Active-Standby -Client-Site VPN

Dear Experts.
We have Cisco two ASA 5550 which is configured in Active-Standby mode but client-site VPN is not working when secondary unit becomes active. Failover status is showing as " Secondary Active" when primary unit is active all client-site VPN connections are working fine. Both ASA's has 7.2(3) IOS image and DES, 3DES/AES license enables.
We are getting following error messages
IPSEC: Deleted outbound permit rule, SPI 0xBFA351A9
Rule ID: 0x059C3060
IPSEC: Deleted outbound VPN context, SPI 0xBFA351A9
VPN handle: 0x00227DFC
Jan 09 13:23:52 [IKEv1]: Group = DefaultRAGroup, IP = x.x.x.x, Removing peer from peer table failed, no match!
Jan 09 13:23:52 [IKEv1]: Group = DefaultRAGroup, IP = x.x.x.x, Error: Unable to remove PeerTblEntry
Please advise

One of the things that I have seen that can cause symptoms like this is to not have some files in flash of the backup ASA. In particular I suggest that you check for files related to the client VPN. So get the output of show flash from the primary ASA and from the backup ASA and compare them.
HTH
Rick

Similar Messages

  • Email activity not working on Clients site

    Hi,
    I created a Bpel process that contains an email activity, It works fine when I am connected to the Oracle network through VPN and while i am in the Oracle office.
    But when I am at the clients site or connected through VPN, it doesnt work at all.
    when I configure my ns_emails.xml to Oracle's info, it works fine but when its configured to clients info, it doesnt work.
    I have configured ns_emails.xml and wf_config.xml
    This is my ns_emails.xml when I am at the clients site._
    note:_ Since I am not using the Default domain for deployment, I changed the <Name> under <EmailAccount> to cdmsd since I am deploying my Bpel processes to the cdmsd domain.
    ^<EmailAccounts xmlns="http://xmlns.oracle.com/ias/pcbpel/NotificationService"^
    ^ EmailMimeCharset=""^
    ^ NotificationMode="EMAIL">^
    ^ <EmailAccount>^
    ^ *<Name>cdmsd</Name>*^
    ^ <GeneralSettings>^
    ^ <FromName>Oracle BPM</FromName>^
    ^ <FromAddress>[email protected]</FromAddress>^
    ^ </GeneralSettings>^
    ^ <OutgoingServerSettings>^
    ^ <SMTPHost>mail.co.la.ca.us</SMTPHost>^
    ^ <SMTPPort>25</SMTPPort>^
    ^ </OutgoingServerSettings>^
    ^ <IncomingServerSettings>^
    ^ <Server>mail.co.la.ca.us</Server>^
    ^ <Port>25</Port>^
    ^ <Protocol>SMTP</Protocol>^
    ^ <UserName>[email protected]</UserName>^
    ^ <Password ns0:encrypted="false" xmlns:ns0="http://xmlns.oracle.com/ias/pcbpel/NotificationService">Temp123</Password>^
    ^ <UseSSL>true</UseSSL>^
    ^ <Folder>Inbox</Folder>^
    ^ <PollingFrequency>1</PollingFrequency>^
    ^ <PostReadOperation>^
    ^ <MarkAsRead/>^
    ^ </PostReadOperation>^
    ^ </IncomingServerSettings>^
    ^ </EmailAccount>^
    ^</EmailAccounts>^
    and for wf_config.xml I only add one line_
    ^<property name="oracle.bpel.services.notification.publisher_interval" value="1" />^
    I dont understand why its not working while I am on the clients site ?? any ideas ??
    could it be a network issue on their side ??

    I pinged my email server and I got the following:
    {size:12pt}
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),{size}
    Edited by: user9976478 on Jan 30, 2009 2:09 PM

  • %ASA-7-710005: TCP request discarded error in Client to Site VPN in CISCO ASA 5510

    Hi Friends,
    I'm trying to built client to site VPN in CISCO ASA 5510 8.4(4) and getting below error while connecting cisco VPN client software. Also, I'm getting below log in ASA. Please help me to reslove.
    Error in CISCO VPN Client Software:
    Secure VPN Connection Terminated locally by the client.
    Reason : 414 : Failed to establish a TCP connection.
    Error in CISCO ASA 5510
    %ASA-7-710005: TCP request discarded from <Public IP> /49276 to outside:<Outside Interface IP of my ASA> /10000
    ASA Configuration:
    XYZ# sh run
    : Saved
    ASA Version 8.4(4)
    hostname XYZ
    domain-name XYZ
    enable password 3uLkVc9JwRA1/OXb level 3 encrypted
    enable password R/x90UjisGVJVlh2 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    nameif outside_rim
    security-level 0
    ip address 1.1.1.1 255.255.255.252
    interface Ethernet0/1
    duplex full
    nameif XYZ_DMZ
    security-level 50
    ip address 172.1.1.1 255.255.255.248
    interface Ethernet0/2
    speed 100
    duplex full
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.252
    interface Ethernet0/3
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 3.3.3.3 255.255.255.224
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa844-k8.bin
    ftp mode passive
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    domain-name XYZ
    object network obj-172.17.10.3
    host 172.17.10.3
    object network obj-10.1.134.0
    subnet 10.1.134.0 255.255.255.0
    object network obj-208.75.237.0
    subnet 208.75.237.0 255.255.255.0
    object network obj-10.7.0.0
    subnet 10.7.0.0 255.255.0.0
    object network obj-172.17.2.0
    subnet 172.17.2.0 255.255.255.0
    object network obj-172.17.3.0
    subnet 172.17.3.0 255.255.255.0
    object network obj-172.19.2.0
    subnet 172.19.2.0 255.255.255.0
    object network obj-172.19.3.0
    subnet 172.19.3.0 255.255.255.0
    object network obj-172.19.7.0
    subnet 172.19.7.0 255.255.255.0
    object network obj-10.1.0.0
    subnet 10.1.0.0 255.255.0.0
    object network obj-10.2.0.0
    subnet 10.2.0.0 255.255.0.0
    object network obj-10.3.0.0
    subnet 10.3.0.0 255.255.0.0
    object network obj-10.4.0.0
    subnet 10.4.0.0 255.255.0.0
    object network obj-10.6.0.0
    subnet 10.6.0.0 255.255.0.0
    object network obj-10.9.0.0
    subnet 10.9.0.0 255.255.0.0
    object network obj-10.11.0.0
    subnet 10.11.0.0 255.255.0.0
    object network obj-10.12.0.0
    subnet 10.12.0.0 255.255.0.0
    object network obj-172.19.1.0
    subnet 172.19.1.0 255.255.255.0
    object network obj-172.21.2.0
    subnet 172.21.2.0 255.255.255.0
    object network obj-172.16.2.0
    subnet 172.16.2.0 255.255.255.0
    object network obj-10.19.130.201
    host 10.19.130.201
    object network obj-172.30.2.0
    subnet 172.30.2.0 255.255.255.0
    object network obj-172.30.3.0
    subnet 172.30.3.0 255.255.255.0
    object network obj-172.30.7.0
    subnet 172.30.7.0 255.255.255.0
    object network obj-10.10.1.0
    subnet 10.10.1.0 255.255.255.0
    object network obj-10.19.130.0
    subnet 10.19.130.0 255.255.255.0
    object network obj-XXXXXXXX
    host XXXXXXXX
    object network obj-145.248.194.0
    subnet 145.248.194.0 255.255.255.0
    object network obj-10.1.134.100
    host 10.1.134.100
    object network obj-10.9.124.100
    host 10.9.124.100
    object network obj-10.1.134.101
    host 10.1.134.101
    object network obj-10.9.124.101
    host 10.9.124.101
    object network obj-10.1.134.102
    host 10.1.134.102
    object network obj-10.9.124.102
    host 10.9.124.102
    object network obj-115.111.99.133
    host 115.111.99.133
    object network obj-10.8.108.0
    subnet 10.8.108.0 255.255.255.0
    object network obj-115.111.99.129
    host 115.111.99.129
    object network obj-195.254.159.133
    host 195.254.159.133
    object network obj-195.254.158.136
    host 195.254.158.136
    object network obj-209.164.192.0
    subnet 209.164.192.0 255.255.224.0
    object network obj-209.164.208.19
    host 209.164.208.19
    object network obj-209.164.192.126
    host 209.164.192.126
    object network obj-10.8.100.128
    subnet 10.8.100.128 255.255.255.128
    object network obj-115.111.99.130
    host 115.111.99.130
    object network obj-10.10.0.0
    subnet 10.10.0.0 255.255.0.0
    object network obj-115.111.99.132
    host 115.111.99.132
    object network obj-10.10.1.45
    host 10.10.1.45
    object network obj-10.99.132.0
    subnet 10.99.132.0 255.255.255.0
    object-group network Serversubnet
    network-object 10.10.1.0 255.255.255.0
    network-object 10.10.5.0 255.255.255.192
    object-group network XYZ_destinations
    network-object 10.1.0.0 255.255.0.0
    network-object 10.2.0.0 255.255.0.0
    network-object 10.3.0.0 255.255.0.0
    network-object 10.4.0.0 255.255.0.0
    network-object 10.6.0.0 255.255.0.0
    network-object 10.7.0.0 255.255.0.0
    network-object 10.11.0.0 255.255.0.0
    network-object 10.12.0.0 255.255.0.0
    network-object 172.19.1.0 255.255.255.0
    network-object 172.19.2.0 255.255.255.0
    network-object 172.19.3.0 255.255.255.0
    network-object 172.19.7.0 255.255.255.0
    network-object 172.17.2.0 255.255.255.0
    network-object 172.17.3.0 255.255.255.0
    network-object 172.16.2.0 255.255.255.0
    network-object 172.16.3.0 255.255.255.0
    network-object host 10.50.2.206
    object-group network XYZ_us_admin
    network-object 10.3.1.245 255.255.255.255
    network-object 10.5.33.7 255.255.255.255
    network-object 10.211.5.7 255.255.255.255
    network-object 10.3.33.7 255.255.255.255
    network-object 10.211.3.7 255.255.255.255
    object-group network XYZ_blr_networkdevices
    network-object 10.200.10.0 255.255.255.0
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host 172.16.2.21
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host 172.16.2.22
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host XXXXXXXX
    access-list XYZ_PAT extended permit ip 10.19.130.0 255.255.255.0 any
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 195.254.159.133
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 195.254.158.136
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 any
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 209.164.192.0 255.255.224.0
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 209.164.208.19
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 209.164.192.126
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.7.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.17.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.17.3.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.3.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.7.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.1.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.3.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.4.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.6.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.9.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.11.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.12.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.1.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.21.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.2.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.3.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.7.0 255.255.255.0
    access-list nonat extended permit ip object-group Serversubnet object-group XYZ_destinations
    access-list nonat extended permit ip 10.10.1.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list nonat extended permit ip 10.19.130.0 255.255.255.0 host XXXXXXXX
    access-list nonat extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list Guest_PAT extended permit ip 10.8.108.0 255.255.255.0 any
    access-list Cacib extended permit ip 10.8.100.128 255.255.255.128 145.248.194.0 255.255.255.0
    access-list Cacib_PAT extended permit ip 10.8.100.128 255.255.255.128 any
    access-list New_Edge extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.7.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.7.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 172.17.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.17.3.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.3.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.7.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.2.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.3.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.4.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.6.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.9.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.11.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.12.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.1.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.21.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.17.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.17.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.7.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.1.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.3.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.4.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.6.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.9.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.11.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.12.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.1.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.21.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.16.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.2.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.3.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.7.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.7.0 255.255.255.0
    access-list XYZ_global extended permit ip object-group Serversubnet object-group XYZ_destinations
    access-list XYZ_global extended permit ip object-group XYZ_destinations object-group Serversubnet
    access-list ML_VPN extended permit ip host 115.111.99.129 209.164.192.0 255.255.224.0
    access-list ML_VPN extended permit ip host 115.111.99.129 host 209.164.208.19
    access-list ML_VPN extended permit ip host 115.111.99.129 host 209.164.192.126
    access-list Da_VPN extended permit ip host 10.9.124.100 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.101 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.102 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.100 10.125.81.0 255.255.255.0
    access-list Da_VPN extended permit ip host 10.9.124.101 10.125.81.0 255.255.255.0
    access-list Da_VPN extended permit ip host 10.9.124.102 10.125.81.0 255.255.255.0
    access-list Sr_PAT extended permit ip 10.10.0.0 255.255.0.0 any
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 host 10.125.86.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 host 10.125.86.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 host 10.125.86.46
    access-list XYZ_reliance extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list coextended permit ip host 2.2.2.2 host XXXXXXXX
    access-list coextended permit ip host XXXXXXXXhost 2.2.2.2
    access-list ci extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list ci extended permit ip 208.75.237.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list acl-outside extended permit ip host 57.66.81.159 host 172.17.10.3
    access-list acl-outside extended permit ip host 80.169.223.179 host 172.17.10.3
    access-list acl-outside extended permit ip any host 172.17.10.3
    access-list acl-outside extended permit tcp any host 10.10.1.45 eq https
    access-list acl-outside extended permit tcp any any eq 10000
    access-list acl-outside extended deny ip any any log
    pager lines 10
    logging enable
    logging buffered debugging
    mtu outside_rim 1500
    mtu XYZ_DMZ 1500
    mtu outside 1500
    mtu inside 1500
    ip local pool XYZ_c2s_vpn_pool 172.30.10.51-172.30.10.254
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-208.75.237.0 obj-208.75.237.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.7.0.0 obj-10.7.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.17.2.0 obj-172.17.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.17.3.0 obj-172.17.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.2.0 obj-172.19.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.3.0 obj-172.19.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.7.0 obj-172.19.7.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.2.0.0 obj-10.2.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.3.0.0 obj-10.3.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.4.0.0 obj-10.4.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.6.0.0 obj-10.6.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.9.0.0 obj-10.9.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.11.0.0 obj-10.11.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.12.0.0 obj-10.12.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.1.0 obj-172.19.1.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.21.2.0 obj-172.21.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.16.2.0 obj-172.16.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.2.0 obj-172.30.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.3.0 obj-172.30.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.7.0 obj-172.30.7.0 no-proxy-arp route-lookup
    nat (inside,any) source static Serversubnet Serversubnet destination static XYZ_destinations XYZ_destinations no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-10.2.0.0 obj-10.2.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.0 obj-10.19.130.0 destination static obj-XXXXXXXX obj-XXXXXXXX no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.0 obj-10.19.130.0 destination static obj-145.248.194.0 obj-145.248.194.0 no-proxy-arp route-lookup
    nat (inside,outside) source static obj-10.1.134.100 obj-10.9.124.100
    nat (inside,outside) source static obj-10.1.134.101 obj-10.9.124.101
    nat (inside,outside) source static obj-10.1.134.102 obj-10.9.124.102
    nat (inside,outside) source dynamic obj-10.8.108.0 interface
    nat (inside,outside) source dynamic obj-10.19.130.0 obj-115.111.99.129
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-195.254.159.133 obj-195.254.159.133
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-195.254.158.136 obj-195.254.158.136
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.192.0 obj-209.164.192.0
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.208.19 obj-209.164.208.19
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.192.126 obj-209.164.192.126
    nat (inside,outside) source dynamic obj-10.8.100.128 obj-115.111.99.130
    nat (inside,outside) source dynamic obj-10.10.0.0 obj-115.111.99.132
    nat (inside,outside) source static obj-10.10.1.45 obj-115.111.99.133
    nat (inside,outside) source dynamic obj-10.99.132.0 obj-115.111.99.129
    object network obj-172.17.10.3
    nat (XYZ_DMZ,outside) static 115.111.99.134
    access-group acl-outside in interface outside
    route outside 0.0.0.0 0.0.0.0 115.111.23.129 1
    route outside 0.0.0.0 0.0.0.0 115.254.127.130 10
    route inside 10.10.0.0 255.255.0.0 10.8.100.1 1
    route inside 10.10.1.0 255.255.255.0 10.8.100.1 1
    route inside 10.10.5.0 255.255.255.192 10.8.100.1 1
    route inside 10.8.100.128 255.255.255.128 10.8.100.1 1
    route inside 10.8.108.0 255.255.255.0 10.8.100.1 1
    route inside 10.19.130.0 255.255.255.0 10.8.100.1 1
    route inside 10.99.4.0 255.255.255.0 10.99.130.254 1
    route inside 10.99.132.0 255.255.255.0 10.8.100.1 1
    route inside 10.1.134.0 255.255.255.0 10.8.100.1 1
    route outside 208.75.237.0 255.255.255.0 115.111.23.129 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication telnet console LOCAL
    aaa authorization command LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set vpn2 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn6 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set vpn5 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn7 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set vpn4 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn1 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn_reliance esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set c2s_vpn esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 86400
    crypto dynamic-map dyn1 1 set ikev1 transform-set c2s_vpn
    crypto dynamic-map dyn1 1 set reverse-route
    crypto map vpn 1 match address XYZ
    crypto map vpn 1 set peer XYZ Peer IP
    crypto map vpn 1 set ikev1 transform-set vpn1
    crypto map vpn 1 set security-association lifetime seconds 3600
    crypto map vpn 1 set security-association lifetime kilobytes 4608000
    crypto map vpn 2 match address NE
    crypto map vpn 2 set peer NE_Peer IP
    crypto map vpn 2 set ikev1 transform-set vpn2
    crypto map vpn 2 set security-association lifetime seconds 3600
    crypto map vpn 2 set security-association lifetime kilobytes 4608000
    crypto map vpn 4 match address ML_VPN
    crypto map vpn 4 set pfs
    crypto map vpn 4 set peer ML_Peer IP
    crypto map vpn 4 set ikev1 transform-set vpn4
    crypto map vpn 4 set security-association lifetime seconds 3600
    crypto map vpn 4 set security-association lifetime kilobytes 4608000
    crypto map vpn 5 match address XYZ_global
    crypto map vpn 5 set peer XYZ_globa_Peer IP
    crypto map vpn 5 set ikev1 transform-set vpn5
    crypto map vpn 5 set security-association lifetime seconds 3600
    crypto map vpn 5 set security-association lifetime kilobytes 4608000
    crypto map vpn 6 match address Da_VPN
    crypto map vpn 6 set peer Da_VPN_Peer IP
    crypto map vpn 6 set ikev1 transform-set vpn6
    crypto map vpn 6 set security-association lifetime seconds 3600
    crypto map vpn 6 set security-association lifetime kilobytes 4608000
    crypto map vpn 7 match address Da_Pd_VPN
    crypto map vpn 7 set peer Da_Pd_VPN_Peer IP
    crypto map vpn 7 set ikev1 transform-set vpn6
    crypto map vpn 7 set security-association lifetime seconds 3600
    crypto map vpn 7 set security-association lifetime kilobytes 4608000
    crypto map vpn interface outside
    crypto map vpn_reliance 1 match address XYZ_rim
    crypto map vpn_reliance 1 set peer XYZ_rim_Peer IP
    crypto map vpn_reliance 1 set ikev1 transform-set vpn_reliance
    crypto map vpn_reliance 1 set security-association lifetime seconds 3600
    crypto map vpn_reliance 1 set security-association lifetime kilobytes 4608000
    crypto map vpn_reliance interface outside_rim
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto isakmp identity address
    no crypto isakmp nat-traversal
    crypto ikev1 enable outside_rim
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28800
    crypto ikev1 policy 2
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    crypto ikev1 policy 4
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28000
    crypto ikev1 policy 5
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 10.8.100.0 255.255.255.224 inside
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    no threat-detection basic-threat
    no threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy XYZ_c2s_vpn internal
    username testadmin password oFJjANE3QKoA206w encrypted
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXXtype ipsec-l2l
    tunnel-group XXXXXXXXipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XYZ_c2s_vpn type remote-access
    tunnel-group XYZ_c2s_vpn general-attributes
    address-pool XYZ_c2s_vpn_pool
    tunnel-group XYZ_c2s_vpn ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect icmp
      inspect ip-options
    service-policy global_policy global
    privilege show level 3 mode exec command running-config
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command crypto
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:caa7476cd348ed89b95d37d4e3c9e1d8
    : end
    XYZ#

    Thanks Javier.
    But i have revised the VPN confuration. Below are the latest configs. with this latest configs. I'm getting username & password screen while connecting cisco vpn client software. once we entered the login credential. it shows "security communication channel" then it goes to "not connected" state. Can you help me to fix this.
    access-list ACL-RA-SPLIT standard permit host 10.10.1.3
    access-list ACL-RA-SPLIT standard permit host 10.10.1.13
    access-list ACL-RA-SPLIT standard permit host 10.91.130.201
    access-list nonat line 1 extended permit ip host 10.10.1.3 172.30.10.0 255.255.255.0
    access-list nonat line 2 extended permit ip host 10.10.1.13 172.30.10.0 255.255.255.0
    access-list nonat line 3 extended permit ip host 10.91.130.201 172.30.10.0 255.255.255.0
    ip local pool CO-C2S-VPOOL 172.30.10.51-172.30.10.254 mask 255.255.255.0
    group-policy CO-C2S internal
    group-policy CO-C2S attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list vlauel ACL-RA-SPLIT
    dns-server value 10.10.1.3
    tunnel-group TUN-RA-SPLIT type remote-access
    tunnel-group TUN-RA-SPLIT general-attributes
    default-group-policy CO-C2S
    address-pool CO-C2S-VPOOL
    tunnel-group TUN-RA-SPLIT ipsec-attributes
    pre-shared-key sekretk3y
    username ra-user1 password passw0rd1 priv 1
    group-policy CO-C2S internal
    group-policy CO-C2S attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list vlauel ACL-RA-SPLIT
    dns-server value 10.10.1.3
    tunnel-group TUN-RA-SPLIT type remote-access
    tunnel-group TUN-RA-SPLIT general-attributes
    default-group-policy CO-C2S
    address-pool CO-C2S-VPOOL
    tunnel-group TUN-RA-SPLIT ipsec-attributes
    pre-shared-key *********
    username ******* password ******** priv 1
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set 3DES
    crypto map Outside_Map 500 ipsec-isakmp dynamic dynmap
    crypto isakmp identify address
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encr 3des
    hash sha
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set 3DES
    crypto map Outside_Map 500 ipsec-isakmp dynamic dynmap
    crypto map vpn interface outside
    crypto isakmp identify address
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encr 3des
    hash sha
    group 1
    lifetime 3600

  • ASA 5520 VPN load balancing with Active/Standby failover on 2 devices only...

