VPN site to Site VPN dynamic + XAUTH Catch 22

Similar Questions

• IKEv2 vpn dynamic sites

  I do ikev2 VPN with the ASA and sites have a dynamic IP. A solution is to do a vpn site-to site, configure ASA headoffice with dynamic crypto map and the asa of the client with static cryptographic cards and put even the intellectual Headquarters property.

  However, a better approach would be the classic scenario of ezvpn but I can't find a reference doc or config for ikev2. Is this supported using ikev2 or the only option, I have one I described above?

  Hello

  IKEv2 support for VPN tunnels easy on ASAs is not available, only for IKEv1.

  It is available on routers Cisco, called FlexVPN:

  FlexVPN on Cisco routers:

  https://supportforums.Cisco.com/community/NetPro/security/VPN/blog/2012/...

  Kind regards

  Aditya

  Please evaluate the useful messages and mark the correct answers.

• VPN site to Site with dynamic routing on ASAs

  I'm planning a backup connection to a primary site if our link main broken through two ASAs using site to site vpn.

  This is what I have resulted to date and just need to work through some issues and best practices.

  ##Regular connectivity and Internet traffic flow "> Primary_Internet".

  Backup_Internet - ASA - CoreA - router-->> Private_Wan<>

  ?? If Private_Wan a link down, use via ASA l2l Internet VPN to connect sites

  x - router - CoreA - ASA-->> VPN l2l<>

  ?? Once the link is available, preferred over the private Wan path must be used.

  A few questions,

  1. can I use a routing via the l2l VPN Protocol? VTI, GRE?

  2. If I enter OSPF or EIGRP, will be the last static use of each work in the ASA redistibuting?

  3. in execution of VPN l2l, using 'show the way' does not show available via the vpn routes, only "crypto ipsec to show his" watch info. Is this correct? If yes how metric would work for routes registered if all the links are up and there are many paths to the same subnet?

  Welllll,

  (2) I would keep as simple as possible, you can put all one VPN perhaps NSSA, if your ASA touch BB.

  (3) IPP on ASA is always the insertion of static routes, it is not the best way to generate the backup.

  Marcin

• Problem of site 2 site config dynamic to static

  I must be missing something in the config, but I'm not sure.

  Try to get a 506th PIX (6.3) at an ASA 5505 (7.2). The PIX is dynamic IP and the SAA is the static IP address. This is a second Site 2 site VPN between the PIX and PIX, another who has an IP staitic.

  I tried everything I can think of. I think it's on the side of the ASA, but not sure. I have reset the pre shared key several times. I tried the sysopt connection permit-vpn on the SAA. He took command, but it does not appear in the config of runn. Put in ipsec-ra tunnels both ipsec-l2l as well as other things. In any case, I have attached my config.

  Almost forgot, I used this link as a guide. http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805733df.shtml

  Thanks for your help - Keith

  Keith,

  I think you should compare your ASA to static IP and the PIX for dynamic-IP configs - see what is different (apart from the names of things)

  The pre-shared key, I used was test1234 at both ends.

• l2l ipsec vpn - problem XAUTH need-based policy

  Hello

  I have a problem that I see a few solutions but they do not work.

  I have a p2p IPSec vpn, which worked until I added access remote VPN configuration (which works perfectly).

  According to the documents, I used isakmp policy allowing mixed tunnels. Now, whenever I try to send traffic through the l2l link I get the following debugging results telling me that the remote router is demanding XAUTH.

  September 8 09:53:12: ISAKMP: (2015): the total payload length: 12

  September 8 09:53:12: ISAKMP: (2015): send package to [source] my_port 500 peer_port 500 (R) MM_KEY_EXCH

  September 8 09:53:12: ISAKMP: (2015): sending a packet IPv4 IKE.

