[VPN Site-to-Site] Network that overlap

Hello

We have a Cisco ASA 9.1 and many VPN clients that work very well to this topic.

Now, he must connect to a partner with VPN Site to Site site.

We have a few problems:

  • Duplication of IP address (we use 10.145.0.0/16 10.0.0.0/8 and partner use)
  • Partner cannot use NAT on the router

What are the best solutions to configure the VPN Site to Site?

Thanks for your help,

Patrick

Hi Patrick,

Best option here is that you can specify the required subnets only in the field of /encryption cryptomap...

said in other 10.0.0.0/8 need access only a few subnets 10.1.0.0/24, 10.10.20.0/24... You can specify only in your crypto acl... Alternatively, you can use refuse instruction for the specific 10.145.0.0/16 crypto card but am not sure if this gives you the best result.

If you have the required access is mixed with several 10.x.x.x/8 instructions... then you can have the crypto ACL like sub areas of encryption... Here you jump only 10.145.0.0/16 of the subnet range...

10.0.0.0/9 to 10.145.0.0/16
10.128.0.0/12 to 10.145.0.0/16
10.146.0.0/15 to 10.145.0.0/16
10.148.0.0/14 to 10.145.0.0/16
10.152.0.0/13 to 10.145.0.0/16
10.160.0.0/11 to 10.145.0.0/16

10.192.0.0/10 to 10.145.0.0/16

but make sure you have not all servers in 10.145.0.0/16 on your local network that the client requires access...

Link to have refuse to crypto ACL'; s

https://supportforums.Cisco.com/discussion/10909276/crypto-ACL-question

Concerning

Knockaert

Tags: Cisco Security

Similar Questions

  • Networks that overlap

    I had a configuration of tunnel for this within the network 192.168.141.0/24 to access the remote network of 10.90.238.148/24 that was in place and functioning.

    We had a few changes and added inside network 192.168.10.0/24 with the following statements from the road:

    Route 10.0.0.0 K_Inc 255.192.0.0 192.168.10.252 1 (10.0.0.0 - 10.63.255.255)

    Route K_Inc 10.64.0.0 255.224.0.0 192.168.10.252 1 (10.64.0.0 - 10.95.255.255)

    Route K_Inc 10.100.100.0 255.255.255.0 192.168.10.252 1 (10.100.100.0 - 10.100.100.255)

    Route K_Inc 10.128.0.0 255.128.0.0 192.168.10.252 1 (10.128.0.0 - 10.255.255.255)

    There was another VPN tunnel with a remote network of 10.99.225.0/24, which explains in part why the routes have been dispersed.

    10.90.238.148/24 is not respected

    What are my options?

    1 modify the 10.64.0.0/11 to a slash 12 route (as long as I have no local 10. addresses that will be affected)

    2. pat dynamics...?

    any thoughts?

    Hello

    If traffic destined to the 10.90.238.0/24 network which overlap reached the ASA at the present time, then probably you

    crypto set reverse-road map

    It would be a configuration line added to the VPN VPN in question L2L configuration that would generate automatically a static route to the ASA based on any remote network configured on the 'access list' which is used in the command

    address for correspondence card crypto

    If you have a network where one internal routers that have now been included a subnet that contains the remote network, then it would probably mean that traffic destined for the remote network would not reach the ASA at present.

    In this case, you might want to try to set up a specific static route on the router for the remote network of 10.90.238.0/24 to the ASA gateway to a possible network connected on the router would not affect the operation of this network remotely.

    Let know if I missed something with the specified configuration.

    Hope this helps

    -Jouni

  • Tunnel from site to site VPN that overlap within the network

    Hi all

    I need to connect 2 networks via a tunnel VPN site to site. On the one hand, there is a 506th PIX by the termination of the VPN. The other side, I'm not too sure yet.

    However, what I know, is that both sides of the tunnel using the exact same IP subnet 192.168.1.0/24.

    This creates a problem when I need to define the Routing and the others when it comes to VPN and what traffic should be secure etc.

    However, read a lot for the review of CERT. Adv. Cisco PIX and noticed that outside NAT can solve my 'small' problem.

    That's all it is said, but I'd really like to see an example of configuration of this or hear from someone who has implemented it.

    Anyone?

    Steffen

    How is it then?

    http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a00800949f1.shtml

  • Problem VPN site to Site with overlapping networks

    We currently have a PIX 515E firewall as a headboard with many tunnels of site-to-site configured for her with the enpoints of PIX 506. Our internal LAN addressing scheme is 172.18.0.0 255.255.0.0. Addresses of local network in two of the remote networks with congigured VPN site-to-site are 172.18.107.0 255.255.255.224 and 172.18.107.32 255.255.255.0. Remote network access to all services on our internal network very well. We have 20 other network segments configured the same way. The 172.18.107.32.0 network needs to communicate with the 172.18.107.0 network for the services of file on the other remote PIX. Since the station PIX will not allow traffic to leave the same interface it came we thought with him we would just set up a tunnel from site to site between the two remote LAN. After the configuration of the site to another remote firewalls do not appear to try to establish tunnels when sending valuable traffic. I turned on debug for ISAKMP and nothing is either sent or received on a remote Firewall with regard to these tunnels. It's almost like since we already have a tunnel set to our 172.18.0.0 internal LAN that the remote PIX will not build specifically to 172.18.107.0 tunnel. I am able to ping each remote peer with each other and hear protection rules, but nothing has ever been established.

    Is what we are trying to do possible? Sorry for the long post but the kind of a strange scenario. Thanks in advance for any help.

    In what order are the numbers of seqence card crypto for configuring vpn on pix distance units? It could be that you are trying to install is a lot and will be checked later as head of pix. If this is the case, then yes the 172.18/16 road prevail the 172.18.107/24. Try to rebuild the entrance card crypto with a lower number so that traffic to 172.18.107/24 comes first.

    I would like to know how it works.

  • VPN site to Site, LRT214, Windows network active directory DNS, WINS, and DHCP

    Hi guys

    New to the forum. I'm trying to set up a network between 2 sites (one site to another). Each location has a DC with its own protocol, dhcp, dns and wins on the same domain service. I bought 2 LRT214 to establish the connection between the 2 sites.

    I tried searching, but all results are pretty generic (IE assuming you will use the LRT214 as DNS DHCP etc.).

    I went through the pages of the router configuration, and there are so many options. For my particular configuration objectives, which will be the best way to do this? Open vpn? EasyLink vpn? I think I'd rather do a standard vpn configuration, but then for that I have a lot of questions such as: security methods to use (FROM THE, 3DES, SHA1, MD5, etc.). can I export a cert of AD and import to the router, or export from the router and import to AD?

    I know the questions are in all directions and there is much more that I don't specifically know until I get by configuring this router at both ends. Just trying to come up with an initial plan. I guess someone must have made a similar setup and would like to know what is a good start (maybe less safe to operate), and while I get more familiar and it all worked, start to down to safety.

    Is there maybe a guide who walks through this installation with explanations of each parameter type?

    Sorry for the long post and thanks for any direction.

    I suggest you use the gateway to gateway installation and use all default settings it for this time. To start, you can try this link: http://kb.linksys.com/Linksys/ukp.aspx?vw=1&docid=240cfc1d772642dfad1deb7500a2fa6c_Creating_an_IPSec...

  • VPN site-to-Site: several remote networks

    Examples of VPN Site to Site ASA configuration that I have met has only a single network at both sites.

    If the network/remote site multi-network for example DMZ1, DMZ2, etc. from the INSIDE how can it be added via the wizard of Site to Site VPN ASDM.

    Thank you.

    Hello

    I have not seen an example of specific configuration with the addition of several networks for tunnel l2l IPSEC via ASDM.

    Generally speaking, you would just follow the same process in the Sub URL, but add all the multiple networks local and remote networks that you want to be protected IPSEC.

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00805a87f7.shtml

    http://www.Cisco.com/en/us/docs/security/ASDM/6_1/user/guide/vpn_wiz.html#wp999348

    Kind regards

    Arul

    * Rate pls if it helps *.

  • remote VPN and vpn site to site vpn remote users unable to access the local network

    As per below config remote vpn and vpn site to site vpn remote users unable to access the local network please suggest me a required config

    The local 192.168.215.4 not able ping server IP this server connectivity remote vpn works fine but not able to ping to the local network vpn users.

    ASA Version 8.2 (2)
    !
    host name
    domain kunchevrolet
    activate r8xwsBuKsSP7kABz encrypted password
    r8xwsBuKsSP7kABz encrypted passwd
    names of
    !
    interface Ethernet0/0
    nameif outside
    security-level 0
    PPPoE client vpdn group dataone
    IP address pppoe
    !
    interface Ethernet0/1
    nameif inside
    security-level 50
    IP 192.168.215.2 255.255.255.0
    !
    interface Ethernet0/2
    nameif Internet
    security-level 0
    IP address dhcp setroute
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    Shutdown
    No nameif
    no level of security
    no ip address
    management only
    !
    passive FTP mode
    clock timezone IST 5 30
    DNS server-group DefaultDNS
    domain kunchevrolet
    permit same-security-traffic intra-interface
    object-group network GM-DC-VPN-Gateway
    object-group, net-LAN
    access extensive list ip 192.168.215.0 sptnl allow 255.255.255.0 192.168.2.0 255.255.255.0
    192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0
    tunnel of splitting allowed access list standard 192.168.215.0 255.255.255.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    Within 1500 MTU
    MTU 1500 Internet
    IP local pool VPN_Users 192.168.2.1 - 192.168.2.250 mask 255.255.255.0
    ICMP unreachable rate-limit 1 burst-size 1
    enable ASDM history
    ARP timeout 14400
    NAT-control
    Global 1 interface (outside)
    NAT (inside) 1 0.0.0.0 0.0.0.0
    Route outside 0.0.0.0 0.0.0.0 59.90.214.1 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    the ssh LOCAL console AAA authentication
    AAA authentication LOCAL telnet console
    AAA authentication http LOCAL console
    AAA authentication enable LOCAL console
    LOCAL AAA authentication serial console
    Enable http server
    x.x.x.x 255.255.255.252 out http
    http 192.168.215.0 255.255.255.252 inside
    http 192.168.215.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
    life crypto ipsec security association seconds 28800
    Crypto ipsec kilobytes of life - safety 4608000 association
    Crypto-map dynamic dynmap 65500 transform-set RIGHT
    card crypto 10 VPN ipsec-isakmp dynamic dynmap
    card crypto VPN outside interface
    card crypto 10 ASA-01 set peer 221.135.138.130
    card crypto 10 ASA - 01 the transform-set RIGHT value
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    crypto ISAKMP policy 65535
    preshared authentication
    the Encryption
    sha hash
    Group 2
    lifetime 28800
    Telnet 192.168.215.0 255.255.255.0 inside
    Telnet timeout 5
    SSH 0.0.0.0 0.0.0.0 outdoors
    SSH timeout 5
    Console timeout 0
    management-access inside
    VPDN group dataone request dialout pppoe
    VPDN group dataone localname bb4027654187_scdrid
    VPDN group dataone ppp authentication chap
    VPDN username bb4027654187_scdrid password * local store
    interface for identifying DHCP-client Internet customer
    dhcpd dns 218.248.255.141 218.248.245.1
    !
    dhcpd address 192.168.215.11 - 192.168.215.254 inside
    dhcpd allow inside
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    Des-sha1 encryption SSL
    WebVPN
    allow outside
    tunnel-group-list activate
    internal kun group policy
    kun group policy attributes
    VPN - connections 8
    Protocol-tunnel-VPN IPSec
    Split-tunnel-policy tunnelspecified
    Split-tunnel-network-list value split tunnel
    kunchevrolet value by default-field
    test P4ttSyrm33SV8TYp encrypted password username
    username kunauto password bSHrKTGl8PUbvus / encrypted privilege 15
    username kunauto attributes
    Strategy Group-VPN-kun
    Protocol-tunnel-VPN IPSec
    tunnel-group vpngroup type remote access
    tunnel-group vpngroup General attributes
    address pool VPN_Users
    Group Policy - by default-kun
    tunnel-group vpngroup webvpn-attributes
    the vpngroup group alias activation
    vpngroup group tunnel ipsec-attributes
    pre-shared key *.
    type tunnel-group test remote access
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group ipsec-attributes x.x.x.x
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    Review the ip options
    inspect the netbios
    inspect the rsh
    inspect the rtsp
    inspect the skinny
    inspect esmtp
    inspect sqlnet
    inspect sunrpc
    inspect the tftp
    inspect the sip
    inspect xdmcp
    inspect the icmp
    !
    global service-policy global_policy
    context of prompt hostname
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:0d2497e1280e41ab3875e77c6b184cf8
    : end
    kunauto #.