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    This topic has been beat to death, but I did not see a real answer. Here is configuration:
    1) 2 x ASA 5520, running 8.2
    2) Both ASA are in same outside and inside interface broadcast domains – common Ethernet on interfaces
    3) Both ASA are running single context but are active/standby failovers of each other. There are no more ASA’s in the equation. Just these 2. NOTE: this is not a Active/Active failover configuration. This is simply a 1-context active/standby configuration.
    4) I want to share VPN load among two devices and retain active/standby failover functionality. Can I use VPN load balancing feature?
    This sounds trivial, but I cannot find a clear answer (without testing this); and many people are confusing the issue. Here are some examples of confusion. These do not apply to my scenario.
    Active/Active failover is understood to mean only two ASA running multi-contexts. Context 1 is active on ASA1 Context 2 is active on ASA2. They are sharing failover information. Active/Active does not mean two independently configured ASA devices, which do not share failover communication, but do VPN load balancing. It is clear that this latter scenario will work and that both ASA are active, but they are not in the Active/Active configuration definition. Some people are calling VPN load balancing on two unique ASA’s “active/active”, but it is not
    The other confusing thing I have seen is that VPN config guide for VPN load balancing mentions configuring separate IP address pools on the VPN devices, so that clients on ASA1 do not have IP address overlap with clients on ASA2. When you configure ip address pool on active ASA1, this gets replicated to standby ASA2. In other words, you cannot have two unique IP address pools on a ASA Active/Standby cluster. I guess I could draw addresses from external DHCP server, and then do some kind of routing. Perhaps this will work?
    In any case, any experts out there that can answer question? TIA!

    Wow, some good info posted here (both questions and some answers). I'm in a similar situation with a couple of vpn load-balanced pairs... my goal was to get active-standby failover up and running in each pair- then I ran into this thread and saw the first post about the unique IP addr pools (and obviously we can't have unique pools in an active-standby failover rig where the complete config is replicated). So it would seem that these two features are indeed mutually exclusive. Real nice initial post to call this out.
    Now I'm wondering if the ASA could actually handle a single addr pool in an active-standby fo rig- *if* the code supported the exchange of addr pool status between the fo members (so they each would know what addrs have been farmed out from this single pool)? Can I get some feedback from folks on this? If this is viable, then I suppose we could submit a feature request to Cisco... not that this would necessarily be supported anytime soon, but it might be worth a try. And I'm also assuming we might need a vip on the inside int as well (not just on the outside), to properly flip the traffic on both sides if the failover occurs (note we're not currently doing this).
    Finally, if a member fails in a std load-balanced vpn pair (w/o fo disabled), the remaining member must take over traffic hitting the vip addr (full time)... can someone tell me how this works? And when this pair is working normally (with both members up), do the two systems coordinate who owns the vip at any time to load-balance the traffic? Is this basically how their load-balancing scheme works?
    Anyway, pretty cool thread... would really appreciate it if folks could give some feedback on some of the above.
    Thanks much,
    Mike

  • Configure a VPN client and Site to Site VPN tunnel

    Hi, I'm setting up a test network between 2 sites. SiteA has a 515E PIX and SiteB has a 501 PIX. Both sites have been setup with a site to site VPN tunnel, see SiteA config below. I also require that remote clients using Cisco VPN client 3.6 be able to connect into SiteA, be authenticated, get DHCP info and connect to hosts inside the network. However, when I add these config lines, see below, to SiteA PIX it stops the vpn tunnel to SiteB. However, the client can conect and do as needed so that part of my config is correct but I cannot see why the site to site vpn tunnel is then no longer.
    SiteA config with working VPN tunnel to SiteB:
    SITE A
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.x.x.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.x.x.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.x.x.0.0 201.201.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    SiteA-pix(config)#
    Lines I add for Cisco VPN clients is attached
    I entered each line one by one and did a reload and sh crypto map all was OK until I entered the crypto map VPNPEER lines.
    Anyone any ideas what this can be?
    Thanks

    Heres my config:
    PIX Version 6.3(1)
    interface ethernet0 auto
    interface ethernet1 auto
    interface ethernet2 auto shutdown
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    nameif ethernet2 webdmz security20
    enable password xxx
    passwd xxx
    hostname SiteA-pix
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol ils 389
    fixup protocol rsh 514
    fixup protocol rtsp 554
    no fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    names
    name 200.x.x.0 SiteA_INT
    name 201.x.x.201 SiteA_EXT
    name 200.x.x.254 PIX_INT
    name 10.10.10.0 SiteB_INT
    name 11.11.11.11 SiteB_EXT
    access-list inside_outbound_nat0_acl permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list outside_cryptomap_20 permit ip SiteA_INT 255.255.0.0 SiteB_INT 255.255.255.0
    access-list acl_inside permit icmp any any
    access-list acl_inside permit ip any any
    access-list acl_outside permit ip any any
    access-list acl_outside permit icmp any any
    access-list 80 permit ip SiteA_INT 255.255.0.0 200.220.0.0 255.255.0.0
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu webdmz 1500
    ip address outside SiteA_EXT 255.255.255.128
    ip address inside PIX_INT 255.255.0.0
    no ip address webdmz
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool pix_inside 200.x.x.100-200.220.200.150
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_outbound_nat0_acl
    route outside 0.0.0.0 0.0.0.x.x.201.202 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host 200.200.200.20 letmein timeout 10
    aaa-server LOCAL protocol local
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set AAADES esp-3des esp-md5-hmac
    crypto dynamic-map DYNOMAP 10 match address 80
    crypto dynamic-map DYNOMAP 10 set transform-set AAADES
    crypto map outside_map 20 ipsec-isakmp
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer SiteB_EXT
    crypto map outside_map 20 set transform-set ESP-DES-MD5
    crypto map outside_map 30 ipsec-isakmp dynamic DYNOMAP
    crypto map outside_map client authentication RADIUS
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp key secret address SiteB_EXT netmask 255.255.255.255 no-xauth no-config-mode
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption 3des
    isakmp policy 30 hash sha
    isakmp policy 30 group 2
    isakmp policy 30 lifetime 86400
    vpngroup Remote address-pool pix_inside
    vpngroup Remote dns-server 200.200.200.20
    vpngroup Remote wins-server 200.200.200.20
    vpngroup Remote default-domain mycorp.co.uk
    vpngroup Remote idle-time 1800
    vpngroup Remote password password
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    terminal width 80
    I will attach debug output later today.
    Thanks

  • ASA 5505 site-to-site VPN tunnel and client VPN sessions

    Hello all
    I have several years of general networking experience, but I have not yet had to set up an ASA from the ground up, so please bear with me.
    I have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z).  His satellite office will have a single PC sitting behind the ASA.  In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.
    The first question I have is about the ASA 5505 and the various licensing options.  I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A.  Would someone please confirm or deny that for me?
    Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)
    Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules?  Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?
    I don't yet have the equipment in-hand, so I can't provide any sample configs for you to look over, but I will certainly do so once I've got it.
    Thanks in advance for any assistance provided!

    First question:
    Yes, 5505 will be able to establish site-to-site tunnel, and he can use IPSec vpn client, and SSL VPN (it comes with 2 default SSL VPN license).
    Second question:
    Yes, you are right. No special routing is required. All you need to configure is site-to-site VPN between Site A and Site Z LAN, and the internet traffic will be routed via Site A internet. Assuming you have all the NAT statement configured for that.
    Last question:
    This needs to be configured, it wouldn't automatically allow access to Site Z when he VPNs in to Site A.
    Here is what needs to be configured:
    1) Split tunnel ACL for VPN Client should include both Site Z and Site A LAN subnets.
    2) On site A configures: same-security-traffic permit intra-interface
    3) Crypto ACL for the site-to-site tunnel between Site Z and Site A needs to include the VPN Client pool subnet as follows:
    On Site Z:
    access-list permit ip
    On Site A:
    access-list permit ip
    4) NAT exemption on site Z needs to include vpn client pool subnet as well.
    Hope that helps.
    Message was edited by: Jennifer Halim

  • Cisco ASA 5505 Site to Site VPN

    Hello All,
    First time posting to the forums. I've been working with Cisco ASA 5505 for a number of months and recently I purchased a 2nd ASA with the goal of setting up Site to Site VPN tunnel. It look so simple from the number of videos that I have watched on the internet. But when I have done it suprise suprise it didn't work for me ... I have deleted the tunnels a number of times and attempted to recreate them. I am using the VPN wizard in the ADM to create the tunnel. Both the asa are 5505 and have the same same firmware etc.
    I would appreciate any help that can be directed towards this issue please.  Slowly losing my mind
    Please see details below:
    Both ADM are 7.1
    IOS
    ASA 1
    aved
    ASA Version 9.0(1)
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address 92.51.193.158 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network CIX_Subnet
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network NETWORK_OBJ_84.39.233.50
    host 84.39.233.50
    object network NETWORK_OBJ_92.51.193.158
    host 92.51.193.158
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address
    [email protected]
    logging recipient-address
    [email protected]
    level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    http 192.168.40.0 255.255.255.0 wireless
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 84.39.233.50
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 192.168.10.0 255.255.255.0 inside
    ssh 192.168.40.0 255.255.255.0 wireless
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password uYePLcrFadO9pBZx encrypted
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1
    ASA 2
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address 84.39.233.50 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network Eiresoft
    host 146.66.160.70
    description DBA Contractor
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_3
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_7
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in remark Access for Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark This is allowing access from Eiresoft to the OLTP Failover server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 192.168.10.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 92.51.193.156 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 92.51.193.158
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 92.51.193.156 255.255.255.252 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
    : end

    Hi,
    Thanks for the help to date
    I now have the Site to Site working but there is one little issue I have. If I try to RD to a server through the tunnel it will not allow connection on the first attempt however if I ping that host and then attempt to RD it will allow the connection. It looks like the host is asleep until it receives traffic through the tunnel. Is this thje correct behaviour.
    See below the details:
    ASA1:
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address XX.XX.XX.XX 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    description Wireless network
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    service-object object SQL_Server
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address [email protected]
    logging recipient-address [email protected] level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (wireless,outside) source static Wireless Wireless destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Servers Servers destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer XX.XX.XX.XX
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map servers_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map servers_map interface servers
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable inside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    crypto ikev1 enable servers
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.10.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username niamh password MlFlIlEiy8vismE0 encrypted
    username niamh attributes
    service-type admin
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password yQeVtvLLKqapoUje encrypted privilege 0
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:83fa7ce1d93375645205f6e79b526381
    ASA2:
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address X.X.X.X 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock timezone GMT 0
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network LAN
    subnet 192.168.100.0 255.255.255.0
    object network REMOTE-LAN
    subnet 192.168.10.0 255.255.255.0
    object network TargetMC
    host 83.71.194.145
    description This is Target Location that will be accessing the Webserver
    object network Rackspace_OLTP
    host 162.13.34.56
    description This is the IP address of production OLTP
    object service DB
    service tcp destination eq 5022
    object network Topaz_Target_VM
    host 82.198.151.168
    description This is Topaz IP that will be accessing Targets VM
    object service DB_2
    service tcp destination eq 5023
    object network EireSoft_NEW_IP
    host 146.66.161.3
    description Eiresoft latest IP form ISP DHCP
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    service-object icmp echo
    service-object icmp echo-reply
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object tcp destination eq www
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_12
    service-object object MSQL
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    service-object object DB_2
    object-group service DM_INLINE_SERVICE_13
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_14
    service-object object MSQL
    service-object object RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_access_in remark Access rules from Traget to CIX for testing
    access-list outside_access_in extended permit tcp object TargetMC object TMC_Webserver eq www
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_12 object Rackspace_OLTP object OLTP_Failover
    access-list outside_access_in remark Topaz access to Target VM
    access-list outside_access_in extended permit tcp object Topaz_Target_VM object TMC_Webserver eq www
    access-list outside_access_in remark Opened up for Target for the weekend. Closing on Monday 20th
    access-list outside_access_in extended permit tcp any object TMC_Webserver eq www
    access-list outside_access_in remark Access for Eiresoft after their ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_13 object EireSoft_NEW_IP object Development_OLTP
    access-list outside_access_in remark Eiresoft Access after ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_14 object EireSoft_NEW_IP object OLTP_Failover
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 object-group Payback_Intrernal
    pager lines 24
    logging enable
    logging console debugging
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static Payback_Intrernal Payback_Intrernal no-proxy-arp route-lookup
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source dynamic LAN interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http X.X.X.X 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer X.X.X.X
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh X.X.X.X  255.255.255.240 outside
    ssh X.X.X.X 255.255.255.252 outside
    ssh 192.168.40.0 255.255.255.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:78a7b9ccec2fa048306092eb29a2b769

  • ASA 5520 site-to-site VPN question

    Hello,
    We have a Cisco 5520 ASA 8.2(1) connected to a Cisco RVS4000 router via an IPsec Site-to-Site VPN. The RVS4000 is located at a branch office. The tunnel works beautifully. When computers at the remote site are turned on the tunnel is established, and data is transferred back and forth.
    The only issue I'm having is being able to Remote Desktop to the branch office computers, or ping for that matter. I can ping and Remote Desktop from the branch office computers to computers at the main site where the ASA is located.
    After doing some research, I came across the this command;
    sysopt connection permit-vpn
    I haven't tried entering the command yet, but was wondering if this is something that I can try initially to see it it resolves the problem.
    Thanks,
    John

    What are your configs and network diagrams at each location?  What are you doing for DNS?  I can help quicker with that info.  Also, here are some basic site to site VPN examples if it helps.
    hostname cisco
    domain-name cisco.com
    enable password XXXXXXXX encrypted
    passwd XXXXXXXXXXX encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address XXX.XXX.XXX.XXX 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.0.0.2 255.255.255.0
    interface Ethernet0/2
    nameif backup
    security-level 0
    no ip address
    interface Ethernet0/3
    nameif outsidetwo
    security-level 0
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    dns server-group DefaultDNS
    domain-name cisco.com
    same-security-traffic permit intra-interface
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.10.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.2.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.4.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list XXX extended permit ip 10.90.238.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list XXX extended permit ip 10.90.238.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list nonat extended permit ip 10.0.10.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.2.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.4.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list split standard permit 10.0.0.0 255.255.255.0
    access-list split standard permit 10.90.238.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 1048576
    logging buffered errors
    logging trap notifications
    logging asdm informational
    logging class vpn buffered debugging
    mtu outside 1500
    mtu inside 1500
    mtu backup 1500
    mtu outsidetwo 1500
    mtu management 1500
    ip local pool vpnpool 10.0.10.100-10.0.10.200
    ip audit name Inbound-Attack attack action alarm drop
    ip audit name Inbound-Info info action alarm
    ip audit interface outside Inbound-Info
    ip audit interface outside Inbound-Attack
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inbound in interface outside
    route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map dynmap 10 set transform-set myset
    crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
    crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address XXX
    crypto map outside_map 1 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 1 set transform-set myset
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto map outside_map 2 match address XXX2
    crypto map outside_map 2 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 2 set transform-set myset
    crypto map outside_map 2 set security-association lifetime seconds 28800
    crypto map outside_map 2 set security-association lifetime kilobytes 4608000
    crypto map outside_map 3 match address XXX3
    crypto map outside_map 3 set pfs
    crypto map outside_map 3 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 3 set transform-set myset
    crypto map outside_map 3 set security-association lifetime seconds 28800
    crypto map outside_map 3 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic dynmap
    crypto map outside_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 60
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy XXXgroup internal
    group-policy XXXgroup attributes
    dns-server value XXX.XXX.XXX.XXX
    vpn-idle-timeout 30
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split
    default-domain value domain.local
    username XXX24 password XXXX encrypted privilege 15
    username admin password XXXX encrypted
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    tunnel-group XXXgroup type remote-access
    tunnel-group XXXgroup general-attributes
    address-pool vpnpool
    default-group-policy rccgroup
    tunnel-group XXXgroup ipsec-attributes
    pre-shared-key XXXXXXXXXX
    isakmp ikev1-user-authentication none
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily

  • Site to Site VPN on Cisco ASA

    Hello,
    I'm trying to set up a site to site VPN. I've never done this before and can't get it to work. I've watched training vids online and thought it looked straight forward enough. My problem appears to be that th ASA is not trying to create a tunnel. It doesn't seem to know that this traffic should be sent over the tunnel. Both the outside interfaces can ping one another and are on the same subnet.
    I've pasted the two configs below. They're just base configs with all the VPN commands having been created by the wizard. I've not put any routes in as the two devices are on the same subnet. If you can see my mistake I'd be very grateful to you if you could point it out or even point me in the right direction.
    Cheers,
    Tormod
    ciscoasa1
    : Saved
    : Written by enable_15 at 05:11:30.489 UTC Wed Jun 19 2013
    ASA Version 8.2(5)13
    hostname ciscoasa1
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 1.1.1.1 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    access-list outside_1_cryptomap extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list inside_nat0_outbound
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 1.1.1.2
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
    tunnel-group 1.1.1.2 type ipsec-l2l
    tunnel-group 1.1.1.2 ipsec-attributes
    pre-shared-key ciscocisco
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:29e3cdb2d704736b7fbbc477e8418d65
    : end
    ciscoasa2
    : Saved
    : Written by enable_15 at 15:40:31.509 UTC Wed Jun 19 2013
    ASA Version 8.2(5)13
    hostname ciscoasa2
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address 1.1.1.2 255.255.255.0
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.1.2.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    access-list outside_1_cryptomap extended permit ip 10.1.2.0 255.255.255.0 10.1.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.2.0 255.255.255.0 10.1.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list inside_nat0_outbound
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key ciscocisco
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:92dca65f5c2cf16486aa7d564732b0e1
    : end

