface Vlan2

nameif outside

security-level 0

IP address 193.173.x.x 255.255.255.240

OSPF cost 10

!

interface Vlan3

Shutdown

nameif dmz

security-level 50

192.168.50.1 IP address 255.255.255.0

OSPF cost 10

!

interface Vlan23

nameif wireless

security-level 80

192.168.40.1 IP address 255.255.255.0

OSPF cost 10

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

switchport access vlan 3

!

interface Ethernet0/6

switchport access vlan 23

!

interface Ethernet0/7

!

passive FTP mode

clock timezone THATS 1

clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

DNS lookup field inside

DNS server-group DefaultDNS

domain pearle.local

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

object-group Protocol TCPUDP

object-protocol udp

object-tcp protocol

object-group service RDP - tcp

Remote Desktop Protocol Description

EQ port 3389 object

object-group service UDP - udp VC

range of object-port 60000 60039

object-group VC - TCP tcp service

60000 60009 object-port Beach

object-group service tcp Fortis

1501 1501 object-port Beach

Beach of port-object 1502-1502

Beach of port-object sqlnet sqlnet

1584 1584 object-port Beach

1592 1592 object-port Beach

object-group service tcp fortis

1592 1592 object-port Beach

Beach of port-object 1502-1502

1584 1584 object-port Beach

Beach of port-object sqlnet sqlnet

1501 1501 object-port Beach

1500 1500 object-port Beach

the DM_INLINE_NETWORK_1 object-group network

object-network 192.168.50.0 255.255.255.0

object-network 192.168.72.0 255.255.255.0

object-network 192.168.40.0 255.255.255.0

object-network VPN_Pool_2 255.255.255.0

the DM_INLINE_NETWORK_2 object-group network

object-network 192.168.50.0 255.255.255.0

object-network 192.168.72.0 255.255.255.0

object-group network inside-networks

object-network 192.168.72.0 255.255.255.0

WingFTP_TCP tcp service object-group

Secure FTP description

port-object eq 989

port-object eq 990

DM_INLINE_TCP_1 tcp service object-group

port-object eq ftp

port-object eq ftp - data

Group object WingFTP_TCP

DM_INLINE_TCP_2 tcp service object-group

port-object eq ftp

port-object eq ftp - data

Group object WingFTP_TCP

the DM_INLINE_NETWORK_3 object-group network

object-network 192.168.72.0 255.255.255.0

object-network VPN_Pool_2 255.255.255.0

the DM_INLINE_NETWORK_4 object-group network

object-network 192.168.72.0 255.255.255.0

object-network VPN_Pool_2 255.255.255.0

object-group network Oracle

network-object OracleTwo 255.255.224.0

network-object OracleOne 255.255.240.0

network-object OracleThree 255.255.224.0

the DM_INLINE_NETWORK_5 object-group network

network-object Grandvision 255.255.255.0

network-object Grandvision2 255.255.255.240

object-network Grandvision3 255.255.255.0

host of the object-Network Grandvision4

host of the object-Network GrandVision_PC

the DM_INLINE_NETWORK_6 object-group network

network-object Grandvision 255.255.255.0

network-object Grandvision2 255.255.255.240

object-network Grandvision3 255.255.255.0

host of the object-Network Grandvision4

host of the object-Network GrandVision_PC

the DM_INLINE_NETWORK_7 object-group network

network-object Grandvision 255.255.255.0

network-object Grandvision2 255.255.255.240

object-network Grandvision3 255.255.255.0

host of the object-Network GrandVision_PC

the DM_INLINE_NETWORK_8 object-group network

network-object Grandvision 255.255.255.0

network-object Grandvision2 255.255.255.240

object-network Grandvision3 255.255.255.0

host of the object-Network GrandVision_PC

object-group service DM_INLINE_SERVICE_2

the purpose of the ip service

EQ-3389 tcp service object

the DM_INLINE_NETWORK_9 object-group network

network-object OracleThree 255.255.0.0

network-object OracleTwo 255.255.224.0

network-object OracleOne 255.255.240.0

object-group service DM_INLINE_SERVICE_3

the purpose of the ip service

EQ-3389 tcp service object

Atera tcp service object-group

Atera Webbased monitoring description

8001 8001 object-port Beach

8002 8002 object-port Beach

8003 8003 object-port Beach