  September 8 09:53:12: ISAKMP: (2015): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

  September 8 09:53:12: ISAKMP: (2015): former State = new State IKE_R_MM5 = IKE_P1_COMPLETE

  September 8 09:53:12: ISAKMP: (2015): need XAUTH

  September 8 09:53:12: ISAKMP: node set 1635909437 to CONF_XAUTH

  September 8 09:53:12: ISAKMP/xauth: application XAUTH_USER_NAME_V2 attribute

  September 8 09:53:12: ISAKMP/xauth: application XAUTH_USER_PASSWORD_V2 attribute

  September 8 09:53:12: ISAKMP: (2015): launch peer config [source]. ID = 1635909437

  September 8 09:53:12: ISAKMP: (2015): send package to [source] my_port 500 peer_port 500 (R) CONF_XAUTH

  September 8 09:53:12: ISAKMP: (2015): sending a packet IPv4 IKE.

  September 8 09:53:12: ISAKMP: (2015): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

  September 8 09:53:12: ISAKMP: (2015): former State = new State IKE_P1_COMPLETE = IKE_XAUTH_REQ_SENT

  September 8 09:53:12: ISAKMP (2015): package receipt from [source] 500 Global 500 (R) sport dport CONF_XAUTH

  September 8 09:53:20: ISAKMP (2015): package receipt from [source] 500 Global 500 (R) sport dport CONF_XAUTH

  September 8 09:53:27: ISAKMP: (2015): transmit phase 2 CONF_XAUTH 1635909437...

  September 8 09:53:27: ISAKMP (2015): increment the count of errors on the node, try 1 5: retransmit the phase 2

  September 8 09:53:27: ISAKMP (2015): increment the count of errors on his, try 1 5: retransmit the phase 2

  September 8 09:53:27: ISAKMP: (2015): transmit phase 2 1635909437 CONF_XAUTH

  September 8 09:53:27: ISAKMP: (2015): send package to [source] my_port 500 peer_port 500 (R) CONF_XAUTH

  September 8 09:53:27: ISAKMP: (2015): sending a packet IPv4 IKE.

  September 8 09:53:28: ISAKMP (2015): package receipt from [source] 500 Global 500 (R) sport dport CONF_XAUTH

  September 8 09:53:36: ISAKMP (2015): package receipt from [source] 500 Global 500 (R) sport dport CONF_XAUTH

  September 8 09:53:42: ISAKMP: (2015): transmit phase 2 CONF_XAUTH 1635909437...

  September 8 09:53:42: ISAKMP (2015): increment the count of errors on the node, try 2 of 5: retransmit the phase 2

  September 8 09:53:42: ISAKMP (2015): increment the count of errors on his, try 2 of 5: retransmit the phase 2

  September 8 09:53:42: ISAKMP: (2015): transmit phase 2 1635909437 CONF_XAUTH

  September 8 09:53:42: ISAKMP: (2015): send package to [source] my_port 500 peer_port 500 (R) CONF_XAUTH

  September 8 09:53:42: ISAKMP: (2015): sending a packet IPv4 IKE.

  September 8 09:53:44: ISAKMP (2015): package receipt from [source] 500 Global 500 (R) sport dport CONF_XAUTH

  September 8 09:53:44: ISAKMP: node set 2054552354 to CONF_XAUTH

  September 8 09:53:44: ISAKMP: (2015): HASH payload processing. Message ID = 2054552354

  September 8 09:53:44: ISAKMP: (2015): treatment of payload to DELETE. Message ID = 2054552354

  September 8 09:53:44: ISAKMP: (2015): peer does not paranoid KeepAlive.

  So, it seems that Phase 1 ends without XAUTH.

  Here's my cryptographic configurations:

  Keyring cryptographic s2s

  pre-shared key key address [source] [key]

  !

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  lifetime 28800

  !

  crypto ISAKMP policy 5

  BA 3des

  preshared authentication

  lifetime 28800

  !

  crypto ISAKMP policy 10

  preshared authentication

  lifetime 28800

  !

  Configuration group customer crypto isakmp [RA_GROUP]

  key [key2]

  DNS 192.168.7.7

  win 192.168.7.222

  ninterface.com field

  pool SDM_POOL_1

  ACL 100

  Max-users 6

  netmask 255.255.255.0

  ISAKMP crypto ciscocp-ike-profile-1 profile

  identity group match [RA_GROUP]

  client authentication list ciscocp_vpn_xauth_ml_1

  ISAKMP authorization list ciscocp_vpn_group_ml_1

  client configuration address respond

  virtual-model 1

  Crypto isakmp ISA_PROF profile

  S2S keyring

  function identity [source] address 255.255.255.255

  ISAKMP crypto unified profile

  identity group match [RA_GROUP]

  client authentication list ciscocp_vpn_xauth_ml_1

  ISAKMP authorization list ciscocp_vpn_grop_ml_1

  client configuration address respond

  !

