VPN site to Site-> DMZ

Similar Questions

• To vpn Site to Site of DMZ

  Hello

  I recently install a vpn site-to site between a pix 515 running 6.3 (5) and a juniper netscreen. The tunnel is configured to only allow communications between two hosts, one at each end of the tunnel. Then, the client wanted to be the host behind the pix of their demilitarized zone. We made appropriate changes to the address list ACL nat0 and match, but now it has stopped working.

  When I do a sh crypto ipsec sa, I get decaps and packages, but no program to decrypt and encrypt the packets. Sh isakmp his watch an active tunnel between two end points.

  I don't know where to look for here. Haven't found anything on google.

  Here is the current result of sh crypto ipsec his:

  local ident (addr, mask, prot, port): (192.168.210.50/255.255.255.255/0/0)

  Remote ident (addr, mask, prot, port): (10.1.0.36/255.255.255.255/0/0)

  current_peer: a.b.c.d:500

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts 0 digest

  #pkts decaps: 38, #pkts decrypt: 5741, #pkts check 5741

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0, #pkts decompress failed: 0

  Errors #send 0, #recv 5703 errors

  local crypto endpt. : z.y.x.w, remote Start crypto. : a.b.c.d

  Path mtu 1500, overload ipsec 56, media, mtu 1500

  current outbound SPI: 0

  SAS of the esp on arrival:

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  outgoing ah sas:

  outgoing CFP sas:

  Thank you!

  -Jeff

  You did nat exemption like that right?

  (Dmz) NAT 0 access-list...

• Use the remote website via VPN site-to-site

  Hi all

  We have two sites, the site has and B. At site A, we have a Web site we want to share with all of site B. Currently, site B can access the site via the VPN site-to site on X 0, which is their LAN. Nothing outside X 0 cannot access or ping to the address.

  We added access rules to allow access from the DMZ to this interface, but again, no ping and no communication at all. The other strange thing is that we see that no trip package for these access rules either.

  Any help is appreciated. Thank you.

  It seems that the demilitarized zone is not part of the VPN tunnel.

  Can you confirm that the DMZ subnet is part of local destinations on the site B and a part of the local destinations on site?

  Kevin

• VPN site to Site one-way traffic

  Hi all

  I set up a Vpn site-to site and everything works well in the remote site to the corporate site, but since the site of the company asa 5510, I can't access to the remote site asa 5505.  I checked the logging on the SAA and I can see the packets being fallen but I can't find what I need to do to allow this traffic through.  Here are most of my 5510 config, I'm sure it's something simple I'm missing, but I can't run it please help.

  REMOTE network is 192.168.72.0

  : Saved

  : Written by enable_15 at 10:29:17.163 GMT/BDT Thu Jun 10 2010

  !

  ASA Version 8.0 (5)

  !

  host name Casa

  uk domain name

  activate the encrypted password of VgZT0UwPdkSV9l7N

  zlo5ImUVRkHl4lcl encrypted passwd

  names of

  name 192.168.103.14 description of Appliance CITRIX CITRIX Appliance

  name 192.168.3.12 description villages villages

  DNS-guard

  !

  interface Ethernet0/0

  nameif outside

  security-level 0

  IP address x.x.x.123 255.255.255.224

  !

  interface Ethernet0/1

  nameif inside

  security-level 100

  192.168.3.254 IP address 255.255.255.0

  !

  interface Ethernet0/2

  nameif dmz

  security-level 50

  IP 192.168.103.254 255.255.255.0

  !

  interface Ethernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  nameif management

  security-level 100

  IP 192.168.1.1 255.255.255.0

  management only

  !

  boot system Disk0: / asa805 - k8.bin

  boot system Disk0: / asa707 - k8.bin

  passive FTP mode

  clock timezone GMT/UTC 0

  summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS server-group DefaultDNS

  uk domain name

  object-group network ExternalAccess

  Description hosts allowed direct web access

  network object-SVR-01 255.255.255.255

  SVR GIS 255.255.255.255 network-object

  host of network-object cient

  host villages network-object

  the ExternalAccessFromDMZ object-group network

  Description hosts allowed direct web access to DMZ

  CITRIX-device 255.255.255.255 network-object

  network-object IRONPORT1 255.255.255.255

  worker of the object-network 255.255.255.255

  MitelUDPinternet udp service object-group

  Description Mitel UDP services on the internet

  20000-27000 object-port Beach

  port-object eq sip

  port-object eq 5064

  MitelTCPinternet tcp service object-group

  Description Mitel TCP services on the internet

  port-object eq 2114

  port-object eq 2116

  port-object eq 35000

  port-object eq 37000

  port-object eq 3998

  6801-6802 object-port Beach

  port-object eq 6880

  port-object eq www

  EQ object of the https port

  port-object eq 6800

  EQ object Port 3478

  port-object eq sip

  EQ port ssh object

  MitelTCPinternetOpt tcp service object-group

  Description Mitel TCP optional services on the internet

  port-object eq 3300

  6806-6807 object-port Beach

  36005 36005 object-port Beach

  36005 36006 object-port Beach

  EQ object Port 3478

  port-object eq sip

  MitelUDP2LAN udp service object-group

  Description Mitel UDP for the local network of services

  object-port range 1024-65535

  port-object eq sip

  MitelTCP2LAN tcp service object-group

  Description Mitel TCP for the local network of services

  port-object eq 2114

  port-object eq 2116

  port-object eq 35000

  port-object eq 37000

  port-object eq 1606

  object-port 4443 eq

  port-object eq 3998

  port-object eq 3999

  6801-6802 object-port Beach

  port-object eq 6880

  port-object eq www

  EQ object of the https port

  EQ object Port 3478

  port-object eq sip

  acl_outside list extended access permit icmp any any echo response

  acl_outside list extended access allow all unreachable icmp

  acl_outside list extended access permit icmp any any source-quench

  acl_outside list extended access permit tcp any host Mail_Outside_AGH eq smtp

  acl_outside list extended access permit tcp any host Mail_Outside_AGH eq https

  acl_outside list extended access permit tcp any host x.x.x.123 eq ssh

  acl_outside list extended access permit tcp host x.x.x.x host Icritical_Outside eq ssh

  acl_outside list extended access permit tcp any host Citrix_Portal_outside eq 8088

  acl_outside list extended access permit tcp any host Citrix_Portal_outside eq https

  acl_outside list extended access permit tcp any host Citrix_Portal_outside eq 8081

  acl_outside list extended access permit tcp any host Mail_Outside_AVON eq smtp

  acl_outside list extended access permit tcp any host Mail_Outside_AVON eq https

  acl_outside list extended access permit udp host x.x.x.x host Icritical_Outside eq snmp

  acl_outside list extended access permit udp host x.x.x.x host Icritical_Outside eq snmp

  acl_outside list extended access permit tcp any host teleworker_outside MitelTCPinternet object-group

  acl_outside list extended access permit udp any host teleworker_outside MitelUDPinternet object-group

  acl_outside list extended access permit tcp any host teleworker_outside MitelTCPinternetOpt object-group

  acl_outside list extended access permit tcp host x.x.x.x host Icritical_Outside eq ssh

  acl_outside list extended access permit udp any host ESX-PAL-01 eq ntp

  acl_outside list extended access permit udp any host ESX-PAL-02 eq ntp

  acl_outside list extended access permit udp any host ESX-PAL-03 eq ntp

  inside_outbound_nat0_acl to access ip 192.168.1.0 scope list allow 255.255.255.0 172.30.100.0 inactive 255.255.255.224

  inside_outbound_nat0_acl list of allowed ip extended access all 172.31.1.0 255.255.255.0

  inside_outbound_nat0_acl to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.103.0 255.255.255.0

  inside_outbound_nat0_acl to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.72.0 255.255.255.0

  inside_pnat_outbound list extended access allowed object-group ip ExternalAccess everything

  acl_dmz list extended access permit ip host host IRONPORT1 Mail_Inside_AGH

  acl_dmz list extended access permit udp host field of pal-svr-22 eq IRONPORT1 host

  acl_dmz list extended access permit tcp host IRONPORT1 host pal-svr-22 eq 3268

  acl_dmz list extended access permit udp host host IRONPORT1 ARM-SVR-01 eq field

  acl_dmz list extended access permit tcp host IRONPORT1 host ARM-SVR-01 eq 3268

  acl_dmz list extended access permit udp host host IRONPORT1 Pal-Svr-17 eq field

  acl_dmz list extended access allowed icmp host host IRONPORT1 Mail_Inside_AGH

  access extensive list ip 192.168.103.0 acl_dmz allow 255.255.255.0 any

  acl_dmz list extended access permit tcp host host CITRIX-device-CITRIXCSG-lan eq https inactive

  acl_dmz list extended access permit ip any host CITRIXCSG-lan idle

  acl_dmz list extended access permit tcp host IRONPORT1 eq Mail_Outside_AGH smtp

  acl_dmz list extended access permit tcp host teleworker host 192.168.20.1 object-group MitelTCP2LAN

  acl_dmz list extended access permit udp host teleworker host 192.168.20.1 object-group MitelUDP2LAN

  dmz_pnat_outbound list extended access allowed object-group ip ExternalAccessFromDMZ all

  access extensive list ip 192.168.103.0 dmz_nat0_inbound allow 255.255.255.0 192.168.3.0 255.255.255.0

  dmz_nat0_inbound list of ip host 192.168.20.1 telecommuter host allowed extended access

  access extensive list ip 192.168.21.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

  access extensive list ip 192.168.22.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

  access extensive list ip 192.168.23.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

  access extensive list ip 192.168.24.0 inside_pnat_outbound_AVON allow 255.255.248.0 all

  inside_pnat_outbound_AVON to access extended list ip 192.168.32.0 allow 255.255.240.0 everything

  access extensive list ip 192.168.48.0 inside_pnat_outbound_AVON allow 255.255.248.0 all

  access extensive list ip 192.168.56.0 inside_pnat_outbound_AVON allow 255.255.252.0 all

  access extensive list ip 192.168.60.0 inside_pnat_outbound_AVON allow 255.255.255.0 any

  allow any scope to an entire ip access list

  inside_nat_AVON_Marshall list extended access permit ip host Mail_Inside_AVON all

  dmz_pnat1_outbound list of ip telecommuter host allowed extended access any

  outside_1_cryptomap to access extended list ip 192.168.3.0 allow 255.255.255.0 192.168.72.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  logging e-mail notifications

  uk address record

  exploitation forest-address recipient [email protected] / * / critical level

  Outside 1500 MTU

  Within 1500 MTU

  MTU 1500 dmz

  management of MTU 1500

  IP local pool vpnpool 172.31.1.1 - 172.31.1.254 mask 255.255.255.0

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow any inside

  ICMP allow no dmz echo

  ICMP allow all dmz

  ASDM image disk0: / asdm-625 - 53.bin

  ASDM location SVR-01 255.255.255.255 inside

  ASDM location svr-02 255.255.255.255 inside

  ASDM location IRONPORT1 255.255.255.255 dmz

  ASDM location 194.81.55.226 255.255.255.255 dmz

  ASDM 255.255.255.255 inside server location

  ASDM location CITRIX-device 255.255.255.255 dmz

  ASDM group ExternalAccess inside

  ASDM group dmz ExternalAccessFromDMZ

  don't allow no asdm history

  ARP timeout 14400

  Global x.x.x.121 2 (outdoor)