WingFTP_UDP udp service object-group

port-object eq 989

port-object eq 990

WingFTP tcp service object-group

Description range of ports for the transmission of data

object-port range 1024-1054

HTTPS_redirected tcp service object-group

Description redirect WingFTP Server

port-object eq 40200

Note to inside_access_in to access list ICMP test protocol inside outside

inside_access_in list extended access allow icmp 192.168.72.0 255.255.255.0 any

Note to inside_access_in to access list ICMP test protocol inside outside

access-list inside_access_in note HTTP inside outside

inside_access_in list extended access allowed object-group TCPUDP 192.168.72.0 255.255.255.0 any eq www

access-list inside_access_in note queries DNS inside to outside

inside_access_in list extended access allowed object-group TCPUDP 192.168.72.0 255.255.255.0 no matter what eq field

access-list inside_access_in note the HTTPS protocol inside and outside

inside_access_in list extended access permitted tcp 192.168.72.0 255.255.255.0 any https eq

Note to inside_access_in to access list ICMP test protocol inside outside

access-list inside_access_in note 7472 Epo-items inside outside

inside_access_in list extended access permitted tcp 192.168.72.0 255.255.255.0 any eq 7472

access-list inside_access_in note POP3 inside outside

inside_access_in list extended access permitted tcp 192.168.72.0 255.255.255.0 any eq pop3

inside_access_in list extended access permit udp host LifeSize-PE-HQ any object-group UDP - VC

inside_access_in list extended access permit tcp host LifeSize-PE-HQ all eq h323

access-list inside_access_in note video conference services

inside_access_in list extended access permit tcp host LifeSize-PE-HQ any object-group VC - TCP

inside_access_in list extended access permitted tcp 192.168.72.0 255.255.255.0 any

Note to inside_access_in to access list Fortis

inside_access_in list extended access permitted tcp 192.168.72.0 255.255.255.0 any object-group Fortis

access extensive list ip 192.168.40.0 inside_access_in allow 255.255.255.0 any

inside_access_in list extended access permitted tcp 192.168.40.0 255.255.255.0 any

inside_access_in list extended access permitted tcp 192.168.40.0 255.255.255.0 any eq www

inside_access_in list extended access permitted tcp 192.168.40.0 255.255.255.0 any https eq

inside_access_in allowed all Hyperion 255.255.255.0 ip extended access list

inside_access_in list extended access udp allowed any any eq isakmp

inside_access_in list extended access udp allowed any any eq ntp

inside_access_in list extended access udp allowed any any eq 4500

inside_access_in list of allowed ip extended access any Oracle object-group

inside_access_in list extended access udp allowed any any eq 10000

access-list inside_access_in note PPTP inside outside

inside_access_in list extended access permit tcp any any eq pptp

access-list inside_access_in note WILL inside outside

inside_access_in list extended access will permit a full

Note to inside_access_in to access the Infrastructure of the RIM BES server list

inside_access_in list extended access permit tcp host BESServer any eq 3101

inside_access_in list extended access permit tcp any any DM_INLINE_TCP_2 object-group

inside_access_in list extended access permit tcp any any HTTPS_redirected object-group

access extensive list ip Hyperion 255.255.255.0 inside_access_in 255.255.255.0 allow VPN_Pool_2

inside_access_in list extended access permit udp any host 86.109.255.177 eq 1194

access extensive list ip 192.168.72.0 inside_access_in allow 255.255.255.0 DM_INLINE_NETWORK_7 object-group

access extensive list ip VPN_Pool_2 inside_access_in allow 255.255.255.0 any

inside_access_in list extended access deny ip any any inactive debug log

Note to outside_access_in to access list ICMP test protocol outside inside

outside_access_in list extended access permit icmp any one

access-list outside_access_in Note SMTP outside inside

outside_access_in list extended access permit tcp any any eq smtp

outside_access_in list extended access udp allowed any any eq ntp disable journal