    Thanks very much for your help Jouni. I came in this morning and ran the crypto map outside_map 1 set reverse-route command and everything started to work. I'm surprised the wizard didn't include that command but maybe it's because I didn't have a default route set.
    However, I now have a new problem. We're working towards migrating from ASA8.2 to 9.1. In order to prepare for this I've created a mock of our environment and am testing that everything works prior to making the changes. I can't get this site to site VPN to work. (The one I posted yesterday was just to get a basic site to site VPN working so that I could go from there)
    I've posted the debug from the ASA to which I'm trying to connect. To my undtrained eye it looks like it completes phase one but fails to match a vpn tunnel map. I'm coming from 10.99.99.99 going to 10.1.1.57
    Hope you can help as I'm going nuts here. Although I will of course understand if you've something better to do with your time than bail me out.
    access-list 1111_cryptomap extended permit ip 10.1.1.0 255.255.255.0 Private1 255.255.255.0
    access-list 1111_cryptomap extended permit ip 10.99.99.0 255.255.255.0 10.1.1.0 255.255.255.0
    crypto map vpntunnelmap 1 match address 1111_cryptomap
    crypto map vpntunnelmap 1 set pfs
    crypto map vpntunnelmap 1 set peer 1.1.1.1
    crypto map vpntunnelmap 1 set transform-set ESP-3DES-MD5
    ciscoasa# debug crypto isakmp 255
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 00 00 00 00 00 00 00 00    |  ...?:...........
    01 10 02 00 00 00 00 00 00 00 00 f4 0d 00 00 84    |  ................
    00 00 00 01 00 00 00 01 00 00 00 78 01 01 00 03    |  ...........x....
    03 00 00 24 01 01 00 00 80 04 00 02 80 01 00 05    |  ...$............
    80 02 00 02 80 03 00 01 80 0b 00 01 00 0c 00 04    |  ................
    00 00 70 80 03 00 00 28 02 01 00 00 80 04 00 02    |  ..p....(........
    80 01 00 07 80 0e 00 c0 80 02 00 02 80 03 00 01    |  ................
    80 0b 00 01 00 0c 00 04 00 00 70 80 00 00 00 24    |  ..........p....$
    03 01 00 00 80 04 00 02 80 01 00 05 80 02 00 01    |  ................
    80 03 00 01 80 0b 00 01 00 0c 00 04 00 01 51 80    |  ..............Q.
    0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5    |  ........>.in.c..
    ec 42 7b 1f 0d 00 00 14 7d 94 19 a6 53 10 ca 6f    |  .B{.....}...S..o
    2c 17 9d 92 15 52 9d 56 0d 00 00 14 4a 13 1c 81    |  ,....R.V....J...
    07 03 58 45 5c 57 28 f2 0e 95 45 2f 00 00 00 18    |  ..XE\W(...E/....
    40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3    |  @H..n...%.....
    c0 00 00 00                                        |  ....
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 00 00 00 00 00 00 00 00
      Next Payload: Security Association
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 244
      Payload Security Association
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 132
        DOI: IPsec
        Situation:(SIT_IDENTITY_ONLY)
        Payload Proposal
          Next Payload: None
          Reserved: 00
          Payload Length: 120
          Proposal #: 1
          Protocol-Id: PROTO_ISAKMP
          SPI Size: 0
          # of transforms: 3
          Payload Transform
            Next Payload: Transform
            Reserved: 00
            Payload Length: 36
            Transform #: 1
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Group Description: Group 2
            Encryption Algorithm: 3DES-CBC
            Hash Algorithm: SHA1
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 00 00 70 80
          Payload Transform
            Next Payload: Transform
            Reserved: 00
            Payload Length: 40
            Transform #: 2
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Group Description: Group 2
            Encryption Algorithm: AES-CBC
            Key Length: 192
            Hash Algorithm: SHA1
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 00 00 70 80
          Payload Transform
            Next Payload: None
            Reserved: 00
            Payload Length: 36
            Transform #: 3
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Group Description: Group 2
            Encryption Algorithm: 3DES-CBC
            Hash Algorithm: MD5
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 00 01 51 80
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 24
        Data (In Hex):
          40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
          c0 00 00 00
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 244
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Oakley proposal is acceptable
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal ver 02 VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal ver 03 VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received NAT-Traversal RFC VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Fragmentation VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, IKE Peer included IKE fragmentation capability flags:  Main Mode:        True  Aggressive Mode:  True
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing IKE SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, IKE SA Proposal # 1, Transform # 1 acceptable  Matches global IKE entry # 1
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing ISAKMP SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing Fragmentation VID + extended capabilities payload
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 104
    SENDING PACKET to 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Security Association
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 104
      Payload Security Association
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 52
        DOI: IPsec
        Situation:(SIT_IDENTITY_ONLY)
        Payload Proposal
          Next Payload: None
          Reserved: 00
          Payload Length: 40
          Proposal #: 1
          Protocol-Id: PROTO_ISAKMP
          SPI Size: 0
          # of transforms: 1
          Payload Transform
            Next Payload: None
            Reserved: 00
            Payload Length: 32
            Transform #: 1
            Transform-Id: KEY_IKE
            Reserved2: 0000
            Encryption Algorithm: 3DES-CBC
            Hash Algorithm: SHA1
            Group Description: Group 2
            Authentication Method: Preshared key
            Life Type: seconds
            Life Duration (Hex): 70 80
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 24
        Data (In Hex):
          40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3
          c0 00 00 00
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    04 10 02 00 00 00 00 00 00 00 01 00 0a 00 00 84    |  ................
    00 c8 2a 4d bf 63 9f 5c d3 b6 e9 fb 1e c9 61 b3    |  ..*M.c.\......a.
    f9 09 19 75 63 23 3f 59 ef c2 57 4b 59 9f 60 53    |  ...uc#?Y..WKY.`S
    0d d2 b5 2b b5 31 e8 75 46 57 ed 5b 4c f3 96 aa    |  ...+.1.uFW.[L...
    a5 c9 4a e7 62 68 e3 55 4c 54 ac 79 73 be ba f0    |  ..J.bh.ULT.ys...
    09 fe d0 5a 3f 9c 9c 2e 90 88 4d db b0 7b 7c f4    |  ...Z?.....M..{|.
    cc b4 07 1a 11 30 5b 2f 4f bd 56 b5 07 a3 9a cb    |  .....0[/O.V.....
    b3 e3 c8 10 20 a5 41 3a f9 fe 1b ed f0 d7 fa 05    |  .... .A:........
    fa df ef 8a 03 e9 4a 1c 09 ad 05 e6 02 f1 0a fa    |  ......J.........
    0d 00 00 18 bc d2 18 cc 37 f5 cb 77 b6 e2 0a 04    |  ........7..w....
    de c9 d3 1a b0 6f ee a8 0d 00 00 14 12 f5 f2 8c    |  .....o..........
    45 71 68 a9 70 2d 9f e2 74 cc 01 00 0d 00 00 0c    |  Eqh.p-..t.......
    09 00 26 89 df d6 b7 12 0d 00 00 14 2e 41 69 22    |  ..&..........Ai"
    3a a8 e7 0a cd 38 ba 43 ed f2 db 2c 00 00 00 14    |  :....8.C...,....
    1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00    |  .....e.....T*P..
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Key Exchange
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 256
      Payload Key Exchange
        Next Payload: Nonce
        Reserved: 00
        Payload Length: 132
        Data:
          00 c8 2a 4d bf 63 9f 5c d3 b6 e9 fb 1e c9 61 b3
          f9 09 19 75 63 23 3f 59 ef c2 57 4b 59 9f 60 53
          0d d2 b5 2b b5 31 e8 75 46 57 ed 5b 4c f3 96 aa
          a5 c9 4a e7 62 68 e3 55 4c 54 ac 79 73 be ba f0
          09 fe d0 5a 3f 9c 9c 2e 90 88 4d db b0 7b 7c f4
          cc b4 07 1a 11 30 5b 2f 4f bd 56 b5 07 a3 9a cb
          b3 e3 c8 10 20 a5 41 3a f9 fe 1b ed f0 d7 fa 05
          fa df ef 8a 03 e9 4a 1c 09 ad 05 e6 02 f1 0a fa
      Payload Nonce
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 24
        Data:
          bc d2 18 cc 37 f5 cb 77 b6 e2 0a 04 de c9 d3 1a
          b0 6f ee a8
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Data (In Hex): 09 00 26 89 df d6 b7 12
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          2e 41 69 22 3a a8 e7 0a cd 38 ba 43 ed f2 db 2c
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing ke payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing ISA_KE payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing nonce payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Cisco Unity client VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received xauth V6 VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Processing VPN3000/ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Received Altiga/Cisco VPN3000/Cisco ASA GW VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing ke payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing nonce payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing Cisco Unity VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing xauth V6 VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Send IOS VID
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, constructing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Connection landed on tunnel_group 1.1.1.2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Generating keys for Responder...
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 256
    SENDING PACKET to 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Key Exchange
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 256
      Payload Key Exchange
        Next Payload: Nonce
        Reserved: 00
        Payload Length: 132
        Data:
          27 62 7f 00 84 06 59 07 28 a1 05 9f 2a 13 ad ff
          47 10 99 27 68 01 2a c8 06 52 b8 55 0c 7d 82 3d
          31 94 0d 68 aa 98 5e 60 ee 2b 37 a5 0f ca 06 5c
          2a f7 83 bb 2e 8b 53 13 49 8b 4e 4c bf d1 34 67
          df ff 50 5b ab e9 f2 12 cb bd c2 0c ab 95 3a 39
          ca 60 31 7a d4 80 80 b6 0c 85 3e f5 16 fb f5 f8
          27 5d 28 b9 b1 2e b3 35 79 1a 9e f7 fd 13 8f f4
          5f 5d 53 93 74 6d d1 60 97 ca d2 bc b3 b4 e6 03
      Payload Nonce
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 24
        Data:
          a7 f8 48 c1 98 b4 cb 02 79 de ae 6e 59 3d 23 cb
          4c a1 7b 44
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Data (In Hex): 09 00 26 89 df d6 b7 12
      Payload Vendor ID
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          99 8a 8b d3 68 02 55 58 44 16 79 1c 51 be 23 8f
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          1f 07 f7 0e aa 65 14 d3 b0 fa 96 54 2a 50 01 00
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    05 10 02 01 00 00 00 00 00 00 00 64 8f a8 6e 03    |  ...........d..n.
    81 b9 24 e5 f0 ba ca 1a 0f fa 5a a1 3c 2d 61 1a    |  ..$.......Z.<-a.
    7d 48 b0 0c 7f 09 bc 82 9b b1 25 b4 f6 04 45 a0    |  }H......%...E.
    13 12 27 ff 7a 41 9f e9 8e 96 c2 80 b9 59 b0 ec    |  ..'.zA.......Y..
    40 e3 95 4d 96 ef eb ce e2 fb d9 45 83 50 0d e7    |  @..M.......E.P..
    9c c7 70 7f                                        |  ..
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (Encryption)
      MessageID: 00000000
      Length: 100
    AFTER DECRYPTION
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (Encryption)
      MessageID: 00000000
      Length: 100
      Payload Identification
        Next Payload: Hash
        Reserved: 00
        Payload Length: 12
        ID Type: IPv4 Address (1)
        Protocol ID (UDP/TCP, etc...): 17
        Port: 500
        ID Data: 1.1.1.2
      Payload Hash
        Next Payload: IOS Proprietary Keepalive or CHRE
        Reserved: 00
        Payload Length: 24
        Data:
          f4 40 eb 6b 55 f0 19 cd 10 81 e6 53 cf 23 75 c5
          45 ab 7f 3d
      Payload IOS Proprietary Keepalive or CHRE
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Default Interval: 32767
        Retry Interval: 32767
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR ID received
    1.1.1.2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Computing hash for ISAKMP
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Processing IOS keep alive payload: proposal=32767/32767 sec.
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing VID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Received DPD VID
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Connection landed on tunnel_group 1.1.1.2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing ID payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Computing hash for ISAKMP
    Jun 20 16:29:42 [IKEv1 DEBUG]: IP = 1.1.1.2, Constructing IOS keep alive payload: proposal=32767/32767 sec.
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing dpd vid payload
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + IOS KEEPALIVE (128) + VENDOR (13) + NONE (0) total length : 96
    BEFORE ENCRYPTION
    RAW PACKET DUMP on SEND
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    05 10 02 00 00 00 00 00 1c 00 00 00 08 00 00 0c    |  ................
    01 11 01 f4 c2 9f 09 02 80 00 00 18 58 00 80 06    |  ............X...
    e9 66 ba 20 1e ba 79 c8 16 85 2d 2f a0 96 b4 e5    |  .f. ..y...-/....
    0d 00 00 0c 80 00 7f ff 80 00 7f ff 00 00 00 14    |  ............
    af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00    |  ....h...k...wW..
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (none)
      MessageID: 00000000
      Length: 469762048
      Payload Identification
        Next Payload: Hash
        Reserved: 00
        Payload Length: 12
        ID Type: IPv4 Address (1)
        Protocol ID (UDP/TCP, etc...): 17
        Port: 500
        ID Data: 1.1.1.1
      Payload Hash
        Next Payload: IOS Proprietary Keepalive or CHRE
        Reserved: 00
        Payload Length: 24
        Data:
          58 00 80 06 e9 66 ba 20 1e ba 79 c8 16 85 2d 2f
          a0 96 b4 e5
      Payload IOS Proprietary Keepalive or CHRE
        Next Payload: Vendor ID
        Reserved: 00
        Payload Length: 12
        Default Interval: 32767
        Retry Interval: 32767
      Payload Vendor ID
        Next Payload: None
        Reserved: 00
        Payload Length: 20
        Data (In Hex):
          af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
    SENDING PACKET to 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Identification
      Version: 1.0
      Exchange Type: Identity Protection (Main Mode)
      Flags: (Encryption)
      MessageID: 00000000
      Length: 100
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, PHASE 1 COMPLETED
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, Keep-alive type for this connection: DPD
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, Starting P1 rekey timer: 27360 seconds.
    IKE Recv RAW packet dump
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58    |  ...?:...lM,.h.UX
    08 10 20 01 56 e5 a4 1e 00 00 01 4c d2 44 3e 24    |  .. .V......L.D>$
    87 96 a1 fe d1 a3 d3 a3 ed 59 45 2d 53 be 17 9f    |  .........YE-S...
    42 72 2b a3 5f f8 5e 41 5a 62 25 0c 5d bf 6c 2a    |  Br+._.^AZb%.].l*
    e6 e0 1f 77 d5 ed c8 1c 06 cb ef f2 58 07 1d 35    |  ...w........X..5
    a9 d5 7b 86 24 05 88 32 e7 33 6f f2 f7 9d 70 07    |  ..{.$..2.3o...p.
    18 40 51 77 7d 7e 6c 77 55 d9 18 7a 57 5d b9 88    |  .@Qw}~lwU..zW]..
    6c a6 d5 f3 60 5e 14 4f da cb 42 65 88 d6 75 0e    |  l...`^.O..Be..u.
    22 1c bb 89 1f 57 bd c2 f2 46 30 31 30 9c 63 e6    |  "....W...F010.c.
    e2 e9 5b 68 71 f2 ed 69 f1 eb a7 65 2d b2 31 85    |  ..[hq..i...e-.1.
    31 93 0a c1 21 44 57 de ad 8b 79 5e 3d 36 5c 44    |  1...!DW...y^=6\D
    88 23 a8 44 76 2c d6 c2 ed 31 2d 69 b1 50 26 9f    |  .#.Dv,...1-i.P&.
    ee 48 3e c4 dd 0d 40 8f 65 d2 fb 82 19 42 b7 0f    |  .H>[email protected]..
    a0 74 b3 e6 df dd 16 c4 fa ca bf d2 b6 33 b0 5f    |  .t...........3._
    d6 59 4f 6a 84 9e 0d 76 a4 d6 d3 94 67 bc 9c df    |  .YOj...v....g...
    33 20 48 61 d7 80 b6 97 0d a9 32 48 7d 5b 79 8b    |  3 Ha......2H}[y.
    7b bc e0 9b b4 5d ed 49 04 6b 5d 72 d7 5b 82 90    |  {....].I.k]r.[..
    47 e5 65 64 a9 25 ce 2f 3f a2 ca 98 b1 0b ff 01    |  G.ed.%./?.......
    9c 32 64 5c dd 9c 26 71 c4 59 cd 52 da 1f b9 23    |  .2d\..&q.Y.R...#
    32 dd d8 a5 d1 1c 2a d0 0f ef 2b 26 66 c0 14 48    |  2.....*...+&f..H
    52 35 3a ee 36 a6 00 df a5 d6 6b 42                |  R5:.6.....kB
    RECV PACKET from 1.1.1.2
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Hash
      Version: 1.0
      Exchange Type: Quick Mode
      Flags: (Encryption)
      MessageID: 56E5A41E
      Length: 332
    Jun 20 16:29:42 [IKEv1 DECODE]: IP = 1.1.1.2, IKE Responder starting QM: msg id = 56e5a41e
    AFTER DECRYPTION
    ISAKMP Header
      Initiator COOKIE: db 86 ce 3f 3a a9 e7 0a
      Responder COOKIE: 6c 4d 2c ce 68 03 55 58
      Next Payload: Hash
      Version: 1.0
      Exchange Type: Quick Mode
      Flags: (Encryption)
      MessageID: 56E5A41E
      Length: 332
      Payload Hash
        Next Payload: Security Association
        Reserved: 00
        Payload Length: 24
        Data:
          78 09 81 d2 54 22 37 a1 b0 a8 53 cf df d4 1e fb
          4a 7b 99 f7
      Payload Security Association
        Next Payload: Nonce
        Reserved: 00
        Payload Length: 64
        DOI: IPsec
        Situation:(SIT_IDENTITY_ONLY)
        Payload Proposal
          Next Payload: None
          Reserved: 00
          Payload Length: 52
          Proposal #: 1
          Protocol-Id: PROTO_IPSEC_ESP
          SPI Size: 4
          # of transforms: 1
          SPI: b2 c1 66 6e
          Payload Transform
            Next Payload: None
            Reserved: 00
            Payload Length: 40
            Transform #: 1
            Transform-Id: ESP_3DES
            Reserved2: 0000
            Life Type: Seconds
            Life Duration (Hex): 70 80
            Life Type: Kilobytes
            Life Duration (Hex): 00 46 50 00
            Encapsulation Mode: Tunnel
            Authentication Algorithm: MD5
            Group Description: Group 2
      Payload Nonce
        Next Payload: Key Exchange
        Reserved: 00
        Payload Length: 24
        Data:
          1e 43 34 fa cc 9f 77 65 45 7c b6 18 2f 18 fd a9
          86 e6 58 42
      Payload Key Exchange
        Next Payload: Identification
        Reserved: 00
        Payload Length: 132
        Data:
          3c 26 4c 94 68 33 4b 2d ce 37 4a d2 8c 62 ab 6b
          e6 d4 d2 8a df 70 bc 67 62 ca 96 8c 3b 30 cd 58
          54 55 71 0f 9e bc da 63 a9 68 86 fd ba 7a 13 f3
          e9 51 e9 a4 13 b0 b0 20 45 cf 1f 36 1e 95 95 c9
          dd 92 c9 cd 2b 33 2d 4b 7e bd ed d4 ec bf 54 b9
          6e 13 7f 17 dc 28 61 5d 46 fe 1d ba 88 e5 ca 70
          40 59 12 c1 0c 3a 51 7f ae 5f e2 95 73 bc c9 16
          67 ce 38 82 e7 b3 1b 6a 39 05 46 71 b8 da c3 57
      Payload Identification
        Next Payload: Identification
        Reserved: 00
        Payload Length: 16
        ID Type: IPv4 Subnet (4)
        Protocol ID (UDP/TCP, etc...): 0
        Port: 0
        ID Data: 10.99.99.0/255.255.255.0
      Payload Identification
        Next Payload: Notification
        Reserved: 00
        Payload Length: 16
        ID Type: IPv4 Subnet (4)
        Protocol ID (UDP/TCP, etc...): 0
        Port: 0
        ID Data: 10.1.1.0/255.255.255.0
      Payload Notification
        Next Payload: None
        Reserved: 00
        Payload Length: 28
        DOI: IPsec
        Protocol-ID: PROTO_ISAKMP
        Spi Size: 16
        Notify Type: STATUS_INITIAL_CONTACT
        SPI:
          db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55 58
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE RECEIVED Message (msgid=56e5a41e) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 332
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing SA payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing nonce payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ke payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ISA_KE for PFS in phase 2
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR_SUBNET ID received--10.99.99.0--255.255.255.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received remote IP Proxy Subnet data in ID Payload:   Address 10.99.99.0, Mask 255.255.255.0, Protocol 0, Port 0
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing ID payload
    Jun 20 16:29:42 [IKEv1 DECODE]: Group = 1.1.1.2, IP = 1.1.1.2, ID_IPV4_ADDR_SUBNET ID received--10.1.1.0--255.255.255.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Received local IP Proxy Subnet data in ID Payload:   Address 10.1.1.0, Mask 255.255.255.0, Protocol 0, Port 0
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, processing notify payload
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, QM IsRekeyed old sa not found by addr
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 1...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 1, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 2...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 2, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 3...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 3, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 35...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 35, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 40...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 40, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, checking map = vpntunnelmap, seq = 41...
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Static Crypto Map check, map = vpntunnelmap, seq = 41, ACL does not match proxy IDs src:10.99.99.0 dst:10.1.1.0
    Jun 20 16:29:42 [IKEv1]: Group = 1.1.1.2, IP = 1.1.1.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 10.99.99.0/255.255.255.0/0/0 local proxy 10.1.1.0/255.255.255.0/0/0 on interface thus
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, sending notify message
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing blank hash payload
    Jun 20 16:29:42 [IKEv1 DEBUG]: Group = 1.1.1.2, IP = 1.1.1.2, constructing qm hash payload
    Jun 20 16:29:42 [IKEv1]: IP = 1.1.1.2, IKE_DECODE SENDING Message (msgid=7ecccf15) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 384
    BEFORE ENCRYPTION
    RAW PACKET DUMP on SEND
    db 86 ce 3f 3a a9 e7 0a 6c 4d 2c ce 68 03 55
    IKE Recv RAW packet dump

  • Site to Site VPN Between Two ASA 5505's Up But Not Passing Traffic

    hello,
    i am setting up a site to site vpn between two asa 5505's.  the tunnel is up but i cannot get it to pass traffic and i have run out of ideas at this point.  i am on site as i am posting this question and only have about 4 hours left to figure this out, so any help asap is greatly appreciated.  i'll post the configs below along with the output of sh crypto isakmp sa and sh ipsec sa.
    FYI the asa's are different versions, one is 9.2 the other is 8.2
    Note: 1.1.1.1 = public ip for Site A 2.2.2.2 = public ip for site B
    Site A running config:
    Result of the command: "sh run"
    : Saved
    ASA Version 8.2(2)
    hostname csol-asa
    enable password WI19w3dXj6ANP8c6 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.1.0 san_antonio_inside
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.2.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 1.1.1.1 255.255.255.248
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
     name-server 24.93.41.125
     name-server 24.93.41.126
    object-group network NETWORK_OBJ_192.168.2.0_24
    access-list inside_access_out extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in_1 extended permit icmp any interface outside
    access-list outside_access_in_1 extended permit tcp any interface outside eq pop3
    access-list outside_access_in_1 extended permit tcp any interface outside eq 8100
    access-list outside_access_in_1 extended permit udp any interface outside eq 8100
    access-list outside_access_in_1 extended permit udp any interface outside eq 1025
    access-list outside_access_in_1 extended permit tcp any interface outside eq 1025
    access-list outside_access_in_1 extended permit tcp any interface outside eq 5020
    access-list outside_access_in_1 extended permit tcp any interface outside eq 8080
    access-list outside_access_in_1 extended permit tcp any interface outside eq www
    access-list outside_access_in_1 extended permit ip san_antonio_inside 255.255.255.0 any
    access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.255.0 host san_antonio_inside
    access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 san_antonio_inside 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 san_antonio_inside 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (inside) 2 interface
    global (outside) 101 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 101 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface pop3 192.168.2.249 pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface 8100 192.168.2.161 8100 netmask 255.255.255.255
    static (inside,outside) udp interface 8100 192.168.2.161 8100 netmask 255.255.255.255
    static (inside,outside) udp interface 1025 192.168.2.161 1025 netmask 255.255.255.255
    static (inside,outside) tcp interface 5020 192.168.2.8 5020 netmask 255.255.255.255
    static (inside,outside) tcp interface 8080 192.168.2.251 8080 netmask 255.255.255.255
    static (inside,inside) tcp interface www 192.168.2.8 www netmask 255.255.255.255
    static (inside,outside) tcp interface 1025 192.168.2.161 1025 netmask 255.255.255.255
    access-group inside_access_out out interface inside
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 2.2.2.2 255.255.255.255 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map1 1 match address outside_1_cryptomap_1
    crypto map outside_map1 1 set peer 2.2.2.2
    crypto map outside_map1 1 set transform-set ESP-3DES-SHA
    crypto map outside_map1 interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.30-192.168.2.155 inside
    dhcpd dns 24.93.41.125 24.93.41.126 interface inside
    dhcpd domain corporatesolutionsfw.local interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    group-policy DfltGrpPolicy attributes
    tunnel-group 2.2.2.2 type ipsec-l2l
    tunnel-group 2.2.2.2 ipsec-attributes
     pre-shared-key *****
    prompt hostname context
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:021cf43a4211a99232849372c380dda2
    : end
    Site A sh crypto isakmp sa:
    Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 2.2.2.2
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    Site A sh ipsec sa:
    Result of the command: "sh ipsec sa"
    interface: outside
        Crypto map tag: outside_map1, seq num: 1, local addr: 1.1.1.1
          access-list outside_1_cryptomap_1 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (san_antonio_inside/255.255.255.0/0/0)
          current_peer: 2.2.2.2
          #pkts encaps: 1, #pkts encrypt: 1, #pkts digest: 1
          #pkts decaps: 239, #pkts decrypt: 239, #pkts verify: 239
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 1, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 1.1.1.1, remote crypto endpt.: 71.40.110.179
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: C1074C40
          current inbound spi : B21273A9
        inbound esp sas:
          spi: 0xB21273A9 (2987553705)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 1691648, crypto-map: outside_map1
             sa timing: remaining key lifetime (kB/sec): (3914989/27694)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0xC1074C40 (3238480960)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, }
             slot: 0, conn_id: 1691648, crypto-map: outside_map1
             sa timing: remaining key lifetime (kB/sec): (3914999/27694)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
    Site B running config:
    Result of the command: "sh run"
    : Saved
    : Serial Number: JMX184640WY
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.2(2)4
    hostname CSOLSAASA
    enable password WI19w3dXj6ANP8c6 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 2.2.2.2 255.255.255.248
    ftp mode passive
    object network NETWORK_OBJ_192.168.1.0_24
     subnet 192.168.1.0 255.255.255.0
    object network mcallen_network
     subnet 192.168.2.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object NETWORK_OBJ_192.168.1.0_24 object mcallen_network
    access-list outside_access_in extended permit ip object mcallen_network 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-731-101.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static mcallen_network mcallen_network no-proxy-arp route-lookup
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 2.2.2.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map3 1 match address outside_cryptomap
    crypto map outside_map3 1 set peer 1.1.1.1
    crypto map outside_map3 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map3 interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh stricthostkeycheck
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd address 192.168.1.200-192.168.1.250 inside
    dhcpd dns 24.93.41.125 24.93.41.126 interface inside
    dhcpd domain CSOLSA.LOCAL interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
     anyconnect-essentials
    group-policy DfltGrpPolicy attributes
     vpn-tunnel-protocol ikev1
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 ipsec-attributes
     ikev1 pre-shared-key *****
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4e058021a6e84ac7956dca0e5a143b8d
    : end
    Site B sh crypto isakmp sa:
    Result of the command: "sh crypto isakmp sa"
    IKEv1 SAs:
       Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 1.1.1.1
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    There are no IKEv2 SAs
    Site B sh ipsec sa:
    Result of the command: "sh ipsec sa"
    interface: outside
        Crypto map tag: outside_map3, seq num: 1, local addr: 71.40.110.179
          access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: 1.1.1.1
          #pkts encaps: 286, #pkts encrypt: 286, #pkts digest: 286
          #pkts decaps: 1, #pkts decrypt: 1, #pkts verify: 1
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 286, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #TFC rcvd: 0, #TFC sent: 0
          #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 2.2.2.2/0, remote crypto endpt.: 1.1.1.1/0
          path mtu 1500, ipsec overhead 58(36), media mtu 1500
          PMTU time remaining (sec): 0, DF policy: copy-df
          ICMP error validation: disabled, TFC packets: disabled
          current outbound spi: B21273A9
          current inbound spi : C1074C40
        inbound esp sas:
          spi: 0xC1074C40 (3238480960)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, IKEv1, }
             slot: 0, conn_id: 28672, crypto-map: outside_map3
             sa timing: remaining key lifetime (kB/sec): (4373999/27456)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000003
        outbound esp sas:
          spi: 0xB21273A9 (2987553705)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, IKEv1, }
             slot: 0, conn_id: 28672, crypto-map: outside_map3
             sa timing: remaining key lifetime (kB/sec): (4373987/27456)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001