    Hello

    Looking at the configuration, there is an access list this nat exemption: -.

    192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0

    But it is not applied in the States of nat.

    Send the following command to the nat exemption to apply: -.

    NAT (inside) 0 access-list sheep

    Kind regards

    Dinesh Moudgil

    P.S. Please mark this message as 'Responded' If you find this information useful so that it brings goodness to other users of the community

  • problem with users to access remote vpn site to site vpn network

    I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

    execution of the configuration of my asa 5510 is

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.4(2)
    
    !
    
    hostname asa5510
    
    domain-name dri.local
    
    enable password 8Ry2YjIyt7RRXU24 encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    !
    
    interface Ethernet0/0
    
    nameif outside
    
    security-level 0
    
    ip address x.x.x.178 255.255.255.248
    
    !
    
    interface Ethernet0/1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.10 255.255.255.0
    
    !
    
    interface Ethernet0/2
    
    description Mreza za virtualne masine- mail server, wsus....
    
    nameif DMZ
    
    security-level 50
    
    ip address 172.16.20.1 255.255.255.0
    
    !
    
    interface Ethernet0/3
    
    shutdown
    
    no nameif
    
    no security-level
    
    no ip address
    
    !
    
    interface Management0/0
    
    nameif management
    
    security-level 100
    
    ip address 192.168.1.1 255.255.255.0
    
    management-only
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    dns server-group DefaultDNS
    
    domain-name dri.local
    
    object network VPN-POOL
    
    subnet 192.168.50.0 255.255.255.0
    
    description VPN Client pool
    
    object network LAN-NETWORK
    
    subnet 192.168.0.0 255.255.255.0
    
    description LAN Network
    
    object network NETWORK_OBJ_192.168.0.0_24
    
    subnet 192.168.0.0 255.255.255.0
    
    object network 192.168.0.10
    
    host 192.168.0.10
    
    object service ssl
    
    service tcp destination eq 465
    
    object service tls
    
    service tcp destination eq 995
    
    object network mail_server
    
    host 172.16.20.201
    
    object service StartTLS
    
    service tcp destination eq 587
    
    object service admin_port
    
    service tcp destination eq 444
    
    object service ODMR
    
    service tcp destination eq 366
    
    object service SSL-IMAP
    
    service tcp destination eq 993
    
    object network remote
    
    host 172.16.20.200
    
    object network test
    
    host 192.168.0.22
    
    object network mail
    
    host 172.16.20.200
    
    object network DMZ
    
    host 172.16.20.200
    
    object network Inside_DMZ
    
    host 192.168.0.20
    
    object service rdp
    
    service tcp destination eq 3389
    
    object network DRI_PS99
    
    host 192.168.0.54
    
    object service microsoft_dc
    
    service tcp destination eq 445
    
    object service https448
    
    service tcp destination eq 448
    
    object network mail_server_internal
    
    host 172.16.20.201
    
    object service Acronis_remote
    
    service tcp destination eq 9876
    
    object service Acronis_25001
    
    service tcp destination eq 25001
    
    object service HTTP3000
    
    service tcp destination eq 3000
    
    object network VPNPOOL
    
    subnet 192.168.50.0 255.255.255.0
    
    object-group network PAT-SOURCE-NETWORKS
    
    description Source networks for PAT
    
    network-object 192.168.0.0 255.255.255.0
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object object admin_port
    
    service-object object ssl
    
    service-object object tls
    
    service-object object https448
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object object tls
    
    service-object tcp destination eq pop3
    
    service-object tcp destination eq smtp
    
    object-group service DM_INLINE_SERVICE_3
    
    service-object object admin_port
    
    service-object object https448
    
    service-object object ssl
    
    service-object tcp destination eq smtp
    
    service-object object tls
    
    service-object object Acronis_remote
    
    service-object tcp destination eq www
    
    service-object object Acronis_25001
    
    service-object object microsoft_dc
    
    object-group protocol DM_INLINE_PROTOCOL_1
    
    protocol-object ip
    
    protocol-object tcp
    
    object-group service DM_INLINE_SERVICE_4
    
    service-object object Acronis_25001
    
    service-object object Acronis_remote
    
    service-object object microsoft_dc
    
    service-object tcp destination eq www
    
    service-object tcp
    
    service-object ip
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
    
    access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
    
    access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
    
    access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
    
    access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
    
    access-list DMZ extended deny tcp any any eq smtp
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    mtu outside 1500
    
    mtu inside 1500
    
    mtu DMZ 1500
    
    mtu management 1500
    
    ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
    
    !
    
    object network mail_server
    
    nat (DMZ,outside) static x.x.x.179
    
    object network mail
    
    nat (DMZ,outside) static x.x.x.180
    
    access-group outside_access_in in interface outside
    
    access-group DMZ in interface DMZ
    
    route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    timeout floating-conn 0:00:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    action terminate
    
    dynamic-access-policy-record dripolisa
    
    aaa-server DRI protocol ldap
    
    aaa-server DRI (inside) host 192.168.0.20
    
    ldap-base-dn DC=dri,DC=local
    
    ldap-scope subtree
    
    ldap-naming-attribute sAMAccountName
    
    ldap-login-password *****
    
    ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
    
    server-type microsoft
    
    user-identity default-domain LOCAL
    
    aaa authentication enable console LOCAL
    
    aaa authentication http console LOCAL
    
    aaa authentication serial console LOCAL
    
    aaa authentication telnet console LOCAL
    
    aaa authorization command LOCAL
    
    http server enable
    
    http 192.168.1.0 255.255.255.0 management
    
    http 192.168.0.0 255.255.255.0 inside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    
    virtual telnet 192.168.1.12
    
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    
    crypto ipsec ikev2 ipsec-proposal DES
    
    protocol esp encryption des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal 3DES
    
    protocol esp encryption 3des
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES
    
    protocol esp encryption aes
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES192
    
    protocol esp encryption aes-192
    
    protocol esp integrity sha-1 md5
    
    crypto ipsec ikev2 ipsec-proposal AES256
    
    protocol esp encryption aes-256
    
    protocol esp integrity sha-1 md5
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 match address outside_cryptomap
    
    crypto map outside_map 1 set peer 195.222.96.223
    
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    
    crypto map outside_map interface outside
    
    crypto ikev2 policy 1
    
    encryption aes-256
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 10
    
    encryption aes-192
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 20
    
    encryption aes
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 30
    
    encryption 3des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 policy 40
    
    encryption des
    
    integrity sha
    
    group 5 2
    
    prf sha
    
    lifetime seconds 86400
    
    crypto ikev2 enable outside
    
    crypto ikev1 enable outside
    
    crypto ikev1 policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    
    dhcpd address 192.168.0.14-192.168.0.45 inside
    
    !
    
    dhcpd address 172.16.20.2-172.16.20.150 DMZ
    
    dhcpd dns x.x.x.177 interface DMZ
    
    dhcpd auto_config outside interface DMZ
    
    dhcpd option 6 ip x.x.x.177 interface DMZ
    
    dhcpd enable DMZ
    
    !
    
    dhcpd address 192.168.1.2-192.168.1.254 management
    
    dhcpd enable management
    
    !
    
    threat-detection basic-threat
    
    threat-detection statistics port
    
    threat-detection statistics protocol
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    group-policy GroupPolicy_x.x.x.223 internal
    
    group-policy GroupPolicy_x.x.x.223 attributes
    
    vpn-tunnel-protocol ikev1 ikev2
    
    group-policy drivpn internal
    
    group-policy drivpn attributes
    
    dns-server value 192.168.0.20 192.168.0.254
    
    vpn-simultaneous-logins 10
    
    vpn-idle-timeout 30
    
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    
    split-tunnel-network-list value Split_Tunnel_List
    
    default-domain value dri.local
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group drivpn type remote-access
    
    tunnel-group drivpn general-attributes
    
    address-pool vpnadrese
    
    authentication-server-group DRI
    
    default-group-policy drivpn
    
    tunnel-group drivpn ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    tunnel-group x.x.x.223 type ipsec-l2l
    
    tunnel-group x.x.x.223 general-attributes
    
    default-group-policy GroupPolicy_x.x.x.223
    
    tunnel-group x.x.x.223 ipsec-attributes
    
    ikev1 pre-shared-key *****
    
    ikev2 remote-authentication pre-shared-key *****
    
    ikev2 local-authentication pre-shared-key *****
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum client auto
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect tftp
    
      inspect ip-options
    
      inspect netbios
    
      inspect icmp
    
      inspect http
    
    !
    
    service-policy global_policy global
    
    prompt hostname context
    
    no call-home reporting anonymous
    
    Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
    
    : end

    running config asa 5505

    Result of the command: "show run"
    

    : Saved
    
    :
    
    ASA Version 8.2(1)
    
    !
    
    hostname ciscoasa
    
    enable password csq7sfr0bQJqMGET encrypted
    
    passwd 2KFQnbNIdI.2KYOU encrypted
    
    names
    
    name 192.168.5.0 PALATA
    
    !
    
    interface Vlan1
    
    nameif inside
    
    security-level 100
    
    ip address 192.168.0.17 255.255.255.0
    
    !
    
    interface Vlan2
    
    nameif outside
    
    security-level 0
    
    ip address 10.13.74.33 255.255.255.0
    
    !
    