  Global 1 x.x.x.125 (outside)

  Global Mail_Outside_AVON 3 (outside)

  Global Mail_Outside_AGH 4 (outside)

  Global teleworker_outside 5 (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 2-list of access inside_pnat_outbound_AVON

  NAT (inside) 3 access-list inside_nat_AVON_Marshall

  NAT (inside) 1 access-list inside_pnat_outbound

  NAT (dmz) 0-list of access dmz_nat0_inbound outside

  NAT (dmz) 4 access-list dmz_pnat_outbound

  NAT (dmz) 5 access-list dmz_pnat1_outbound

  static (inside, outside) tcp ssh Icritical ssh netmask 255.255.255.255 Icritical_Outside

  static (inside, outside) tcp https Mail_Outside_AGH Mail_Inside_AGH https netmask 255.255.255.255

  static (dmz, outside) tcp smtp smtp IRONPORT1 netmask 255.255.255.255 Mail_Outside_AGH

  static (inside, outside) tcp https Mail_Outside_AVON Exchange_Inside_AVON https netmask 255.255.255.255

  static (inside, outside) tcp smtp smtp Mail_Inside_AVON netmask 255.255.255.255 Mail_Outside_AVON

  static (inside, outside) udp snmp Icritical snmp netmask 255.255.255.255 Icritical_Outside

  static (dmz, outside) device-CITRIX-Citrix_Portal_outside netmask 255.255.255.255

  static (inside, outside) Mail_Outside_AVON Mail_Inside_AVON netmask 255.255.255.255

  static (dmz, external) teleworker_outside netmask 255.255.255.255 teleworker

  Access-group acl_outside in interface outside

  Access-group acl_dmz in dmz interface

  Route outside 0.0.0.0 0.0.0.0 X.X.X.254 1

  Route inside 192.168.0.0 255.255.0.0 192.168.3.3 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  dynamic-access-policy-registration DfltAccessPolicy

  Enable http server

  oner http 255.255.255.255 inside

  http 192.168.1.0 255.255.255.0 management

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  card crypto outside_map 1 match address outside_1_cryptomap

  card crypto outside_map 1 set pfs Group1

  card crypto outside_map 1 set r.r.r.244 counterpart

  card crypto outside_map 1 set of transformation-ESP-3DES-SHA

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  No encryption isakmp nat-traversal

  Telnet timeout 5

  SSH x.x.x.x 255.255.255.255 outside

  SSH Mail_Inside_AGH 255.255.255.255 inside

  SSH timeout 5

  Console timeout 0

  management of 192.168.1.2 - dhcpd address 192.168.1.254

  enable dhcpd management

  !

  a basic threat threat detection

  statistical threat detection port

  Statistical threat detection Protocol

  Statistics-list of access threat detection

  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

  prefer NTP server SVR - DC1 source inside

  internal VPN group policy

  attributes of VPN group policy

  value 192.168.x.x 192.168.x.x WINS server

  Server DNS value 192.168.x.x 192.168.x.x

  enable IPSec-udp

  value by default domain-ACE

  username, password pmmPwcDD/inpnNfB VPN encrypted privilege 0

  attributes of VPN username

  Strategy-Group-VPN VPN

  VPN Tunnel-group type remote access

  General-attributes of VPN Tunnel-group

  address vpnpool pool

  Group Policy - by default-VPN

  Group-tunnel VPN ipsec-attributes

  pre-shared key *.

  tunnel-group r.r.r.244 type ipsec-l2l

  r.r.r.244 tunnel ipsec-attributes group

  pre-shared key *.

  by default-group r.r.r.244 tunnel-Group-map

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns migrated_dns_map_1

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the migrated_dns_map_1 dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the netbios

  inspect the tftp

  inspect the sip

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:8360816431357f109b3c4b950d545c86

  : end

  This route is duplicated with the remote network

  Route inside 192.168.0.0 255.255.0.0 192.168.3.3 1

  I suggest to make this more specific subnet or add something like

  Route outside 192.168.72.0 255.255.255.0 outside_default_gateway_ip

  Internal, if above not in fact help, put a trace packet to simulate traffic even that fails on the 5510.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/p.html#wp1878788

  Kind regards

• problem with users to access remote vpn site to site vpn network

  I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

  execution of the configuration of my asa 5510 is

  Result of the command: "show run"
  : Saved
  
      :
  
      ASA Version 8.4(2)
  
      !
  
      hostname asa5510
  
      domain-name dri.local
  
      enable password 8Ry2YjIyt7RRXU24 encrypted
  
      passwd 2KFQnbNIdI.2KYOU encrypted
  
      names
  
      !
  
      interface Ethernet0/0
  
      nameif outside
  
      security-level 0
  
      ip address x.x.x.178 255.255.255.248
  
      !
  
      interface Ethernet0/1
  
      nameif inside
  
      security-level 100
  
      ip address 192.168.0.10 255.255.255.0
  
      !
  
      interface Ethernet0/2
  
      description Mreza za virtualne masine- mail server, wsus....
  
      nameif DMZ
  
      security-level 50
  
      ip address 172.16.20.1 255.255.255.0
  
      !
  
      interface Ethernet0/3
  
      shutdown
  
      no nameif
  
      no security-level
  
      no ip address
  
      !
  
      interface Management0/0
  
      nameif management
  
      security-level 100
  
      ip address 192.168.1.1 255.255.255.0
  
      management-only
  
      !
  
      ftp mode passive
  
      clock timezone CEST 1
  
      clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
  
      dns server-group DefaultDNS
  
      domain-name dri.local
  
      object network VPN-POOL
  
      subnet 192.168.50.0 255.255.255.0
  
      description VPN Client pool
  
      object network LAN-NETWORK
  
      subnet 192.168.0.0 255.255.255.0
  
      description LAN Network
  
      object network NETWORK_OBJ_192.168.0.0_24
  
      subnet 192.168.0.0 255.255.255.0
  
      object network 192.168.0.10
  
      host 192.168.0.10
  
      object service ssl
  
      service tcp destination eq 465
  
      object service tls
  
      service tcp destination eq 995
  
      object network mail_server
  
      host 172.16.20.201
  
      object service StartTLS
  
      service tcp destination eq 587
  
      object service admin_port
  
      service tcp destination eq 444
  
      object service ODMR
  
      service tcp destination eq 366
  
      object service SSL-IMAP
  
      service tcp destination eq 993
  
      object network remote
  
      host 172.16.20.200
  
      object network test
  
      host 192.168.0.22
  
      object network mail
  
      host 172.16.20.200
  
      object network DMZ
  
      host 172.16.20.200
  
      object network Inside_DMZ
  
      host 192.168.0.20
  
      object service rdp
  
      service tcp destination eq 3389
  
      object network DRI_PS99
  
      host 192.168.0.54
  
      object service microsoft_dc
  
      service tcp destination eq 445
  
      object service https448
  
      service tcp destination eq 448
  
      object network mail_server_internal
  
      host 172.16.20.201
  
      object service Acronis_remote
  
      service tcp destination eq 9876
  
      object service Acronis_25001
  
      service tcp destination eq 25001
  
      object service HTTP3000
  
      service tcp destination eq 3000
  
      object network VPNPOOL
  
      subnet 192.168.50.0 255.255.255.0
  
      object-group network PAT-SOURCE-NETWORKS
  
      description Source networks for PAT
  
      network-object 192.168.0.0 255.255.255.0
  
      object-group service DM_INLINE_SERVICE_1
  
      service-object object admin_port
  
      service-object object ssl
  
      service-object object tls
  
      service-object object https448
  
      object-group service DM_INLINE_SERVICE_2
  
      service-object object admin_port
  
      service-object object https448
  
      service-object object ssl
  
      service-object object tls
  
      service-object tcp destination eq pop3
  
      service-object tcp destination eq smtp
  
      object-group service DM_INLINE_SERVICE_3
  
      service-object object admin_port
  
      service-object object https448
  
      service-object object ssl
  
      service-object tcp destination eq smtp
  
      service-object object tls
  
      service-object object Acronis_remote
  
      service-object tcp destination eq www
  
      service-object object Acronis_25001
  
      service-object object microsoft_dc
  
      object-group protocol DM_INLINE_PROTOCOL_1
  
      protocol-object ip
  
      protocol-object tcp
  
      object-group service DM_INLINE_SERVICE_4
  
      service-object object Acronis_25001
  
      service-object object Acronis_remote
  
      service-object object microsoft_dc
  
      service-object tcp destination eq www
  
      service-object tcp
  
      service-object ip
  
      access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
  
      access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
  
      access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
  
      access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
  
      access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
  
      access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
  
      access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
  
      access-list DMZ extended deny tcp any any eq smtp
  
      pager lines 24
  
      logging enable
  
      logging asdm informational
  
      mtu outside 1500
  
      mtu inside 1500
  
      mtu DMZ 1500
  
      mtu management 1500
  
      ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
  
      icmp unreachable rate-limit 1 burst-size 1
  
      no asdm history enable
  
      arp timeout 14400
  
      nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
  
      !
  