    Hi Keegan,
    Your tunnel is up and encrypting traffic one way, the other end is not able to encrypt the traffic.
    I would suggest to do a 'clear xlate'?  Sometimes if you setup the nonat configuration after you've attempted other configurations, you need to 'clear xlate' before the previous NAT configuration is cleared and the new one works.
    HTH
    "Please rate useful posts"

  • Site-to-Site VPN between Cisco ASA 5505 (8.4) and Cisco Router (IOS 15.2)

    Hi, I'm trying to create Site-to-Site VPN between Cisco ASA 5505 and Cisco Router 3945.
    I've tried create configuration with and without ASA wizard, but anyway it doesn't work.
    Please help me to find where is the issue.
    I have two sites and would like to get access from 192.168.83.0 to 192.168.17.0
    192.168.17.0 --- S1.S1.S1.S1 (IOS Router) ==================== S2.S2.S2.S2 (ASA 5505) --- 192.168.83.0
    Here is my current configuration.
    Thanks for your help.
    IOS Configuration
    version 15.2
    crypto isakmp policy 1
    encr aes 256
    authentication pre-share
    group 2
    crypto isakmp key cisco address 198.0.183.225
    crypto isakmp invalid-spi-recovery
    crypto ipsec transform-set AES-SET esp-aes esp-sha-hmac
    mode transport
    crypto map static-map 1 ipsec-isakmp
    set peer S2.S2.S2.S2
    set transform-set AES-SET
    set pfs group2
    match address 100
    interface GigabitEthernet0/0
    ip address S1.S1.S1.S1 255.255.255.240
    ip nat outside
    ip virtual-reassembly in
    duplex auto
    speed auto
    crypto map static-map
    interface GigabitEthernet0/1
    ip address 192.168.17.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    access-list 100 permit ip 192.168.17.0 0.0.0.255 192.168.83.0 0.0.0.255
    ASA Configuration
    ASA Version 8.4(3)
    interface Ethernet0/0
    switchport access vlan 2
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.83.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address S2.S2.S2.S2 255.255.255.248
    ftp mode passive
    same-security-traffic permit intra-interface
    object network inside-network
    subnet 192.168.83.0 255.255.255.0
    object network datacenter
    host S1.S1.S1.S1
    object network datacenter-network
    subnet 192.168.17.0 255.255.255.0
    object network NETWORK_OBJ_192.168.83.0_24
    subnet 192.168.83.0 255.255.255.0
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any log
    access-list outside_cryptomap extended permit ip 192.168.83.0 255.255.255.0 object datacenter-network
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool vpn_pool 192.168.83.200-192.168.83.254 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic inside-network interface
    nat (inside,outside) source static inside-network inside-network destination static inside-network inside-network no-proxy-arp route-lookup
    nat (inside,outside) source static inside-network inside-network destination static datacenter-network datacenter-network no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.83.0_24 NETWORK_OBJ_192.168.83.0_24 destination static datacenter-network pdatacenter-network no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 DEFAULT_GATEWAY 1
    crypto ipsec ikev1 transform-set vpn-transform-set esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn-transform-set mode transport
    crypto ipsec ikev1 transform-set L2L_SET esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set L2L_SET mode transport
    crypto dynamic-map dyno 10 set ikev1 transform-set vpn-transform-set
    crypto map vpn 1 match address outside_cryptomap
    crypto map vpn 1 set pfs
    crypto map vpn 1 set peer S1.S1.S1.S1
    crypto map vpn 1 set ikev1 transform-set L2L_SET
    crypto map vpn 20 ipsec-isakmp dynamic dyno
    crypto map vpn interface outside
    crypto isakmp nat-traversal 3600
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    group-policy GroupPolicy_S1.S1.S1.S1 internal
    group-policy GroupPolicy_S1.S1.S1.S1 attributes
    vpn-tunnel-protocol ikev1
    group-policy remote_vpn_policy internal
    group-policy remote_vpn_policy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    username artem password 8xs7XK3To4s5WfTvtKAutA== nt-encrypted
    username admin password rqiFSVJFung3fvFZ encrypted privilege 15
    tunnel-group DefaultRAGroup general-attributes
    address-pool vpn_pool
    default-group-policy remote_vpn_policy
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    tunnel-group S1.S1.S1.S1 type ipsec-l2l
    tunnel-group S1.S1.S1.S1 general-attributes
    default-group-policy GroupPolicy_S1.S1.S1.S1
    tunnel-group S1.S1.S1.S1 ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:f55f10c19a0848edd2466d08744556eb
    : end

    Thanks for helping me again. I really appreciate.
    I don't hve any NAT-exemptions in Cisco IOS Router. Transform-set I will change soon, but I've tried with tunnel mode and it didn't work.
    Maybe NAT-exemptions is the issue. Can you advice me which exemptions should be in Cisco IOS Router?
    Because on Cisco ASA I guess I have everything.
    Here is show crypto session detail
    router(config)#do show crypto session detail
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: GigabitEthernet0/0
    Session status: DOWN
    Peer: 198.0.183.225 port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.17.0/255.255.255.0 192.168.83.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
    Should I see something in crypto isakmp sa?
    pp-border#sh crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    IPv6 Crypto ISAKMP SA
    Thanks again for your help.

  • Cisco ASA & Router Site to Site VPN up but not passing traffic

    Dear all,
    Please help me the attached document vpn issue, site-to-site vpn is up but I am not able to passing traffic.
    Advance Thanks
    ahossain

    ASA#
    ASA Version 8.2(1)
    hostname Active
    domain-name test.com
    interface Ethernet0/0
    description LAN/STATE Failover Interface
    interface Ethernet0/1
    speed 100
    nameif outside
    security-level 0
    ip address 212.71.53.38 255.255.255.224 standby 212.71.53.37
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.50.1 255.255.255.0 standby 192.168.50.4
    interface Ethernet0/3
    description INSIDE
    speed 100
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa821-k8.bin
    boot config disk0:/running-config
    ftp mode passive
    dns server-group DefaultDNS
    domain-name test.com
    access-list deny-flow-max 1
    access-list alert-interval 2
    access-list allow extended permit ip any any
    access-list VPN extended permit ip any any
    access-list OUTSIDE extended permit ip any any
    access-list al-outside extended permit ip any host 212.107.106.129
    access-list al-outside extended permit ip any any
    access-list encrypt_acl extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit ip any any
    access-list DMZ_access_out extended permit ip any any
    access-list inside_access_in extended permit ip any any
    access-list DMZ_access_in extended permit ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list no-nat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu DMZ 1500
    mtu inside 1500
    failover
    failover lan unit primary
    failover lan interface failover Ethernet0/0
    failover key *****
    failover link failover Ethernet0/0
    failover interface ip failover 10.10.10.1 255.255.255.252 standby 10.10.10.2
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any DMZ
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 212.71.53.36 1
    route outside 10.2.2.0 255.255.255.0 212.71.53.36 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    service resetoutside
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mal 10 set peer 212.107.106.129
    crypto map IPSec_map 10 match address encrypt_acl
    crypto map IPSec_map 10 set peer 212.107.106.129
    crypto map IPSec_map 10 set transform-set mal
    crypto map IPSec_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 outside
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXXX address 212.71.53.38
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto map mal 10 ipsec-isakmp
    set peer 212.71.53.38
    set transform-set mal
    match address 120
    interface Loopback0
    ip address 10.3.3.1 255.255.255.0
    ip virtual-reassembly in
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 172.20.34.54 255.255.255.252
    ip nat outside
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/1
    ip address 212.107.106.129 255.255.255.248
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/2
    description *!* LAN *!*
    ip address 10.2.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip nat pool OUTPOOL 212.107.106.132 212.107.106.132 netmask 255.255.255.248
    ip nat inside source route-map nonat pool OUTPOOL overload
    ip route 0.0.0.0 0.0.0.0 172.20.34.53
    ip route 10.1.1.0 255.255.255.0 212.107.106.130
    ip route 192.168.50.0 255.255.255.0 212.71.53.38
    ip access-list extended outside
    remark CCP_ACL Category=1
    permit ip any any log
    ip access-list extended outside1
    remark CCP_ACL Category=1
    permit ip any any log
    access-list 110 permit tcp 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 130 permit ip 10.2.2.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 130
    control-plane
    ASA Version 8.2(1)
    hostname Active
    domain-name test.com
    interface Ethernet0/0
    description LAN/STATE Failover Interface
    interface Ethernet0/1
    speed 100
    nameif outside
    security-level 0
    ip address 212.71.53.38 255.255.255.224 standby 212.71.53.37
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.50.1 255.255.255.0 standby 192.168.50.4
    interface Ethernet0/3
    description INSIDE
    speed 100
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa821-k8.bin
    boot config disk0:/running-config
    ftp mode passive
    dns server-group DefaultDNS
    domain-name test.com
    access-list deny-flow-max 1
    access-list alert-interval 2
    access-list allow extended permit ip any any
    access-list VPN extended permit ip any any
    access-list OUTSIDE extended permit ip any any
    access-list al-outside extended permit ip any host 212.107.106.129
    access-list al-outside extended permit ip any any
    access-list encrypt_acl extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit ip any any
    access-list DMZ_access_out extended permit ip any any
    access-list inside_access_in extended permit ip any any
    access-list DMZ_access_in extended permit ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list no-nat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu DMZ 1500
    mtu inside 1500
    failover
    failover lan unit primary
    failover lan interface failover Ethernet0/0
    failover key *****
    failover link failover Ethernet0/0
    failover interface ip failover 10.10.10.1 255.255.255.252 standby 10.10.10.2
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any DMZ
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 212.71.53.36 1
    route outside 10.2.2.0 255.255.255.0 212.71.53.36 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    service resetoutside
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mal 10 set peer 212.107.106.129
    crypto map IPSec_map 10 match address encrypt_acl
    crypto map IPSec_map 10 set peer 212.107.106.129
    crypto map IPSec_map 10 set transform-set mal
    crypto map IPSec_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 outside
    ==================================================================
    Remote-Router#
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXXX address 212.71.53.38
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto map mal 10 ipsec-isakmp
    set peer 212.71.53.38
    set transform-set mal
    match address 120
    interface Loopback0
    ip address 10.3.3.1 255.255.255.0
    ip virtual-reassembly in
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 172.20.34.54 255.255.255.252
    ip nat outside
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/1
    ip address 212.107.106.129 255.255.255.248
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/2
    description *!* LAN *!*
    ip address 10.2.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip nat pool OUTPOOL 212.107.106.132 212.107.106.132 netmask 255.255.255.248
    ip nat inside source route-map nonat pool OUTPOOL overload
    ip route 0.0.0.0 0.0.0.0 172.20.34.53
    ip route 10.1.1.0 255.255.255.0 212.107.106.130
    ip route 192.168.50.0 255.255.255.0 212.71.53.38
    ip access-list extended outside
    remark CCP_ACL Category=1
    permit ip any any log
    ip access-list extended outside1
    remark CCP_ACL Category=1
    permit ip any any log
    access-list 110 permit tcp 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 130 permit ip 10.2.2.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 130
    control-plane