    interface Ethernet0/0
    
    switchport access vlan 2
    
    !
    
    interface Ethernet0/1
    
    !
    
    interface Ethernet0/2
    
    !
    
    interface Ethernet0/3
    
    !
    
    interface Ethernet0/4
    
    !
    
    interface Ethernet0/5
    
    !
    
    interface Ethernet0/6
    
    !
    
    interface Ethernet0/7
    
    !
    
    ftp mode passive
    
    clock timezone CEST 1
    
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    
    object-group service DM_INLINE_SERVICE_1
    
    service-object ip
    
    service-object tcp
    
    service-object icmp echo
    
    service-object icmp echo-reply
    
    service-object tcp eq domain
    
    service-object tcp eq ldap
    
    service-object tcp eq smtp
    
    object-group service DM_INLINE_SERVICE_2
    
    service-object ip
    
    service-object tcp eq domain
    
    service-object tcp eq www
    
    service-object tcp eq https
    
    service-object tcp eq smtp
    
    object-group service Sharepoint8080 tcp
    
    port-object eq 8080
    
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
    
    access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
    
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
    
    pager lines 24
    
    logging enable
    
    logging asdm informational
    
    logging mail errors
    
    logging from-address
    
    logging recipient-address  level debugging
    
    mtu inside 1500
    
    mtu outside 1500
    
    icmp unreachable rate-limit 1 burst-size 1
    
    no asdm history enable
    
    arp timeout 14400
    
    global (outside) 1 interface
    
    nat (inside) 0 access-list inside_nat0_outbound_1
    
    nat (inside) 1 192.168.0.0 255.255.255.0
    
    static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
    
    static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
    
    access-group inside_access_in in interface inside
    
    access-group outside_access_in in interface outside
    
    route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
    
    route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
    
    timeout xlate 3:00:00
    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    
    timeout tcp-proxy-reassembly 0:01:00
    
    dynamic-access-policy-record DfltAccessPolicy
    
    aaa authentication telnet console LOCAL
    
    http server enable
    
    http 10.13.74.0 255.255.255.0 outside
    
    http 192.168.0.0 255.255.255.0 inside
    
    http 10.15.100.0 255.255.255.0 outside
    
    no snmp-server location
    
    no snmp-server contact
    
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    
    virtual telnet 192.168.0.53
    
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    
    crypto ipsec security-association lifetime seconds 28800
    
    crypto ipsec security-association lifetime kilobytes 4608000
    
    crypto map outside_map 1 match address outside_2_cryptomap
    
    crypto map outside_map 1 set pfs
    
    crypto map outside_map 1 set peer 10.15.100.15
    
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    
    crypto map outside_map interface outside
    
    crypto isakmp enable outside
    
    crypto isakmp policy 10
    
    authentication pre-share
    
    encryption 3des
    
    hash sha
    
    group 2
    
    lifetime 86400
    
    telnet 192.168.0.0 255.255.255.0 inside
    
    telnet timeout 5
    
    ssh timeout 5
    
    console timeout 0
    
    dhcpd auto_config outside
    
    !
    

    threat-detection basic-threat
    
    threat-detection statistics access-list
    
    no threat-detection statistics tcp-intercept
    
    webvpn
    
    username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
    
    tunnel-group 10.15.100.15 type ipsec-l2l
    
    tunnel-group 10.15.100.15 ipsec-attributes
    
    pre-shared-key *
    
    !
    
    class-map inspection_default
    
    match default-inspection-traffic
    
    !
    
    !
    
    policy-map type inspect dns preset_dns_map
    
    parameters
    
      message-length maximum 512
    
    policy-map global_policy
    
    class inspection_default
    
      inspect dns preset_dns_map
    
      inspect ftp
    
      inspect h323 h225
    
      inspect h323 ras
    
      inspect rsh
    
      inspect rtsp
    
      inspect esmtp
    
      inspect sqlnet
    
      inspect skinny 
    
      inspect sunrpc
    
      inspect xdmcp
    
      inspect sip 
    
      inspect netbios
    
      inspect tftp
    
      inspect icmp
    
    !
    
    service-policy global_policy global
    
    smtp-server 173.194.79.109
    
    prompt hostname context
    
    Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
    
    : end

    Thank you

    Hello

    I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

    EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

    So you don't really have any of those.

    Please mark the question answers and/or assess response

    Ask more if necessary

    -Jouni

  • Cannot access remote network by VPN Site to Site ASA

    Hello everyone

    First of all I must say that I have configured the VPN site-to site a million times before.  Stuck with it. First of all I can't ping outside the interface of my ASA remote. Secondly, VPN is in place, but no connectivity between local networks

    ASA local:
    hostname gyd - asa
    domain bct.az
    activate the encrypted password of XeY1QWHKPK75Y48j
    XeY1QWHKPK75Y48j encrypted passwd
    names of
    DNS-guard
    !
    interface GigabitEthernet0/0
    Shutdown
    nameif vpnswc
    security-level 0
    IP 10.254.17.41 255.255.255.248
    !
    interface GigabitEthernet0/1
    Vpn-turan-Baku description
    nameif outside Baku
    security-level 0
    IP 10.254.17.9 255.255.255.248
    !
    interface GigabitEthernet0/2
    Vpn-ganja description
    nameif outside-Ganja
    security-level 0
    IP 10.254.17.17 255.255.255.248
    !
    interface GigabitEthernet0/2.30
    Description remote access
    VLAN 30
    nameif remote access
    security-level 0
    IP 85.*. *. * 255.255.255.0
    !
    interface GigabitEthernet0/3
    Description BCT_Inside
    nameif inside-Bct
    security-level 100
    IP 10.40.50.65 255.255.255.252
    !
    interface Management0/0
    nameif management
    security-level 100
    IP 192.168.251.1 255.255.255.0
    management only
    !
    boot system Disk0: / asa823 - k8.bin
    passive FTP mode
    DNS server-group DefaultDNS
    name-server 192.168.1.3
    domain bct.az
    permit same-security-traffic intra-interface
    object-group network obj - 192.168.121.0
    object-group network obj - 10.40.60.0
    object-group network obj - 10.40.50.0
    object-group network obj - 192.168.0.0
    object-group network obj - 172.26.0.0
    object-group network obj - 10.254.17.0
    object-group network obj - 192.168.122.0
    object-group service obj-tcp-eq-22
    object-group network obj - 10.254.17.18
    object-group network obj - 10.254.17.10
    object-group network obj - 10.254.17.26
    access-list 110 scope ip allow a whole
    NAT list extended access permit tcp any host 10.254.17.10 eq ssh
    NAT list extended access permit tcp any host 10.254.17.26 eq ssh
    access-list extended ip allowed any one sheep
    icmp_inside list extended access permit icmp any one
    icmp_inside of access allowed any ip an extended list
    access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh
    RDP list extended access permit tcp any host 192.168.45.3 eq 3389
    rdp extended permitted any one ip access list
    sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0
    NAT-vpn-internet access-list extended ip 192.168.121.0 allow 255.255.255.0 any
    NAT-vpn-internet access-list extended ip 172.26.0.0 allow 255.255.255.0 any
    NAT-vpn-internet access-list extended ip 192.168.122.0 allow 255.255.255.0 any
    access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 10.40.60.0 255.255.255.0
    access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 10.40.50.0 255.255.255.0
    access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
    access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 172.26.0.0 255.255.255.0
    access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 10.254.17.0 255.255.255.0
    GHC-ganja-internet access-list extended ip 192.168.45.0 allow 255.255.255.0 any
    Standard access list Split_Tunnel_List allow 192.168.16.0 255.255.255.0
    azans 192.168.69.0 ip extended access-list allow 255.255.255.0 any
    permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.121.0 255.255.255.0
    permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.80.0 255.255.255.0
    pager lines 24
    Enable logging
    emblem of logging
    recording of debug console
    recording of debug trap
    asdm of logging of information
    Interior-Bct 192.168.1.27 host connection
    flow-export destination inside-Bct 192.168.1.27 9996
    vpnswc MTU 1500
    outside Baku MTU 1500
    outside-Ganja MTU 1500
    MTU 1500 remote access
    Interior-Bct MTU 1500
    management of MTU 1500
    IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0
    IP local pool ssl 192.168.121.130 - 192.168.121.200 mask 255.255.255.0
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow any outside Baku
    ICMP allow access remotely
    ICMP allow any interior-Bct
    ASDM image disk0: / asdm - 621.bin
    don't allow no asdm history
    ARP timeout 14400
    global (outside-Baku) 1 interface
    global (outside-Ganja) interface 2
    3 overall (RAS) interface
    azans access-list NAT 3 (outside-Ganja)
    NAT (remote access) 0 access-list sheep-vpn-city
    NAT 3 list nat-vpn-internet access (remote access)
    NAT (inside-Bct) 0-list of access inside_nat0_outbound
    NAT (inside-Bct) 2-nat-ganja access list
    NAT (inside-Bct) 1 access list nat
    Access-group rdp on interface outside-Ganja
    !
    Router eigrp 2008
    No Auto-resume
    neighbor 10.254.17.10 interface outside Baku
    neighbor 10.40.50.66 Interior-Bct interface
    Network 10.40.50.64 255.255.255.252
    Network 10.250.25.0 255.255.255.0
    Network 10.254.17.8 255.255.255.248
    Network 10.254.17.16 255.255.255.248
    redistribute static
    !
    Access remote 0.0.0.0 0.0.0.0 85.*. *. * 1
    Outside-Baku route 10.0.11.0 255.255.255.0 10.254.17.10 1
    Outside-Baku route 10.0.33.0 255.255.255.0 10.254.17.10 1
    Outside-Baku route 10.0.150.0 255.255.255.0 10.254.17.10 1
    Outside-Baku route 10.0.170.0 255.255.255.0 10.254.17.10 1
    Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1
    Route outside Baku 10.254.17.32 255.255.255.248 10.254.17.10 1
    Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1
    Outside-Baku route 192.168.27.0 255.255.255.0 10.254.17.10 1
    Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1
    Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1
    Route outside-Ganja 192.168.66.0 255.255.255.0 10.254.17.18 1
    Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1
    Outside-Baku route 192.168.80.0 255.255.255.0 10.254.17.11 1
    Access remote 192.168.121.0 255.255.255.0 85.132.43.1 1
    Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1
    Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1
    Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1
    Route inside-Bct 192.168.254.0 255.255.255.0 10.40.50.66 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    AAA-server protocol Ganymede GANYMEDE +.
    AAA-server GANYMEDE (Interior-Bct) 192.168.1.8
    key *.
    AAA-server GANYMEDE (Interior-Bct) 192.168.22.46
    key *.
    RADIUS protocol AAA-server TACACS1
    AAA-server TACACS1 (Interior-Bct) host 192.168.1.8
    key *.
    AAA-server TACACS1 (Interior-Bct) host 192.168.22.46
    key *.
    authentication AAA ssh console LOCAL GANYMEDE
    Console to enable AAA authentication RADIUS LOCAL
    Console Telnet AAA authentication RADIUS LOCAL
    AAA accounting ssh console GANYMEDE
    Console Telnet accounting AAA GANYMEDE
    Enable http server
    http 192.168.1.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 Interior-Bct
    http 192.168.139.0 255.255.255.0 Interior-Bct
    http 192.168.0.0 255.255.255.0 Interior-Bct
    Survey community SNMP-server host inside-Bct 192.168.1.27
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
    Crypto ipsec transform-set newset aes - esp esp-md5-hmac
    Crypto ipsec transform-set esp-3des esp-sha-hmac myset2
    Crypto ipsec transform-set esp-3des esp-md5-hmac raccess
    Crypto ipsec transform-set esp-3des esp-sha-hmac vpnclienttrans
    Crypto ipsec transform-set vpnclienttrans transport mode
    life crypto ipsec security association seconds 2147483646
    Crypto ipsec kilobytes of life security-association 2147483646
    raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map
    correspondence address card crypto mymap 10 110
    card crypto mymap 10 peers set 10.254.17.10
    card crypto mymap 10 transform-set RIGHT
    correspondence address card crypto mymap 20 110
    card crypto mymap 20 peers set 10.254.17.11
    mymap 20 transform-set myset2 crypto card
    card crypto mymap interface outside Baku
    correspondence address card crypto ganja 10 110
    10 ganja crypto map peer set 10.254.17.18
    card crypto ganja 10 transform-set RIGHT
    card crypto interface outside-Ganja ganja
    correspondence address card crypto vpntest 20 110
    peer set card crypto vpntest 20 10.250.25.1
    newset vpntest 20 transform-set card crypto
    card crypto vpntest interface vpnswc
    vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1
    card crypto interface for remote access vpnclientmap
    Crypto ca trustpoint ASDM_TrustPoint0
    registration auto
    name of the object CN = gyd - asa .az .bct
    sslvpnkeypair key pair
    Configure CRL
    map of crypto DefaultCertificateMap 10 ca certificate