access-list outside_access_in note 7472 EPO-items outside inside

outside_access_in list extended access permit tcp any any eq 7472

outside_access_in list extended access permit tcp any any object-group inactive RDP

outside_access_in list extended access permit tcp any any eq www

outside_access_in list extended access permit tcp any any HTTPS_redirected object-group

outside_access_in list extended access permitted tcp everything any https eq

access-list outside_access_in note hyperion outside inside

outside_access_in list extended access permitted tcp Hyperion 255.255.255.0 DM_INLINE_NETWORK_4 object-group

outside_access_in to access Hyperion 255.255.255.0 ip extended list object-group DM_INLINE_NETWORK_3 allow

outside_access_in list extended access permit tcp any host LifeSize-PE-HQ eq h323

outside_access_in list extended access permit tcp any host LifeSize-PE-HQ object-group VC - TCP

outside_access_in list extended access permit udp any host group-object-LifeSize-PE-HQ UDP - VC

outside_access_in of access allowed any ip an extended list

outside_access_in list extended access udp allowed any any eq 4500

outside_access_in list extended access udp allowed any any eq isakmp

outside_access_in list extended access udp allowed any any eq 10000

outside_access_in list extended access will permit a full

outside_access_in list extended access permit tcp any any eq pptp

outside_access_in list extended access permit tcp any any DM_INLINE_TCP_1 object-group

outside_access_in list extended access allowed object-group ip DM_INLINE_NETWORK_8 192.168.72.0 255.255.255.0 inactive

outside_access_in list extended access permit tcp any any Atera object-group

outside_access_in list extended access deny ip any any inactive debug log

outside_1_cryptomap list extended access allowed object-group Hyperion DM_INLINE_NETWORK_2 255.255.255.0 ip

outside_1_cryptomap to access extended list ip 192.168.50.0 allow Hyperion 255.255.255.0 255.255.255.0

access extensive list ip 192.168.72.0 inside_nat0_outbound allow Hyperion 255.255.255.0 255.255.255.0

inside_nat0_outbound list of allowed ip extended access all 193.172.182.64 255.255.255.240

inside_nat0_outbound list of allowed ip extended access all 192.168.72.192 255.255.255.192

inside_nat0_outbound list of allowed ip extended access all 192.168.72.0 255.255.255.0

access extensive list ip 192.168.72.0 inside_nat0_outbound allow 255.255.255.0 VPN_Pool_2 255.255.255.0

access extensive list ip 192.168.72.0 inside_nat0_outbound allow 255.255.255.0 DM_INLINE_NETWORK_5 object-group

inside_nat0_outbound list of allowed ip extended access all GrandVisionSoesterberg 255.255.255.0

inside_nat0_outbound list of allowed ip extended access any Swabach 255.255.255.0

access-list 200 scope allow tcp all fortis of fortis host object-group

access extensive list ip VPN_Pool_2 outside_nat0_outbound allow 255.255.255.0 DM_INLINE_NETWORK_9 object-group

outside_cryptomap_2 list extended access allowed object-group Hyperion DM_INLINE_NETWORK_1 255.255.255.0 ip

outside_cryptomap_2 to access extended list ip 192.168.50.0 allow Hyperion 255.255.255.0 255.255.255.0

Note Wireless_access_in of access list, select Hyperion / wifi access NAT rule.