  86400 seconds, duration of life crypto ipsec security association

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac VPN_T_BW

  Crypto ipsec transform-set MY - SET esp - aes 256 esp-sha-hmac

  Crypto ipsec transform-set esp-3des esp-sha-hmac trans-rem

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec df - bit clear

  !

  Profile of crypto ipsec CiscoCP_Profile1

  game of transformation-ESP-3DES-SHA

  set of isakmp - profile ciscocp-ike-profile-1

  !

  !

  Crypto dynamic-map [RA_GROUP] 77

  the transform-set trans-rem value

  Isakmp profile unified set

  market arriere-route

  !

  !

  !

  list of authentication of card crypto clientmap client RAD_GRP

  map clientmap isakmp authorization list rtr crypto / remote

  client configuration address map clientmap crypto answer

  card crypto clientmap 77-isakmp dynamic ipsec [RA_GROUP]

  !

  client configuration address card crypto [RA_GROUP] answer

  !

  Crypto card remote isakmp authorization list rtr / remote

  !

  RTP 10 ipsec-isakmp crypto map

  set peer [source]

  MY - Set transform-set

  PFS group2 Set

  match address 111

  It is a bit of a breakfast dogs because I'm at the time of implementation of policies.

  I managed to block xauth before I used policy by adding no_xauth the end of my speech key but I can't work out how to add this using the strategy.

  I'm something simple Paris that I missed.

  Thanks for your help!

  Hi Bruno.

  Thanks for the brief explanation.

  What crypto map is applied on the external interface?

  I think the "crypto isakmp profile" solution is the best way and they seem to be ok, however, we must remember that you cannot have a single card encryption by interface, so you should have something like this:

  1 - crypto dynamic-map outside_dynamic 10

  game of transformation-ESP-AES-SHA

  2-outside_map 10 ipsec-isakmp crypto map

  the value of xxxx.xxxx.xxxx.xxxx peer

  Map 3-crypto outside_map 65535-isakmp ipsec dynamic outside_dynamic

  4-interface f0/0

  outside_map card crypto

  * I'm not configure all of the cryptographic configuration, I wanted to give you a better idea.

  Please correct your configuration to accommodate one card encryption.

  Just to add more information on isakmp profiles:

  ISAKMP profile overview

  Let me know.

  Thank you.

  Portu.

• ASA - IOS VPN dynamic routing

  I saw the docs that show how to configure ASA-ASA VPN share OSPF routes and for IOS to IOS OSPF sharing routes. Is it possible to get the ASA to IOS device?

  I'm supposed to put in place a DMVPN through some remote sites, and there is an ASA one of the sites. The EIGRP routes are expected to be shared across the DMVPN (I suppose could go to OSPF if necessary). My plan for the site of the SAA was to set up a VPN site-to-site regular with the DMVPN hub and redistribute OSPF and EIGRP routes in the other, so the rays can talk to the ASA branch by the hub.

  Is it possible, or I have to use static routes to and from the network of the ASA?

  Xavier,

  In the road map you must place a match statement corresponding prefixes/subnets that you would like to advertise in EIGRP.

  About the ASA, normally you have not to, but I don't see a problem with the addition of statements of IPP in crypto card (normally).

  With regard to orders. I always refer people to self-help ;-)

  http://www.Cisco.com/en/us/products/ps10591/products_product_indices_list.html

  more precisely:

  http://www.Cisco.com/en/us/docs/iOS/MCL/allreleasemcl/all_book.html

  Docs IPP:

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_rev_rte_inject_ps10592_TSD_Products_Configuration_Guide_Chapter.html

  Redistribution of EIGRP:

  http://www.Cisco.com/en/us/docs/iOS-XML/iOS/iproute_eigrp/configuration/15-1mt/Configuring_EIGRP.html#GUID-1D5F3B6E-B89A-497A-BBC4-98C4A4E21CE7

  In any case take step by step, start by checking what the situation will be when you insert routes into the routing on the hub by RRI table. Then, if necessary, redistribute static routes in EIGRP.