    crypto isakmp identity address
    ISAKMP crypto enable vpnswc
    ISAKMP crypto enable outside-Baku
    ISAKMP crypto enable outside-Ganja
    crypto ISAKMP enable remote access
    ISAKMP crypto enable Interior-Bct
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    md5 hash
    Group 2
    life 86400
    crypto ISAKMP policy 20
    preshared authentication
    aes encryption
    md5 hash
    Group 2
    life 86400
    crypto ISAKMP policy 30
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    crypto ISAKMP policy 40
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    Crypto isakmp nat-traversal 30
    No vpn-addr-assign aaa
    Telnet timeout 5
    SSH 192.168.0.0 255.255.255.0 Interior-Bct
    SSH timeout 35
    Console timeout 0
    priority queue outside Baku
    queue-limit 2046
    TX-ring-limit 254
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    Server NTP 192.168.1.3
    SSL encryption, 3des-sha1 rc4 - md5 aes128-sha1 sha1-aes256
    SSL-trust point ASDM_TrustPoint0 to vpnlb-ip remote access
    SSL-trust ASDM_TrustPoint0 remote access point
    WebVPN
    turn on remote access
    SVC disk0:/anyconnect-win-2.4.1012-k9.pkg 1 image
    enable SVC
    tunnel-group-list activate
    attributes of Group Policy DfltGrpPolicy
    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
    internal group ssl policy
    attributes of group ssl policy
    banner welcome to SW value
    value of DNS-server 192.168.1.3
    Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
    group-lock value SSL
    WebVPN
    value of the SPS URL-list
    internal vpn group policy
    attributes of vpn group policy
    value of DNS-server 192.168.1.3
    Protocol-tunnel-VPN IPSec l2tp ipsec
    disable the PFS
    BCT.AZ value by default-field
    ssl VPN-group-strategy
    WebVPN
    value of the SPS URL-list
    IPSec-attributes tunnel-group DefaultL2LGroup
    ISAKMP retry threshold 20 keepalive 5
    attributes global-tunnel-group DefaultRAGroup
    raccess address pool
    Group-RADIUS authentication server
    Group Policy - by default-vpn
    IPSec-attributes tunnel-group DefaultRAGroup
    pre-shared key *.
    ISAKMP retry threshold 20 keepalive 5
    IPSec-attributes tunnel-group DefaultWEBVPNGroup
    ISAKMP retry threshold 20 keepalive 5
    tunnel-group 10.254.17.10 type ipsec-l2l
    IPSec-attributes tunnel-group 10.254.17.10
    pre-shared key *.
    ISAKMP retry threshold 20 keepalive 5
    type SSL tunnel-group remote access
    attributes global-group-tunnel SSL
    ssl address pool
    Authentication (remote access) LOCAL servers group
    Group Policy - by default-ssl
    certificate-use-set-name username
    Group-tunnel SSL webvpn-attributes
    enable SSL group-alias
    Group-url https://85. *. *. * / activate
    tunnel-group 10.254.17.18 type ipsec-l2l
    IPSec-attributes tunnel-group 10.254.17.18
    pre-shared key *.
    ISAKMP retry threshold 20 keepalive 5
    tunnel-group 10.254.17.11 type ipsec-l2l
    IPSec-attributes tunnel-group 10.254.17.11
    pre-shared key *.
    ISAKMP retry threshold 20 keepalive 5
    type tunnel-group DefaultSWITGroup remote access
    attributes global-tunnel-group DefaultSWITGroup
    raccess address pool
    Group-RADIUS authentication server
    Group Policy - by default-vpn
    IPSec-attributes tunnel-group DefaultSWITGroup
    pre-shared key *.
    !
    type of policy-card inspect dns migrated_dns_map_1
    parameters
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the migrated_dns_map_1 dns
    inspect the rsh
    inspect the rtsp
    inspect sqlnet
    inspect sunrpc
    inspect xdmcp
    inspect the netbios
    Review the ip options
    class flow_export_cl
    flow-export-type of event all the destination 192.168.1.27
    class class by default
    flow-export-type of event all the destination 192.168.1.27
    Policy-map Voicepolicy
    class voice
    priority
    The class data
    police release 80000000
    !
    global service-policy global_policy
    service-policy interface outside Baku Voicepolicy
    context of prompt hostname

    Cryptochecksum:4f35f975ba7a0c11f7f46dfd541d266f
    : end
    GYD - asa #.

    ASA remote:
    ASA Version 8.2 (3)
    !
    ciscoasa hostname
    activate the encrypted password of XeY1QWHKPK75Y48j
    2KFQnbNIdI.2KYOU encrypted passwd
    names of
    DNS-guard
    !
    interface Ethernet0/0
    nameif inside
    security-level 100
    IP 192.168.80.14 255.255.255.0
    !
    interface Ethernet0/1
    nameif outside
    security-level 0
    IP 10.254.17.11 255.255.255.248
    !
    interface Ethernet0/2
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Ethernet0/3
    Shutdown
    No nameif
    no level of security
    no ip address
    !
    interface Management0/0
    Shutdown
    nameif management
    security-level 100
    no ip address
    management only
    !
    boot system Disk0: / asa823 - k8.bin
    passive FTP mode
    access-list 110 scope ip allow a whole
    192.168.80.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.0.0 255.255.0.0
    pager lines 24
    Enable logging
    asdm of logging of information
    Outside 1500 MTU
    management of MTU 1500
    Within 1500 MTU
    no failover
    ICMP unreachable rate-limit 1 burst-size 1
    ICMP allow all outside
    ICMP allow any inside
    ASDM image disk0: / asdm - 621.bin
    don't allow no asdm history
    ARP timeout 14400
    NAT (inside) 0 access-list sheep
    Route outside 0.0.0.0 0.0.0.0 10.254.17.9 1
    Timeout xlate 03:00
    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-registration DfltAccessPolicy
    Enable http server
    http 192.168.1.0 255.255.255.0 management
    http 192.168.80.0 255.255.255.0 inside
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
    Crypto ipsec transform-set newset aes - esp esp-md5-hmac
    Crypto ipsec transform-set esp-3des esp-sha-hmac myset2
    life crypto ipsec security association seconds 2147483646
    Crypto ipsec kilobytes of life security-association 2147483646
    correspondence address card crypto mymap 10 110
    card crypto mymap 10 peers set 10.254.17.9
    mymap 10 transform-set myset2 crypto card
    mymap outside crypto map interface
    crypto ISAKMP allow outside
    crypto ISAKMP policy 10
    preshared authentication
    3des encryption
    md5 hash
    Group 2
    life 86400
    crypto ISAKMP policy 20
    preshared authentication
    aes encryption
    md5 hash
    Group 2
    life 86400
    crypto ISAKMP policy 30
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    crypto ISAKMP policy 40
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH timeout 5
    Console timeout 0
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    WebVPN

    tunnel-group 10.254.17.9 type ipsec-l2l
    IPSec-attributes tunnel-group 10.254.17.9
    pre-shared key *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns migrated_dns_map_1
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the migrated_dns_map_1 dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    !
    global service-policy global_policy
    context of prompt hostname

    Cryptochecksum:1c1ac60e2fb84f65269d15d53f27c21b
    : end
    ciscoasa # $

    Still, I can't ping ASA remote outside from outside of the Local interface. And there is no connectivity between the 192.168.80.0 distance and local don't say 192.168.1.0. I have run out of ideas

    Would appreciate any help. Thank you in advance...

    If the tunnel is up (phase 1), but no traffic passing the best test is the following:

    Add order management-access to the Interior , and then try to PING the intellectual property inside ASA counterpart.

    inside x.x.x.x ping --> x.x.x.x is the IP of the ASA peer inside

    The test above shows if the traffic passes through the tunnel (check encrypted/decrypted packets of sh cry ips its).

    Test on both directions.

    Please post the results.

    Federico.

  • Cisco ASA 5505 VPN Site to Site

    Hi all

    First post on the forums. I have worked with Cisco ASA 5505 for a few months and I recently bought a 2nd ASA to implement tunnel VPN Site to Site. It seems so simple in the number of videos watched on the internet. But when I did he surprise it did work for me... I've removed the tunnels, a number of times and tried to recreate. I use the VPN Wizard in the SMA to create the tunnel. Both the asa 5505 of are and have the same firmware even etc..

    I'd appreciate any help that can be directed to this problem please.  Slowly losing my mind

    Please see details below:

    Two ADMS are 7.1

    IOS

    ASA 1

    Nadia

    :

    ASA Version 9.0 (1)

    !

    hostname PAYBACK

    activate the encrypted password of HSMurh79NVmatjY0

    volatile xlate deny tcp any4 any4

    volatile xlate deny tcp any4 any6

    volatile xlate deny tcp any6 any4

    volatile xlate deny tcp any6 any6

    volatile xlate deny udp any4 any4 eq field

    volatile xlate deny udp any4 any6 eq field

    volatile xlate deny udp any6 any4 eq field

    volatile xlate deny udp any6 any6 eq field

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    local pool VPN1 192.168.50.1 - 192.168.50.254 255.255.255.0 IP mask

    !

    interface Ethernet0/0

    switchport access vlan 2

    Speed 100

    full duplex

    !

    interface Ethernet0/1

    link Trunk Description of SW1

    switchport trunk allowed vlan 1,10,20,30,40

    switchport trunk vlan 1 native

    switchport mode trunk

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    No nameif

    no level of security

    no ip address

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP 92.51.193.158 255.255.255.252

    !

    interface Vlan10

    nameif inside

    security-level 100

    IP 192.168.10.1 255.255.255.0

    !

    interface Vlan20

    nameif servers

    security-level 100

    address 192.168.20.1 255.255.255.0

    !