      object network mail_server
  
      nat (DMZ,outside) static x.x.x.179
  
      object network mail
  
      nat (DMZ,outside) static x.x.x.180
  
      access-group outside_access_in in interface outside
  
      access-group DMZ in interface DMZ
  
      route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
  
      timeout xlate 3:00:00
  
      timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  
      timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  
      timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  
      timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  
      timeout tcp-proxy-reassembly 0:01:00
  
      timeout floating-conn 0:00:00
  
      dynamic-access-policy-record DfltAccessPolicy
  
      action terminate
  
      dynamic-access-policy-record dripolisa
  
      aaa-server DRI protocol ldap
  
      aaa-server DRI (inside) host 192.168.0.20
  
      ldap-base-dn DC=dri,DC=local
  
      ldap-scope subtree
  
      ldap-naming-attribute sAMAccountName
  
      ldap-login-password *****
  
      ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
  
      server-type microsoft
  
      user-identity default-domain LOCAL
  
      aaa authentication enable console LOCAL
  
      aaa authentication http console LOCAL
  
      aaa authentication serial console LOCAL
  
      aaa authentication telnet console LOCAL
  
      aaa authorization command LOCAL
  
      http server enable
  
      http 192.168.1.0 255.255.255.0 management
  
      http 192.168.0.0 255.255.255.0 inside
  
      no snmp-server location
  
      no snmp-server contact
  
      snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
  
      virtual telnet 192.168.1.12
  
      crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
  
      crypto ipsec ikev2 ipsec-proposal DES
  
      protocol esp encryption des
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal 3DES
  
      protocol esp encryption 3des
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal AES
  
      protocol esp encryption aes
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal AES192
  
      protocol esp encryption aes-192
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal AES256
  
      protocol esp encryption aes-256
  
      protocol esp integrity sha-1 md5
  
      crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
  
      crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
  
      crypto map outside_map 1 match address outside_cryptomap
  
      crypto map outside_map 1 set peer 195.222.96.223
  
      crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
  
      crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
  
      crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  
      crypto map outside_map interface outside
  
      crypto ikev2 policy 1
  
      encryption aes-256
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 10
  
      encryption aes-192
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 20
  
      encryption aes
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 30
  
      encryption 3des
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 40
  
      encryption des
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 enable outside
  
      crypto ikev1 enable outside
  
      crypto ikev1 policy 10
  
      authentication pre-share
  
      encryption 3des
  
      hash sha
  
      group 2
  
      lifetime 86400
  
      telnet 192.168.0.0 255.255.255.0 inside
  
      telnet timeout 5
  
      ssh timeout 5
  
      console timeout 0
  
      dhcpd auto_config outside
  
      !
  
      dhcpd address 192.168.0.14-192.168.0.45 inside
  
      !
  
      dhcpd address 172.16.20.2-172.16.20.150 DMZ
  
      dhcpd dns x.x.x.177 interface DMZ
  
      dhcpd auto_config outside interface DMZ
  
      dhcpd option 6 ip x.x.x.177 interface DMZ
  
      dhcpd enable DMZ
  
      !
  
      dhcpd address 192.168.1.2-192.168.1.254 management
  
      dhcpd enable management
  
      !
  
      threat-detection basic-threat
  
      threat-detection statistics port
  
      threat-detection statistics protocol
  
      threat-detection statistics access-list
  
      no threat-detection statistics tcp-intercept
  
      webvpn
  
      group-policy GroupPolicy_x.x.x.223 internal
  
      group-policy GroupPolicy_x.x.x.223 attributes
  
      vpn-tunnel-protocol ikev1 ikev2
  
      group-policy drivpn internal
  
      group-policy drivpn attributes
  
      dns-server value 192.168.0.20 192.168.0.254
  
      vpn-simultaneous-logins 10
  
      vpn-idle-timeout 30
  
      vpn-tunnel-protocol ikev1 l2tp-ipsec
  
      split-tunnel-network-list value Split_Tunnel_List
  
      default-domain value dri.local
  
      username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
  
      tunnel-group drivpn type remote-access
  
      tunnel-group drivpn general-attributes
  
      address-pool vpnadrese
  
      authentication-server-group DRI
  
      default-group-policy drivpn
  
      tunnel-group drivpn ipsec-attributes
  
      ikev1 pre-shared-key *****
  
      tunnel-group x.x.x.223 type ipsec-l2l
  
      tunnel-group x.x.x.223 general-attributes
  
      default-group-policy GroupPolicy_x.x.x.223
  
      tunnel-group x.x.x.223 ipsec-attributes
  
      ikev1 pre-shared-key *****
  
      ikev2 remote-authentication pre-shared-key *****
  
      ikev2 local-authentication pre-shared-key *****
  
      !
  
      class-map inspection_default
  
      match default-inspection-traffic
  
      !
  
      !
  
      policy-map type inspect dns preset_dns_map
  
      parameters
  
        message-length maximum client auto
  
        message-length maximum 512
  
      policy-map global_policy
  
      class inspection_default
  
        inspect dns preset_dns_map
  
        inspect ftp
  
        inspect h323 h225
  
        inspect h323 ras
  
        inspect rsh
  
        inspect rtsp
  
        inspect sqlnet
  
        inspect skinny 
  
        inspect sunrpc
  
        inspect xdmcp
  
        inspect sip 
  
        inspect tftp
  
        inspect ip-options
  
        inspect netbios
  
        inspect icmp
  
        inspect http
  
      !
  
      service-policy global_policy global
  
      prompt hostname context
  
      no call-home reporting anonymous
  
      Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
  
      : end
  

  running config asa 5505

  Result of the command: "show run"
  : Saved
  
      :
  
      ASA Version 8.2(1)
  
      !
  
      hostname ciscoasa
  
      enable password csq7sfr0bQJqMGET encrypted
  
      passwd 2KFQnbNIdI.2KYOU encrypted
  
      names
  
      name 192.168.5.0 PALATA
  
      !
  
      interface Vlan1
  
      nameif inside
  
      security-level 100
  
      ip address 192.168.0.17 255.255.255.0
  
      !
  
      interface Vlan2
  
      nameif outside
  
      security-level 0
  
      ip address 10.13.74.33 255.255.255.0
  
      !
  
      interface Ethernet0/0
  
      switchport access vlan 2
  
      !
  
      interface Ethernet0/1
  
      !
  
      interface Ethernet0/2
  
      !
  
      interface Ethernet0/3
  
      !
  
      interface Ethernet0/4
  
      !
  
      interface Ethernet0/5
  
      !
  
      interface Ethernet0/6
  
      !
  
      interface Ethernet0/7
  
      !
  
      ftp mode passive
  
      clock timezone CEST 1
  
      clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
  
      object-group service DM_INLINE_SERVICE_1
  
      service-object ip
  
      service-object tcp
  
      service-object icmp echo
  
      service-object icmp echo-reply
  
      service-object tcp eq domain
  
      service-object tcp eq ldap
  
      service-object tcp eq smtp
  
      object-group service DM_INLINE_SERVICE_2
  
      service-object ip
  
      service-object tcp eq domain
  
      service-object tcp eq www
  
      service-object tcp eq https
  
      service-object tcp eq smtp
  
      object-group service Sharepoint8080 tcp
  
      port-object eq 8080
  
      access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
  
      access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
  
      access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
  
      access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
  
      access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
  
      pager lines 24
  
      logging enable
  
      logging asdm informational
  
      logging mail errors
  
      logging from-address
  
      logging recipient-address  level debugging
  
      mtu inside 1500
  
      mtu outside 1500
  
      icmp unreachable rate-limit 1 burst-size 1
  
      no asdm history enable
  
      arp timeout 14400
  
      global (outside) 1 interface
  
      nat (inside) 0 access-list inside_nat0_outbound_1
  
      nat (inside) 1 192.168.0.0 255.255.255.0
  
      static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
  
      static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
  
      access-group inside_access_in in interface inside
  
      access-group outside_access_in in interface outside
  
      route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
  
      route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
  
      timeout xlate 3:00:00
  
      timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  
      timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  
      timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  
      timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  
      timeout tcp-proxy-reassembly 0:01:00
  
      dynamic-access-policy-record DfltAccessPolicy
  
      aaa authentication telnet console LOCAL
  
      http server enable
  
      http 10.13.74.0 255.255.255.0 outside
  
      http 192.168.0.0 255.255.255.0 inside
  
      http 10.15.100.0 255.255.255.0 outside
  
      no snmp-server location
  
      no snmp-server contact
  
      snmp-server enable traps snmp authentication linkup linkdown coldstart
  
      virtual telnet 192.168.0.53
  
      crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  
      crypto ipsec security-association lifetime seconds 28800
  
      crypto ipsec security-association lifetime kilobytes 4608000
  
      crypto map outside_map 1 match address outside_2_cryptomap
  
      crypto map outside_map 1 set pfs
  
      crypto map outside_map 1 set peer 10.15.100.15
  
      crypto map outside_map 1 set transform-set ESP-3DES-SHA
  
      crypto map outside_map interface outside
  
      crypto isakmp enable outside
  
      crypto isakmp policy 10
  
      authentication pre-share
  
      encryption 3des
  
      hash sha
  
      group 2
  
      lifetime 86400
  
      telnet 192.168.0.0 255.255.255.0 inside
  
      telnet timeout 5
  
      ssh timeout 5
  
      console timeout 0
  
      dhcpd auto_config outside
  
      !
  threat-detection basic-threat
  
      threat-detection statistics access-list
  
      no threat-detection statistics tcp-intercept
  
      webvpn
  
      username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
  
      tunnel-group 10.15.100.15 type ipsec-l2l
  
      tunnel-group 10.15.100.15 ipsec-attributes
  
      pre-shared-key *
  
      !
  
      class-map inspection_default
  
      match default-inspection-traffic
  
      !
  