Access extensive list ip 192.168.40.0 Wireless_access_in allow Hyperion inactive 255.255.255.0 255.255.255.0

Wireless_access_in list extended access deny ip 192.168.40.0 255.255.255.0 192.168.72.0 255.255.255.0

Comment by Wireless_access_in-list of the traffic Internet access

Access extensive list ip 192.168.40.0 Wireless_access_in allow 255.255.255.0 any

standard access list splittunnelclientvpn allow 192.168.72.0 255.255.255.0

splittunnelclientvpn list standard access allowed Hyperion 255.255.255.0

standard access list splittunnelclientvpn allow Pearleshare 255.255.255.0

splittunnelclientvpn list standard access allowed host 85.17.235.22

splittunnelclientvpn list standard access allowed OracleThree 255.255.224.0

standard access list splittunnelclientvpn allow 143.47.128.0 255.255.240.0

splittunnelclientvpn list standard access allowed host inethost

Standard access list SplittnlHyperion allow OracleThree 255.255.0.0

Standard access list SplittnlOOD allow OracleThree 255.255.0.0

Standard access list SplittnlOOD allow 143.47.128.0 255.255.240.0

access extensive list ip 192.168.72.0 outside_cryptomap allow 255.255.255.0 DM_INLINE_NETWORK_6 object-group

outside_cryptomap_1 list of allowed ip extended access all GrandVisionSoesterberg 255.255.255.0

outside_cryptomap_3 list of allowed ip extended access any Swabach 255.255.255.0

192.168.72.0 IP Access-list extended sheep 255.255.255.0 GrandVisionSoesterberg 255.255.255.0 allow

192.168.72.0 IP Access-list extended sheep 255.255.255.0 VPN_Pool_2 255.255.255.0 allow

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

MTU 1500 dmz

MTU 1500 wireless

local pool VPN_DHCP 192.168.72.220 - 192.168.72.235 255.255.255.0 IP mask

mask 192.168.75.1 - 192.168.75.50 255.255.255.0 IP local pool VPN_Range_2

no failover

ICMP unreachable rate-limit 1 burst-size 1

ICMP allow any inside

ICMP allow all outside

ASDM image disk0: / asdm - 613.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0 access-list sheep

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (wireless) 1 192.168.40.0 255.255.255.0

public static tcp (indoor, outdoor) interface smtp smtp Mailsrv_Pearle_Europe netmask 255.255.255.255

public static tcp (indoor, outdoor) interface ftp ftp netmask 255.255.255.255 Pearle-DC02

public static 990 Pearle-DC02 990 netmask 255.255.255.255 interface tcp (indoor, outdoor)

static (inside, outside) tcp 3389 3389 Mailsrv_Pearle_Europe netmask 255.255.255.255 interface

public static tcp (indoor, outdoor) interface www Pearle-DC02 www netmask 255.255.255.255

public static 40200 Pearle-DC02 40200 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static tcp (indoor, outdoor) interface https Exchange2010 https netmask 255.255.255.255

public static tcp (indoor, outdoor) interface h323 h323 LifeSize-PE-HQ netmask 255.255.255.255

public static 60000 60000 LifeSize-PE-HQ netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60001 LifeSize-PE-HQ 60001 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60002 LifeSize-PE-HQ 60002 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60003 LifeSize-PE-HQ 60003 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60004 LifeSize-PE-HQ 60004 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60005 LifeSize-PE-HQ 60005 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60006 LifeSize-PE-HQ 60006 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60007 LifeSize-PE-HQ 60007 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60008 LifeSize-PE-HQ 60008 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static 60009 LifeSize-PE-HQ 60009 netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static (inside, outside) udp interface 60001 LifeSize-PE-HQ 60001 netmask 255.255.255.255

public static (inside, outside) udp interface 60002 LifeSize-PE-HQ 60002 netmask 255.255.255.255

public static (inside, outside) udp interface 60003 LifeSize-PE-HQ 60003 netmask 255.255.255.255

public static (inside, outside) udp interface 60004 LifeSize-PE-HQ 60004 netmask 255.255.255.255

public static (inside, outside) udp interface 60005 LifeSize-PE-HQ 60005 netmask 255.255.255.255

public static (inside, outside) udp interface 60006 LifeSize-PE-HQ 60006 netmask 255.255.255.255

public static (inside, outside) udp interface 60007 LifeSize-PE-HQ 60007 netmask 255.255.255.255

public static (inside, outside) udp interface 60008 LifeSize-PE-HQ 60008 netmask 255.255.255.255

public static (inside, outside) udp interface 60009 LifeSize-PE-HQ 60009 netmask 255.255.255.255