  Marcin

• Dynamically to catch a call of function of an object at run time

  Hello

  I kinda an interesting question.

  I have a dynamic object called Foo. He may have a set of clearly defined functions:

  public function helloWorld (): String

  {

  return "hello world";

  }

  public function get name (): String

  {

  return to 'My Name';

  }

  etc.

  I want to be able to create another function

  public function handleFunctionCall (functionCall:String, args:Array) :*

  {

  trace ("function:" + functionCall + "has been called with the arguments :");)

  for (var i: int = 0; i < args.length; i ++)

  {

  trace (args [i]);

  }

  }

  This is so that I can declare the Foo object and then call any function and therefore manipulate during execution.

  for example

  var foo:Foo = new Foo();

  foo.bar ();

  foo. WhatHaveYou();

  foo. Whatever();

  Hope someone can point me in the right direction.

  If you can have your dynamic class extend proxy ( http://livedocs.adobe.com/flex/3/langref/flash/utils/Proxy.html ), maybe it's what you need.

• VPN site-to-site between 3 dynamic ip site to ip address static site

  Hi all

  I have a scenario,

  I have a static ip address in the headquarters and I have 4 office locations of all offices of construction site have dynamic ip.

  I created a site to site vpn between HO perfect work for 1 site office

  but I create a second profile in HO ASA for site office 2 config, I have created does not work.

  I use HO ASA 5520 and branches 5505 all site offices is ADSL connection

  I enclose my config HO

  Can u sat down just how dynamic config several profile in the HO

  Thank you

  Zeus

  It's just a suggestion...

  You want to get 3 dynamic sites connected with the HO, right?

  HO:

  As the branch have dynamic ip, you must use the DefaultL2LGroup profile (the same shared key for all three BO).

  The crypto-plan should be dynamic with the right soure/destination NET configured. Exempt NAT with the same source/destination NET as well.

  BO:

  Configured as a VPN Site-2-Site normal with the HO. The IPSEC Wizard is very useful.

  To connect to HO Bo, the branch must initiate the tunnel. After that, you have 2 full functional site site VPN.

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a00805733df.shtml

  Welcome,

  Norbert

• Tunnel VPN from Site to Site dynamic

  I spent the last 2 days, try to set up a dynamic tunnel VPN site to site of a Cisco 5510 to a Cisco SA540. The 540 is a dynamic supplier that can not be changed. There a dyndns account.

  I was lucky that the other 10 sites are all static and the ADSM Assistant creates these tunnels without problems.

  What I try to do is:

  Is it possible to do it VIA ADSM?

  If this isn't the case, someone please in detail can help with orders.

  Kind regards

  PP

  Hello Paul,

  This is possible thanks to the ASDM, but you do have to use some advanced settings:

  Configuration > VPN Site to Site > advanced > Tunnel groups

  It change the group called "DefaultL2LGroup" and add the brightness button before the SA540 (Note: all of your sites with dynamic IP addresses will have the same key communicated in advance, if you have IPSec VPN clients, it will be a good idea to use a different key).

  

  Click ok and then apply.

  Then go to Configuration > VPN Site to Site > advanced > Crypto Maps and add a new entry dynamic

  

  Make sure that you match the phase 2 are on your SA540 (pictured ESP-AES-128-SHA), select a dynamic strategy and make the last sequence number (65535) then ok, apply.

  Then go to Configuration > VPN Site to Site > advanced > IKE policies and make sure you have corresponding policies of the phase 1.

  

  If no corresponding policy is found, add them.

  Through CLI:

  IKEv1 crypto policy 1

  preshared authentication

  aes encryption

  sha hash

  Group 2

  Crypto-map dynamic outside_dyn_map 65535 set transform-set ESP-AES-128-SHA ikev1

  CARD crypto ipsec-isakmp 65535 dynamic outside_dyn_map

  IPSec-attributes tunnel-group DefaultL2LGroup

  IKEv1 pre-shared-key *.