  • Site-to-Site VPN btw Pix535 and Router 2811, can't get it work

    Hi, every one,  I spent couple of days trying to make  a site-to-site VPN between PIX535 and router 2811 work but come up empty handed, I followed instructions here:
    http://www.cisco.com/en/US/products/ps9422/products_configuration_example09186a0080b4ae61.shtml
    #1: PIX config:
    : Saved
    : Written by enable_15 at 18:05:33.678 EDT Sat Oct 20 2012
    PIX Version 8.0(4)
    hostname pix535
    interface GigabitEthernet0
    description to-cable-modem
    nameif outside
    security-level 0
    ip address X.X.138.132 255.255.255.0
    ospf cost 10
    interface GigabitEthernet1
    description inside  10/16
    nameif inside
    security-level 100
    ip address 10.1.1.254 255.255.0.0
    ospf cost 10
    access-list outside_access_in extended permit ip any any
    access-list inside_nat0_outbound extended permit ip 10.1.0.0 255.255.0.0 10.20.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip any 10.1.1.192 255.255.255.248
    access-list outside_cryptomap_dyn_60 extended permit ip any 10.1.1.192 255.255.255.248
    access-list outside_1_cryptomap extended permit ip 10.1.0.0 255.255.0.0 10.20.0.0 255.255.0.0
    pager lines 24
    ip local pool cnf-8-ip 10.1.1.192-10.1.1.199 mask 255.255.0.0
    global (outside) 10 interface
    global (outside) 15 1.2.4.5
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 15 10.1.0.0 255.255.0.0
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 X.X.138.1 1
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-MD5
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 40 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 40 set security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 60 match address outside_cryptomap_dyn_60
    crypto dynamic-map outside_dyn_map 60 set transform-set ESP-3DES-MD5 ESP-3DES-SHA ESP-DES-MD5 ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 60 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 60 set security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer X.X.21.29
    crypto map outside_map 1 set transform-set ESP-DES-SHA
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65534 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp identity hostname
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 1
    lifetime 86400
    crypto isakmp policy 20
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal 3600
    group-policy GroupPolicy1 internal
    group-policy cnf-vpn-cls internal
    group-policy cnf-vpn-cls attributes
    wins-server value 10.1.1.7
    dns-server value 10.1.1.7 10.1.1.205
    vpn-tunnel-protocol IPSec l2tp-ipsec
    default-domain value x.com
    username sean password U/h5bFVjXlIDx8BtqPFrQw== nt-encrypted
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key secret1
    radius-sdi-xauth
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    tunnel-group cnf-vpn-cls type remote-access
    tunnel-group cnf-vpn-cls general-attributes
    address-pool cnf-8-ip
    default-group-policy cnf-vpn-cls
    tunnel-group cnf-vpn-cls ipsec-attributes
    pre-shared-key secret2
    isakmp ikev1-user-authentication none
    tunnel-group cnf-vpn-cls ppp-attributes
    authentication ms-chap-v2
    tunnel-group X.X.21.29 type ipsec-l2l
    tunnel-group X.X.21.29 ipsec-attributes
    pre-shared-key SECRET
    class-map inspection_default
    match default-inspection-traffic
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:9780edb09bc7debe147db1e7d52ec39c
    : end
    #2:  Router 2811 config:
    ! Last configuration change at 09:15:32 PST Fri Oct 19 2012 by cnfla
    ! NVRAM config last updated at 13:45:03 PST Tue Oct 16 2012
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname LA-2800
    crypto pki trustpoint TP-self-signed-1411740556
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1411740556
    revocation-check none
    rsakeypair TP-self-signed-1411740556
    crypto pki certificate chain TP-self-signed-1411740556
    certificate self-signed 01
      3082023F 308201A8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31343131 37343035 3536301E 170D3132 31303136 32303435
      30335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 34313137
      34303535 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100F75F F1BDAD9B DE9381FD 165B5188 7EAF9685 CF15A317 1B424825 9C66AA28
      C990B2D3 D69A2F0F D745DB0E 2BB4995D 73415AC4 F01B2019 84373199 C4BCF9E0
      E599B86C 17DBDCE6 47EBE0E3 8DBC90B2 9B4E217A 87F04BF7 A182501E 24381019
      A61D2C05 5404DE88 DA2A1ADC A81B7F65 C318B697 7ED69DF1 2769E4C8 F3449B33
      35AF0203 010001A3 67306530 0F060355 1D130101 FF040530 030101FF 30120603
      551D1104 0B300982 074C412D 32383030 301F0603 551D2304 18301680 14B56EEB
      88054CCA BB8CF8E8 F44BFE2C B77954E1 52301D06 03551D0E 04160414 B56EEB88
      054CCABB 8CF8E8F4 4BFE2CB7 7954E152 300D0609 2A864886 F70D0101 04050003
      81810056 58755C56 331294F8 BEC4FEBC 54879FF5 0FCC73D4 B964BA7A 07D20452
      E7F40F42 8B355015 77156C9F AAA45F9F 59CDD27F 89FE7560 F08D953B FC19FD2D
      310DA96E A5F3E83B 52D515F8 7B4C99CF 4CECC3F7 1A0D4909 BD08C373 50BB53CC
      659C4246 2CB7B79F 43D94D96 586F9103 9B4659B6 5C8DDE4F 7CC5FC68 C4AD197A 4EC322
                quit
    crypto isakmp policy 1
    authentication pre-share
    crypto isakmp key SECRET address X.X.138.132 no-xauth
    crypto ipsec transform-set la-2800-trans-set esp-des esp-sha-hmac
    crypto map la-2800-ipsec-policy 1 ipsec-isakmp
    description vpn ipsec policy
    set peer X.X.138.132
    set transform-set la-2800-trans-set
    match address 101
    interface FastEthernet0/0
    description WAN Side
    ip address X.X.216.29 255.255.255.248
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    no cdp enable
    no mop enabled
    crypto map la-2800-ipsec-policy
    interface FastEthernet0/1
    description LAN Side
    ip address 10.20.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex full
    speed auto
    no mop enabled
    ip nat inside source route-map nonat interface FastEthernet0/0 overload
    access-list 10 permit X.X.138.132
    access-list 99 permit 64.236.96.53
    access-list 99 permit 98.82.1.202
    access-list 101 remark vpn tunnerl acl
    access-list 101 remark SDM_ACL Category=4
    access-list 101 remark tunnel policy
    access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255
    access-list 110 deny   ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255
    access-list 110 permit ip 10.20.0.0 0.0.0.255 any
    snmp-server community public RO
    route-map nonat permit 10
    match ip address 110
    webvpn gateway gateway_1
    ip address X.X.216.29 port 443
    ssl trustpoint TP-self-signed-1411740556
    inservice
    webvpn install svc flash:/webvpn/svc.pkg
    webvpn context gateway-1
    title "b"
    secondary-color white
    title-color #CCCC66
    text-color black
    ssl authenticate verify all
    policy group policy_1
       functions svc-enabled
       svc address-pool "WebVPN-Pool"
       svc keep-client-installed
       svc split include 10.20.0.0 255.255.0.0
    default-group-policy policy_1
    gateway gateway_1
    inservice
    end
    #3:  Test from Pix to router:
    Active SA:    1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: X.X.21.29
        Type    : user            Role    : initiator
        Rekey   : no              State   : MM_WAIT_MSG2
    >>DEBUG:
    Oct 22 12:07:14 pix535:Oct 22 12:20:28 EDT: %PIX-vpn-3-713902: IP = X.X.21.29, Removing peer from peer table failed, no match!
    Oct 22 12:07:14 pix535 :Oct 22 12:20:28 EDT: %PIX-vpn-4-713903: IP = X.X.21.29, Error: Unable to remove PeerTblEntry
    #4:  test from router to pix:
    LA-2800#sh  crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id slot status
    X.X.138.132  X.X.216.29  MM_KEY_EXCH       1017    0 ACTIVE
    >>debug
    LA-2800#ping 10.1.1.7 source 10.20.1.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.1.1.7, timeout is 2 seconds:
    Packet sent with a source address of 10.20.1.1
    Oct 22 16:24:33.945: ISAKMP:(0): SA request profile is (NULL)
    Oct 22 16:24:33.945: ISAKMP: Created a peer struct for X.X.138.132, peer port 500
    Oct 22 16:24:33.945: ISAKMP: New peer created peer = 0x488B25C8 peer_handle = 0x80000013
    Oct 22 16:24:33.945: ISAKMP: Locking peer struct 0x488B25C8, refcount 1 for isakmp_initiator
    Oct 22 16:24:33.945: ISAKMP: local port 500, remote port 500
    Oct 22 16:24:33.945: ISAKMP: set new node 0 to QM_IDLE     
    Oct 22 16:24:33.945: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 487720A0
    Oct 22 16:24:33.945: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    Oct 22 16:24:33.945: ISAKMP:(0):found peer pre-shared key matching 70.169.138.132
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-07 ID
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-03 ID
    Oct 22 16:24:33.945: ISAKMP:(0): constructed NAT-T vendor-02 ID
    Oct 22 16:24:33.945: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    Oct 22 16:24:33.945: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    Oct 22 16:24:33.945: ISAKMP:(0): beginning Main Mode exchange
    Oct 22 16:24:33.945: ISAKMP:(0): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_NO_STATE
    Oct 22 16:24:33.945: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Oct 22 16:24:34.049: ISAKMP (0:0): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_NO_STATE
    Oct 22 16:24:34.049: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Oct 22 16:24:34.049: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    Oct 22 16:24:34.049: ISAKMP:(0): processing SA payload. message ID = 0
    Oct 22 16:24:34.049: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.049: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Oct 22 16:24:34.049: ISAKMP:(0): vendor ID is NAT-T v2
    Oct 22 16:24:34.049: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.049: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
    Oct 22 16:24:34.053: ISAKMP:(0):found peer pre-shared key matching 70.169.138.132
    Oct 22 16:24:34.053: ISAKMP:(0): local preshared key found
    Oct 22 16:24:34.053: ISAKMP : Scanning profiles for xauth ...
    Oct 22 16:24:34.053: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    Oct 22 16:24:34.053: ISAKMP:      encryption DES-CBC
    Oct 22 16:24:34.053: ISAKMP:      hash SHA
    Oct 22 16:24:34.053: ISAKMP:      default group 1
    Oct 22 16:24:34.053: ISAKMP:      auth pre-share
    Oct 22 16:24:34.053: ISAKMP:      life type in seconds
    Oct 22 16:24:34.053: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    Oct 22 16:24:34.053: ISAKMP:(0):atts are acceptable. Next payload is 0
    Oct 22 16:24:34.053: ISAKMP:(0):Acceptable atts:actual life: 0
    Oct 22 16:24:34.053: ISAKMP:(0):Acceptable atts:life: 0
    Oct 22 16:24:34.053: ISAKMP:(0):Fill atts in sa vpi_length:4
    Oct 22 16:24:34.053: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    Oct 22 16:24:34.053: ISAKMP:(0):Returning Actual lifetime: 86400
    Oct 22 16:24:34.053: ISAKMP:(0)::Started lifetime timer: 86400.
    Oct 22 16:24:34.053: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.053: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Oct 22 16:24:34.053: ISAKMP:(0): vendor ID is NAT-T v2
    Oct 22 16:24:34.053: ISAKMP:(0): processing vendor id payload
    Oct 22 16:24:34.053: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
    Oct 22 16:24:34.053: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Oct 22 16:24:34.053: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Oct 22 16:24:34.057: ISAKMP:(0): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_SA_SETUP
    Oct 22 16:24:34.057: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Oct 22 16:24:34.057: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Oct 22 16:24:34.057: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Oct 22 16:24:34.181: ISAKMP (0:0): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_SA_SETUP
    Oct 22 16:24:34.181: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Oct 22 16:24:34.181: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Oct 22 16:24:34.181: ISAKMP:(0): processing KE payload. message ID = 0
    Oct 22 16:24:34.217: ISAKMP:(0): processing NONCE payload. message ID = 0
    Oct 22 16:24:34.217: ISAKMP:(0):found peer pre-shared key matching X.X.138.132
    Oct 22 16:24:34.217: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.217: ISAKMP:(1018): vendor ID is Unity
    Oct 22 16:24:34.217: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.217: ISAKMP:(1018): vendor ID seems Unity/DPD but major 55 mismatch
    Oct 22 16:24:34.217: ISAKMP:(1018): vendor ID is XAUTH
    Oct 22 16:24:34.217: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.217: ISAKMP:(1018): speaking to another IOS box!
    Oct 22 16:24:34.221: ISAKMP:(1018): processing vendor id payload
    Oct 22 16:24:34.221: ISAKMP:(1018):vendor ID seems Unity/DPD but hash mismatch
    Oct 22 16:24:34.221: ISAKMP:received payload type 20
    Oct 22 16:24:34.221: ISAKMP:received payload type 20
    Oct 22 16:24:34.221: ISAKMP:(1018):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Oct 22 16:24:34.221: ISAKMP:(1018):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Oct 22 16:24:34.221: ISAKMP:(1018):Send initial contact
    Oct 22 16:24:34.221: ISAKMP:(1018):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    Oct 22 16:24:34.221: ISAKMP (0:1018): ID payload
    next-payload : 8
    type         : 1
    address      : X.X.216.29
    protocol     : 17
    port         : 500
    length       : 12
    Oct 22 16:24:34.221: ISAKMP:(1018):Total payload length: 12
    Oct 22 16:24:34.221: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:24:34.221: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:24:34.225: ISAKMP:(1018):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Oct 22 16:24:34.225: ISAKMP:(1018):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Oct 22 16:24:38.849: ISAKMP:(1017):purging node 198554740
    Oct 22 16:24:38.849: ISAKMP:(1017):purging node 812380002
    Oct 22 16:24:38.849: ISAKMP:(1017):purging node 773209335..
    Success rate is 0 percent (0/5)
    LA-2800#
    Oct 22 16:24:44.221: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:24:44.221: ISAKMP (0:1018): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    Oct 22 16:24:44.221: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:24:44.221: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:24:44.221: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:24:44.317: ISAKMP (0:1018): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_KEY_EXCH
    Oct 22 16:24:44.317: ISAKMP:(1018): phase 1 packet is a duplicate of a previous packet.
    Oct 22 16:24:44.321: ISAKMP:(1018): retransmission skipped for phase 1 (time since last transmission 96)
    Oct 22 16:24:48.849: ISAKMP:(1017):purging SA., sa=469BAD60, delme=469BAD60
    Oct 22 16:24:52.313: ISAKMP (0:1018): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_KEY_EXCH
    Oct 22 16:24:52.313: ISAKMP:(1018): phase 1 packet is a duplicate of a previous packet.
    Oct 22 16:24:52.313: ISAKMP:(1018): retransmitting due to retransmit phase 1
    Oct 22 16:24:52.813: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:24:52.813: ISAKMP (0:1018): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
    Oct 22 16:24:52.813: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:24:52.813: ISAKMP:(1018): sending packet to X.X138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:24:52.813: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:24:52.913: ISAKMP:(1018): phase 1 packet is a duplicate of a previous packet.
    Oct 22 16:24:52.913: ISAKMP:(1018): retransmission skipped for phase 1 (time since last transmission 100)
    Oct 22 16:25:00.905: ISAKMP (0:1018): received packet from X.X.138.132 dport 500 sport 500 Global (I) MM_KEY_EXCH
    Oct 22 16:25:00.905: ISAKMP: set new node 422447177 to QM_IDLE     
    Oct 22 16:25:03.941: ISAKMP:(1018):SA is still budding. Attached new ipsec request to it. (local 1X.X.216.29, remote X.X.138.132)
    Oct 22 16:25:03.941: ISAKMP: Error while processing SA request: Failed to initialize SA
    Oct 22 16:25:03.941: ISAKMP: Error while processing KMI message 0, error 2.
    Oct 22 16:25:12.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:25:12.814: ISAKMP (0:1018): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
    Oct 22 16:25:12.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:25:12.814: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:25:12.814: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:25:22.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:25:22.814: ISAKMP (0:1018): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
    Oct 22 16:25:22.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH
    Oct 22 16:25:22.814: ISAKMP:(1018): sending packet to X.X.138.132 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Oct 22 16:25:22.814: ISAKMP:(1018):Sending an IKE IPv4 Packet.
    Oct 22 16:25:32.814: ISAKMP:(1018): retransmitting phase 1 MM_KEY_EXCH...
    Oct 22 16:25:32.814: ISAKMP:(1018):peer does not do paranoid keepalives.
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting SA reason "Death by retransmission P1" state (I) MM_KEY_EXCH (peer 70.169.138.132)
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting SA reason "Death by retransmission P1" state (I) MM_KEY_EXCH (peer 70.169.138.132)
    Oct 22 16:25:32.814: ISAKMP: Unlocking peer struct 0x488B25C8 for isadb_mark_sa_deleted(), count 0
    Oct 22 16:25:32.814: ISAKMP: Deleting peer node by peer_reap for X.X.138.132: 488B25C8
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting node 1112432180 error FALSE reason "IKE deleted"
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting node 422447177 error FALSE reason "IKE deleted"
    Oct 22 16:25:32.814: ISAKMP:(1018):deleting node -278980615 error FALSE reason "IKE deleted"
    Oct 22 16:25:32.814: ISAKMP:(1018):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    Oct 22 16:25:32.814: ISAKMP:(1018):Old State = IKE_I_MM5  New State = IKE_DEST_SA
    Oct 22 16:26:22.816: ISAKMP:(1018):purging node 1112432180
    Oct 22 16:26:22.816: ISAKMP:(1018):purging node 422447177
    Oct 22 16:26:22.816: ISAKMP:(1018):purging node -278980615
    Oct 22 16:26:32.816: ISAKMP:(1018):purging SA., sa=487720A0, delme=487720A0
    ****** The PIX is also used    VPN client access  , such as  Cicso VPN client  5.0, working fine ; Router is  used as  SSL VPN server, working too
    I know there are lots of data here, hopefully these data may be useful for   diagnosis purpose.
    Any suggestions and advices are greatly appreciated.
    Sean

    Hi Sean,
    Current configuration:
    On the PIX:
    crypto isakmp policy 5
          authentication pre-share
          encryption 3des
          hash sha
          group 2
          lifetime 86400
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer X.X.21.29
    crypto map outside_map 1 set transform-set ESP-DES-SHA
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    access-list outside_1_cryptomap extended permit ip 10.1.0.0 255.255.0.0 10.20.0.0 255.255.0.0
    tunnel-group X.X.21.29 type ipsec-l2l
    tunnel-group X.X.21.29 ipsec-attributes
         pre-shared-key SECRET
    On the Router:
    crypto isakmp policy 1
          authentication pre-share
    crypto map la-2800-ipsec-policy 1 ipsec-isakmp
          description vpn ipsec policy    
          set peer X.X.138.132
          set transform-set la-2800-trans-set
          match address 101
    access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255
    crypto ipsec transform-set la-2800-trans-set esp-des esp-sha-hmac
    crypto isakmp key SECRET address X.X.138.132 no-xauth
    Portu.
    Please rate any helpful posts
    Message was edited by: Javier Portuguez

  • Site to Site VPN between ASA 5505 and Cisco 800 router

    Evening all,
    Hoping that someboy can see the error of my ways.  It seems very like the problem that i read here: https://supportforums.cisco.com/thread/2016300
    We have a cisco 800 in a remote site which we wanted to use for a site to site vpn.  Went through the steps on the ASA 5505 and the 800 and have got to the stage were the tunnel is up and connected.  Getting traffic through it is another matter.  Remote network is 172.20.224.0/20 and the server network behind the ASA is 192.168.168.0/24. The tunnel does intiate when you send traffic from 172 ......to 192.......  Both the ASA and 800 report the tunnel is up.  If i look at the stats using ccp on the 800 i can see the encapsulation packets graph shooting up but nothing cominbg back.  I did packet captures on the 5505 and could not see anything coming from the tunnel so i dont belive its making it to the ASA.  Here is the config from the 800:
    Building configuration...
    Current configuration : 6488 bytes
    version 12.4
    no service pad
    service timestamps debug uptime
    service timestamps log uptime
    no service password-encryption
    hostname hhp-sty-backup
    boot-start-marker
    boot-end-marker
    logging message-counter syslog
    logging buffered 4096
    enable secret 5 $1$jI1i$/kZbRk2WHD5h0HtfuQVej1
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa authorization auth-proxy default local
    aaa session-id common
    crypto pki trustpoint TP-self-signed-1347488939
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1347488939
    revocation-check none
    rsakeypair TP-self-signed-1347488939
    crypto pki certificate chain TP-self-signed-1347488939
    certificate self-signed 02
      30820255 308201BE A0030201 02020102 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31333437 34383839 3339301E 170D3032 30333031 30313336
      33375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 33343734
      38383933 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100E714 7B0ADB41 19F60528 A8A5C43B 5CD2D1CD DCCF2E08 8B38D444 36EAB9B7
      0E93CEF7 660F979E E27915B9 E44812A5 794EA03D BA66752B FD0F7EBF D6342513
      D6410E4E 098CE838 C3BADD0A 5F3505FE 22CA776F 89B19510 F0852225 3600F046
      4D57D2E2 FE4AAD1E 8BE4BF80 7B27369E BFA65160 BC769BC9 00A13741 E336D0EA
      8A810203 010001A3 7D307B30 0F060355 1D130101 FF040530 030101FF 30280603
      551D1104 21301F82 1D686870 2D737479 2D626163 6B75702E 796F7572 646F6D61
      696E2E63 6F6D301F 0603551D 23041830 168014FA 4A8C4DF6 629638DE 87D7B60A
      0F5BB40F EA6AED30 1D060355 1D0E0416 0414FA4A 8C4DF662 9638DE87 D7B60A0F
      5BB40FEA 6AED300D 06092A86 4886F70D 01010405 00038181 00BBE577 6EF63FE7
      789766D5 37841812 298D4885 1CD06D07 4C625369 C3403106 89EE1398 73495432
      66C49CB1 36A5B2F8 D77A8C46 5AFE4112 EA5917D9 81542640 80EF2D36 54A85CC6
      C3FFFFB8 39A648DD 2ABA2B13 4137BE07 760E46C0 74401DA7 482E3FA2 A64B70FF
      447AA1B2 52E37240 29987085 532BBE3B C2E2E54A 54CA1D13 0E
                quit
    dot11 syslog
    ip source-route
    ip dhcp excluded-address 10.10.10.1
    ip dhcp pool inside
    ip dhcp pool lan_network
       network 172.20.224.0 255.255.240.0
       dns-server 8.8.8.8 8.8.4.4
       default-router 172.20.224.1
       lease 7
    ip cef
    no ip domain lookup
    ip domain name yourdomain.com
    password encryption aes
    username pix privilege 15 secret 5 $1$Z.wA$lBmj36AJx/cbK1RjmfGJh1
    username admin privilege 15 password 0 434Zaty
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key password address 217.36.32.222
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to217.36.32.222
    set peer 217.36.32.222
    set transform-set ESP-3DES-SHA
    match address 100
    archive
    log config
      hidekeys
    interface ATM0
    no ip address
    no atm ilmi-keepalive
    pvc 0/38
      encapsulation aal5mux ppp dialer
      dialer pool-member 1
    dsl operating-mode auto
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    interface FastEthernet3
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
    ip address 172.20.224.1 255.255.240.0
    ip nat inside
    ip virtual-reassembly
    ip tcp adjust-mss 1452
    interface Dialer0
    ip address negotiated
    ip nat outside
    ip virtual-reassembly
    encapsulation ppp
    dialer pool 1
    no cdp enable
    ppp authentication chap callin
    ppp chap hostname B6*******.btclick.com
    ppp chap password 0 H*******
    crypto map SDM_CMAP_1
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip http server
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
    access-list 1 remark CCP_ACL Category=16
    access-list 1 permit 172.4.0.0 0.240.255.255
    access-list 10 permit 195.12.1.35
    access-list 10 permit 172.4.0.0 0.240.255.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 172.20.224.0 0.0.15.255 192.168.168.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 172.20.224.0 0.0.15.255 192.168.168.0 0.0.0.255
    access-list 101 permit ip 172.4.0.0 0.240.255.255 any
    route-map SDM_RMAP_1 permit 1
    match ip address 101
    control-plane
    banner exec ^C
    % Password expiration warning.
    Cisco Configuration Professional (Cisco CP) is installed on this device
    and it provides the default username "cisco" for  one-time use. If you have
    already used the username "cisco" to login to the router and your IOS image
    supports the "one-time" user option, then this username has already expired.
    You will not be able to login to the router with this username after you exit
    this session.
    It is strongly suggested that you create a new username with a privilege level
    of 15 using the following command.
    username <myuser> privilege 15 secret 0 <mypassword>
    Replace <myuser> and <mypassword> with the username and password you
    want to use.
    ^C
    banner login ^C
    Cisco Configuration Professional (Cisco CP) is installed on this device.
    This feature requires the one-time use of the username "cisco" with the
    password "cisco". These default credentials have a privilege level of 15.
    YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE 
    PUBLICLY-KNOWN CREDENTIALS
    Here are the Cisco IOS commands.
    username <myuser>  privilege 15 secret 0 <mypassword>
    no username cisco
    Replace <myuser> and <mypassword> with the username and password you want
    to use.
    IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
    NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
    For more information about Cisco CP please follow the instructions in the
    QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
    ^C
    line con 0
    no modem enable
    stopbits 1
    line aux 0
    line vty 0 4
    access-class 10 in
    privilege level 15
    password 434Zaty
    transport input telnet ssh
    scheduler max-task-time 5000
    end
    Any help will be most gratefully recieved.