public static (inside, outside) udp interface 60010 LifeSize-PE-HQ 60010 netmask 255.255.255.255

public static (inside, outside) udp interface 60011 LifeSize-PE-HQ 60011 netmask 255.255.255.255

public static (inside, outside) udp interface 60012 LifeSize-PE-HQ 60012 netmask 255.255.255.255

public static (inside, outside) udp interface 60013 LifeSize-PE-HQ 60013 netmask 255.255.255.255

public static (inside, outside) udp interface 60014 LifeSize-PE-HQ 60014 netmask 255.255.255.255

public static (inside, outside) udp interface 60015 LifeSize-PE-HQ 60015 netmask 255.255.255.255

public static (inside, outside) udp interface 60016 LifeSize-PE-HQ 60016 netmask 255.255.255.255

public static (inside, outside) udp interface 60017 LifeSize-PE-HQ 60017 netmask 255.255.255.255

public static (inside, outside) udp interface 60018 LifeSize-PE-HQ 60018 netmask 255.255.255.255

public static (inside, outside) udp interface 60019 LifeSize-PE-HQ 60019 netmask 255.255.255.255

public static (inside, outside) udp interface 60020 LifeSize-PE-HQ 60020 netmask 255.255.255.255

public static (inside, outside) udp interface 60021 60021 LifeSize-PE-HQ netmask 255.255.255.255

public static (inside, outside) udp interface 60022 LifeSize-PE-HQ 60022 netmask 255.255.255.255

public static (inside, outside) udp interface 60023 LifeSize-PE-HQ 60023 netmask 255.255.255.255

public static (inside, outside) udp interface 60024 LifeSize-PE-HQ 60024 netmask 255.255.255.255

public static (inside, outside) udp interface 60025 LifeSize-PE-HQ 60025 netmask 255.255.255.255

public static (inside, outside) udp interface 60026 LifeSize-PE-HQ 60026 netmask 255.255.255.255

public static (inside, outside) udp interface 60027 LifeSize-PE-HQ 60027 netmask 255.255.255.255

public static (inside, outside) udp interface 60028 LifeSize-PE-HQ 60028 netmask 255.255.255.255

public static (inside, outside) udp interface 60029 LifeSize-PE-HQ 60029 netmask 255.255.255.255

public static (inside, outside) udp interface 60030 LifeSize-PE-HQ 60030 netmask 255.255.255.255

public static (inside, outside) udp interface 60031 LifeSize-PE-HQ 60031 netmask 255.255.255.255

public static (inside, outside) udp interface 60032 LifeSize-PE-HQ 60032 netmask 255.255.255.255

public static (inside, outside) udp interface 60033 LifeSize-PE-HQ 60033 netmask 255.255.255.255

public static (inside, outside) udp interface 60034 LifeSize-PE-HQ 60034 netmask 255.255.255.255

public static (inside, outside) udp interface 60035 LifeSize-PE-HQ 60035 netmask 255.255.255.255

public static (inside, outside) udp interface 60036 LifeSize-PE-HQ 60036 netmask 255.255.255.255

public static (inside, outside) udp interface 60037 LifeSize-PE-HQ 60037 netmask 255.255.255.255

public static (inside, outside) udp interface 60038 LifeSize-PE-HQ 60038 netmask 255.255.255.255

public static (inside, outside) udp interface 60039 LifeSize-PE-HQ 60039 netmask 255.255.255.255

public static (inside, outside) udp interface 60040 60040 LifeSize-PE-HQ netmask 255.255.255.255

public static Mailsrv_Pearle_Europe 7472 netmask 255.255.255.255 7472 interface tcp (indoor, outdoor)

public static LanSweep-XP netmask 255.255.255.255 8001 8001 interface tcp (indoor, outdoor)

public static 8002 8002 LanSweep-XP netmask 255.255.255.255 interface tcp (indoor, outdoor)

public static LanSweep-XP netmask 255.255.255.255 8003 8003 interface tcp (indoor, outdoor)