  I hope this helps.

• VPN site-to-site dynamic-to-static

  Dear

  I have a few sites already connected with ASA 5505 VPN site to site with both ending static IP address.  Normally, all traffic can be found without any problems.  Even, I used 'inside access management' for the two ASA.

  Now I have a new office with only the ADSL pppoe.  I used to install between Site B:remote the site dynamic IP and IP SiteA:static with a similar example of this easy VPN: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

  All my ASA 5505 run 1 8.4 (4)

  Site A - Static IP

  Site B - Dynamic IP with pppoe connection.

  After EasyVPN connected, I don't know how I remote manangment of the site a lan at the ASA 5505 B site?

  Best regards

  Alan.

  If you're ok with or the other solution, it is probably easier to use dynamic to static lan-to-lan, so, at least, that your solution is consistent and fair use lan-to-lan tunnel instead of customer vpn solution mixture and lan-to-lan.

• Dynamic IP address of the remote VPN L2L ASA sites

  Hello

  I have a client who is to change their links to backup from ADSL to 4 G - LTE using Cisco 819 s.

  Unfortunately, access to 4G of PSI will have dynamic IP addressing. Online, I see configurations for one remote site with dynamic IP address, speaking to ASA, but I can't find anything on several sites of L2L linking to the ASA with dynamic addressing.

  Does anyone can help with examples of configuration

  concerning

  Richard

  Hi Richard,

  the next days I will also write a blogpost with triple recovery WAN by using this configuration.

  Michael

• Question of dynamic VPN

  Trying to setup VPN Dynamic tunnels site to site our ASA with a static ip address by using the correct method of Cisco. We do it for a few years, but apparently this is not the recommended method. We were advised to use the DefaultL2LGroup method.

  We have the standard model, but I do not see how this will work without the access lists we used previously.

  .

  ---------

  Model

  ---------

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT
  !
  Crypto-map mymap 1 transform-set RIGHT Dynamics
  Crypto-map mymap Dynamics 1 the value reverse-road
  10 IPSec-isakmp crypto map dyn-map mymap Dynamics
  dyn-map interface card crypto outside
  !
  crypto ISAKMP policy 10
  preshared authentication
  the Encryption
  md5 hash
  Group 2
  life 86400
  !
  IPSec-attributes tunnel-group DefaultL2LGroup
  pre-shared-key *.

  .

  ---------

  Previous config to access list

  ---------

  address the Site1 72 of the crypto dynamic-map WAN_cryptomap_59

  WAN_cryptomap_59 list extended access permitted ip object HQ Site1

  Hello

  Please follow below document

  TP: / /www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-gener...

  Concerning

  #Rohan

• L2l VPN using Dynamic IP - question

  Dear all,

  I have several sites with dynamic IP address.

  HO, I have a cisco router with dynamic IP, in which internet VPN and terminated on SAA configured port forwarding.

  I have 40 branches will be all dynamic ip. all L2L tunnels are running.

  My problem is that of creates a branch to HO communication is perfect but to HO, I'm not able to access the ants of branch resources.

  could someone help me solve this problem... Config is attached.

  AHA!

  I understand a little better Setup.

  It seems that your routers are destination NAT, so all the tunnels seem to come from the subnet "172.16.40.0/23."

  And indeed your hypothesis is correct problem seems to be related to the lack of correct roads pointing outward. (at least it seems that Yes for now).

  However, reverse route injection should take care of it.

  Speaking of which I noticed your field of tunnels on

  Crypto dynamic-map alfa and not the default system.

  Please add "crypto dynamic-map alfa 1 set reverse" and restart one of the tunnels (do not speak it, simply identify isakmp and ipsec for this session).

  We'll see from there.

  Marcin

• dynamic ip vpn configuration

  Hey friends

  I'm just CCNA, I have a project to set up vpn site to site and remote access on the pix firewall and cisco routers 3000... but the problem is that the main site has static ip address while other sites have dynamic IP addresses. can anyone guid me is possible vpn if

  1 - both sides have dynamic ips.

  2 - a site were static and the other dynamic.