    Rick,
    Thanks for replying.  Here is the output from the 800 Show Crypto command:
    interface: Dialer0
        Crypto map tag: SDM_CMAP_1, local addr 81.136.160.237
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (172.20.224.0/255.255.240.0/0/0)
       remote ident (addr/mask/prot/port): (192.168.168.0/255.255.255.0/0/0)
       current_peer 217.36.32.222 port 500
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 10928, #pkts encrypt: 10928, #pkts digest: 10928
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 2, #recv errors 0
         local crypto endpt.: 81.136.160.237, remote crypto endpt.: 217.36.32.222
         path mtu 1500, ip mtu 1500, ip mtu idb Virtual-Access2
         current outbound spi: 0x0(0)
         inbound esp sas:
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
         outbound ah sas:
         outbound pcp sas:
    interface: Virtual-Access2
        Crypto map tag: SDM_CMAP_1, local addr 81.136.160.237
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (172.20.224.0/255.255.240.0/0/0)
       remote ident (addr/mask/prot/port): (192.168.168.0/255.255.255.0/0/0)
       current_peer 217.36.32.222 port 500
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 10928, #pkts encrypt: 10928, #pkts digest: 10928
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 2, #recv errors 0
         local crypto endpt.: 81.136.160.237, remote crypto endpt.: 217.36.32.222
         path mtu 1500, ip mtu 1500, ip mtu idb Virtual-Access2
         current outbound spi: 0x0(0)
         inbound esp sas:
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
         outbound ah sas:
         outbound pcp sas:
    and this is the running config frm our ASA at HQ:
    Result of the command: "sh run"
    : Saved
    ASA Version 8.2(1)
    hostname secure-access
    domain-name hhp.com
    enable password UWWykvGjAPmxufUo encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.168.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group BT
    ip address 217.36.32.222 255.255.255.255 pppoe
    interface Vlan12
    nameif DMZ
    security-level 50
    ip address 192.168.169.1 255.255.255.0
    interface Vlan22
    nameif Wireless_HHP
    security-level 100
    ip address 172.16.36.1 255.255.254.0
    interface Vlan32
    nameif CNES
    security-level 100
    ip address 187.187.168.1 255.255.0.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 12
    interface Ethernet0/3
    switchport access vlan 22
    interface Ethernet0/4
    switchport access vlan 32
    interface Ethernet0/5
    switchport access vlan 12
    interface Ethernet0/6
    switchport access vlan 12
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup DMZ
    dns domain-lookup Wireless_HHP
    dns domain-lookup CNES
    dns server-group DefaultDNS
    name-server 192.168.168.2
    domain-name hhp.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network NET-cnes_HHP-Sty
    network-object 172.20.224.0 255.255.240.0
    object-group network NET-cnes_HHP-Balivanich
    network-object 172.20.192.0 255.255.240.0
    object-group network Oak-DC1
    network-object 192.168.168.2 255.255.255.255
    object-group network Maple-DC2
    network-object 192.168.168.3 255.255.255.255
    object-group network HHP_Domain_Controllers
    group-object Oak-DC1
    group-object Maple-DC2
    object-group network PC-Support
    network-object 187.187.60.1 255.255.255.255
    network-object 187.187.60.2 255.255.255.254
    network-object 187.187.60.4 255.255.255.254
    network-object 187.187.60.6 255.255.255.255
    object-group network ELM-ActiveH
    network-object 192.168.168.6 255.255.255.255
    object-group network Pine-GP
    network-object 192.168.168.12 255.255.255.255
    object-group network HHP_Application_Servers
    group-object ELM-ActiveH
    group-object Pine-GP
    object-group network Fern-TS1
    network-object 192.168.168.4 255.255.255.255
    object-group network Fir-TS2
    network-object 192.168.168.5 255.255.255.255
    object-group network HHP_Terminal_Servers
    group-object Fern-TS1
    group-object Fir-TS2
    object-group service Global_Catalog_LDAP
    description (Generated by Cisco SM from Object "Global Catalog LDAP")
    service-object tcp eq 3268
    object-group service Global_Catalog_LDAP_SSL
    description (Generated by Cisco SM from Object "Global Catalog LDAP SSL")
    service-object tcp eq 3269
    object-group service UDP-389
    description UDP port for LDAP
    service-object udp eq 389
    object-group service TCP-88
    description TCP Port 88
    service-object tcp eq 88
    object-group service TCP-445
    description SMB
    service-object tcp eq 445
    object-group network John_-_Laptop
    description John's Laptop
    network-object 187.187.10.65 255.255.255.255
    object-group network Graham_-_PC
    description Graham Morrison's PC
    network-object 187.187.10.90 255.255.255.255
    object-group network john_test
    network-object 187.187.40.7 255.255.255.255
    object-group network Iain_PC
    description Iain Macaulay IT
    network-object 187.187.10.19 255.255.255.255
    object-group network John_-_PC
    description John MacPhail's PC
    network-object 187.187.10.7 255.255.255.255
    object-group network it-alahen-lap
    network-object 187.187.10.230 255.255.255.255
    object-group network Catriona_-_Laptop
    description Catriona's Laptop
    network-object 187.187.10.60 255.255.255.255
    object-group network Graham_-_Laptop
    network-object 187.186.10.120 255.255.255.255
    object-group network it-innive-xp
    description Innes MacIver's PC
    network-object 187.187.10.14 255.255.255.255
    object-group network it-alahen-xp
    description Desktop
    network-object 187.187.10.229 255.255.255.255
    object-group network Cat_-_PC
    description Catriona Macmillan's PC
    network-object 187.187.10.4 255.255.255.255
    object-group network it-davdon-xp
    description Desktop
    network-object 187.187.160.7 255.255.255.255
    object-group network cat-laptop
    description Catriona's Laptop addresses
    network-object 187.187.77.81 255.255.255.255
    network-object 187.187.77.82 255.255.255.255
    object-group network Catriona_old_pc
    network-object 187.187.10.44 255.255.255.255
    object-group network cat-tablet
    description Catriona's Tablet ip address's
    network-object 187.187.77.78 255.255.255.254
    object-group network DSO-SQLServer
    description Task Database Server
    network-object 187.187.1.33 255.255.255.255
    object-group network it-finfernew-xp
    description Findlay Ferguson PC
    network-object 187.187.10.153 255.255.255.255
    object-group network PC_Support
    group-object John_-_Laptop
    group-object Graham_-_PC
    group-object john_test
    group-object Iain_PC
    group-object John_-_PC
    group-object it-alahen-lap
    group-object Catriona_-_Laptop
    group-object Graham_-_Laptop
    group-object it-alahen-xp
    group-object Cat_-_PC
    group-object it-davdon-xp
    group-object cat-laptop
    group-object Catriona_old_pc
    group-object cat-tablet
    group-object it-innive-xp
    network-object 187.187.1.128 255.255.255.255
    network-object 187.187.10.76 255.255.255.255
    group-object DSO-SQLServer
    network-object 187.187.15.234 255.255.255.255
    network-object 187.187.4.60 255.255.255.255
    network-object 187.187.10.134 255.255.255.255
    network-object 172.18.194.22 255.255.255.255
    group-object it-finfernew-xp
    object-group network Entire_CNE
    description Entire CNE range
    network-object 187.0.0.0 255.0.0.0
    object-group network NET-cnes_HHP-Sty-Staff
    network-object 172.20.225.0 255.255.255.0
    object-group network NET-cnes_HHP-Balivanich-staff
    network-object 172.20.193.0 255.255.255.0
    object-group network Alder-Intranet
    network-object 192.168.168.13 255.255.255.255
    object-group network Aspen-ISA
    network-object 192.168.168.10 255.255.255.255
    object-group service tcp-8080
    description TCP Port 8080
    service-object tcp eq 8080
    object-group network Beech-External
    network-object 217.36.32.210 255.255.255.255
    object-group network it-csm
    description cisco security manager
    network-object 187.187.1.72 255.255.255.255
    object-group network Juniper-External
    description Internet Server
    network-object 217.36.32.211 255.255.255.255
    object-group network HHP_Server_Network
    network-object 192.168.168.0 255.255.255.0
    object-group network Messagelabs_Incoming_HHP
    network-object 67.219.240.0 255.255.240.0
    network-object 95.131.104.0 255.255.248.0
    network-object 193.109.254.0 255.255.254.0
    network-object 195.245.230.0 255.255.254.0
    network-object 216.82.240.0 255.255.240.0
    network-object 85.158.136.0 255.255.248.0
    network-object 117.120.16.0 255.255.248.0
    network-object 194.106.220.0 255.255.254.0
    object-group network Angus-Maclean-PC
    network-object 187.187.10.250 255.255.255.255
    object-group service RDP
    service-object tcp eq 3389
    object-group network it-dbserver
    description Database Server (Live)
    network-object 187.187.1.65 255.255.255.255
    object-group network it-sql-test
    description Test SQL / database server
    network-object 187.187.1.81 255.255.255.255
    object-group service DNS-Resolving
    description Domain Name Server
    service-object tcp eq domain
    service-object udp eq domain
    object-group network Beech-Exchange
    network-object 192.168.168.91 255.255.255.255
    object-group network Messagelabs_-_Incoming
    description List of MessageLab addresses that SMTP connections are accepted from
    network-object 212.125.75.0 255.255.255.224
    network-object 216.82.240.0 255.255.240.0
    network-object 195.216.16.211 255.255.255.255
    network-object 194.205.110.128 255.255.255.224
    network-object 194.106.220.0 255.255.254.0
    network-object 193.109.254.0 255.255.254.0
    network-object 62.231.131.0 255.255.255.0
    network-object 62.173.108.208 255.255.255.240
    network-object 62.173.108.16 255.255.255.240
    network-object 212.125.74.44 255.255.255.255
    network-object 195.245.230.0 255.255.254.0
    network-object 85.158.136.0 255.255.248.0
    object-group network MIS_Support
    network-object 192.168.168.250 255.255.255.254
    object-group network it-donadon-xp
    description Donald Macdonald's PC
    network-object 187.187.10.13 255.255.255.255
    object-group network Angela_PC
    network-object 187.187.10.155 255.255.255.255
    object-group network Katie_PC
    network-object 187.187.10.151 255.255.255.255
    object-group network Pauline_PC
    network-object 187.187.10.12 255.255.255.255
    object-group network it-paye-net
    network-object 187.187.1.92 255.255.255.255
    object-group network MessageLabs-Towers
    description Message Labs IP Address ranges
    network-object 216.82.240.0 255.255.240.0
    network-object 67.219.240.0 255.255.240.0
    network-object 85.158.136.0 255.255.248.0
    network-object 95.131.104.0 255.255.248.0
    network-object 117.120.16.0 255.255.248.0
    network-object 193.109.254.0 255.255.254.0
    network-object 194.106.220.0 255.255.254.0
    network-object 195.245.230.0 255.255.254.0
    network-object 62.231.131.0 255.255.255.0
    network-object 212.125.75.16 255.255.255.240
    object-group network NET_cnes-castlebay-staff
    network-object 172.19.17.0 255.255.255.0
    object-group network NET_cnes_tarbert_staff
    description NET_cnes_tarbert_staff
    network-object 172.19.33.0 255.255.255.0
    object-group network Juniper
    network-object 192.168.169.5 255.255.255.255
    object-group network HHP_DMZ_Network
    network-object 192.168.169.0 255.255.255.0
    object-group network Ash
    network-object 192.168.168.100 255.255.255.255
    object-group service UDP-445
    service-object udp eq 445
    object-group service tcp-udp-135-139
    service-object tcp-udp range 135 139
    object-group network HHP-ELM
    description HHP's ELM ActiveH server
    network-object 187.187.1.203 255.255.255.255
    object-group network CNES-Ext-GW
    description CNES External Address
    network-object 194.83.245.242 255.255.255.255
    object-group service IPSEC
    description IPSEC
    service-object 57
    service-object ah
    service-object esp
    service-object udp eq isakmp
    object-group network Alamur-PC
    network-object 187.187.10.15 255.255.255.255
    object-group network Iain-Nicolson-PC
    network-object 187.187.10.159 255.255.255.255
    object-group network HHP_Remote_Access_Pool
    network-object 192.168.168.200 255.255.255.248
    network-object 192.168.168.208 255.255.255.240
    network-object 192.168.168.224 255.255.255.252
    network-object 192.168.168.228 255.255.255.254
    object-group network Holly-AV
    network-object 192.168.168.9 255.255.255.255
    object-group service AVG_Ports
    description For AVG server to HHP PCs
    service-object tcp-udp eq 6150
    service-object tcp-udp eq 6051
    service-object tcp-udp eq 445
    service-object tcp-udp eq 138
    service-object tcp-udp eq 135
    service-object tcp-udp eq 6054
    service-object tcp-udp eq 4158
    service-object tcp-udp eq 139
    service-object tcp-udp eq 137
    object-group network CNES_Access
    network-object 192.168.168.230 255.255.255.254
    network-object 192.168.168.232 255.255.255.248
    network-object 192.168.168.240 255.255.255.248
    network-object 192.168.168.248 255.255.255.254
    object-group network HHP-068
    description BACS PC
    network-object 172.20.225.6 255.255.255.255
    object-group network Banyan
    network-object 192.168.168.105 255.255.255.255
    object-group service TCP81
    description TCP Port 81
    service-object tcp eq 81
    object-group network Gavin_-_new_PC
    network-object 187.187.10.150 255.255.255.255
    object-group network Secudoors
    network-object 172.20.224.4 255.255.255.255
    access-list outside_access_in remark Time sync to external ntp server
    access-list outside_access_in extended permit udp host 192.108.114.23 object-group HHP_Domain_Controllers eq ntp
    access-list outside_access_in extended permit tcp object-group MessageLabs-Towers object-group Beech-External eq smtp
    access-list outside_access_in extended permit ip host 81.136.160.237 object-group HHP_Server_Network
    access-list outside_access_in extended permit ip object-group CNES_Access object-group HHP_Server_Network
    access-list outside_access_in extended permit ip object-group MIS_Support object-group HHP_Server_Network
    access-list outside_access_in extended permit ip object-group HHP_Remote_Access_Pool object-group HHP_Server_Network
    access-list outside_access_in extended permit tcp any object-group Juniper-External eq www
    access-list outside_access_in extended permit tcp any object-group Juniper-External eq https
    access-list outside_access_in extended deny ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list CSM_FW_ACL_Wireless_HHP extended permit ip object-group NET-cnes_HHP-Balivanich object-group HHP_Server_Network
    access-list CSM_FW_ACL_Wireless_HHP extended permit ip object-group NET-cnes_HHP-Sty object-group HHP_Server_Network
    access-list CSM_FW_ACL_Wireless_HHP extended permit tcp object-group HHP-068 any eq www
    access-list CSM_FW_ACL_Wireless_HHP extended permit tcp object-group HHP-068 any eq domain
    access-list CSM_FW_ACL_Wireless_HHP extended permit udp object-group HHP-068 any eq domain
    access-list CSM_FW_ACL_Wireless_HHP extended permit tcp object-group HHP-068 any eq https
    access-list CSM_FW_ACL_Wireless_HHP extended permit object-group DNS-Resolving object-group HHP-068 any
    access-list CSM_FW_ACL_Wireless_HHP extended permit object-group tcp-8080 object-group HHP-068 any
    access-list CSM_FW_ACL_Wireless_HHP extended permit ip host 172.20.193.53 object-group CNES-Ext-GW
    access-list CSM_FW_ACL_Wireless_HHP extended permit ip object-group Secudoors any
    access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Server_Network object-group NET-cnes_HHP-Balivanich
    access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Server_Network object-group NET-cnes_HHP-Sty
    access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Application_Servers object-group PC_Support
    access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Domain_Controllers object-group PC_Support
    access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Terminal_Servers object-group PC_Support
    access-list CSM_FW_ACL_inside extended permit tcp object-group Oak-DC1 any eq domain
    access-list CSM_FW_ACL_inside extended permit udp object-group Oak-DC1 any eq domain
    access-list CSM_FW_ACL_inside extended permit object-group DNS-Resolving object-group Oak-DC1 any
    access-list CSM_FW_ACL_inside extended permit tcp object-group Maple-DC2 any eq domain
    access-list CSM_FW_ACL_inside extended permit udp object-group Maple-DC2 any eq domain
    access-list CSM_FW_ACL_inside extended permit object-group DNS-Resolving object-group Maple-DC2 any
    access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA any eq www
    access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA any eq domain
    access-list CSM_FW_ACL_inside extended permit udp object-group Aspen-ISA any eq domain
    access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA any eq https
    access-list CSM_FW_ACL_inside extended permit object-group DNS-Resolving object-group Aspen-ISA any
    access-list CSM_FW_ACL_inside extended permit object-group tcp-8080 object-group Aspen-ISA any
    access-list CSM_FW_ACL_inside remark For Symantec Liveupdates
    access-list CSM_FW_ACL_inside extended permit tcp object-group Banyan any eq ftp
    access-list CSM_FW_ACL_inside extended permit tcp object-group Banyan any eq www
    access-list CSM_FW_ACL_inside extended permit tcp object-group Banyan any eq https
    access-list CSM_FW_ACL_inside remark IPSec VPN access from ELm to CNES
    access-list CSM_FW_ACL_inside extended permit object-group IPSEC object-group ELM-ActiveH object-group CNES-Ext-GW
    access-list CSM_FW_ACL_inside extended permit udp object-group ELM-ActiveH object-group CNES-Ext-GW eq 4500
    access-list CSM_FW_ACL_inside extended permit tcp object-group ELM-ActiveH object-group CNES-Ext-GW eq 4500
    access-list CSM_FW_ACL_inside extended permit icmp object-group HHP_Server_Network object-group HHP_DMZ_Network
    access-list CSM_FW_ACL_inside remark Time sync to external ntp server
    access-list CSM_FW_ACL_inside extended permit udp object-group HHP_Domain_Controllers host 192.108.114.23 eq ntp
    access-list CSM_FW_ACL_inside extended permit tcp object-group Beech-Exchange object-group Messagelabs_-_Incoming eq smtp
    access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA object-group Juniper eq www
    access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA object-group Juniper eq https
    access-list CSM_FW_ACL_inside extended permit ip object-group Holly-AV object-group Juniper
    access-list CSM_FW_ACL_inside extended deny ip any any
    access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group HHP_Server_Network
    access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group HHP_DMZ_Network
    access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group NET-cnes_HHP-Balivanich
    access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group NET-cnes_HHP-Sty
    access-list CSM_FW_ACL_CNES extended permit tcp object-group it-csm any eq ssh
    access-list CSM_FW_ACL_CNES extended permit tcp object-group it-csm any eq www
    access-list CSM_FW_ACL_CNES extended permit tcp object-group it-csm any eq https
    access-list CSM_FW_ACL_CNES remark Aim's access to Active H server: DSO SQL
    access-list CSM_FW_ACL_CNES remark server's access (Task)
    access-list CSM_FW_ACL_CNES remark IT Ops - mapped drive for FTP transfer to and from E450/Elm of Entitlement Adjustments