      !
  
      policy-map type inspect dns preset_dns_map
  
      parameters
  
        message-length maximum 512
  
      policy-map global_policy
  
      class inspection_default
  
        inspect dns preset_dns_map
  
        inspect ftp
  
        inspect h323 h225
  
        inspect h323 ras
  
        inspect rsh
  
        inspect rtsp
  
        inspect esmtp
  
        inspect sqlnet
  
        inspect skinny 
  
        inspect sunrpc
  
        inspect xdmcp
  
        inspect sip 
  
        inspect netbios
  
        inspect tftp
  
        inspect icmp
  
      !
  
      service-policy global_policy global
  
      smtp-server 173.194.79.109
  
      prompt hostname context
  
      Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
  
      : end
  

  Thank you

  Hello

  I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

  EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"
  

  So you don't really have any of those.

  Please mark the question answers and/or assess response

  Ask more if necessary

  -Jouni

• Have a vpn site to site of work, added second who has problems

  We've had a success vpn site to site working for several months now. It's a 5510 ASA to Headquarters for an ASA 5505 in a branch in another State. We add a second vpn site to site in another State this time of the AC to a Sonicwall TZ100. After connecting the Sonicwall to the Qwest modem in bridge mode tunnel came right up. I was unable to ping all off the coast of the private IPs to the HQ of the new branch, but was able to use the remote desktop in servers and workstations at Headquarters. Also, all computers appear when you browse the network of the new branch.

  The first part, we are able to ping both directions and use remote desktop in both directions.

  When using tracers of package in ASDM on the ASA HQ and rattling one of the IPs in HQ protected network to an IP address in the new network of agencies EXEMPT from NAT looks good, but when it hits the first NAT it fits on the "dynamic translation to the pool (10.1.255.254) 10 [Interface PAT]" (which is the default route to all VLAN access to Internet).

  Next NAT (subtype - host-limits) is more beautiful and this one goes to the IP address of the external interface of the ASA 5510 HQ, but then the third NAT (subtype - rpf-check) returns to the ' 10 (10.1.255.254) Interface PAT] "and the package is ABANDONED. Also there is no step VPN in Packet Tracer after NAT.

  So obviously the HQ ASA 5510 does not consider this to be interesting traffic but I don't know why.

  Here is the output of sh crypto ipsec his ffrom HQ ASA:

  Interface: outside
  Tag crypto map: outside_map, seq num: 30 local addr: 209.X.X.X

  access-list encrypt_acl-30 permit ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
  local ident (addr, mask, prot, port): (10.1.1.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.1.8.0/255.255.255.0/0/0)
  current_peer: 65.102.14.72

  #pkts program: 229450, #pkts encrypt: 229450, #pkts digest: 229450
  #pkts decaps: 172516, #pkts decrypt: 172516, #pkts check: 172516
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 229450, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 209.X.X.X, remote Start crypto. : 65.102.X.X

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: 91860025

  SAS of the esp on arrival:
  SPI: 0x88957B9C (2291497884)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 59068
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0xFFFFFFFF to 0xFFFFFFFF
  outgoing esp sas:
  SPI: 0 x 91860025 (2441478181)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 59068
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Tag crypto map: outside_map, seq num: 30 local addr: 209.X.X.X

  access-list encrypt_acl-30 permit ip 10.1.10.0 255.255.255.0 10.1.8.0 255.255.255.0
  local ident (addr, mask, prot, port): (10.1.10.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (10.1.8.0/255.255.255.0/0/0)
  current_peer: 65.102.x.x

  #pkts program: encrypt 0, #pkts: 0, #pkts digest: 0
  #pkts decaps: 0, #pkts decrypt: 0, #pkts check: 0
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, comp #pkts failed: 0, #pkts Dang failed: 0
  success #frag before: 0, failures before #frag: 0, #fragments created: 0
  Sent #PMTUs: 0, #PMTUs rcvd: 0, reassembly: 20th century / of frgs #decapsulated: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt. : 209.X.X.X, remote Start crypto. : 65.102.X.X

  Path mtu 1500, fresh ipsec generals 58, media, mtu 1500
  current outbound SPI: A204BAE2

  SAS of the esp on arrival:
  SPI: 0xDA8C653A (3666634042)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 84670
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001
  outgoing esp sas:
  SPI: 0xA204BAE2 (2718218978)
  transform: esp-3des esp-md5-hmac no compression
  running parameters = {L2L, Tunnel}
  slot: 0, id_conn: 2600960, crypto-card: outside_map
  calendar of his: service life remaining key (s): 84621
  Size IV: 8 bytes
  support for replay detection: Y
  Anti-replay bitmap:
  0x00000000 0x00000001

  Here is the output of sh crypto isakmp his on HQ ASA:

  3 peer IKE: 65.102.x.x

  Type: L2L role: answering machine

  Generate a new key: no State: MM_ACTIVE

  Here is the config:

  ASA Version 8.0 (4)
  !
  hostname COMPASA
  domain COMPfirm.com
  activate the encrypted password of TMACBloMlcBsq1kp
  TMACBloMlcBsq1kp encrypted passwd
  names of
  DNS-guard
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 209.X.X.X 255.255.255.224
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  IP 10.1.255.254 255.255.255.248
  !
  interface Ethernet0/2
  nameif dmz
  security-level 50
  10.2.2.1 IP address 255.255.255.0
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  management only
  !
  boot system Disk0: / asa804 - k8.bin
  passive FTP mode
  clock timezone MDT - 7
  clock to summer time recurring MDT
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  Name-Server 4.2.2.1
  domain COMPfirm.com
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  list of allowed inbound tcp extended access any host 209.X.X.X eq www
  list of allowed inbound tcp extended access any host 209.X.X.X eq https
  list of allowed inbound tcp extended access any host 209.X.X.X eq ftp
  list of allowed inbound tcp extended access any host 209.X.X.X eq ftp - data
  list of allowed inbound tcp extended access any host 209.X.X.X eq ssh
  list of allowed inbound tcp extended access any host 209.X.X.X eq imap4
  list of allowed inbound tcp extended access any host 209.X.X.X eq pop3
  list of allowed inbound tcp extended access any host 209.X.X.X eq www
  list of allowed inbound tcp extended access any host 209.X.X.X eq https
  list of allowed inbound tcp extended access any host 209.X.X.X eq smtp
  list of extended inbound icmp permitted access a whole
  access list entering note MMS-1755
  list incoming extended access permit tcp any eq 1755 host inactive 209.X.X.X
  inbound access list notice MMS - UDP
  list of inbound udp allowed extended access all eq 1755 host inactive 209.X.X.X
  DMZ list extended access permit tcp host 10.2.2.2 10.1.1.11 host eq smtp
  DMZ list extended access permit tcp host 10.2.2.2 host 10.1.1.50 eq 8777
  access-list extended sheep allowed ip 10.1.0.0 255.255.0.0 172.16.22.0 255.255.255.0
  access-list sheep extended ip 10.1.10.0 allow 255.255.255.0 10.0.0.0 255.255.255.0
  access-list extended sheep allowed ip 10.1.1.0 255.255.255.0 10.0.0.0 255.255.255.0
  access-list sheep extended ip 10.1.10.0 allow 255.255.255.0 10.1.8.0 255.255.255.0
  access-list extended sheep allowed ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
  access extensive list ip 10.1.0.0 vpnsplit allow 255.255.0.0 172.16.22.0 255.255.255.0
  access extensive list ip 10.1.10.0 encrypt_acl allow 255.255.255.0 10.0.0.0 255.255.255.0
  permit encrypt_acl to access extended list ip 10.1.1.0 255.255.255.0 10.0.0.0 255.255.255.0
  global_mpc list extended access permitted tcp a whole
  access-list encrypt_acl-30 scope ip 10.1.10.0 allow 255.255.255.0 10.1.8.0 255.255.255.0
  access-list encrypt_acl-30 permit extended ip 10.1.1.0 255.255.255.0 10.1.8.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 dmz
  management of MTU 1500
  IP local pool vpnpool 172.16.22.1 - 172.16.22.254 mask 255.255.255.0
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any inside
  ASDM image disk0: / asdm - 61551.bin
  don't allow no asdm history
  ARP timeout 14400
  Global (outside) 10 209.X.X.X netmask 255.255.255.0
  Global interface (10 Interior)
  Global interface (dmz) 10
  NAT (inside) 0 access-list sheep
  NAT (inside) 10 0.0.0.0 0.0.0.0
  NAT (dmz) 10 0.0.0.0 0.0.0.0
  static (dmz, external) 209.X.X.X 10.2.2.2 netmask 255.255.255.255
  static (inside, outside) 209.X.X.X 10.1.1.11 netmask 255.255.255.255
  static (dmz, inside) 10.2.2.2 10.2.2.2 netmask 255.255.255.255
  static (inside, dmz) 10.1.1.11 10.1.1.11 netmask 255.255.255.255
  static (inside, dmz) 10.1.1.50 10.1.1.50 netmask 255.255.255.255
  Access-group interface incoming outside
  Access-group in interface dmz dmz
  Route outside 0.0.0.0 0.0.0.0 209.X.X.X 1
  Route inside 10.1.0.0 255.255.0.0 10.1.255.249 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  Ray of AAA-server vpn Protocol
  AAA-server vpn (inside) host 10.1.1.12
  key--> ZZZZZZ
  the ssh LOCAL console AAA authentication
  AAA authentication LOCAL telnet console
  local AAA authentication attempts 16 max in case of failure
  Enable http server
  http 172.16.22.0 255.255.255.0 inside
  http 10.1.0.0 255.255.0.0 inside
  No snmp server location
  No snmp Server contact
  Sysopt noproxyarp inside
  Sysopt noproxyarp dmz
  Sysopt noproxyarp management
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set esp-3des esp-md5-hmac HQset
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  Crypto-map dynamic outside_dyn_map 10 the transform-set ESP-3DES-MD5 value
  life together - the association of security crypto dynamic-map outside_dyn_map 10 28800 seconds
  Crypto-map dynamic outside_dyn_map 10 kilobytes of life together - the association of safety 4608000
  Crypto-map dynamic outside_dyn_map 10 the value reverse-road
  card crypto outside_map 20 match address encrypt_acl
  card crypto outside_map 20 game peers 67.42.X.X
  outside_map 20 game of transformation-HQset crypto card
  life safety association set card crypto outside_map 20 28800 seconds
  card crypto outside_map 20 set security-association life kilobytes 4608000
  card crypto 30 match address encrypt_acl-30 outside_map
  crypto outside_map 30 peer 65.102.X.X card game
  crypto outside_map 30 card value transform-set HQset
  86400 seconds, duration of life card crypto outside_map 30 set - the security association
  card crypto outside_map 30 set security-association life kilobytes 4608000
  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  md5 hash
  Group 2
  life 86400
  Crypto isakmp nat-traversal 50
  Telnet 10.1.0.0 255.255.0.0 inside
  Telnet timeout 15
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH 10.1.0.0 255.255.0.0 inside
  SSH timeout 30
  Console timeout 0
  management-access inside
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  threat scan-threat detection
  threat detection statistics
  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
  Server NTP 192.43.244.18
  WebVPN
  allow outside
  SVC disk0:/anyconnect-win-2.3.0254-k9.pkg 1 image
  enable SVC
  tunnel-group-list activate
  internal Clients_VPN group strategy
  Group Policy Clients_VPN attributes
  value of server WINS 10.1.1.12
  value of server DNS 10.1.1.12
  Protocol-tunnel-VPN IPSec
  enable IPSec-udp
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list vpnsplit
  value by default-field COMPfirm.local
  Split-dns value COMPfirm.local
  the address value vpnpool pools
  internal clientgroup group policy
  attributes of the strategy of group clientgroup
  value of server WINS 10.1.1.12
  value of server DNS 10.1.1.12
  VPN-tunnel-Protocol svc webvpn
  Split-tunnel-policy tunnelall
  WebVPN
  SVC Dungeon-Installer installed
  time to generate a new key of SVC 30
  SVC generate a new method ssl key
  SVC request no svc default
  ssluser1 encrypted password username
  username bcurtis encrypted password privilege 0 v
  username privilege 15 WPDR encrypted password
  username admin privilege 15 encrypted password
  username privilege password encrypted XXXXXXX 0
  tunnel-group M & J type remote access
  tunnel-group M & J - global attributes
  address vpnpool pool
  Vpn server authentication group
  strategy - by default-group Clients_VPN
  tunnel-group M & J ipsec-attributes
  pre-shared-key *.
  type tunnel-group sslgroup remote access
  tunnel-group sslgroup General-attributes
  address vpnpool pool
  Vpn server authentication group
  Group Policy - by default-clientgroup
  tunnel-group sslgroup webvpn-attributes
  activation of the Group sslgroup_users alias
  tunnel-group 67.42.X.X type ipsec-l2l
  IPSec-attributes tunnel-group 67.42.X.X
  pre-shared-key *.
  tunnel-group 65.102.X.X type ipsec-l2l
  IPSec-attributes tunnel-group 65.102.X.X
  pre-shared-key *.
  !
  Global class-card class
  corresponds to the global_mpc access list
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns migrated_dns_map_1
  parameters
  message-length maximum 768
  Policy-map global_policy
  class inspection_default
  inspect the migrated_dns_map_1 dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Global category
  IPS inline sensor vs0 relief
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:ZZZZZZZZZZZZZZZZZZZZZ
  : end