static (inside, outside) 193.173.12.194 tcp https Pearle-DC02 https netmask 255.255.255.255

inside_access_in access to the interface inside group

Access-group outside_access_in in interface outside

Access-group Wireless_access_in in wireless interface

Route outside 0.0.0.0 0.0.0.0 193.173.12.206 1

Route outside OracleThree 255.255.224.0 193.173.12.198 1

Route outside 143.47.128.0 255.255.240.0 193.173.12.198 1

Route inside 172.27.0.0 255.255.255.0 Pearle-DC02 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

dynamic-access-policy-registration DfltAccessPolicy

AAA authentication LOCAL telnet console

the ssh LOCAL console AAA authentication

Enable http server

http 192.168.40.0 255.255.255.0 Wireless

http 192.168.1.0 255.255.255.0 inside

http 192.168.72.0 255.255.255.0 inside

http GrandVisionSoesterberg 255.255.255.0 inside

SNMP-server host inside 192.168.33.29 survey community public version 2 c

location of Server SNMP Schiphol

contact Server SNMP SSmeekes

SNMP-Server Public community

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set esp-aes-256 GRANDVISION esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define security association lifetime 28800 seconds

cryptographic kilobytes 4608000 life of the set - the association of security of the 65535 SYSTEM_DEFAULT_CRYPTO_MAP of the dynamic-map

card crypto outside_map0 1 match address outside_cryptomap_1

outside_map0 card crypto 1jeu pfs

outside_map0 card crypto 1jeu peer 212.78.223.182

outside_map0 card crypto 1jeu transform-set ESP ESP-3DES-SHA-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-ESP ESP-3DES-MD5 MD5-DES-SHA ESP-DES-MD5

outside_map0 map 1 lifetime of security association set seconds 28800 crypto

card crypto outside_map0 1 set security-association life kilobytes 4608000

card crypto game 2 outside_map0 address outside_cryptomap_2

outside_map0 crypto map peer set 2 193.173.12.193

card crypto outside_map0 2 game of transformation-ESP ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5-DES-SHA ESP-DES-MD5

life card crypto outside_map0 2 set security-association seconds 28800

card crypto outside_map0 2 set security-association life kilobytes 4608000

card crypto outside_map0 3 match address outside_1_cryptomap

outside_map0 card crypto 3 set pfs

outside_map0 card crypto 3 peers set 193.172.182.66

outside_map0 crypto map 3 the value transform-set ESP-3DES-SHA

life card crypto outside_map0 3 set security-association seconds 28800

card crypto outside_map0 3 set security-association life kilobytes 4608000

card crypto outside_map0 game 4 address outside_cryptomap

outside_map0 card crypto 4 peers set 213.56.81.58

outside_map0 4 set transform-set GRANDVISION crypto card

life card crypto outside_map0 4 set security-association seconds 28800

card crypto outside_map0 4 set security-association life kilobytes 4608000

card crypto outside_map0 5 match address outside_cryptomap_3

outside_map0 card crypto 5 set pfs

outside_map0 crypto card 5 peers set 86.109.255.177

outside_map0 card crypto 5 game of transformation-ESP ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5-DES-SHA ESP-DES-MD5

life card crypto outside_map0 5 set security-association seconds 28800

card crypto outside_map0 5 set security-association life kilobytes 4608000

Crypto map outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

outside_map0 interface card crypto outside

crypto ISAKMP allow inside

crypto ISAKMP allow outside

crypto ISAKMP enable dmz

crypto ISAKMP enable wireless

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet 192.168.72.0 255.255.255.0 inside

Telnet timeout 5

SSH 192.168.72.0 255.255.255.0 inside

SSH GrandVisionSoesterberg 255.255.255.0 inside

SSH 213.144.239.0 255.255.255.192 outside

SSH timeout 5

Console timeout 0

management-access inside

dhcpd dns 194.151.228.18 is 10.10.1.100

dhcpd outside auto_config

!

dhcpd address 192.168.72.253 - 192.168.72.253 inside

!

dhcpd address dmz 192.168.50.10 - 192.168.50.50

dhcpd enable dmz

!