    Vlan30 interface

    nameif printers

    security-level 100

    192.168.30.1 IP address 255.255.255.0

    !

    interface Vlan40

    nameif wireless

    security-level 100

    192.168.40.1 IP address 255.255.255.0

    !

    connection line banner welcome to the Payback loyalty systems

    boot system Disk0: / asa901 - k8.bin

    passive FTP mode

    summer time clock GMT/IDT recurring last Sun Mar 01:00 last Sun Oct 02:00

    DNS domain-lookup outside

    DNS lookup field inside

    domain-lookup DNS servers

    DNS lookup domain printers

    DNS domain-lookup wireless

    DNS server-group DefaultDNS

    Server name 83.147.160.2

    Server name 83.147.160.130

    permit same-security-traffic inter-interface

    network obj_any object

    subnet 0.0.0.0 0.0.0.0

    ftp_server network object

    network of the Internal_Report_Server object

    Home 192.168.20.21

    Description address internal automated report server

    network of the Report_Server object

    Home 89.234.126.9

    Description of server automated reports

    service object RDP

    service destination tcp 3389 eq

    Description RDP to the server

    network of the Host_QA_Server object

    Home 89.234.126.10

    Description QA host external address

    network of the Internal_Host_QA object

    Home 192.168.20.22

    host of computer virtual Description for QA

    network of the Internal_QA_Web_Server object

    Home 192.168.20.23

    Description Web Server in the QA environment

    network of the Web_Server_QA_VM object

    Home 89.234.126.11

    Server Web Description in the QA environment

    service object SQL_Server

    destination eq 1433 tcp service

    network of the Demo_Server object

    Home 89.234.126.12

    Description server set up for the product demo

    network of the Internal_Demo_Server object

    Home 192.168.20.24

    Internal description of the demo server IP address

    network of the NETWORK_OBJ_192.168.20.0_24 object

    subnet 192.168.20.0 255.255.255.0

    network of the NETWORK_OBJ_192.168.50.0_26 object

    255.255.255.192 subnet 192.168.50.0

    network of the NETWORK_OBJ_192.168.0.0_16 object

    Subnet 192.168.0.0 255.255.0.0

    service object MSSQL

    destination eq 1434 tcp service

    MSSQL port description

    VPN network object

    192.168.50.0 subnet 255.255.255.0

    network of the NETWORK_OBJ_192.168.50.0_24 object

    192.168.50.0 subnet 255.255.255.0

    service object TS

    tcp destination eq 4400 service

    service of the TS_Return object

    tcp source eq 4400 service

    network of the External_QA_3 object

    Home 89.234.126.13

    network of the Internal_QA_3 object

    Home 192.168.20.25

    network of the Dev_WebServer object

    Home 192.168.20.27

    network of the External_Dev_Web object

    Home 89.234.126.14

    network of the CIX_Subnet object

    255.255.255.0 subnet 192.168.100.0

    network of the NETWORK_OBJ_192.168.10.0_24 object

    192.168.10.0 subnet 255.255.255.0

    network of the NETWORK_OBJ_84.39.233.50 object

    Home 84.39.233.50

    network of the NETWORK_OBJ_92.51.193.158 object

    Home 92.51.193.158

    network of the NETWORK_OBJ_192.168.100.0_24 object

    255.255.255.0 subnet 192.168.100.0

    network of the NETWORK_OBJ_192.168.1.0_24 object

    subnet 192.168.1.0 255.255.255.0

    object-group service DM_INLINE_SERVICE_1

    the tcp destination eq ftp service object

    the purpose of the tcp destination eq netbios-ssn service

    the purpose of the tcp destination eq smtp service

    service-object TS

    the Payback_Internal object-group network

    object-network 192.168.10.0 255.255.255.0

    object-network 192.168.20.0 255.255.255.0

    object-network 192.168.40.0 255.255.255.0

    object-group service DM_INLINE_SERVICE_3

    the purpose of the service tcp destination eq www

    the purpose of the tcp destination eq https service

    service-object TS

    service-object, object TS_Return

    object-group service DM_INLINE_SERVICE_4

    service-object RDP

    the purpose of the service tcp destination eq www

    the purpose of the tcp destination eq https service

    object-group service DM_INLINE_SERVICE_5

    purpose purpose of the MSSQL service

    service-object RDP

    service-object TS

    object-group Protocol TCPUDP

    object-protocol udp

    object-tcp protocol

    object-group service DM_INLINE_SERVICE_6

    service-object TS

    service-object, object TS_Return

    the purpose of the service tcp destination eq www

    the purpose of the tcp destination eq https service

    Note to outside_access_in to access list that this rule allows Internet the interal server.

    Notice on the outside_access_in of the access-list allowed:

    Comment from outside_access_in-list of FTP access

    Comment from outside_access_in-RDP access list

    Comment from outside_access_in-list of SMTP access

    Note to outside_access_in to access list Net Bios

    Comment from outside_access_in-SQL access list

    Comment from outside_access_in-list to access TS - 4400

    outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_1 any4 Internal_Report_Server

    access host access-list outside_access_in note rule internal QA

    Notice on the outside_access_in of the access-list allowed:

    Comment from outside_access_in-HTTP access list

    Comment from outside_access_in-RDP access list

    outside_access_in list extended access permitted tcp any4 object Internal_Host_QA eq www

    Notice on the outside_access_in of the access-list access to the internal Web server:

    Notice on the outside_access_in of the access-list allowed:

    Comment from outside_access_in-HTTP access list

    Comment from outside_access_in-RDP access list

    outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_3 any4 Internal_QA_Web_Server

    Note to outside_access_in to access list rule allowing access to the demo server

    Notice on the outside_access_in of the access-list allowed:

    Comment from outside_access_in-RDP access list

    Comment from outside_access_in-list to access MSSQL

    outside_access_in list extended access allowed object object-group DM_INLINE_SERVICE_4 any4 Internal_Demo_Server

    outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_5 any object Internal_QA_3

    Note to outside_access_in access to the development Web server access list

    outside_access_in list extended access allowed object-group DM_INLINE_SERVICE_6 any object Dev_WebServer

    AnyConnect_Client_Local_Print deny any4 any4 ip extended access list

    AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq lpd

    Note AnyConnect_Client_Local_Print of access list IPP: Internet Printing Protocol

    AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 631

    print the access-list AnyConnect_Client_Local_Print Note Windows port

    AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 eq 9100

    access-list AnyConnect_Client_Local_Print mDNS Note: multicast DNS protocol

    AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.251 any4 eq 5353

    AnyConnect_Client_Local_Print of access list LLMNR Note: link Local Multicast Name Resolution protocol

    AnyConnect_Client_Local_Print list extended access permit udp host 224.0.0.252 any4 eq 5355

    Note access list TCP/NetBIOS protocol AnyConnect_Client_Local_Print

    AnyConnect_Client_Local_Print list extended access permitted tcp any4 any4 EQ. 137

    AnyConnect_Client_Local_Print list extended access permitted udp any4 any4 eq netbios-ns

    Payback_VPN_splitTunnelAcl list standard access allowed 192.168.20.0 255.255.255.0

    permit outside_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0

    pager lines 24

    Enable logging

    information recording console

    asdm of logging of information

    address record

    [email protected] / * /.

    the journaling recipient

    [email protected] / * /.

    level alerts

    Outside 1500 MTU

    Within 1500 MTU

    MTU 1500 servers

    MTU 1500 printers

    MTU 1500 wireless

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm-711 - 52.bin

    don't allow no asdm history

    ARP timeout 14400

    no permit-nonconnected arp

    NAT (inside, outside) source Dynamics one interface

    NAT (wireless, outdoors) source Dynamics one interface

    NAT (servers, outside) no matter what source dynamic interface

    NAT (servers, external) static source Internal_Report_Server Report_Server

    NAT (servers, external) static source Internal_Host_QA Host_QA_Server

    NAT (servers, external) static source Internal_QA_Web_Server Web_Server_QA_VM

    NAT (servers, external) static source Internal_Demo_Server Demo_Server

    NAT (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

    NAT (servers, external) static source Internal_QA_3 External_QA_3

    NAT (servers, external) static source Dev_WebServer External_Dev_Web

    NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

    NAT (inside, outside) static source NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 92.51.193.157 1

    Timeout xlate 03:00

    Pat-xlate timeout 0:00:30

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    identity of the user by default-domain LOCAL
    the ssh LOCAL console AAA authentication
    Enable http server
    http 192.168.10.0 255.255.255.0 inside
    http 192.168.40.0 255.255.255.0 wireless
    No snmp server location
    No snmp Server contact
    Server enable SNMP traps snmp authentication linkup, linkdown cold start
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit
    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac
    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal OF
    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto outside_map 1 match address outside_cryptomap
    card crypto outside_map 1 set pfs
    peer set card crypto outside_map 1 84.39.233.50
    card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 1 set ikev2 AES256 AES192 AES 3DES ipsec-proposal OF
    outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 5
    FRP sha
    second life 86400
    Crypto ikev2 activate out of service the customer port 443
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH 77.75.100.208 255.255.255.240 outside
    SSH 192.168.10.0 255.255.255.0 inside
    SSH 192.168.40.0 255.255.255.0 wireless
    SSH timeout 5
    Console timeout 0