  Is the problem may be due to the fact that my 2 new ACL to fall "encrypt_acl-30" after "access-list extended global_mpc permit tcp any any" in the config and it flows into the implied all refuse?

  Thanks for looking at this.

  Rather than replace the static route, you can simply add a new static route to 10.1.8.0/24 as follows:

  outdoor 10.1.8.0 255.255.255.0 209.X.X.X 1

  Because it is more precise it will take precedence over your most generic static route from 10.1.0.0/16 inward.

  Good spot btw!

• UC520 VPN Site-to-Site

  Hi all

  I have a very weird problem (at least for me)

  I have a UC520 connected to an ASA5510 via the VPN Site to Site.

  I can ping from clients behind customer UC520 behind ASA5510.

  I can ping from clients behind ASA5510 customer behind UC520

  I can access services (such as RDP) clients behind customer UC520 behind ASA5510

  I can't go to services (such as RDP, HTTP) clients behind customer ASA5510 behind UC520

  Does anyone have an idea where I should look? I tried to remove any access list by (temporarily) to a permit ip everything any line in these.

  I think it must be some sort of NAT problem, but I'm not sure.

  Thanks in advance

  You said your UC logs revealed nothing trying to connect a.11 et.12, this means that traffic is never achieved to the CPU at all, got to the UC and was abandoned before entering the LAN or traffic got to the hosts but never returned.

  Internal hosts to other outgoing routes defined on them (unlikely but possible), and you can check that traffic is through the UC outside interface at least?

• Cisco ASA 5505 VPN Site to Site

  Hi all

  First post on the forums. I have worked with Cisco ASA 5505 for a few months and I recently bought a 2nd ASA to implement tunnel VPN Site to Site. It seems so simple in the number of videos watched on the internet. But when I did he surprise it did work for me... I've removed the tunnels, a number of times and tried to recreate. I use the VPN Wizard in the SMA to create the tunnel. Both the asa 5505 of are and have the same firmware even etc..

  I'd appreciate any help that can be directed to this problem please.  Slowly losing my mind

  Please see details below:

  Two ADMS are 7.1

  IOS

  ASA 1

  Nadia

  :

  ASA Version 9.0 (1)

  !

  hostname PAYBACK

  activate the encrypted password of HSMurh79NVmatjY0

  volatile xlate deny tcp any4 any4

  volatile xlate deny tcp any4 any6

  volatile xlate deny tcp any6 any4

  volatile xlate deny tcp any6 any6

  volatile xlate deny udp any4 any4 eq field

  volatile xlate deny udp any4 any6 eq field

  volatile xlate deny udp any6 any4 eq field

  volatile xlate deny udp any6 any6 eq field

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  local pool VPN1 192.168.50.1 - 192.168.50.254 255.255.255.0 IP mask

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  link Trunk Description of SW1

  switchport trunk allowed vlan 1,10,20,30,40

  switchport trunk vlan 1 native

  switchport mode trunk

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  No nameif

  no level of security

  no ip address

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 92.51.193.158 255.255.255.252

  !

  interface Vlan10

  nameif inside

  security-level 100

  IP 192.168.10.1 255.255.255.0

  !

  interface Vlan20

  nameif servers

  security-level 100

  address 192.168.20.1 255.255.255.0

  !

  Vlan30 interface

  nameif printers

  security-level 100

  192.168.30.1 IP address 255.255.255.0

  !

  interface Vlan40

  nameif wireless

  security-level 100

  192.168.40.1 IP address 255.255.255.0

  !

  connection line banner welcome to the Payback loyalty systems

  boot system Disk0: / asa901 - k8.bin

  passive FTP mode

  summer time clock GMT/IDT recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS lookup field inside

  domain-lookup DNS servers

  DNS lookup domain printers

  DNS domain-lookup wireless

  DNS server-group DefaultDNS

  Server name 83.147.160.2

  Server name 83.147.160.130

  permit same-security-traffic inter-interface

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  ftp_server network object

  network of the Internal_Report_Server object

  Home 192.168.20.21

  Description address internal automated report server

  network of the Report_Server object

  Home 89.234.126.9

  Description of server automated reports

  service object RDP

  service destination tcp 3389 eq

  Description RDP to the server

  network of the Host_QA_Server object

  Home 89.234.126.10

  Description QA host external address

  network of the Internal_Host_QA object

  Home 192.168.20.22

  host of computer virtual Description for QA

  network of the Internal_QA_Web_Server object

  Home 192.168.20.23

  Description Web Server in the QA environment

  network of the Web_Server_QA_VM object

  Home 89.234.126.11

  Server Web Description in the QA environment

  service object SQL_Server

  destination eq 1433 tcp service

  network of the Demo_Server object

  Home 89.234.126.12

  Description server set up for the product demo

  network of the Internal_Demo_Server object

  Home 192.168.20.24

  Internal description of the demo server IP address

  network of the NETWORK_OBJ_192.168.20.0_24 object

  subnet 192.168.20.0 255.255.255.0

  network of the NETWORK_OBJ_192.168.50.0_26 object

  255.255.255.192 subnet 192.168.50.0

  network of the NETWORK_OBJ_192.168.0.0_16 object

  Subnet 192.168.0.0 255.255.0.0

  service object MSSQL

  destination eq 1434 tcp service

  MSSQL port description

  VPN network object

  192.168.50.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_192.168.50.0_24 object

  192.168.50.0 subnet 255.255.255.0

  service object TS

  tcp destination eq 4400 service

  service of the TS_Return object

  tcp source eq 4400 service

  network of the External_QA_3 object

  Home 89.234.126.13

  network of the Internal_QA_3 object

  Home 192.168.20.25

  network of the Dev_WebServer object

  Home 192.168.20.27

  network of the External_Dev_Web object

  Home 89.234.126.14

  network of the CIX_Subnet object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.10.0_24 object

  192.168.10.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_84.39.233.50 object

  Home 84.39.233.50

  network of the NETWORK_OBJ_92.51.193.158 object

  Home 92.51.193.158

  network of the NETWORK_OBJ_192.168.100.0_24 object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.1.0_24 object

  subnet 192.168.1.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_1

  the tcp destination eq ftp service object

  the purpose of the tcp destination eq netbios-ssn service

  the purpose of the tcp destination eq smtp service

  service-object TS

  the Payback_Internal object-group network

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.20.0 255.255.255.0

  object-network 192.168.40.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_3

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  service-object TS

  service-object, object TS_Return

  object-group service DM_INLINE_SERVICE_4

  service-object RDP

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  object-group service DM_INLINE_SERVICE_5

  purpose purpose of the MSSQL service

  service-object RDP

  service-object TS

  object-group Protocol TCPUDP

  object-protocol udp

  object-tcp protocol

  object-group service DM_INLINE_SERVICE_6

  service-object TS

  service-object, object TS_Return

  the purpose of the service tcp destination eq www

  the purpose of the tcp destination eq https service

  Note to outside_access_in to access list that this rule allows Internet the interal server.