    access-list CSM_FW_ACL_CNES remark and Tenancy Changes
    access-list CSM_FW_ACL_CNES extended permit ip object-group it-sql-test object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit ip object-group DSO-SQLServer object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit ip object-group it-paye-net object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit ip object-group Angela_PC object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit ip object-group Katie_PC object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit ip object-group Pauline_PC object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES remark donald and Findlay RDP access to Active H
    access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-donadon-xp object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-donadon-xp object-group HHP_Terminal_Servers
    access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-finfernew-xp object-group ELM-ActiveH
    access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-finfernew-xp object-group HHP_Terminal_Servers
    access-list CSM_FW_ACL_CNES extended permit ip object-group Angus-Maclean-PC object-group Alder-Intranet
    access-list CSM_FW_ACL_CNES extended permit ip object-group Angus-Maclean-PC host 192.168.168.17
    access-list CSM_FW_ACL_CNES extended permit ip object-group Angus-Maclean-PC object-group Juniper
    access-list CSM_FW_ACL_CNES extended permit ip object-group Iain-Nicolson-PC object-group Alder-Intranet
    access-list CSM_FW_ACL_CNES extended permit ip object-group Iain-Nicolson-PC host 192.168.168.17
    access-list CSM_FW_ACL_CNES extended permit ip object-group Iain-Nicolson-PC object-group Juniper
    access-list CSM_FW_ACL_CNES extended permit ip object-group it-davdon-xp object-group Alder-Intranet
    access-list CSM_FW_ACL_CNES extended permit ip object-group it-davdon-xp host 192.168.168.17
    access-list CSM_FW_ACL_CNES extended permit ip object-group it-davdon-xp object-group Juniper
    access-list CSM_FW_ACL_CNES extended permit ip object-group Alamur-PC object-group Alder-Intranet
    access-list CSM_FW_ACL_CNES extended permit ip object-group Alamur-PC host 192.168.168.17
    access-list CSM_FW_ACL_CNES extended permit ip object-group Alamur-PC object-group Juniper
    access-list CSM_FW_ACL_CNES extended permit ip object-group Gavin_-_new_PC object-group Alder-Intranet
    access-list CSM_FW_ACL_CNES extended permit ip object-group Gavin_-_new_PC host 192.168.168.17
    access-list CSM_FW_ACL_CNES extended permit ip object-group Gavin_-_new_PC object-group Juniper
    access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group NET_cnes-castlebay-staff object-group HHP_Server_Network
    access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group NET_cnes_tarbert_staff object-group HHP_Server_Network
    access-list MIS_splitTunnelAcl standard permit 192.168.168.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip object-group HHP_Server_Network 192.168.168.250 255.255.255.254
    access-list inside_nat0_outbound extended permit ip object-group HHP_Server_Network 192.168.168.224 255.255.255.224
    access-list CSM_FW_ACL_DMZ extended permit ip object-group HHP_DMZ_Network object-group PC_Support
    access-list CSM_FW_ACL_DMZ extended permit icmp object-group HHP_DMZ_Network object-group HHP_Server_Network
    access-list CSM_FW_ACL_DMZ extended permit ip object-group Juniper object-group Angus-Maclean-PC
    access-list CSM_FW_ACL_DMZ extended permit ip object-group Juniper object-group Holly-AV
    access-list CSM_FW_ACL_DMZ extended permit tcp object-group Juniper object-group Beech-Exchange eq smtp
    access-list CSM_FW_ACL_DMZ extended permit tcp object-group Juniper object-group HHP_Domain_Controllers eq domain
    access-list CSM_FW_ACL_DMZ extended permit udp object-group Juniper object-group HHP_Domain_Controllers eq domain
    access-list CSM_FW_ACL_DMZ remark for backups to USB drive on ASH
    access-list CSM_FW_ACL_DMZ extended permit object-group TCP-445 object-group Juniper object-group Ash
    access-list CSM_FW_ACL_DMZ extended permit object-group UDP-445 object-group Juniper object-group Ash
    access-list CSM_FW_ACL_DMZ extended permit object-group tcp-udp-135-139 object-group Juniper object-group Ash
    access-list CSM_FW_ACL_DMZ extended deny ip any any
    access-list CNES_Support_splitTunnelAcl standard permit 192.168.168.0 255.255.255.0
    access-list RemoteAccess_splitTunnelAcl standard permit 192.168.168.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object-group HHP_Server_Network object-group NET-cnes_HHP-Sty
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1492
    mtu DMZ 1500
    mtu Wireless_HHP 1500
    mtu CNES 1500
    ip local pool CNES_Access 192.168.168.230-192.168.168.249
    ip local pool MIS_Support 192.168.168.250-192.168.168.251
    ip local pool OLM-VPN-Pool 192.168.168.252
    ip local pool HHP_Remote_Access_Pool 192.168.168.200-192.168.168.229
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (Wireless_HHP) 1 172.20.193.53 255.255.255.255
    nat (Wireless_HHP) 1 172.20.225.0 255.255.255.0
    static (inside,CNES) 192.168.168.0 192.168.168.0 netmask 255.255.255.0
    static (CNES,inside) 187.187.0.0 255.255.0.0 netmask 255.255.0.0
    static (Wireless_HHP,inside) 172.20.224.0 172.20.224.0 netmask 255.255.240.0
    static (inside,Wireless_HHP) 192.168.168.0 192.168.168.0 netmask 255.255.255.0
    static (CNES,Wireless_HHP) 187.187.0.0 187.187.0.0 netmask 255.255.0.0
    static (inside,outside) 217.36.32.210 192.168.168.91 netmask 255.255.255.255
    static (DMZ,outside) 217.36.32.211 192.168.169.5 netmask 255.255.255.255
    static (inside,DMZ) 192.168.168.0 192.168.168.0 netmask 255.255.255.0
    static (CNES,DMZ) 187.0.0.0 187.0.0.0 netmask 255.0.0.0
    access-group CSM_FW_ACL_inside in interface inside
    access-group outside_access_in_1 in interface outside control-plane
    access-group outside_access_in in interface outside
    access-group CSM_FW_ACL_DMZ in interface DMZ
    access-group CSM_FW_ACL_Wireless_HHP in interface Wireless_HHP
    access-group CSM_FW_ACL_CNES in interface CNES
    route outside 0.0.0.0 0.0.0.0 81.148.0.157 1
    route Wireless_HHP 172.20.192.0 255.255.240.0 172.16.36.3 1
    route Wireless_HHP 172.20.224.0 255.255.240.0 172.16.36.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server HHP protocol ldap
    aaa-server HHP (inside) host 192.168.168.2
    timeout 5
    ldap-base-dn dc=hhp,dc=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *
    ldap-login-dn cn=gramor,cn=users,dc=hhp,dc=com
    server-type microsoft
    aaa-server HHP_1 protocol ldap
    aaa-server HHP_1 (inside) host 192.168.168.2
    timeout 5
    ldap-base-dn dc=hhp,dc=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *
    ldap-login-dn cn=administrator,cn=users,dc=hhp,dc=com
    server-type microsoft
    aaa-server HHP_3 protocol ldap
    aaa-server HHP_3 (inside) host 192.168.168.2
    timeout 5
    ldap-base-dn dc=hhp,dc=com
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *
    ldap-login-dn cn=administrator,cn=users,dc=hhp,dc=com
    server-type microsoft
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.168.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http 194.83.245.242 255.255.255.255 outside
    http 187.187.1.72 255.255.255.255 CNES
    http 187.187.10.90 255.255.255.255 CNES
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map outside_map_dynamic 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set peer 81.136.160.237
    crypto map outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 30001 ipsec-isakmp dynamic outside_map_dynamic
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    fqdn none
    subject-name O=Hebridean Housing Partnership Limited,CN=secure-access.hebrideanhousing.co.uk,L=Isle of Lewis,ST=Scotland,C=GB
    keypair SSL_Certificate
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment terminal
    fqdn none
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 0100000000012790a5c005
        30820530 30820418 a0030201 02020b01 00000000 012790a5 c005300d 06092a86
        4886f70d 01010505 00306a31 23302106 0355040b 131a4f72 67616e69 7a617469
        6f6e2056 616c6964 6174696f 6e204341 31133011 06035504 0a130a47 6c6f6261
        6c536967 6e312e30 2c060355 04031325 476c6f62 616c5369 676e204f 7267616e
        697a6174 696f6e20 56616c69 64617469 6f6e2043 41301e17 0d313030 33323431
        34313835 385a170d 31333033 32343134 31383534 5a308197 310b3009 06035504
        06130247 42311130 0f060355 04081308 53636f74 6c616e64 31163014 06035504
        07130d49 736c6520 6f66204c 65776973 312e302c 06035504 0a132548 65627269
        6465616e 20486f75 73696e67 20506172 746e6572 73686970 204c696d 69746564
        312d302b 06035504 03132473 65637572 652d6163 63657373 2e686562 72696465
        616e686f 7573696e 672e636f 2e756b30 82012230 0d06092a 864886f7 0d010101
        05000382 010f0030 82010a02 82010100 def181d9 c34c58a8 9abcc849 7d8ad0a9
        3c64c77f f3126c81 30911f41 5903a92c 81fb374b 2fe2680e 10b26dce 81ca0c23
        af2c9f9a 52295e8c d2223fa6 7c4c386d 51c6fb16 a47688e6 e47e2410 b0283503
        fd72abd3 e59d3b02 cd47706e babf948c 4e0282a3 5f789ff7 8041b2db ceac64eb
        3e163b38 3a8ecc25 0c4802a8 d17fecd9 f1a36288 29202df4 b20ae891 f95ce055
        6e670559 3d075024 7f3ac7ef 26218154 a7f6a399 34c43c4a 97c2c88c c4588ee4
        77cc2ad8 b1bd868d d55c2b9b 727e9904 66d0fb52 c212abd7 a06f28f1 ad2aa04b
        3d7b3094 c59c00d4 cf51fefb d8bfa101 8ba9c4ba 5cf629ff c50716d3 71019a98
        8fa55b83 6b158b6d 1043f092 646ef07d 02030100 01a38201 a7308201 a3301f06
        03551d23 04183016 80147d6d 2aec66ab a75136ab 0269f170 8fc4590b 9a1f3049
        06082b06 01050507 0101043d 303b3039 06082b06 01050507 3002862d 68747470
        3a2f2f73 65637572 652e676c 6f62616c 7369676e 2e6e6574 2f636163 6572742f
        6f726776 312e6372 74303f06 03551d1f 04383036 3034a032 a030862e 68747470
        3a2f2f63 726c2e67 6c6f6261 6c736967 6e2e6e65 742f4f72 67616e69 7a617469
        6f6e5661 6c312e63 726c301d 0603551d 0e041604 14d398d5 ddf29355 15b04750
        baccc6b3 0f97a6c9 94302f06 03551d11 04283026 82247365 63757265 2d616363
        6573732e 68656272 69646561 6e686f75 73696e67 2e636f2e 756b3009 0603551d
        13040230 00300e06 03551d0f 0101ff04 04030205 a0302906 03551d25 04223020
        06082b06 01050507 03010608 2b060105 05070302 060a2b06 01040182 370a0303
        304b0603 551d2004 44304230 4006092b 06010401 a0320114 30333031 06082b06
        01050507 02011625 68747470 3a2f2f77 77772e67 6c6f6261 6c736967 6e2e6e65
        742f7265 706f7369 746f7279 2f301106 09608648 0186f842 01010404 030206c0
        300d0609 2a864886 f70d0101 05050003 82010100 8af3be01 c4830d83 9b347355
        de7496ef bd76b86c ee92f32f 1157ef11 6ad949b6 611537ad 81f06408 73ec6fe2
        6466675c cf31a80f bead422d ec574f95 55fe0b7a 97e271e7 0220c7b1 53376843
        ff7f7280 f9bfdee6 3584e123 00c37d9f 5004b766 9469ead5 f002744c fd50271c
        6bcdb54c e5db85aa 9760a330 d72464a2 bc8ecdff d80bbc27 7551e97c ee9b7078
        9207f9d6 b969a47a 6df722b6 14ce803d 8d4bb9e9 4695e8e6 d453950e 06506594
        ec7652ea 365cdf94 90e2f7ee 855dadb5 c0459d73 bb6d01a8 3c076718 7f80de40
        c5eb9e0e 17c93087 fd5c5fc1 fd6401fe 7e5038b1 3da1d250 01ccd8be 964d5557
        b320c4c1 0015d1b7 daad7527 930b0c90 7711704f
      quit
    crypto ca certificate chain ASDM_TrustPoint1
    certificate ca 0400000000011e44a5f52a
        30820467 3082034f a0030201 02020b04 00000000 011e44a5 f52a300d 06092a86
        4886f70d 01010505 00305731 0b300906 03550406 13024245 31193017 06035504
        0a131047 6c6f6261 6c536967 6e206e76 2d736131 10300e06 0355040b 1307526f
        6f742043 41311b30 19060355 04031312 476c6f62 616c5369 676e2052 6f6f7420
        4341301e 170d3037 30343131 31323030 30305a17 0d313730 34313131 32303030
        305a306a 31233021 06035504 0b131a4f 7267616e 697a6174 696f6e20 56616c69
        64617469 6f6e2043 41311330 11060355 040a130a 476c6f62 616c5369 676e312e
        302c0603 55040313 25476c6f 62616c53 69676e20 4f726761 6e697a61 74696f6e
        2056616c 69646174 696f6e20 43413082 0122300d 06092a86 4886f70d 01010105
        00038201 0f003082 010a0282 010100a1 2fc4bcce 8703e967 c189c8e5 93fc7db4
        ad9ef663 4e6ae89c 2c7389a2 01f48f21 f8fd259d 58166d86 f6ee4957 757e75ea
        22117e3d fbc74241 dcfcc50c 9155807b eb64331d 9bf9ca38 e9abc625 43512540
        f4e47e18 556aa98f 103a401e d65783ef 7f2f342f 2dd2f653 c2190db7 edc981f5
        462cb423 425e9d13 0375ecea 6afc577c c936973b 98dc1313 ecec41fa 5d34eab9
        93e71016 65cc9c92 fdf5c59d 3e4ab909 fce45f1e 695f4df4 567244b1 1d2303c8
        36f66588 c8bf3916 458e1e26 6c5116c5 2a0038c5 a4136995 7dab013b a8c414b4
        80daac1a 4420d5fe a9067b14 27afe030 21dd90f4 a9d52319 2e1e03e6 c1df9529
        e4c19443 dd3e90aa cb4bc9be 8ad33902 03010001 a382011f 3082011b 300e0603
        551d0f01 01ff0404 03020106 30120603 551d1301 01ff0408 30060101 ff020100
        301d0603 551d0e04 1604147d 6d2aec66 aba75136 ab0269f1 708fc459 0b9a1f30
        4b060355 1d200444 30423040 06092b06 010401a0 32011430 33303106 082b0601
        05050702 01162568 7474703a 2f2f7777 772e676c 6f62616c 7369676e 2e6e6574
        2f726570 6f736974 6f72792f 30330603 551d1f04 2c302a30 28a026a0 24862268
        7474703a 2f2f6372 6c2e676c 6f62616c 7369676e 2e6e6574 2f726f6f 742e6372
        6c301106 09608648 0186f842 01010404 03020204 30200603 551d2504 19301706
        0a2b0601 04018237 0a030306 09608648 0186f842 0401301f 0603551d 23041830
        16801460 7b661a45 0d97ca89 502f7d04 cd34a8ff fcfd4b30 0d06092a 864886f7
        0d010105 05000382 01010079 47fc15d7 4c79df0f 7a9eced4 7c4b63c9 89b57b3f
        9912e89c 8c9a492f e04e954a edc7bcbe f1a2db8e 931dba71 54aa4bd9 89222487
        c504a8ac 8252a052 f8b8e14f a1276663 214a39e7 c7c54e5f b2d61d13 6d30e9ce
        d7a21cbc 290a733c 5b2349fe d6ffcab0 4ff5f267 98c04711 f8b748a6 9009d642
        beeab1b9 5342c39c 20c9fba1 5bb5566d 8781c860 acc4b972 270a8e1e a8b12ecd
        32a27857 b09cf895 bb438e8c 31866e53 0dc61205 ba416ea8 35300918 1d0261ff
        fdee35de 6ac33bd0 4d4b4e50 b256360c 445dda1a 652ae698 56a96333 2e04e7ae
        e8f48eb7 b2da7dc0 c8e2aea6 282fe3c9 73bdfc07 4134b7aa 6eeea7db d1933ced
        90ec3292 88d9c823 6c7421
      quit
    crypto isakmp identity hostname
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 1
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh 187.187.1.41 255.255.255.255 inside
    ssh 187.187.1.72 255.255.255.255 inside
    ssh 187.187.77.81 255.255.255.255 inside
    ssh 187.187.10.19 255.255.255.255 inside
    ssh 187.187.10.229 255.255.255.255 inside
    ssh 187.187.160.7 255.255.255.255 inside
    ssh 187.187.1.41 255.255.255.255 outside
    ssh 187.187.1.72 255.255.255.255 outside
    ssh 187.187.77.81 255.255.255.255 outside
    ssh 187.187.10.19 255.255.255.255 outside
    ssh 187.187.10.229 255.255.255.255 outside
    ssh 187.187.160.7 255.255.255.255 outside
    ssh timeout 15
    console timeout 0
    vpdn group BT request dialout pppoe
    vpdn group BT localname B*******.btclick.com
    vpdn group BT ppp authentication chap
    vpdn username B*******@hg39.btclick.com password *********
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    ssl trust-point ASDM_TrustPoint0 outside vpnlb-ip
    webvpn
    enable inside
    enable outside
    group-policy HHP_Remote_Access_1 internal
    group-policy HHP_Remote_Access_1 attributes
    wins-server value 192.168.168.2 192.168.168.2
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value CNES_Support_splitTunnelAcl
    group-policy HHP_Remote_Access internal
    group-policy HHP_Remote_Access attributes
    wins-server value 192.168.168.2 192.168.168.2
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value CNES_Support_splitTunnelAcl
    group-policy Omfax internal
    group-policy Omfax attributes
    wins-server value 192.168.168.2 192.168.168.3
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec webvpn
    webvpn
      svc ask none default webvpn
    group-policy MIS_1 internal
    group-policy MIS_1 attributes
    wins-server value 192.168.168.2 192.168.168.3
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value MIS_splitTunnelAcl
    default-domain value hhp.com
    group-policy RemoteAccess internal
    group-policy RemoteAccess attributes
    wins-server value 192.168.168.2 192.168.168.3
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value RemoteAccess_splitTunnelAcl
    group-policy CNES_Access internal
    group-policy CNES_Access attributes
    wins-server value 192.168.168.2 192.168.168.3
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value CNES_Support_splitTunnelAcl
    group-policy HHP internal
    group-policy HHP attributes
    dhcp-network-scope none
    vpn-access-hours none
    vpn-idle-timeout none
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    split-dns none
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout none
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    client-firewall none
    webvpn
      url-list value Severs
      filter none
      homepage none
      port-forward disable
      http-proxy disable
      sso-server none
      svc dtls none
      svc keep-installer none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression none
      svc modules none
      svc profiles none
      svc ask none default webvpn
      customization none
      http-comp none
      user-storage none
      storage-key none
      hidden-shares none
      smart-tunnel disable
      activex-relay disable
      file-entry disable
      file-browsing disable
      url-entry disable
      deny-message none
    group-policy MIS internal
    group-policy MIS attributes
    wins-server value 192.168.168.2 192.168.168.3
    dns-server value 192.168.168.2 192.168.168.3
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value MIS_splitTunnelAcl
    username test password Kg/Rgy23do7gPGTv encrypted privilege 0
    username test attributes
    vpn-group-policy HHP_Remote_Access
    username catneil password yOgiHCGobUNIkjcN encrypted privilege 0
    username omfax password pvUaCLwilGmQVifd encrypted privilege 0
    username backup password IHQbl.JAoESlM9Jv encrypted privilege 0
    username misadmin password 8IZXmHa67HIJYHK1 encrypted
    username misadmin attributes
    service-type remote-access
    username gramor password ne829U0rGFVEedhY encrypted privilege 15
    username gramor attributes
    vpn-group-policy HHP_Remote_Access
    webvpn
      url-list value Severs
    username aim_user password 5OQaWCdB18qiHlOn encrypted privilege 0
    username aim_user attributes
    vpn-group-policy CNES_Support
    username katask password 2WsX.HoqKXuiqkDk encrypted privilege 0
    username katask attributes
    vpn-group-policy CNES_Support
    username janboyd password ZEUyykwzME6hII2i encrypted privilege 0
    username marmor password C5n48AiRLXwxAeBQ encrypted privilege 0
    username marste password amwTL584WdiT87Tb encrypted privilege 0
    username helmah password RvU8c.3w0H3/MJz4 encrypted privilege 0
    username anglea password wGlUJDBrmJI.uz./ encrypted privilege 0
    username anglea attributes
    vpn-group-policy CNES_Support
    username fiobuc password 5Uispw90wqvDYerQ encrypted privilege 0
    tunnel-group DefaultRAGroup general-attributes
    authentication-server-group HHP_1
    tunnel-group DefaultWEBVPNGroup general-attributes
    authentication-server-group HHP_1
    default-group-policy HHP
    tunnel-group DefaultWEBVPNGroup webvpn-attributes
    nbns-server 192.168.168.2 timeout 2 retry 2
    nbns-server 192.168.168.3 timeout 2 retry 2
    tunnel-group WebVPN type remote-access
    tunnel-group WebVPN general-attributes
    authentication-server-group HHP_3
    default-group-policy HHP
    username-from-certificate UID
    tunnel-group CNES_Access