  Hi Adam

  Please see this:

  How to configure a VPN tunnel to static-dynamic between a router with a dynamic IP address and an ASA

  Dynamic IPsec Tunnel between a statically addressed ASA and dynamically addressed Cisco IOS router that uses the example of Configuration of CCP

  LAN-to-LAN tunnels on a concentrator VPN 3000 with a PIX firewall DHCP

  HTH.

  Portu.

  Please note all useful posts

• Remote VPN cannot access devices LAN or internet

  So I have a server and a computer inside that I can access through an ASA 5505 with ASA 9.2 (1) and ASDM 7.2 (1)

  The computer on 192.168.1.110 via port 8080 can show me a demo site.

  The server on 192.168.1.222 got my DNS, HTTP, FTP, mail and more about it.

  Outside, I got a computer (by outside, I hear from the firewall and the cable directly into the computer) on 192.168.20.2 and firewall outside being 192.168.20.1

  From the outside I can access the 8080 without problem (and I guess as well with the server, but it is on another default gateway and are not accessible right now). -When I connect through my VPN I am assigned 192.168.30.5 but unable to connect inside the computer through 192.168.1.110:8080.

  This will return the error: asymmetrical NAT rules matched for before and back flow; Connection for udp src outdoors: 192.168.30.5/49608 (...) dst inside: 192.168.1.222/53 refused because of the failure of the path reverse NAT.

  Somewhere, I had a conflict or a non-created access rule. Anyone who wants to take a shot?

  I marked with "BOLD" for what I thought that may be the cause.

  ciscoasa (config) # sh running-config
  : Saved
  :
  ASA Version 9.2 (1)
  !
  ciscoasa hostname
  activate 8Ry2YjIyt7RRXU24 encrypted password
  volatile xlate deny tcp any4 any4
  volatile xlate deny tcp any4 any6
  volatile xlate deny tcp any6 any4
  volatile xlate deny tcp any6 any6
  volatile xlate deny udp any4 any4 eq field
  volatile xlate deny udp any4 any6 eq field
  volatile xlate deny udp any6 any4 eq field
  volatile xlate deny udp any6 any6 eq field
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  192.168.30.5 mask - 192.168.30.200 local pool Pool of IP IP 255.255.255.0
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.1.254 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  address 192.168.20.1 255.255.255.0
  !
  boot system Disk0: / asa921 - k8.bin
  passive FTP mode
  permit same-security-traffic intra-interface
  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  object network testServer-8080
  host 192.168.1.110
  Description of the test server
  network of the object server-21
  Home 192.168.1.222
  Description of the test server
  network of the object Server-25
  Home 192.168.1.222
  Description of the test server
  network of the object Server-53
  Home 192.168.1.222
  Description of the test server
  network of the object server-80
  Home 192.168.1.222
  Description of the test server
  network of the object server-443
  Home 192.168.1.222
  Description of the test server
  network of the object server-2525
  Home 192.168.1.222
  Description of the test server
  network of the object server-993
  Home 192.168.1.222
  Description of the test server
  network of the object server-6001
  Home 192.168.1.222
  Description of the test server
  network of the object server-6002
  Home 192.168.1.222
  Description of the test server
  network of the object server-6003
  Home 192.168.1.222
  Description of the test server
  network of the object server-6004
  Home 192.168.1.222
  Description of the test server
  network of the VPN HOST object
  192.168.30.0 subnet 255.255.255.0
  network of the object inside
  host 192.168.1.0
  the vpn server object network
  Home 192.168.1.222
  outside_access_in list extended access permit tcp any object testServer-8080 eq 8080
  outside_access_in list extended access permit tcp any object server-21 eq ftp
  outside_access_in list extended access permit tcp any object Server-25 eq smtp
  outside_access_in list extended access permit tcp any object server-2525 2525 eq
  outside_access_in list extended access permit udp any object server-53 eq inactive field
  outside_access_in list extended access permit tcp any object server-80 eq www
  outside_access_in list extended access permit tcp any object server-443 https eq
  outside_access_in list extended access permit tcp any object server-993 993 eq
  outside_access_in list extended access permit tcp any object server-6001 eq 6001
  outside_access_in list extended access permit tcp any object server-6002 6002 eq
  outside_access_in list extended access permit tcp any object server-6003 eq 6003
  outside_access_in list extended access permit tcp any object server-6004 eq 6004
  outside_access_in to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.30.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 721.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (inside, outside) VPN-dynamic HOSTS within static destination to source Server VPN - vpn server
  !
  network obj_any object
  NAT dynamic interface (indoor, outdoor)
  object network testServer-8080
  NAT (inside, outside) interface static 8080 8080 tcp service
  network of the object server-21
  NAT static (inside, inside) of the service ftp ftp tcp interface
  network of the object Server-25
  NAT (inside, outside) interface static tcp smtp smtp service
  network of the object Server-53
  NAT static (inside, inside) interface tcp service area
  network of the object server-80
  NAT (inside, outside) interface static tcp www www service
  network of the object server-443
  NAT (inside, outside) interface static tcp https https service
  network of the object server-2525
  NAT (inside, outside) interface static 2525 2525 tcp service
  network of the object server-993
  NAT (inside, outside) interface static tcp 993 993 service
  network of the object server-6001
  NAT (inside, outside) interface static tcp 6001 6001 service
  network of the object server-6002
  NAT (inside, outside) interface static tcp 6002 6002 service
  network of the object server-6003
  NAT (inside, outside) interface static 6003 6003 tcp service
  network of the object server-6004
  NAT (inside, outside) interface static service tcp 6004 6004
  Access-group outside_access_in in interface outside
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  RADIUS AAA server HSS-auth-server protocol
  allow only
  AAA-server HSS-auth-server (inside) host 192.168.1.222
  Timeout 5
  key *.
  identity of the user by default-domain LOCAL
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec pmtu aging infinite - the security association
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  trustpool crypto ca policy
  Crypto isakmp nat-traversal 30
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  authentication crack
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 20
  authentication rsa - sig
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 30
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 40
  authentication crack
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 50
  authentication rsa - sig
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 60
  preshared authentication
  aes-192 encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 70
  authentication crack
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 80
  authentication rsa - sig
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 90
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 100
  authentication crack
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 110
  authentication rsa - sig
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 120
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 130
  authentication crack
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 140
  authentication rsa - sig
  the Encryption
  sha hash
  Group 2
  life 86400
  IKEv1 crypto policy 150
  preshared authentication
  the Encryption
  sha hash
  Group 2
  life 86400
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0