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-list of FTP access

  Comment from outside_access_in-RDP access list

  Comment from outside_access_in-list of SMTP access

  Note to outside_access_in to access list Net Bios

  Comment from outside_access_in-SQL access list

  Comment from outside_access_in-list to access TS - 4400

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_1 any4 Internal_Report_Server

  access host access-list outside_access_in note rule internal QA

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-HTTP access list

  Comment from outside_access_in-RDP access list

  outside_access_in list extended access permitted tcp any4 object Internal_Host_QA eq www

  Notice on the outside_access_in of the access-list access to the internal Web server:

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-HTTP access list

  Comment from outside_access_in-RDP access list

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_3 any4 Internal_QA_Web_Server

  Note to outside_access_in to access list rule allowing access to the demo server

  Notice on the outside_access_in of the access-list allowed:

  Comment from outside_access_in-RDP access list

  Comment from outside_access_in-list to access MSSQL

  outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_4 any4 Internal_Demo_Server

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_5 any object Internal_QA_3

  Note to outside_access_in access to the development Web server access list

  outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_6 any object Dev_WebServer

  AnyConnect_Client_Local_Print deny any4 any4 ip extended access list

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq lpd

  Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 631

  print the access-list AnyConnect_Client_Local_Print Note Windows port

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 9100

  access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

  AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.251 any4 eq 5353

  AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

  AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.252 any4 eq 5355

  Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

  AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 EQ. 137

  AnyConnect_Client_Local_Print list extended access permitted udp any4 any4 eq netbios-ns

  Payback_VPN_splitTunnelAcl list standard access allowed 192.168.20.0 255.255.255.0

  permit outside_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0

  pager lines 24

  Enable logging

  information recording console

  asdm of logging of information

  address record

  [email protected] / * /.

  the journaling recipient

  [email protected] / * /.

  level alerts

  Outside 1500 MTU

  Within 1500 MTU

  MTU 1500 servers

  MTU 1500 printers

  MTU 1500 wireless

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm-711 - 52.bin

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) source Dynamics one interface

  NAT (wireless, outdoors) source Dynamics one interface

  NAT (servers, outside) no matter what source dynamic interface

  NAT (servers, external) static source Internal_Report_Server Report_Server

  NAT (servers, external) static source Internal_Host_QA Host_QA_Server

  NAT (servers, external) static source Internal_QA_Web_Server Web_Server_QA_VM

  NAT (servers, external) static source Internal_Demo_Server Demo_Server

  NAT (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

  NAT (servers, external) static source Internal_QA_3 External_QA_3

  NAT (servers, external) static source Dev_WebServer External_Dev_Web

  NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 92.51.193.157 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL
  the ssh LOCAL console AAA authentication
  Enable http server
  http 192.168.10.0 255.255.255.0 inside
  http 192.168.40.0 255.255.255.0 wireless
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto outside_map 1 match address outside_cryptomap
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 84.39.233.50
  card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 5
  FRP sha
  second life 86400
  Crypto ikev2 activate out of service the customer port 443
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH 77.75.100.208 255.255.255.240 outside
  SSH 192.168.10.0 255.255.255.0 inside
  SSH 192.168.40.0 255.255.255.0 wireless
  SSH timeout 5
  Console timeout 0

  dhcpd 192.168.0.1 dns
  dhcpd outside auto_config
  !
  dhcpd address 192.168.10.21 - 192.168.10.240 inside
  dhcpd dns 192.168.20.21 83.147.160.2 interface inside
  paybackloyalty.com dhcpd option 15 inside ascii interface
  dhcpd allow inside
  !
  dhcpd address 192.168.40.21 - 192.168.40.240 Wireless
  dhcpd dns 192.168.20.21 83.147.160.2 wireless interface
  dhcpd update dns of the wireless interface
  dhcpd option 15 ascii paybackloyalty.com wireless interface
  dhcpd activate wireless
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal Payback_VPN group strategy
  attributes of Group Policy Payback_VPN
  VPN - 10 concurrent connections
  Ikev1 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list Payback_VPN_splitTunnelAcl
  attributes of Group Policy DfltGrpPolicy
  value of 83.147.160.2 DNS server 83.147.160.130
  VPN-tunnel-Protocol ikev1, ikev2 clientless ssl
  internal GroupPolicy_84.39.233.50 group strategy
  attributes of Group Policy GroupPolicy_84.39.233.50
  VPN-tunnel-Protocol ikev1, ikev2
  Noelle XB/IpvYaATP.2QYm username encrypted password
  Noelle username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username Éanna encrypted password privilege 0 vXILR9ZZQIsd1Naw
  Éanna attributes username
  VPN-group-policy Payback_VPN
  type of remote access service
  Michael qpbleUqUEchRrgQX of encrypted password username
  user name Michael attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username, password from Danny .7fEXdzESUk6S/cC encrypted privilege 0
  user name Danny attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Aileen tytrelqvV5VRX2pz encrypted password privilege 0 username
  user name Aileen attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Aidan aDu6YH0V5XaxpEPg encrypted password privilege 0 username
  Aidan username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
  shane.c iqGMoWOnfO6YKXbw encrypted password username
  username shane.c attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Shane uYePLcrFadO9pBZx of encrypted password username
  user name Shane attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  username, encrypted James TdYPv1pvld/hPM0d password
  user name James attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Mark yruxpddqfyNb.qFn of encrypted password username
  user name brand attributes
  type of service admin
  username password of Mary XND5FTEiyu1L1zFD encrypted
  user name Mary attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  Massimo vs65MMo4rM0l4rVu encrypted password privilege 0 username
  Massimo username attributes
  VPN-group-policy Payback_VPN
  type of remote access service
  type tunnel-group Payback_VPN remote access
  attributes global-tunnel-group Payback_VPN
  VPN1 address pool
  Group Policy - by default-Payback_VPN
  IPSec-attributes tunnel-group Payback_VPN
  IKEv1 pre-shared-key *.
  tunnel-group 84.39.233.50 type ipsec-l2l
  tunnel-group 84.39.233.50 General-attributes
  Group - default policy - GroupPolicy_84.39.233.50
  IPSec-attributes tunnel-group 84.39.233.50
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  Global class-card class
  match default-inspection-traffic
  !
  !
  World-Policy policy-map
  Global category
  inspect the dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the pptp
  inspect the rsh
  inspect the rtsp
  inspect the sip
  inspect the snmp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect xdmcp
  inspect the icmp error
  inspect the icmp
  !
  service-policy-international policy global
  192.168.20.21 SMTP server
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1

  ASA 2

  ASA Version 9.0 (1)

  !

  Payback-CIX hostname

  activate the encrypted password of HSMurh79NVmatjY0

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Ethernet0/0

  switchport access vlan 2

  Speed 100

  full duplex

  !

  interface Ethernet0/1

  Description this port connects to the local network VIRTUAL 100

  switchport access vlan 100

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  switchport access vlan 100

  !

  interface Ethernet0/4

  switchport access vlan 100

  !

  interface Ethernet0/5

  switchport access vlan 100

  !

  interface Ethernet0/6

  switchport access vlan 100

  !

  interface Ethernet0/7

  switchport access vlan 100

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP 84.39.233.50 255.255.255.240

  !

  interface Vlan100

  nameif inside

  security-level 100

  IP 192.168.100.1 address 255.255.255.0

  !

  banner welcome to Payback loyalty - CIX connection line

  passive FTP mode

  summer time clock gmt/idt recurring last Sun Mar 01:00 last Sun Oct 02:00

  DNS domain-lookup outside

  DNS lookup field inside

  DNS server-group defaultDNS

  Name-Server 8.8.8.8

  Server name 8.8.4.4

  permit same-security-traffic inter-interface

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  network of the host-CIX-1 object