dhcpd address wireless 192.168.40.10 - 192.168.40.99

dhcpd dns 194.151.228.18 wireless interface

dhcpd activate wireless

!

a basic threat threat detection

host of statistical threat detection

statistical threat detection port

Statistical threat detection Protocol

Statistics-list of access threat detection

no statistical threat detection tcp-interception

Group Policy "pearle_vpn_Hyp only" internal

attributes of Group Policy "pearle_vpn_Hyp only".

value of server WINS 192.168.72.25

value of server DNS 192.168.72.25

Protocol-tunnel-VPN IPSec l2tp ipsec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list SplittnlHyperion

Split-dns value pearle.local

internal pearle_vpn_OOD_only group policy

attributes of the strategy of group pearle_vpn_OOD_only

value of Split-tunnel-network-list SplittnlOOD

internal pearle_vpn group policy

attributes of the strategy of group pearle_vpn

value of server WINS 192.168.72.25

value of server DNS 192.168.72.25

Protocol-tunnel-VPN IPSec l2tp ipsec svc

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list splittunnelclientvpn

Pearle.local value by default-field

Split-dns value pearle.local

username anyone password encrypted password

username something conferred

VPN-group-policy pearle_vpn_OOD_only

type of remote access service

tunnel-group 193 type ipsec-l2l

tunnel-group 193 ipsec-attributes

pre-shared-key *.

tunnel-group 193.173.12.193 type ipsec-l2l

IPSec-attributes tunnel-group 193.173.12.193

pre-shared-key *.

NOCHECK Peer-id-validate

type tunnel-group pearle_vpn remote access

tunnel-group pearle_vpn General-attributes

address pool VPN_Range_2

Group Policy - by default-pearle_vpn

pearle_vpn group of tunnel ipsec-attributes

pre-shared-key *.

type tunnel-group Pearle_VPN_2 remote access

attributes global-tunnel-group Pearle_VPN_2

address pool VPN_Range_2

strategy-group-by default "pearle_vpn_Hyp only".

IPSec-attributes tunnel-group Pearle_VPN_2

pre-shared-key *.

tunnel-group 213.56.81.58 type ipsec-l2l

IPSec-attributes tunnel-group 213.56.81.58

pre-shared-key *.

tunnel-group 212.78.223.182 type ipsec-l2l

IPSec-attributes tunnel-group 212.78.223.182

pre-shared-key *.

tunnel-group 86.109.255.177 type ipsec-l2l

IPSec-attributes tunnel-group 86.109.255.177

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

inspect the pptp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:7d4d9c7ca7c865d9e40f5d77ed1238eb

: end

ASDM image disk0: / asdm - 613.bin

ASDM BESServer 255.255.255.255 inside location

ASDM VPN_Pool_2 255.255.255.0 inside location

ASDM OracleTwo 255.255.224.0 inside location

ASDM OracleOne 255.255.240.0 inside location

ASDM OracleThree 255.255.224.0 inside location

ASDM location Exchange2010 255.255.255.255 inside

ASDM location Grandvision 255.255.255.0 inside

ASDM Grandvision2 255.255.255.240 inside location

ASDM Grandvision3 255.255.255.0 inside location

ASDM Grandvision4 255.255.255.255 inside location

ASDM GrandVision_PC 255.255.255.255 inside location

ASDM location LanSweep-XP 255.255.255.255 inside

ASDM GrandVisionSoesterberg 255.255.255.0 inside location

ASDM location Pearle-DC02 255.255.255.255 inside

ASDM location Pearle-WDS 255.255.255.255 inside

ASDM location Swabach 255.255.255.0 inside

ASDM GrandVisionSoesterberg2 255.255.255.0 inside location

don't allow no asdm history

Where is that host (inethost)? Inside of the ASA, or on the internet (on the outside)?

If it is outside, you must configure the NAT for the pool of vpn as you turn on the SAA.

NAT (outside) 1 192.168.75.0 255.255.255.0

VPN failover between the ASA

Similar Questions

Maybe you are looking for