    dhcpd 192.168.0.1 dns
    dhcpd outside auto_config
    !
    dhcpd address 192.168.10.21 - 192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    paybackloyalty.com dhcpd option 15 inside ascii interface
    dhcpd allow inside
    !
    dhcpd address 192.168.40.21 - 192.168.40.240 Wireless
    dhcpd dns 192.168.20.21 83.147.160.2 wireless interface
    dhcpd update dns of the wireless interface
    dhcpd option 15 ascii paybackloyalty.com wireless interface
    dhcpd activate wireless
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    internal Payback_VPN group strategy
    attributes of Group Policy Payback_VPN
    VPN - 10 concurrent connections
    Ikev1 VPN-tunnel-Protocol
    Split-tunnel-policy tunnelspecified
    value of Split-tunnel-network-list Payback_VPN_splitTunnelAcl
    attributes of Group Policy DfltGrpPolicy
    value of 83.147.160.2 DNS server 83.147.160.130
    VPN-tunnel-Protocol ikev1, ikev2 clientless ssl
    internal GroupPolicy_84.39.233.50 group strategy
    attributes of Group Policy GroupPolicy_84.39.233.50
    VPN-tunnel-Protocol ikev1, ikev2
    Noelle XB/IpvYaATP.2QYm username encrypted password
    Noelle username attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    username Éanna encrypted password privilege 0 vXILR9ZZQIsd1Naw
    Éanna attributes username
    VPN-group-policy Payback_VPN
    type of remote access service
    Michael qpbleUqUEchRrgQX of encrypted password username
    user name Michael attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    username, password from Danny .7fEXdzESUk6S/cC encrypted privilege 0
    user name Danny attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    Aileen tytrelqvV5VRX2pz encrypted password privilege 0 username
    user name Aileen attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    Aidan aDu6YH0V5XaxpEPg encrypted password privilege 0 username
    Aidan username attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
    shane.c iqGMoWOnfO6YKXbw encrypted password username
    username shane.c attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    Shane uYePLcrFadO9pBZx of encrypted password username
    user name Shane attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    username, encrypted James TdYPv1pvld/hPM0d password
    user name James attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    Mark yruxpddqfyNb.qFn of encrypted password username
    user name brand attributes
    type of service admin
    username password of Mary XND5FTEiyu1L1zFD encrypted
    user name Mary attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    Massimo vs65MMo4rM0l4rVu encrypted password privilege 0 username
    Massimo username attributes
    VPN-group-policy Payback_VPN
    type of remote access service
    type tunnel-group Payback_VPN remote access
    attributes global-tunnel-group Payback_VPN
    VPN1 address pool
    Group Policy - by default-Payback_VPN
    IPSec-attributes tunnel-group Payback_VPN
    IKEv1 pre-shared-key *.
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 General-attributes
    Group - default policy - GroupPolicy_84.39.233.50
    IPSec-attributes tunnel-group 84.39.233.50
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    Global class-card class
    match default-inspection-traffic
    !
    !
    World-Policy policy-map
    Global category
    inspect the dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    Review the ip options
    inspect the netbios
    inspect the pptp
    inspect the rsh
    inspect the rtsp
    inspect the sip
    inspect the snmp
    inspect sqlnet
    inspect sunrpc
    inspect the tftp
    inspect xdmcp
    inspect the icmp error
    inspect the icmp
    !
    service-policy-international policy global
    192.168.20.21 SMTP server
    context of prompt hostname
    no remote anonymous reporting call
    call-home
    Profile of CiscoTAC-1
    no active account
    http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
    email address of destination [email protected] / * /
    destination-mode http transport
    Subscribe to alert-group diagnosis
    Subscribe to alert-group environment
    Subscribe to alert-group monthly periodic inventory
    monthly periodicals to subscribe to alert-group configuration
    daily periodic subscribe to alert-group telemetry
    Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1

    ASA 2

    ASA Version 9.0 (1)

    !

    Payback-CIX hostname

    activate the encrypted password of HSMurh79NVmatjY0

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    !

    interface Ethernet0/0

    switchport access vlan 2

    Speed 100

    full duplex

    !

    interface Ethernet0/1

    Description this port connects to the local network VIRTUAL 100

    switchport access vlan 100

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    switchport access vlan 100

    !

    interface Ethernet0/4

    switchport access vlan 100

    !

    interface Ethernet0/5

    switchport access vlan 100

    !

    interface Ethernet0/6

    switchport access vlan 100

    !

    interface Ethernet0/7

    switchport access vlan 100

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP 84.39.233.50 255.255.255.240

    !

    interface Vlan100

    nameif inside

    security-level 100

    IP 192.168.100.1 address 255.255.255.0

    !

    banner welcome to Payback loyalty - CIX connection line

    passive FTP mode

    summer time clock gmt/idt recurring last Sun Mar 01:00 last Sun Oct 02:00

    DNS domain-lookup outside

    DNS lookup field inside

    DNS server-group defaultDNS

    Name-Server 8.8.8.8

    Server name 8.8.4.4

    permit same-security-traffic inter-interface

    network obj_any object

    subnet 0.0.0.0 0.0.0.0

    network of the host-CIX-1 object

    host 192.168.100.2

    Description This is the VM server host machine

    network object host-External_CIX-1

    Home 84.39.233.51

    Description This is the external IP address of the server the server VM host

    service object RDP

    source between 1-65535 destination eq 3389 tcp service

    network of the Payback_Office object

    Home 92.51.193.158

    service object MSQL

    destination eq 1433 tcp service

    network of the Development_OLTP object

    Home 192.168.100.10

    Description for Eiresoft VM

    network of the External_Development_OLTP object

    Home 84.39.233.52

    Description This is the external IP address for the virtual machine for Eiresoft

    network of the Eiresoft object

    Home 146.66.160.70

    Contractor s/n description

    network of the External_TMC_Web object

    Home 84.39.233.53

    Description Public address to the TMC Web server

    network of the TMC_Webserver object

    Home 192.168.100.19

    Internal description address TMC Webserver

    network of the External_TMC_OLTP object

    Home 84.39.233.54

    External targets OLTP IP description

    network of the TMC_OLTP object

    Home 192.168.100.18

    description of the interal target IP address

    network of the External_OLTP_Failover object

    Home 84.39.233.55

    IP failover of the OLTP Public description

    network of the OLTP_Failover object

    Home 192.168.100.60

    Server failover OLTP description

    network of the servers object

    subnet 192.168.20.0 255.255.255.0

    being Wired network

    192.168.10.0 subnet 255.255.255.0

    the subject wireless network

    192.168.40.0 subnet 255.255.255.0

    network of the NETWORK_OBJ_192.168.100.0_24 object

    255.255.255.0 subnet 192.168.100.0

    network of the NETWORK_OBJ_192.168.10.0_24 object

    192.168.10.0 subnet 255.255.255.0

    network of the Eiresoft_2nd object

    Home 137.117.217.29

    Description 2nd Eiresoft IP

    network of the Dev_Test_Webserver object

    Home 192.168.100.12

    Description address internal to the Test Server Web Dev

    network of the External_Dev_Test_Webserver object

    Home 84.39.233.56

    Description This is the PB Dev Test Webserver

    network of the NETWORK_OBJ_192.168.1.0_24 object

    subnet 192.168.1.0 255.255.255.0

    object-group service DM_INLINE_SERVICE_1

    service-object MSQL

    service-object RDP

    object-group service DM_INLINE_SERVICE_2

    service-object MSQL

    service-object RDP

    object-group service DM_INLINE_SERVICE_3

    service-object MSQL

    service-object RDP

    object-group service DM_INLINE_SERVICE_4

    service-object MSQL

    service-object RDP

    the tcp destination eq ftp service object

    object-group service DM_INLINE_SERVICE_5

    service-object MSQL

    service-object RDP

    the tcp destination eq ftp service object

    object-group service DM_INLINE_SERVICE_6

    service-object MSQL

    service-object RDP

    the Payback_Intrernal object-group network

    object-network servers

    Wired network-object

    wireless network object

    object-group service DM_INLINE_SERVICE_7

    service-object MSQL

    service-object RDP

    object-group service DM_INLINE_SERVICE_8

    service-object MSQL

    service-object RDP

    object-group service DM_INLINE_SERVICE_9

    service-object MSQL

    service-object RDP

    object-group service DM_INLINE_SERVICE_10

    service-object MSQL

    service-object RDP

    the tcp destination eq ftp service object

    object-group service DM_INLINE_SERVICE_11

    service-object RDP

    the tcp destination eq ftp service object

    outside_access_in list extended access allow object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-host-1

    Note to access list OLTP Development Office of recovery outside_access_in

    outside_access_in list extended access allow DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP object-group

    Comment from outside_access_in-access Eiresoft access list

    outside_access_in list extended access allow DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP object-group

    outside_access_in list extended access allow DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver object-group

    Note to outside_access_in access to OLTP for target recovery Office Access list

    outside_access_in list extended access allow DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP object-group

    outside_access_in list extended access allow DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover object-group

    Note to outside_access_in access-list that's allowing access of the Eiresoft on the failover OLTP server

    outside_access_in list extended access allow DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover object-group

    Comment from outside_access_in-access list access for the 2nd period of INVESTIGATION of Eiresoft

    outside_access_in list extended access allow DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP object-group

    Note to outside_access_in access from the 2nd IP Eiresoft access list

    outside_access_in list extended access allow DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover object-group

    outside_access_in list extended access allow DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver object-group

    outside_access_in list extended access allow DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP object-group

    outside_cryptomap to access extended list ip 192.168.100.0 allow 255.255.255.0 192.168.10.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Outside 1500 MTU

    Within 1500 MTU

    ICMP unreachable rate-limit 1 burst-size 1

    don't allow no asdm history

    ARP timeout 14400

    no permit-nonconnected arp

    NAT (inside, outside) source Dynamics one interface

    NAT (inside, outside) static source CIX-host-1 External_CIX-host-1

    NAT (inside, outside) static source Development_OLTP External_Development_OLTP

    NAT (inside, outside) static source TMC_Webserver External_TMC_Web

    NAT (inside, outside) static source TMC_OLTP External_TMC_OLTP

    NAT (inside, outside) static source OLTP_Failover External_OLTP_Failover

    NAT (inside, outside) static source Dev_Test_Webserver External_Dev_Test_Webserver

    NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

    NAT (inside, outside) static source NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 84.39.233.49 1

    Timeout xlate 03:00

    Pat-xlate timeout 0:00:30

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    identity of the user by default-domain LOCAL

    the ssh LOCAL console AAA authentication

    Enable http server

    http 92.51.193.156 255.255.255.252 outside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac

    Crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-TRANS-aes - esp esp-md5-hmac

    Crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

    Crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

    Crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

    Crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

    Crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transit

    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

    Crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

    Crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-DES-SHA-TRANS esp - esp-sha-hmac

    Crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transit

    Crypto ipsec transform-set ikev1 ESP-DES-MD5-TRANS esp - esp-md5-hmac

    Crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transit

    Crypto ipsec ikev2 ipsec-proposal OF

    encryption protocol esp
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 proposal ipsec 3DES
    Esp 3des encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES
    Esp aes encryption protocol
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 ipsec-proposal AES192
    Protocol esp encryption aes-192
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec ikev2 AES256 ipsec-proposal
    Protocol esp encryption aes-256
    Esp integrity sha - 1, md5 Protocol
    Crypto ipsec pmtu aging infinite - the security association
    card crypto outside_map 1 match address outside_cryptomap
    card crypto outside_map 1 set pfs
    peer set card crypto outside_map 1 92.51.193.158
    card crypto outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
    outside_map card crypto 1jeu ikev2 AES AES192 AES256 3DES ipsec-proposal
    outside_map interface card crypto outside
    trustpool crypto ca policy
    IKEv2 crypto policy 1
    aes-256 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 10
    aes-192 encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 20
    aes encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 30
    3des encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    IKEv2 crypto policy 40
    the Encryption
    integrity sha
    Group 2 of 5
    FRP sha
    second life 86400
    Crypto ikev2 allow outside
    Crypto ikev1 allow outside
    IKEv1 crypto policy 10
    authentication crack
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 20
    authentication rsa - sig
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 30
    preshared authentication
    aes-256 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 40
    authentication crack
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 50
    authentication rsa - sig
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 60
    preshared authentication
    aes-192 encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 70
    authentication crack
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 80
    authentication rsa - sig
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 90
    preshared authentication
    aes encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 100
    authentication crack
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 110
    authentication rsa - sig
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 120
    preshared authentication
    3des encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 130
    authentication crack
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 140
    authentication rsa - sig
    the Encryption
    sha hash
    Group 2
    life 86400
    IKEv1 crypto policy 150
    preshared authentication
    the Encryption
    sha hash
    Group 2
    life 86400
    Telnet timeout 5
    SSH 77.75.100.208 255.255.255.240 outside
    SSH 92.51.193.156 255.255.255.252 outside
    SSH timeout 5
    Console timeout 0

    dhcpd outside auto_config
    !
    a basic threat threat detection
    Statistics-list of access threat detection
    no statistical threat detection tcp-interception
    internal GroupPolicy_92.51.193.158 group strategy
    attributes of Group Policy GroupPolicy_92.51.193.158
    VPN-tunnel-Protocol ikev1, ikev2
    username password 6e6Djaz3W/XH59zX gordon encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 General-attributes
    Group - default policy - GroupPolicy_92.51.193.158
    IPSec-attributes tunnel-group 92.51.193.158
    IKEv1 pre-shared-key *.
    remote control-IKEv2 pre-shared-key authentication *.
    pre-shared-key authentication local IKEv2 *.
    !
    class-map inspection_default
    match default-inspection-traffic
    !
    !
    type of policy-card inspect dns preset_dns_map
    parameters
    maximum message length automatic of customer
    message-length maximum 512
    Policy-map global_policy
    class inspection_default
    inspect the preset_dns_map dns
    inspect the ftp
    inspect h323 h225
    inspect the h323 ras
    inspect the rsh
    inspect the rtsp
    inspect esmtp
    inspect sqlnet
    inspect the skinny
    inspect sunrpc
    inspect xdmcp
    inspect the sip
    inspect the netbios
    inspect the tftp
    Review the ip options
    inspect the icmp
    !
    global service-policy global_policy
    context of prompt hostname
    no remote anonymous reporting call
    Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
    : end

    Hello

    There are some clear problems I see on a quick glance. These are not related to the actual VPN configuration but rather the NAT configurations.

    All your configuration of NAT CLI format above are configured as manual NAT / double NAT in Section 1. This means that the appliance NAT configurations have been added to the same section of the NAT configurations and scheduling of the NAT inside this Section rules is the cause of the problem for the L2L VPN connection for some.

    Here are a few suggestions on what to change

    ASA1

    Minimal changes

    the object of the LAN network

    192.168.10.0 subnet 255.255.255.0

    being REMOTE-LAN network

    255.255.255.0 subnet 192.168.100.0

    NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

    no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 non-proxy-arp-search of route static destination

    That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

    Finally, we remove the old rule that generated the ASDM. It would do the same thing if it has been moved to the top, but I generally find the creation of the 'object' with descriptive names easier on the eyes in the long term.

    Other suggestions

    These changes are not necessary with regard to the VPN L2L. Here are some suggestions how to clean a part of NAT configurations.

    PAT-SOURCE network object-group

    source networks internal PAT Description

    object-network 192.168.10.0 255.255.255.0

    object-network 192.168.20.0 255.255.255.0

    object-network 192.168.40.0 255.255.255.0

    NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

    No source (indoor, outdoor) nat Dynamics one interface

    no nat (wireless, outdoors) source Dynamics one interface

    no nat (servers, outside) no matter what source dynamic interface

    The above configuration creates a "object-group" that lists all internal networks that you have dynamic PAT configured so far. It then uses the ' object-group ' in a command unique 'nat' to manage the dynamic PAT for all internal networks (with the exception of printers who had nothing at first). Then we remove the old PAT dynamic configurations.

    Contains the command "nat" "car after" because it moving this "nat" configuration to the bottom of the NAT rules. For this reason its less likely to cause problems in the future.

    network of the SERVERS object

    subnet 192.168.20.0 255.255.255.0

    network of the VPN-POOL object

    192.168.50.0 subnet 255.255.255.0

    NAT (servers, external) 2 static static source of destination of SERVERS SERVERS VPN-VPN-POOL

    no nat (servers, external) static source NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 non-proxy-arp-search of route static destination

    The above configuration is supposed to create a NAT0 configuration for traffic between the network and the pool of Client VPN server. To my knowledge the old configuration that remove us is not used because the traffic would have matched PAT rule dynamic server yet rather than this rule which is later in the NAT configurations and would not be addressed.

    no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

    It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

    ASA2

    Minimal changes

    the object of the LAN network

    255.255.255.0 subnet 192.168.100.0

    being REMOTE-LAN network

    192.168.10.0 subnet 255.255.255.0

    NAT (inside, outside) 1 static source LAN LAN to static destination REMOTE - LAN LAN

    no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 non-proxy-arp-search of route static destination

    That means foregoing is first of all create 'object' that contain the local LAN and remote LANs. Then, it creates a NAT0 rule and adds to the top rules NAT. (number 1). It is essentially of at least one of the problems preventing the VPN operation or traffic that cross.

    Finally, we remove the old rule that generated the ASDM.

    Other suggestions

    PAT-SOURCE network object-group

    object-network 192.168.100.0 255.255.255.0

    NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source

    No source (indoor, outdoor) nat Dynamics one interface

    The above configuration is supposed to do the same thing with the other ASA. Although given that this network contains only a single subnet it cleans the "nat" configurations exist that much. But the order of the "nat" configurations is changed to avoid further problems with the NAT order.

    no nat source (indoor, outdoor) public static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 non-proxy-arp-search of route static destination

    It seems to me that network 192.168.1.0/24 is not configured from anywhere in your network. Therefore, the above 'nat' configuration seems useless, can be deleted. If I missed something and its use in then of course do not remove it.

    I suggest trying the changes related to VPN L2L first NAT0 configurations and test traffic. So who gets the work of connectivity, then you could consider changing other NAT configurations. There are other things that could be changed also in what concerns THAT static NAT servers but that probably better left for another time.

    Hope this makes any sense and has helped

    Remember to mark a reply as the answer if it answered your question.

    Feel free to ask more if necessary

    -Jouni

  • VPN site to Site with restrictions (vpn-filter)

    VPN site to site, I installed and it works fine and two site can meet but I question after the vpn enforcement - run under Group Policy

    restrict users in the local site for dial-up networking with specific tcp ports, the vpn does not not like after order question «sh l2l vpn-sessiondb»

    This works but users can't access something in the remote site

    Note > after rising online in ACL at the end with this

    US_SITE ip access list allow a whole

    new to works well again

    example of a line of Access-List

    US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.23 HTTP_HTTPS object-group
    US_SITE list extended access permit tcp host 10.68.22.50 host 192.168.10.24 HTTP_HTTPS object-group

    local network: 10.68.22.50

    remote network: 192.168.10.24

    is that correct or not?

    attributes of the strategy group x.x.x.x
    value of VPN-filer US_SITE

    tunnel-group General y.y.y.y
    x.x.x.x by default-group-policy

    Note: allowed sysopt active vpn connection

    The syntax on ACL that is used as a vpn-filter is different from what is normally expected. These VPN filters is not a direction, it should be noted the traffic we want to allow incoming and outgoing of the VPN in an ACL. The syntax for this is:

    access-list X permit/deny REMOTE-DEFINITION LOCAL-DEFINITION

    Example: You want to allow local users to access the RDP on the remote site:

    access-list VPN-ACL permit tcp host 192.168.10.24 eq 3389 10.68.22.0 255.255.255.0
    Disadvantage: This is all really confusing, and you can't afford things like Ping in one direction.

  • Problem with VPN Site-to-Site between RV215W and ASA5510

    The RV215W is intended to connect a new branch via 3G, but fail.

    But when connected to the internet via a cable modem VPN works.

    I have set up with the FULL domain name and remote ip address.

    Please help me soon as soon as you can.

    Thaks a lot.

    Henriux2412.

    Dear Henry;

    Thank you to the small community of Support Business.

    I doubt that this VPN site-to-site is compatible with the USB modem broadband Mobile 3 G, but I have when even suggest to verify that the Status field of the map will show your mobile card is connected (status > Mobile network). I've seen a similar problem with a Verizon USB modem where the solution was to change a few settings in their access Manager software ("NDIS Mode - connect manually" has been selected and change this option to "Modem Mode - connect manually fixed), but if this is not your case then I suggest you to check with your service provider about supported VPN site to site on the WAN configuration.

    Except that I advise you to contact the Small Business Support Center for more information on this subject, although I don't think they will support

    https://supportforums.Cisco.com/community/NetPro/small-business/sbcountrysupport

    Do not hesitate to contact me if there is anything I can help you with in the meantime.

    Kind regards

    Jeffrey Rodriguez S... : | :. : | :.
    Support Engineer Cisco client

    * Please rate the Post so other will know when an answer has been found.

  • IPSec VPN Site-to-Site router Cisco 837 to Firewall FortiGate 200 has

    I had a challege for a site to site vpn scenario that may need some brainstorming you guys.

    So far, I have had a prior configuration planned for this scenario, but I'm not very sure if the tunnel I created will work because I did not test it before with this scenario. I'll go next week on this project and hopefully get a solution of brainstorming you guys. Thanks in advance!

    Network diagram:

    http://cjunhan.multiply.com/photos/hi-res/5/3?xurl=%2Fphotos%2Fphoto%2F5%2F3

    Challenge:

    (1) configure CISCO R3 IPSec Site to Site VPN between 172.20.10.0 and 10.20.20.0 using cryptographic cards

    (2) IKE Phase I MainMode, lifetime 28000, md5, DH-Group1

    IKE Phase II: des-esp, hmac-md5, tunnel mode

    PSK: sitetositevpn

    Here is my setup for review:

    crypto ISAKMP policy 10

    the BA

    preshared authentication

    Group 1

    md5 hash

    ISAKMP crypto key sitetositevpn address 210.x.x.66

    !

    Crypto ipsec transform-set esp - esp-md5-hmac ciscoset

    !

    infotelmap 10 ipsec-isakmp crypto map

    the value of 210.x.x.66 peer

    Set transform-set ciscoset

    match address 111

    !

    !

    interface Ethernet0

    3 LAN description

    IP 10.20.20.1 255.255.255.0

    IP nat inside

    servers-exit of service-policy policy

    Hold-queue 100 on

    !

    ATM0 interface

    no ip address

    ATM vc-per-vp 64

    No atm ilmi-keepalive

    DSL-automatic operation mode

    !

    point-to-point interface ATM0.1

    IP address 210.x.20.x.255.255.252

    no ip redirection<-- disable="">

    no ip unreachable<-- disable="" icmp="" host="" unreachable="">

    no ip proxy-arp<-- disables="" ip="" directed="">

    NAT outside IP

    PVC 8/35

    aal5snap encapsulation

    !