  host 192.168.100.2

  Description This is the VM server host machine

  network object host-External_CIX-1

  Home 84.39.233.51

  Description This is the external IP address of the server the server VM host

  service object RDP

  source between 1-65535 destination eq 3389 tcp service

  network of the Payback_Office object

  Home 92.51.193.158

  service object MSQL

  destination eq 1433 tcp service

  network of the Development_OLTP object

  Home 192.168.100.10

  Description for Eiresoft VM

  network of the External_Development_OLTP object

  Home 84.39.233.52

  Description This is the external IP address for the virtual machine for Eiresoft

  network of the Eiresoft object

  Home 146.66.160.70

  Contractor s/n description

  network of the External_TMC_Web object

  Home 84.39.233.53

  Description Public address to the TMC Web server

  network of the TMC_Webserver object

  Home 192.168.100.19

  Internal description address TMC Webserver

  network of the External_TMC_OLTP object

  Home 84.39.233.54

  External targets OLTP IP description

  network of the TMC_OLTP object

  Home 192.168.100.18

  description of the interal target IP address

  network of the External_OLTP_Failover object

  Home 84.39.233.55

  IP failover of the OLTP Public description

  network of the OLTP_Failover object

  Home 192.168.100.60

  Server failover OLTP description

  network of the servers object

  subnet 192.168.20.0 255.255.255.0

  being Wired network

  192.168.10.0 subnet 255.255.255.0

  the subject wireless network

  192.168.40.0 subnet 255.255.255.0

  network of the NETWORK_OBJ_192.168.100.0_24 object

  255.255.255.0 subnet 192.168.100.0

  network of the NETWORK_OBJ_192.168.10.0_24 object

  192.168.10.0 subnet 255.255.255.0

  network of the Eiresoft_2nd object

  Home 137.117.217.29

  Description 2nd Eiresoft IP

  network of the Dev_Test_Webserver object

  Home 192.168.100.12

  Description address internal to the Test Server Web Dev

  network of the External_Dev_Test_Webserver object

  Home 84.39.233.56

  Description This is the PB Dev Test Webserver

  network of the NETWORK_OBJ_192.168.1.0_24 object

  subnet 192.168.1.0 255.255.255.0

  object-group service DM_INLINE_SERVICE_1

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_2

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_3

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_4

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_5

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_6

  service-object MSQL

  service-object RDP

  the Payback_Intrernal object-group network

  object-network servers

  Wired network-object

  wireless network object

  object-group service DM_INLINE_SERVICE_7

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_8

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_9

  service-object MSQL

  service-object RDP

  object-group service DM_INLINE_SERVICE_10

  service-object MSQL

  service-object RDP

  the tcp destination eq ftp service object

  object-group service DM_INLINE_SERVICE_11

  service-object RDP

  the tcp destination eq ftp service object

  outside_access_in list extended access allow object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-host-1

  Note to access list OLTP Development Office of recovery outside_access_in

  outside_access_in list extended access allow DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP object-group

  Comment from outside_access_in-access Eiresoft access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver object-group

  Note to outside_access_in access to OLTP for target recovery Office Access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover object-group

  Note to outside_access_in access-list that's allowing access of the Eiresoft on the failover OLTP server

  outside_access_in list extended access allow DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover object-group

  Comment from outside_access_in-access list access for the 2nd period of INVESTIGATION of Eiresoft

  outside_access_in list extended access allow DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP object-group

  Note to outside_access_in access from the 2nd IP Eiresoft access list

  outside_access_in list extended access allow DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver object-group

  outside_access_in list extended access allow DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP object-group

  outside_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) source Dynamics one interface

  NAT (inside, outside) static source CIX-host-1 External_CIX-host-1

  NAT (inside, outside) static source Development_OLTP External_Development_OLTP

  NAT (inside, outside) static source TMC_Webserver External_TMC_Web

  NAT (inside, outside) static source TMC_OLTP External_TMC_OLTP

  NAT (inside, outside) static source OLTP_Failover External_OLTP_Failover

  NAT (inside, outside) static source Dev_Test_Webserver External_Dev_Test_Webserver

  NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 84.39.233.49 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  the ssh LOCAL console AAA authentication

  Enable http server

  http 92.51.193.156 255.255.255.252 outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac

  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit

  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac

  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit

  Crypto ipsec ikev2 ipsec-proposal OF

  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto outside_map 1 match address outside_cryptomap
  card crypto outside_map 1 set pfs
  peer set card crypto outside_map 1 92.51.193.158
  card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 1jeu ikev2 AES AES192 AES256 3DES ipsec-proposal
  outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH 77.75.100.208 255.255.255.240 outside
  SSH 92.51.193.156 255.255.255.252 outside
  SSH timeout 5
  Console timeout 0

  dhcpd outside auto_config
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal GroupPolicy_92.51.193.158 group strategy
  attributes of Group Policy GroupPolicy_92.51.193.158
  VPN-tunnel-Protocol ikev1, ikev2
  username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
  tunnel-group 92.51.193.158 type ipsec-l2l
  tunnel-group 92.51.193.158 General-attributes
  Group - default policy - GroupPolicy_92.51.193.158
  IPSec-attributes tunnel-group 92.51.193.158
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
  : end

  Hello

  There are some clear problems I see on a quick glance. These are not related to the actual VPN configuration but rather the NAT configurations.

  All your configuration of NAT CLI format above are configured as manual NAT / double NAT in Section 1. This means that the appliance NAT configurations have been added to the same section of the NAT configurations and scheduling of the NAT inside this Section rules is the cause of the problem for the L2L VPN connection for some.

  Here are a few suggestions on what to change

  ASA1

  Minimal changes

  the object of the LAN network

  192.168.10.0 subnet 255.255.255.0

  being REMOTE-LAN network

  255.255.255.0 subnet 192.168.100.0

  NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

  That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

  Finally, we remove the old rule that generated the ASDM. It would do the same thing if it has been moved to the top, but I generally find the creation of the 'object' with descriptive names easier on the eyes in the long term.

  Other suggestions

  These changes are not necessary with regard to the VPN L2L. Here are some suggestions how to clean a part of NAT configurations.

  PAT-SOURCE network object-group

  source networks internal PAT Description

  object-network 192.168.10.0 255.255.255.0

  object-network 192.168.20.0 255.255.255.0

  object-network 192.168.40.0 255.255.255.0

  NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

  No source (indoor, outdoor) nat Dynamics one interface

  no nat (wireless, outdoors) source Dynamics one interface

  no nat (servers, outside) no matter what source dynamic interface

  The above configuration creates a "object-group" that lists all internal networks that you have dynamic PAT configured so far. It then uses the ' object-group ' in a command unique 'nat' to manage the dynamic PAT for all internal networks (with the exception of printers who had nothing at first). Then we remove the old PAT dynamic configurations.

  Contains the command "nat" "car after" because it moving this "nat" configuration to the bottom of the NAT rules. For this reason its less likely to cause problems in the future.

  network of the SERVERS object

  subnet 192.168.20.0 255.255.255.0

  network of the VPN-POOL object

  192.168.50.0 subnet 255.255.255.0

  NAT (servers, external) 2 static static source of destination of SERVERS SERVERS VPN-VPN-POOL

  no nat (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

  The above configuration is supposed to create a NAT0 configuration for traffic between the network and the pool of Client VPN server. To my knowledge the old configuration that remove us is not used because the traffic would have matched PAT rule dynamic server yet rather than this rule which is later in the NAT configurations and would not be addressed.

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

  ASA2

  Minimal changes

  the object of the LAN network

  255.255.255.0 subnet 192.168.100.0

  being REMOTE-LAN network

  192.168.10.0 subnet 255.255.255.0

  NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

  That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

  Finally, we remove the old rule that generated the ASDM.

  Other suggestions

  PAT-SOURCE network object-group

  object-network 192.168.100.0 255.255.255.0

  NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

  No source (indoor, outdoor) nat Dynamics one interface

  The above configuration is supposed to do the same thing with the other ASA. Although given that this network contains only a single subnet it cleans the "nat" configurations exist that much. But the order of the "nat" configurations is changed to avoid further problems with the NAT order.

  no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

  It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

  I suggest trying the changes related to VPN L2L first NAT0 configurations and test traffic. So who gets the work of connectivity, then you could consider changing other NAT configurations. There are other things that could be changed also in what concerns THAT static NAT servers but that probably better left for another time.

  Hope this makes any sense and has helped

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• VPN site to Site from one-way data (need help)

  Hello

  Scenario:

  VPN site to Site with Cisco 837 routers:

  Place: Clients and printers

  Site B: server queues and Print

  Site A can communicate via VPN using RDP to site B, very well.

  Question:

  Site B cannot send print jobs to printers on the Site A. also unable to telnet and other access devices on the Site A of the Site (B) Pings work correctly but to all devices.

  Debugging on site an access-list 110 showed no response traffic to the Site B via the VPN?

  I tried change ip tcp adjust 1452 but not good...

  Attached configs.

  An IOS - c837-k9o3y6 - mz.123 - 4.T3.bin site

  SITE B IOS - c837-k9o3sy6 - mz.123 - 2.XC2.bin

  Any help would be appreciated.

  Thank you very much...

  Thank you for including the configs and IOS versions. Looks like you hit a bug known to FW IOS (http://www.cisco.com/cgi-bin/Support/Bugtool/onebug.pl?bugid=CSCec78231&Submit=Search), you can perform debugging as described in details to see for sure. It is difficult to understand what router would be the culprit in a scenario when both run on a tunnel L2L CBAC, but probably RouterA is dropping packets. This would also explain why pings work but TCP connections are not.

  I would upgrade TWO routers to be the same version anyway, you encounter far fewer problems in this way, but make sure that you upgrade to one fixed-In version (or later version), has to work around the problem.

• VPN site to Site with restrictions (vpn-filter)

  VPN site to site, I installed and it works fine and two site can meet but I question after the vpn enforcement - run under Group Policy

  restrict users in the local site for dial-up networking with specific tcp ports, the vpn does not not like after order question «sh l2l vpn-sessiondb»

  This works but users can't access something in the remote site

  Note > after rising online in ACL at the end with this

  US_SITE ip access list allow a whole

  new to works well again

  example of a line of Access-List

  US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.23 HTTP_HTTPS object-group
  US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.24 HTTP_HTTPS object-group

  local network: 10.68.22.50

  remote network: 192.168.10.24

  is that correct or not?

  attributes of the strategy group x.x.x.x
  value of VPN-filer US_SITE

  tunnel-group General y.y.y.y
  x.x.x.x by default-group-policy

  Note: allowed sysopt active vpn connection

  The syntax on ACL that is used as a vpn-filter is different from what is normally expected. These VPN filters is not a direction, it should be noted the traffic we want to allow incoming and outgoing of the VPN in an ACL. The syntax for this is:

  access-list X permit/deny REMOTE-DEFINITION LOCAL-DEFINITION

  Example: You want to allow local users to access the RDP on the remote site:

  access-list VPN-ACL permit tcp host 192.168.10.24 eq 3389 10.68.22.0 255.255.255.0

  Disadvantage: This is all really confusing, and you can't afford things like Ping in one direction.