  dhcpd outside auto_config
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  internal HSSvpn group strategy
  attributes of Group Policy HSSvpn
  value of server DNS 192.168.1.222
  Ikev1 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value outside_access_in ! This value was its own name earlier
  HSS.dk value by default-field
  type tunnel-group HSSvpn remote access
  attributes global-tunnel-group HSSvpn
  address IP-pool pool
  HSS-auth-server authentication-server-group
  Group Policy - by default-HSSvpn
  password-management
  IPSec-attributes tunnel-group HSSvpn
  IKEv1 pre-shared-key *.
  tunnel-group HSSvpn ppp-attributes
  No chap authentication
  no authentication ms-chap-v1
  ms-chap-v2 authentication
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:9859258e11364180cf9b3e21173b3f2f
  : end

  Hello

  "Nat" bold configuration is incorrect, as you would expect.

  Replace it with something like this

  the object of the LAN network
  subnet 192.168.1.0 255.255.255.0

  NAT (inside, outside) 1 static source LAN LAN to static destination HOST-VPN-VPN-HOST

  I also suggest using a separate access the ACL of the Tunnel from Split 'standard' list.

  For example

  standard SPLIT-TUNNEL access list permit 192.168.1.0 255.255.255.0

  Naturally, you must pass the ACL above to used "group policy" .

  In addition, if you want to control the incoming connections to VPN users in 'outside_access_in' ACL, then you could change the default settings on the SAA by running the command

  No vpn sysopt connection permit

  If you need to return back then just to deliver without 'no' in front. Then back to its default value. This does not show in the running configuration by the way.

  With this setting all connections from VPN connections should be allowed on the interface ACL interface that ends the VPN connection. If in your case that would be the ACL attached to the 'outside' interface.

  Hope this helps :)

  -Jouni