    !

    IP nat inside source list 102 interface ATM0.1 overload

    IP classless

    IP route 0.0.0.0 0.0.0.0 ATM0.1

    IP route 0.0.0.0 0.x.0.x.190.60.66

    no ip http secure server

    !

    Note access-list 102 NAT traffic

    access-list 102 permit ip 10.20.20.0 0.0.0.255 any

    !

    access-list 111 note VPN Site-to-Site 3 LAN to LAN 2 network

    access-list 111 allow 0.0.0.x.x.10.0 ip 10.20.20.0 0.0.0.255

    Kind regards

    Junhan

    Hello

    Three changes required in this configuration.

    (1) change the NAT-list access 102 as below:

    access-list 102 deny ip 10.20.20.0 0.0.0.255 172.20.10.0 0.0.0.255

    access-list 102 permit ip 10.20.20.0 0.0.0.255 any

    (2) place the card encryption on interface point-to-point ATM.

    (3) remote all of a default route.

    Thank you

    Mustafa

  • RV042 VPN site to Site

    Hello please could someone help me regarding my PROBLEM with VPN site-to-site.

    I have installation of gateway to gateway unfortunetly I don't have any static IP address, so I have 2 accounts of DynDNS.org on two installation Sites. The two RV042 connect to another router/Modem.

    I put the two as router in router Mode and not as a gateway.  The VPN status remains tab just to "waiting for connection" I can see the dynamic IP address to connect remotely on the main site and distance from each other.  I can ping so two dyndns names.  But unable to connect...

    The VPN log shows the following.

    ERROR: error report asynchronous network on eth1 to message to the port of 105.237.1.xx 500, complainant 192.168.137.153: no route to the host [errno 148, original ICMP type 3 code 1 (unauthenticated)]

    What is the main site and 192.168.138.0 the remote site, the main site has a subnet of 192.168.137.0

    Please could someone help me or point me in the right direction? Thanks in advance.

    Hi Stephen, it may be a few problems. The first is maybe that you said that you have a modem/router device, this means that it is for the RV042 nating.  If that's the case then the modems/routers upstream need port forwarding to go to the RV042. ICMP type 3 is a destination unreachable error. That means subnet remote th could not be reached by the applicant rv042. This can withdraw your NAT problem with modems/routers.

    So, first thing I would do is port before all the RV042 services to make sure that the firewall on the modems/routers aren't pipe upward works.

    -Tom
    Please mark replied messages useful

  • Tunnel VPN site to Site with 2 routers Cisco 1921

    Hi all

    So OK, I'm stumped. I create much s2s vpn tunnels before, but this one I just can't go there. It's just a tunnel VPN Site to Site simple using pre-shared keys. I would appreciate it if someone could take a look at our configs for both routers running and provide a comment. This is the configuration for both routers running. Thank you!

    Router 1

    =======

    Current configuration: 4009 bytes

    !

    ! Last configuration change at 19:01:31 UTC Wednesday, February 22, 2012 by asiuser

    !

    version 15.0

    horodateurs service debug datetime msec

    Log service timestamps datetime msec

    no password encryption service

    !

    SJWHS-RTRSJ host name

    !

    boot-start-marker

    boot-end-marker

    !

    !

    No aaa new-model

    !

    !

    !

    !

    No ipv6 cef

    IP source-route

    IP cef

    !

    !

    DHCP excluded-address 192.168.200.1 IP 192.168.200.110

    DHCP excluded-address IP 192.168.200.200 192.168.200.255

    !

    IP dhcp POOL SJWHS pool

    network 192.168.200.0 255.255.255.0

    default router 192.168.200.1

    10.10.2.1 DNS server 10.10.2.2

    !

    !

    no ip domain search

    IP-name 10.10.2.1 Server

    IP-name 10.10.2.2 Server

    !

    Authenticated MultiLink bundle-name Panel

    !

    !

    Crypto pki trustpoint TP-self-signed-236038042

    enrollment selfsigned

    name of the object cn = IOS - Self - signed - certificate - 236038042

    revocation checking no

    rsakeypair TP-self-signed-236038042

    !

    !

    TP-self-signed-236038042 crypto pki certificate chain

    certificate self-signed 01

    30820241 308201AA A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

    8B1E638A EC

    quit smoking

    license udi pid xxxxxxxxxx sn CISCO1921/K9

    !

    !

    !

    redundancy

    !

    !

    !

    !

    crypto ISAKMP policy 10

    md5 hash

    preshared authentication

    ISAKMP crypto key presharedkey address 112.221.44.18

    !

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

    !

    map CryptoMap1 10 ipsec-isakmp crypto

    defined by peer 112.221.44.18

    game of transformation-IPSecTransformSet1

    match address 100

    !

    !

    !

    !

    !

    interface GigabitEthernet0/0

    192.168.200.1 IP address 255.255.255.0

    automatic duplex

    automatic speed

    !

    !

    interface GigabitEthernet0/1

    Description wireless bridge

    IP 172.17.1.2 255.255.255.0

    automatic duplex

    automatic speed

    !

    !

    interface FastEthernet0/0/0

    Verizon DSL description for failover of VPN

    IP 171.108.63.159 255.255.255.0

    automatic duplex

    automatic speed

    card crypto CryptoMap1

    !

    !

    !

    Router eigrp 88

    network 172.17.1.0 0.0.0.255

    network 192.168.200.0

    redistribute static

    passive-interface GigabitEthernet0/0

    passive-interface FastEthernet0/0/0

    !

    IP forward-Protocol ND

    !

    no ip address of the http server

    local IP http authentication

    IP http secure server

    !

    IP route 0.0.0.0 0.0.0.0 172.17.1.1

    IP route 112.221.44.18 255.255.255.255 171.108.63.1

    !

    access-list 100 permit ip 192.168.200.0 0.0.0.255 10.10.0.0 0.0.255.255

    !

    !

    !

    !

    !

    !

    control plan

    !

    !

    !

    Line con 0

    Synchronous recording

    local connection

    line to 0

    line vty 0 4

    exec-timeout 30 0

    Synchronous recording

    local connection

    transport input telnet ssh

    !

    Scheduler allocate 20000 1000

    end

    =======

    Router 2

    =======

    Current configuration: 3719 bytes

    !

    ! Last configuration change at 18:52:54 UTC Wednesday, February 22, 2012 by asiuser

    !

    version 15.0

    horodateurs service debug datetime msec

    Log service timestamps datetime msec

    no password encryption service

    !

    SJWHS-RTRHQ host name

    !

    boot-start-marker

    boot-end-marker

    !

    logging buffered 1000000

    !

    No aaa new-model

    !

    !

    !

    !

    No ipv6 cef

    IP source-route

    IP cef

    !

    !

    !

    !

    no ip domain search

    !

    Authenticated MultiLink bundle-name Panel

    !

    !

    Crypto pki trustpoint TP-self-signed-3490164941

    enrollment selfsigned

    name of the object cn = IOS - Self - signed - certificate - 3490164941

    revocation checking no

    rsakeypair TP-self-signed-3490164941

    !

    !

    TP-self-signed-3490164941 crypto pki certificate chain

    certificate self-signed 01

    30820243 308201AC A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030

    2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

    EA1455E2 F061AA

    quit smoking

    license udi pid xxxxxxxxxx sn CISCO1921/K9

    !

    !

    !

    redundancy

    !

    !

    !

    !

    crypto ISAKMP policy 10

    md5 hash

    preshared authentication

    ISAKMP crypto key presharedkey address 171.108.63.159

    !

    86400 seconds, duration of life crypto ipsec security association

    !

    Crypto ipsec transform-set esp-3des esp-md5-hmac IPSecTransformSet1

    !

    map CryptoMap1 10 ipsec-isakmp crypto

    defined by peer 171.108.63.159

    game of transformation-IPSecTransformSet1

    match address 100

    !

    !

    !

    !

    !

    interface GigabitEthernet0/0

    no ip address

    automatic duplex

    automatic speed

    !

    !

    interface GigabitEthernet0/0.1

    encapsulation dot1Q 1 native

    IP 10.10.1.6 255.255.0.0

    !

    interface GigabitEthernet0/1

    IP 172.17.1.1 255.255.255.0

    automatic duplex

    automatic speed

    !

    !

    interface FastEthernet0/0/0

    IP 112.221.44.18 255.255.255.248

    automatic duplex

    automatic speed

    card crypto CryptoMap1

    !

    !

    !

    Router eigrp 88

    Network 10.10.0.0 0.0.255.255

    network 172.17.1.0 0.0.0.255

    redistribute static

    passive-interface GigabitEthernet0/0

    passive-interface GigabitEthernet0/0.1

    !

    IP forward-Protocol ND

    !

    no ip address of the http server

    local IP http authentication

    IP http secure server

    !

    IP route 0.0.0.0 0.0.0.0 112.221.44.17

    !

    access-list 100 permit ip 10.10.0.0 0.0.255.255 192.168.200.0 0.0.0.255

    !

    !

    !

    !

    !

    !

    control plan

    !

    !

    !

    Line con 0

    Synchronous recording

    local connection

    line to 0

    line vty 0 4

    exec-timeout 30 0

    Synchronous recording

    local connection

    transport input telnet ssh

    !

    Scheduler allocate 20000 1000

    end

    When the GRE tunnel carries your traffic to private ip range, your ACL must contain address of the host of point to point the IPSec tunnel.

    Since then, both routers are running EIGRP in the corporate network, let the EIGRP Exchange routes via GRE tunnel, which is a good practice, rather than push the ip ranges private individual through the IPSec tunnel.

    Let me know, if that's what you want.

    Thank you

Maybe you are looking for

  • buy Windows

    Hi all I'm trying to help a friend who is running on an interesting/irritating problem these last time. Buy songs on her phone, she wants to bring on his Windows PC as well. She'll have the e-mail marked "XYZ you sent a song on iTunes ', with the ico

  • Can't let site when I click the back button, it keeps just returning on the site, have to close firefox and try again.

    Can't let a Web site when I click the back button, it keeps just returning on the site, have to close Firefox and restart my search.The website below is just an example, it is a little more.Is this a problem with Firefox or this particular Web site?T

  • switch with debounce

    Hello world I need to make a transition, which does the following when you click: 1 - Turn on 2. wait 60 ms 3. cut I'm new to labview for what it is would be useful. Thank you

  • installare su ssd acer x 3910

    I wanted to know how I can install an SSD on my acer x 3910 on the computer there is 2 ports sata, one for the HD and one for the recorder, how can I do without giving up any of the quests?

  • Windows Installer service is missing from my Vista 32 bit. How to re-install Windows Installer?

    Windows Installer service is missing from my Vista 32 bit SP2. How can I re - install Windows Installer? None of the 27 sets of update and Installer Cleanup solutions worked, a last resort option could work but it will not install without the Windows