• Problem with the VPN site to site for the two cisco asa 5505

  Starting with cisco asa. I wanted to do a vpn site-to site of cisco. I need help. I can't ping from site A to site B and vice versa.

  Cisco Config asa1

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 172.xxx.xx.4 255.255.240.0
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.60.2 255.255.255.0
  !
  passive FTP mode
  network of the Lan_Outside object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  Access extensive list ip 192.168.60.0 Outside_cryptomap allow 255.255.255.0 192.168.1.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_2 of object-group a
  network of the Lan_Outside object
  NAT (inside, outside) interface dynamic dns
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 172.110.xx.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.60.0 255.255.255.0 inside
  http 96.xx.xx.222 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 96.88.75.222
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  inside access management

  dhcpd address 192.168.60.50 - 192.168.60.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_96.xx.xx.222 group strategy
  attributes of Group Policy GroupPolicy_96.xx.xx.222
  VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 96.xx.xx.222 type ipsec-l2l
  tunnel-group 96.xx.xx.222 General-attributes
  Group - default policy - GroupPolicy_96.xx.xx.222
  96.XX.XX.222 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error

  ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

  Cisco ASA 2 config

  interface Ethernet0/0
  switchport access vlan 1
  !
  interface Ethernet0/1
  switchport access vlan 2
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address 96.xx.xx.222 255.255.255.248
  !
  interface Vlan2
  nameif inside
  security-level 100
  IP 192.168.1.254 255.255.255.0
  !
  passive FTP mode
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  network of the Lan_Outside object
  subnet 192.168.1.0 255.255.255.0
  network of the NETWORK_OBJ_192.168.60.0_24 object
  192.168.60.0 subnet 255.255.255.0
  network of the NETWORK_OBJ_192.168.1.0_24 object
  subnet 192.168.1.0 255.255.255.0
  object-group Protocol DM_INLINE_PROTOCOL_1
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_2
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_3
  ip protocol object
  icmp protocol object
  object-group Protocol DM_INLINE_PROTOCOL_4
  ip protocol object
  icmp protocol object
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_2 of object-group 192.168.1.0 255.255.255.0 192.168.60.0 255.255.255.0
  Outside_cryptomap list extended access allow DM_INLINE_PROTOCOL_3 of object-group a
  Outside_access_in list extended access allow DM_INLINE_PROTOCOL_1 of object-group a
  Inside_access_in list extended access allow DM_INLINE_PROTOCOL_4 of object-group a
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) static source NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.60.0_24 NETWORK_OBJ_192.168.60.0_24 non-proxy-arp-search of route static destination
  !
  network of the Lan_Outside object
  dynamic NAT (all, outside) interface
  Access-group Outside_access_in in interface outside
  Inside_access_in access to the interface inside group
  Route outside 0.0.0.0 0.0.0.0 96.xx.xx.217 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication http LOCAL console
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  http 172.xxx.xx.4 255.255.255.255 outside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
  Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
  Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
  Crypto ipsec ikev2 ipsec-proposal OF
  encryption protocol esp
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 proposal ipsec 3DES
  Esp 3des encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES
  Esp aes encryption protocol
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 ipsec-proposal AES192
  Protocol esp encryption aes-192
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec ikev2 AES256 ipsec-proposal
  Protocol esp encryption aes-256
  Esp integrity sha - 1, md5 Protocol
  Crypto ipsec pmtu aging infinite - the security association
  card crypto Outside_map 1 corresponds to the address Outside_cryptomap
  card crypto Outside_map 1 set peer 172.110.74.4
  card crypto Outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  card crypto Outside_map 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
  Outside_map interface card crypto outside
  trustpool crypto ca policy
  IKEv2 crypto policy 1
  aes-256 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 10
  aes-192 encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 20
  aes encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 30
  3des encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  IKEv2 crypto policy 40
  the Encryption
  integrity sha
  Group 2 of 5
  FRP sha
  second life 86400
  Crypto ikev2 allow outside
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0

  dhcpd address 192.168.1.50 - 192.168.1.100 inside
  dhcpd allow inside
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  WebVPN
  AnyConnect essentials
  internal GroupPolicy_172.xxx.xx.4 group strategy
  attributes of Group Policy GroupPolicy_172.xxx.xx.4
  L2TP ipsec VPN-tunnel-Protocol ikev1, ikev2
  username admin privilege 15 encrypted password f3UhLvUj1QsXsuK7
  tunnel-group 172.xxx.xx.4 type ipsec-l2l
  tunnel-group 172.xxx.xx.4 General-attributes
  Group - default policy - GroupPolicy_172.xxx.xx.4
  172.xxx.XX.4 group of tunnel ipsec-attributes
  IKEv1 pre-shared-key *.
  remote control-IKEv2 pre-shared-key authentication *.
  pre-shared-key authentication local IKEv2 *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the icmp
  inspect the icmp error
  inspect the http

  For IKEv2 configuration: (example config, you can change to encryption, group,...)

  -You must add the declaration of exemption nat (see previous answer).

  -set your encryption domain ACLs:

  access-list-TRAFFIC IPSEC allowed extended LOCAL REMOTE - LAN LAN ip

  -Set the Phase 1:

  Crypto ikev2 allow outside
  IKEv2 crypto policy 10
  3des encryption
  the sha md5 integrity
  Group 5
  FRP sha
  second life 86400

  -Set the Phase 2:

  Crypto ipsec ikev2 ipsec IKEV2-PROPOSAL
  Esp aes encryption protocol
  Esp integrity sha-1 protocol

  -set the Group of tunnel

  tunnel-group REMOTE-PUBLIC-IP type ipsec-l2l
  REMOTE-PUBLIC-IP tunnel-group ipsec-attributes
  IKEv2 authentication remote pre-shared-key cisco123

  
  IKEv2 authentication local pre-shared-key cisco123

  -Define the encryption card

  address for correspondence CRYPTOMAP 10 - TRAFFIC IPSEC crypto map
  card crypto CRYPTOMAP 10 peer set REMOTE-PUBLIC-IP
  card crypto CRYPTOMAP 10 set ipsec ikev2-IKEV2-PROPOSAL
  CRYPTOMAP interface card crypto outside
  crypto isakmp identity address

  On your config, you have all these commands but on your VPN config, you mix ikev1 and ikev2. You have also defined political different ikev2. Just do a bit of cleaning and reached agreement on a 1 strategy for the two site (encryption, hash,...)

  Thank you

• VPN site to Site using the router and ASA

  Hello

  I have a Cisco 1812 router that is configured for remote access VPN using IPSec (Cisco VPN Client), my question is if I can configure a Cisco ASA 5505 to connect to the router as a VPN from site to site.

  Thank you

  Karl

  Dear Karl,

  Yor are right, in this case you can create a tunnel vpn site-to-site between devices or you can configure your ASA as hardware VPN client. That is to say; Easy VPN.

  For the same thing, you can consult the document below.

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml

  Kind regards

  Shijo.

• Clustering for VPN site-to-site VPN concentrator?

  Hi all

  I think the grouping of the Concentrator VPN configuration guide is only good for the VPN site-to-customer, that is to say that the grouping option cannot be deployed in VPN site-to-site of HA and load balancing?

  Thank you and best regards,

  MAK

  OK, the function was only ever for clients of SW and HW, not the L2L tunnels.

  L2L tunnels, you can configure the settings of tunnel on two of the hubs of the cluster and then just "defined by peer" two statements under the card encryption of the remote device, these statements point to each of the specific IP addresses hubs (not the cluster address).

  Does not give you true balance as do customers SW, but it gives you redundancy.

• Issue of ASA vpn site to site isakmp

  Hello

  He has been asked to configure on ASA a new vpn site-to-site. For that vpn should I put:

  crypto isakmp identity address
  crypto ISAKMP allow outside

  .. the configuration of my identity crypto isakmp is automatic and isakmp crypto is not enabled on any interface. I love vpn with ike enabled on the external interface. My question is: why should I enable isakmp on the external interface and especially can create disturbances to ike vpn that are already in place?

  By elsewhere-group or tunnel-group strategy, it was me asked to set up, the two do not have indication of ike. Never seen this kind of configuration before vpn, something new.

  Thank you

  Hi, Giuseppe.

  The crypto isakmp command activate outside changed ikev1 crypto Enable outside in the new ASA versions you need not enable this.

  There is also no need configure isakmp crypto identity address such that it is set to auto.

  This command indicates that the tunnel would be negotiated on the basis of the IP address but since it is set to auto it on it own will therefore not need to specify this command.

  Yes, you can create a new group policy group for this new tunnel and tunnel and there should be no impact on other tunnels of work.

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.

• VPN site to site UP, but no traffic

  Dear friends,

  I did a VPN site to site using ASA 5555 02 in each site running the Version of the software 9.2 (4).

  The VPN is UP, as shown below:

  ASA-SSP-Pri (config) # sh isak his

  There are no SAs IKEv1

  IKEv2 SAs:

  Session-id: 1, State: UP-ACTIVE, IKE County: 1, number of CHILDREN: 1

  Tunnel-id Local remote status role
  201.23.100.130/500 268373031 200.174.36.19/500 LOAN MACHINE
  BA: AES - CBC, keysize: 256, Hash: SHA96, Grp:5 DH, Auth sign: PSK, Auth check: PSK
  Duration of life/active: 86400/272 sec
  His child: selector local 10.69.0.0/0 - 10.69.0.255/65535
  selector of distance 10.12.20.0/0 - 10.12.20.255/65535
  SPI ESP/output: 0xf89430e6/0x86a5cd8f

  But when I try to ping from one site to another, is not possible, the result of the ping command is '?

  I did some research on this problem and a lot of people say that Miss crypto isakmp nat-traversal 20 command, but this command is already enabled.

  Exempt from NAT is enabled and I did tests of deactivation as well.

  Hello

  The last thing I think is that there is a SPINNAKER twice on the table of the asp and that is why the traffic is not encrypted everything seems correct, run the following command on the ASA:

  clear crypto ipsec its inactive

  test again