  • Site to site VPN re-connection issue

    Hi I done site -to -site VPN between two UC 560 and I am able to make call too. Both site I am using DDNS FQDN. Now I am facing these problems,
    1. When ever any of the site gone down , it is taking around 45 minute to get reconnect the VPN. 
    2. With in 2 minute Dialer interface is getting WAN  IP address from service provider and it is updating with Dyndns also. But while checking crypto session details from my local UC I can see the peer address is not changing or showing none.
    please help me to overcome this issue
    I tested by restarting ROUTER-A  UC560
    Please find the status of remote site:
    ROUTER-B#sh crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    2.50.37.13      86.99.72.10     MM_NO_STATE       2004 ACTIVE (deleted)
    ROUTER-B#sh crypto isa saIPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    ROUTER-A#sh crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    ROUTER-B#sho crypto session detail
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Dialer0
    Session status: UP-NO-IKE
    Peer: 86.99.72.10 port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.10.0/255.255.255.0 192.168.50.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 12452 drop 0 life (KB/Sec) 4477633/1050
            Outbound: #pkts enc'ed 15625 drop 228 life (KB/Sec) 4477628/1050
    ROUTER-A# sho crypto session det
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Virtual-Access2
    Session status: DOWN
    Peer:  port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.50.0/255.255.255.0 192.168.10.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
    Interface: Dialer0
    Session status: DOWN
    Peer:  port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.50.0/255.255.255.0 192.168.10.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 23 life (KB/Sec) 0/0
    **** Here I can see the peer IP is 86.99.72.10, but address had been changed to  92.98.211.242 in ROUTER-A
    Please see the debug crypto isakpm
    ROUTER-A#debug crypto isakmp
    Crypto ISAKMP debugging is on
    ROUTER-A#terminal monitor
    000103: Aug  6 18:40:48.083: ISAKMP:(0): SA request profile is (NULL)
    000104: Aug  6 18:40:48.083: ISAKMP: Created a peer struct for , peer port 500
    000105: Aug  6 18:40:48.083: ISAKMP: New peer created peer = 0x86682AAC peer_handle = 0x80000031
    000106: Aug  6 18:40:48.083: ISAKMP: Locking peer struct 0x86682AAC, refcount 1 for isakmp_initiator
    000107: Aug  6 18:40:48.083: ISAKMP: local port 500, remote port 500
    000108: Aug  6 18:40:48.083: ISAKMP: set new node 0 to QM_IDLE
    000109: Aug  6 18:40:48.083: ISAKMP:(0):insert sa successfully sa = 8B4EBE04
    000110: Aug  6 18:40:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000111: Aug  6 18:40:48.083: ISAKMP:(0):No pre-shared key with !
    000112: Aug  6 18:40:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000113: Aug  6 18:40:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000114: Aug  6 18:40:48.083: ISAKMP: Unlocking peer struct 0x86682AAC for isadb_unlock_peer_delete_sa(), count 0
    000115: Aug  6 18:40:48.083: ISAKMP: Deleting peer node by peer_reap for : 86682AAC
    000116: Aug  6 18:40:48.083: ISAKMP:(0):purging SA., sa=8B4EBE04, delme=8B4EBE04
    000117: Aug  6 18:40:48.083: ISAKMP:(0):purging node 2113438140
    000118: Aug  6 18:40:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000119: Aug  6 18:40:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000120: Aug  6 18:41:18.083: ISAKMP:(0): SA request profile is (NULL)
    000121: Aug  6 18:41:18.083: ISAKMP: Created a peer struct for , peer port 500
    000122: Aug  6 18:41:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000032
    000123: Aug  6 18:41:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000124: Aug  6 18:41:18.083: ISAKMP: local port 500, remote port 500
    000125: Aug  6 18:41:18.083: ISAKMP: set new node 0 to QM_IDLE
    000126: Aug  6 18:41:18.083: ISAKMP:(0):insert sa successfully sa = 86685DFC
    000127: Aug  6 18:41:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000128: Aug  6 18:41:18.083: ISAKMP:(0):No pre-shared key with !
    000129: Aug  6 18:41:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000130: Aug  6 18:41:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000131: Aug  6 18:41:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb_unlock_peer_delete_sa(), count 0
    000132: Aug  6 18:41:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000133: Aug  6 18:41:18.083: ISAKMP:(0):purging SA., sa=86685DFC, delme=86685DFC
    000134: Aug  6 18:41:18.083: ISAKMP:(0):purging node 379490091
    000135: Aug  6 18:41:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000136: Aug  6 18:41:18.083: ISAKMP: Error while processing KMI message 0, error 2.
    000137: Aug  6 18:42:48.083: ISAKMP:(0): SA request profile is (NULL)
    000138: Aug  6 18:42:48.083: ISAKMP: Created a peer struct for , peer port 500
    000139: Aug  6 18:42:48.083: ISAKMP: New peer created peer = 0x86691200 peer_handle = 0x80000033
    000140: Aug  6 18:42:48.083: ISAKMP: Locking peer struct 0x86691200, refcount 1for isakmp_initiator
    000141: Aug  6 18:42:48.083: ISAKMP: local port 500, remote port 500
    000142: Aug  6 18:42:48.083: ISAKMP: set new node 0 to QM_IDLE
    000143: Aug  6 18:42:48.083: ISAKMP:(0):insert sa successfully sa = 866E1758
    000144: Aug  6 18:42:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000145: Aug  6 18:42:48.083: ISAKMP:(0):No pre-shared key with !
    000146: Aug  6 18:42:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000147: Aug  6 18:42:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000148: Aug  6 18:42:48.083: ISAKMP: Unlocking peer struct 0x86691200 for isadb_unlock_peer_delete_sa(), count 0
    000149: Aug  6 18:42:48.083: ISAKMP: Deleting peer node by peer_reap for : 86691200
    000150: Aug  6 18:42:48.083: ISAKMP:(0):purging SA., sa=866E1758, delme=866E1758
    000151: Aug  6 18:42:48.083: ISAKMP:(0):purging node -309783810
    000152: Aug  6 18:42:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000153: Aug  6 18:42:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000154: Aug  6 18:43:18.083: ISAKMP:(0): SA request profile is (NULL)
    000155: Aug  6 18:43:18.083: ISAKMP: Created a peer struct for , peer port 500
    000156: Aug  6 18:43:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000034
    000157: Aug  6 18:43:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000158: Aug  6 18:43:18.083: ISAKMP: local port 500, remote port 500
    000159: Aug  6 18:43:18.083: ISAKMP: set new node 0 to QM_IDLE
    000160: Aug  6 18:43:18.083: ISAKMP:(0):insert sa successfully sa = 8B4AB780
    000161: Aug  6 18:43:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000162: Aug  6 18:43:18.083: ISAKMP:(0):No pre-shared key with !
    000163: Aug  6 18:43:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000164: Aug  6 18:43:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000165: Aug  6 18:43:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb _unlock_peer_delete_sa(), count 0
    000166: Aug  6 18:43:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000167: Aug  6 18:43:18.083: ISAKMP:(0):purging SA., sa=8B4AB780, delme=8B4AB78 0
    000168: Aug  6 18:43:18.083: ISAKMP:(0):purging node 461611358
    000169: Aug  6 18:43:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000170: Aug  6 18:43:18.083: ISAKMP: Error while processing KMI message 0, erro r 2.
    000171: Aug  6 18:44:48.083: ISAKMP:(0): SA request profile is (NULL)
    000172: Aug  6 18:44:48.083: ISAKMP: Created a peer struct for , peer port 500
    000173: Aug  6 18:44:48.083: ISAKMP: New peer created peer = 0x8B4A25C8 peer_handle = 0x80000035
    000174: Aug  6 18:44:48.083: ISAKMP: Locking peer struct 0x8B4A25C8, refcount 1 for isakmp_initiator
    000175: Aug  6 18:44:48.083: ISAKMP: local port 500, remote port 500
    000176: Aug  6 18:44:48.083: ISAKMP: set new node 0 to QM_IDLE
    000177: Aug  6 18:44:48.083: ISAKMP:(0):insert sa successfully sa = 8B4EC7E8
    000178: Aug  6 18:44:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000179: Aug  6 18:44:48.083: ISAKMP:(0):No pre-shared key with !
    000180: Aug  6 18:44:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000181: Aug  6 18:44:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000182: Aug  6 18:44:48.083: ISAKMP: Unlocking peer struct 0x8B4A25C8 for isadb_unlock_peer_delete_sa(), count 0
    000183: Aug  6 18:44:48.083: ISAKMP: Deleting peer node by peer_reap for : 8B4A25C8
    000184: Aug  6 18:44:48.083: ISAKMP:(0):purging SA., sa=8B4EC7E8, delme=8B4EC7E8
    000185: Aug  6 18:44:48.083: ISAKMP:(0):purging node -1902909277
    000186: Aug  6 18:44:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000187: Aug  6 18:44:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000188: Aug  6 18:45:18.083: ISAKMP:(0): SA request profile is (NULL)
    000189: Aug  6 18:45:18.083: ISAKMP: Created a peer struct for , peer port 500
    000190: Aug  6 18:45:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000036
    000191: Aug  6 18:45:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000192: Aug  6 18:45:18.083: ISAKMP: local port 500, remote port 500
    000193: Aug  6 18:45:18.083: ISAKMP: set new node 0 to QM_IDLE
    000194: Aug  6 18:45:18.083: ISAKMP:(0):insert sa successfully sa = 86685DFC
    000195: Aug  6 18:45:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000196: Aug  6 18:45:18.083: ISAKMP:(0):No pre-shared key with !
    000197: Aug  6 18:45:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000198: Aug  6 18:45:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000199: Aug  6 18:45:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb_unlock_peer_delete_sa(), count 0
    000200: Aug  6 18:45:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000201: Aug  6 18:45:18.083: ISAKMP:(0):purging SA., sa=86685DFC, delme=86685DFC
    000202: Aug  6 18:45:18.083: ISAKMP:(0):purging node 1093064733
    000203: Aug  6 18:45:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000204: Aug  6 18:45:18.083: ISAKMP: Error while processing KMI message 0, error 2.
    000205: Aug  6 18:46:48.083: ISAKMP:(0): SA request profile is (NULL)
    000206: Aug  6 18:46:48.083: ISAKMP: Created a peer struct for , peer port 500
    000207: Aug  6 18:46:48.083: ISAKMP: New peer created peer = 0x86682BE0 peer_handle = 0x80000037
    000208: Aug  6 18:46:48.083: ISAKMP: Locking peer struct 0x86682BE0, refcount 1 for isakmp_initiator
    000209: Aug  6 18:46:48.083: ISAKMP: local port 500, remote port 500
    000210: Aug  6 18:46:48.083: ISAKMP: set new node 0 to QM_IDLE
    000211: Aug  6 18:46:48.083: ISAKMP:(0):insert sa successfully sa = 866E1758
    000212: Aug  6 18:46:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000213: Aug  6 18:46:48.083: ISAKMP:(0):No pre-shared key with !
    000214: Aug  6 18:46:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000215: Aug  6 18:46:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000216: Aug  6 18:46:48.083: ISAKMP: Unlocking peer struct 0x86682BE0 for isadb_unlock_peer_delete_sa(), count 0
    000217: Aug  6 18:46:48.083: ISAKMP: Deleting peer node by peer_reap for : 86682BE0
    000218: Aug  6 18:46:48.083: ISAKMP:(0):purging SA., sa=866E1758, delme=866E1758
    000219: Aug  6 18:46:48.083: ISAKMP:(0):purging node -1521272284
    000220: Aug  6 18:46:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000221: Aug  6 18:46:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000222: Aug  6 18:47:03.131: ISAKMP (0): received packet from 2.50.37.13 dport 500 sport 500 Global (N) NEW SA
    000223: Aug  6 18:47:03.131: ISAKMP: Created a peer struct for 2.50.37.13, peer port 500
    000224: Aug  6 18:47:03.131: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000038
    000225: Aug  6 18:47:03.131: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for crypto_isakmp_process_block
    000226: Aug  6 18:47:03.131: ISAKMP: local port 500, remote port 500
    000227: Aug  6 18:47:03.131: ISAKMP:(0):insert sa successfully sa = 8B4C1924
    000228: Aug  6 18:47:03.131: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000229: Aug  6 18:47:03.131: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1
    000230: Aug  6 18:47:03.131: ISAKMP:(0): processing SA payload. message ID = 0
    000231: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000232: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    000233: Aug  6 18:47:03.131: ISAKMP (0): vendor ID is NAT-T RFC 3947
    000234: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000235: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    000236: Aug  6 18:47:03.131: ISAKMP (0): vendor ID is NAT-T v7
    000237: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000238: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    000239: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID is NAT-T v3
    000240: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000241: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    000242: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID is NAT-T v2
    000243: Aug  6 18:47:03.131: ISAKMP:(0):found peer pre-shared key matching 2.50.37.13
    000244: Aug  6 18:47:03.131: ISAKMP:(0): local preshared key found
    000245: Aug  6 18:47:03.131: ISAKMP : Scanning profiles for xauth ... sdm-ike-profile-1
    000246: Aug  6 18:47:03.131: ISAKMP:(0): Authentication by xauth preshared
    000247: Aug  6 18:47:03.131: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    000248: Aug  6 18:47:03.131: ISAKMP:      encryption 3DES-CBC
    000249: Aug  6 18:47:03.131: ISAKMP:      hash SHA
    000250: Aug  6 18:47:03.131: ISAKMP:      default group 2
    000251: Aug  6 18:47:03.131: ISAKMP:      auth pre-share
    000252: Aug  6 18:47:03.131: ISAKMP:      life type in seconds
    000253: Aug  6 18:47:03.131: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    000254: Aug  6 18:47:03.135: ISAKMP:(0):atts are acceptable. Next payload is 0
    000255: Aug  6 18:47:03.135: ISAKMP:(0):Acceptable atts:actual life: 1800
    000256: Aug  6 18:47:03.135: ISAKMP:(0):Acceptable atts:life: 0
    000257: Aug  6 18:47:03.135: ISAKMP:(0):Fill atts in sa vpi_length:4
    000258: Aug  6 18:47:03.135: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    000259: Aug  6 18:47:03.135: ISAKMP:(0):Returning Actual lifetime: 1800
    000260: Aug  6 18:47:03.135: ISAKMP:(0)::Started lifetime timer: 1800.
    000261: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000262: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    000263: Aug  6 18:47:03.135: ISAKMP (0): vendor ID is NAT-T RFC 3947
    000264: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000265: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    000266: Aug  6 18:47:03.135: ISAKMP (0): vendor ID is NAT-T v7
    000267: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000268: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    000269: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID is NAT-T v3
    000270: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000271: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    000272: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID is NAT-T v2
    000273: Aug  6 18:47:03.135: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000274: Aug  6 18:47:03.135: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1
    000275: Aug  6 18:47:03.135: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    000276: Aug  6 18:47:03.135: ISAKMP:(0): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_SA_SETUP
    000277: Aug  6 18:47:03.135: ISAKMP:(0):Sending an IKE IPv4 Packet.
    000278: Aug  6 18:47:03.135: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000279: Aug  6 18:47:03.135: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2
    000280: Aug  6 18:47:03.191: ISAKMP (0): received packet from 2.50.37.13 dport 500 sport 500 Global (R) MM_SA_SETUP
    000281: Aug  6 18:47:03.191: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000282: Aug  6 18:47:03.191: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3
    000283: Aug  6 18:47:03.191: ISAKMP:(0): processing KE payload. message ID = 0
    000284: Aug  6 18:47:03.199: ISAKMP:(0): processing NONCE payload. message ID = 0
    000285: Aug  6 18:47:03.203: ISAKMP:(0):found peer pre-shared key matching 2.50.37.13
    000286: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000287: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID is DPD
    000288: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000289: Aug  6 18:47:03.203: ISAKMP:(2001): speaking to another IOS box!
    000290: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000291: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID seems Unity/DPD but major 223 mismatch
    000292: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID is XAUTH
    000293: Aug  6 18:47:03.203: ISAKMP:received payload type 20
    000294: Aug  6 18:47:03.203: ISAKMP (2001): His hash no match - this node outside NAT
    000295: Aug  6 18:47:03.203: ISAKMP:received payload type 20
    000296: Aug  6 18:47:03.203: ISAKMP (2001): No NAT Found for self or peer
    000297: Aug  6 18:47:03.203: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000298: Aug  6 18:47:03.203: ISAKMP:(2001):Old State = IKE_R_MM3  New State = IKE_R_MM3
    000299: Aug  6 18:47:03.203: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000300: Aug  6 18:47:03.203: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000301: Aug  6 18:47:03.203: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000302: Aug  6 18:47:03.203: ISAKMP:(2001):Old State = IKE_R_MM3  New State = IKE_R_MM4
    000303: Aug  6 18:47:03.295: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) MM_KEY_EXCH
    000304: Aug  6 18:47:03.295: ISAKMP:(2001):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000305: Aug  6 18:47:03.295: ISAKMP:(2001):Old State = IKE_R_MM4  New State = IKE_R_MM5
    000306: Aug  6 18:47:03.295: ISAKMP:(2001): processing ID payload. message ID = 0
    000307: Aug  6 18:47:03.295: ISAKMP (2001): ID payload
            next-payload : 8
            type         : 1
            address      : 2.50.37.13
            protocol     : 17
            port         : 500
            length       : 12
    000308: Aug  6 18:47:03.295: ISAKMP:(0):: peer matches *none* of the profiles
    000309: Aug  6 18:47:03.295: ISAKMP:(2001): processing HASH payload. message ID = 0
    000310: Aug  6 18:47:03.295: ISAKMP:(2001): processing NOTIFY INITIAL_CONTACT protocol 1
            spi 0, message ID = 0, sa = 0x8B4C1924
    000311: Aug  6 18:47:03.295: ISAKMP:(2001):SA authentication status:
            authenticated
    000312: Aug  6 18:47:03.295: ISAKMP:(2001):SA has been authenticated with 2.50.37.13
    000313: Aug  6 18:47:03.295: ISAKMP:(2001):SA authentication status:
            authenticated
    000314: Aug  6 18:47:03.295: ISAKMP:(2001): Process initial contact,
    bring down existing phase 1 and 2 SA's with local 92.98.211.242 remote 2.50.37.13 remote port 500
    000315: Aug  6 18:47:03.295: ISAKMP: Trying to insert a peer 92.98.211.242/2.50.37.13/500/,  and inserted successfully 8668106C.
    000316: Aug  6 18:47:03.295: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000317: Aug  6 18:47:03.295: ISAKMP:(2001):Old State = IKE_R_MM5  New State = IKE_R_MM5
    000318: Aug  6 18:47:03.295: ISAKMP:(2001):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    000319: Aug  6 18:47:03.295: ISAKMP (2001): ID payload
            next-payload : 8
            type         : 1
            address      : 92.98.211.242
            protocol     : 17
            port         : 500
            length       : 12
    000320: Aug  6 18:47:03.295: ISAKMP:(2001):Total payload length: 12
    000321: Aug  6 18:47:03.295: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000322: Aug  6 18:47:03.295: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000323: Aug  6 18:47:03.295: ISAKMP:(2001):Returning Actual lifetime: 1800
    000324: Aug  6 18:47:03.299: ISAKMP: set new node -1235582904 to QM_IDLE
    000325: Aug  6 18:47:03.299: ISAKMP:(2001):Sending NOTIFY RESPONDER_LIFETIME protocol 1
            spi 2291695856, message ID = 3059384392
    000326: Aug  6 18:47:03.299: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000327: Aug  6 18:47:03.299: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000328: Aug  6 18:47:03.299: ISAKMP:(2001):purging node -1235582904
    000329: Aug  6 18:47:03.299: ISAKMP: Sending phase 1 responder lifetime 1800
    000330: Aug  6 18:47:03.299: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000331: Aug  6 18:47:03.299: ISAKMP:(2001):Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE
    000332: Aug  6 18:47:03.299: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    000333: Aug  6 18:47:03.299: ISAKMP:(2001):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    000334: Aug  6 18:47:03.307: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) QM_IDLE
    000335: Aug  6 18:47:03.307: ISAKMP: set new node -687536412 to QM_IDLE
    000336: Aug  6 18:47:03.307: ISAKMP:(2001): processing HASH payload. message ID = 3607430884
    000337: Aug  6 18:47:03.307: ISAKMP:(2001): processing SA payload. message ID = 3607430884
    000338: Aug  6 18:47:03.307: ISAKMP:(2001):Checking IPSec proposal 1
    000339: Aug  6 18:47:03.307: ISAKMP: transform 1, ESP_3DES
    000340: Aug  6 18:47:03.307: ISAKMP:   attributes in transform:
    000341: Aug  6 18:47:03.307: ISAKMP:      encaps is 1 (Tunnel)
    000342: Aug  6 18:47:03.307: ISAKMP:      SA life type in seconds
    000343: Aug  6 18:47:03.307: ISAKMP:      SA life duration (basic) of 3600
    000344: Aug  6 18:47:03.307: ISAKMP:      SA life type in kilobytes
    000345: Aug  6 18:47:03.307: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    000346: Aug  6 18:47:03.307: ISAKMP:      authenticator is HMAC-SHA
    000347: Aug  6 18:47:03.307: ISAKMP:(2001):atts are acceptable.
    000348: Aug  6 18:47:03.307: ISAKMP:(2001): processing NONCE payload. message ID = 3607430884
    000349: Aug  6 18:47:03.311: ISAKMP:(2001): processing ID payload. message ID = 3607430884
    000350: Aug  6 18:47:03.311: ISAKMP:(2001): processing ID payload. message ID = 3607430884
    000351: Aug  6 18:47:03.311: ISAKMP:(2001):QM Responder gets spi
    000352: Aug  6 18:47:03.311: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    000353: Aug  6 18:47:03.311: ISAKMP:(2001):Old State = IKE_QM_READY  New State = IKE_QM_SPI_STARVE
    000354: Aug  6 18:47:03.311: ISAKMP:(2001): Creating IPSec SAs
    000355: Aug  6 18:47:03.311:         inbound SA from 2.50.37.13 to 92.98.211.242 (f/i)  0/ 0
            (proxy 192.168.10.0 to 192.168.50.0)
    000356: Aug  6 18:47:03.311:         has spi 0x4C5A127C and conn_id 0
    000357: Aug  6 18:47:03.311:         lifetime of 3600 seconds
    000358: Aug  6 18:47:03.311:         lifetime of 4608000 kilobytes
    000359: Aug  6 18:47:03.311:         outbound SA from 92.98.211.242 to 2.50.37.13 (f/i) 0/0
            (proxy 192.168.50.0 to 192.168.10.0)
    000360: Aug  6 18:47:03.311:         has spi  0x1E83EC91 and conn_id 0
    000361: Aug  6 18:47:03.311:         lifetime of 3600 seconds
    000362: Aug  6 18:47:03.311:         lifetime of 4608000 kilobytes
    000363: Aug  6 18:47:03.311: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) QM_IDLE
    000364: Aug  6 18:47:03.311: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000365: Aug  6 18:47:03.311: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI
    000366: Aug  6 18:47:03.311: ISAKMP:(2001):Old State = IKE_QM_SPI_STARVE  New State = IKE_QM_R_QM2
    000367: Aug  6 18:47:03.323: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) QM_IDLE
    000368: Aug  6 18:47:03.323: ISAKMP:(2001):deleting node -687536412 error FALSE reason "QM done (await)"
    000369: Aug  6 18:47:03.323: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    000370: Aug  6 18:47:03.323: ISAKMP:(2001):Old State = IKE_QM_R_QM2  New State = IKE_QM_PHASE2_COMPLETE
    000371: Aug  6 18:47:53.323: ISAKMP:(2001):purging node -687536412
    ROUTER-A# sho crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    92.98.211.242   2.50.37.13      QM_IDLE           2001 ACTIVE
    RUNNING CONFIGURATION OF ROUTER-A
    Building configuration...
    Current configuration : 29089 bytes
    ! Last configuration change at 21:31:11 PST Tue Aug 7 2012 by administrator
    version 15.1
    parser config cache interface
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    service internal
    service compress-config
    service sequence-numbers
    hostname xxxxxxxxxxXX
    boot-start-marker
    boot-end-marker
    enable secret 4 LcV6aBcc/53FoCJjXQMd7rBUDEpeevrK8V5jQVoJEhU
    aaa new-model
    aaa authentication login default local
    aaa authentication login Foxtrot_sdm_easyvpn_xauth_ml_1 local
    aaa authorization network Foxtrot_sdm_easyvpn_group_ml_1 local
    aaa session-id common
    clock timezone ZP4 4 0
    clock summer-time PST recurring
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-4070447007
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4070447007
    revocation-check none
    rsakeypair TP-self-signed-4070447007
    crypto pki certificate chain TP-self-signed-4070447007
    certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 34303730 34343730 3037301E 170D3132 30373331 30353139
      30375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 30373034
      34373030 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100BBA6 F2C9A163 B7EAB25D 6C538A5B 29832F58 6B95D2C0 1FBE0E72 BD4E9585
      6230CAD1 8DA4E337 5A11332C 36EAFF86 02D8C977 6CD2AA50 D76FB97F 52AE73AD
      E777194B 011C95EB E2A588B4 3A7D618E F1D03E3F EF1A60FB 26372B63 9395002D
      38126CC5 EA79E23C 40E0F331 76E7731E D03E2CE8 F1A0B5E9 B83AA780 D566A679
      599F0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 14C8BC47 90602FB0 18A8821A 85A3444F 874E2292 27301D06
      03551D0E 04160414 C8BC4790 602FB018 A8821A85 A3444F87 4E229227 300D0609
      2A864886 F70D0101 05050003 8181001B D0EA74FE 7EDD03FE 68733D87 6434D20B
      80481807 DD4A488E FFEFA631 245F396F 5CADF523 1438A70B CA113994 9798483D
      F59221EA 09EDB8FC 6D1DBBAE FE7FE4B9 E79F064F E930F347 B1CAD19B 01F5989A
      8BCFDB1D 906163A4 C467E809 E988B610 FE613177 A815DFB0 97839F92 4A682E8F
      43F08787 E08CBE70 E98DEBE7 BCD8B8
                quit
    dot11 syslog
    ip source-route
    ip cef
    ip dhcp relay information trust-all
    ip dhcp excluded-address 10.1.1.1 10.1.1.9
    ip dhcp excluded-address 10.1.1.241 10.1.1.255
    ip dhcp excluded-address 192.168.50.1 192.168.50.9
    ip dhcp excluded-address 192.168.50.241 192.168.50.255
    ip dhcp pool phone
    network 10.1.1.0 255.255.255.0
    default-router 10.1.1.1
    option 150 ip 10.1.1.1
    ip dhcp pool data
    import all
    network 192.168.50.0 255.255.255.0
    default-router 192.168.50.1
    ip inspect WAAS flush-timeout 10
    ip inspect name SDM_LOW dns
    ip inspect name SDM_LOW ftp
    ip inspect name SDM_LOW h323
    ip inspect name SDM_LOW https
    ip inspect name SDM_LOW icmp
    ip inspect name SDM_LOW imap
    ip inspect name SDM_LOW pop3
    ip inspect name SDM_LOW netshow
    ip inspect name SDM_LOW rcmd
    ip inspect name SDM_LOW realaudio
    ip inspect name SDM_LOW rtsp
    ip inspect name SDM_LOW esmtp
    ip inspect name SDM_LOW sqlnet
    ip inspect name SDM_LOW streamworks
    ip inspect name SDM_LOW tftp
    ip inspect name SDM_LOW tcp router-traffic
    ip inspect name SDM_LOW udp router-traffic
    ip inspect name SDM_LOW vdolive
    ip ddns update method sdm_ddns1
    HTTP
      add http://xxxxxxxs:[email protected]/nic/update?system=dyndns&[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
      remove http://xxxxxxx:[email protected]/nic/update?system=dyndns&[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
    interval maximum 2 0 0 0
    interval minimum 1 0 0 0
    no ipv6 cef
    multilink bundle-name authenticated
    stcapp ccm-group 1
    stcapp
    trunk group ALL_FXO
    max-retry 5
    voice-class cause-code 1
    hunt-scheme longest-idle
    voice call send-alert
    voice rtp send-recv
    voice service voip
    allow-connections h323 to h323
    allow-connections h323 to sip
    allow-connections sip to h323
    allow-connections sip to sip
    no supplementary-service h450.2
    no supplementary-service h450.3
    supplementary-service h450.12
    sip
      no update-callerid
    voice class codec 1
    codec preference 1 g711ulaw
    codec preference 2 g729r8
    voice class h323 1
      call start slow
    voice class cause-code 1
    no-circuit
    voice register global
    mode cme
    source-address 10.1.1.1 port 5060
    load 9971 sip9971.9-2-2
    load 9951 sip9951.9-2-2
    load 8961 sip8961.9-2-2
    voice translation-rule 1000
    rule 1 /.*/ //
    voice translation-rule 1112
    rule 1 /^9/ //
    voice translation-rule 1113
    rule 1 /^82\(...\)/ /\1/
    voice translation-rule 1114
    rule 1 /\(^...$\)/ /82\1/
    voice translation-rule 2002
    rule 1 /^6/ //
    voice translation-rule 2222
    rule 1 /^91900......./ //
    rule 2 /^91976......./ //
    voice translation-profile CALLER_ID_TRANSLATION_PROFILE
    translate calling 1111
    voice translation-profile CallBlocking
    translate called 2222
    voice translation-profile OUTGOING_TRANSLATION_PROFILE
    translate called 1112
    voice translation-profile XFER_TO_VM_PROFILE
    translate redirect-called 2002
    voice translation-profile multisiteInbound
    translate called 1113
    voice translation-profile multisiteOutbound
    translate calling 1114
    voice translation-profile nondialable
    translate called 1000
    voice-card 0
    dspfarm
    dsp services dspfarm
    fax interface-type fax-mail
    license udi pid UC560-FXO-K9 sn FHK1445F43M
    archive
    log config
      logging enable
      logging size 600
      hidekeys
    username administrator privilege 15 secret 4 LcV6aBcc/53FoCJjXQMd7rBUDEpeevrK8V5jQVoJEhU
    username pingerID password 7 06505D771B185F
    ip tftp source-interface Vlan90
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    lifetime 1800
    crypto isakmp key xxxxxxx address 0.0.0.0 0.0.0.0
    crypto isakmp client configuration group EZVPN_GROUP_1
    key xxxxxxx
    dns 213.42.20.20
    pool SDM_POOL_1
    save-password
    max-users 20
    crypto isakmp profile sdm-ike-profile-1
       match identity group EZVPN_GROUP_1
       client authentication list Foxtrot_sdm_easyvpn_xauth_ml_1
       isakmp authorization list Foxtrot_sdm_easyvpn_group_ml_1
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile SDM_Profile1
    set transform-set ESP-3DES-SHA
    set isakmp-profile sdm-ike-profile-1
    crypto map multisite 1 ipsec-isakmp
    description XXXXXXX
    set peer xxxxxxxxxx.dyndns.biz dynamic
    set transform-set ESP-3DES-SHA
    match address 105
    qos pre-classify
    interface GigabitEthernet0/0
    description $ETH-WAN$
    no ip address
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    pppoe enable group global
    pppoe-client dial-pool-number 1
    interface Integrated-Service-Engine0/0
    description Interface used to manage integrated application modulecue is initialized with default IMAP group
    ip unnumbered Vlan90
    ip nat inside
    ip virtual-reassembly in
    service-module ip address 10.1.10.1 255.255.255.252
    service-module ip default-gateway 10.1.10.2
    interface GigabitEthernet0/1/0
    switchport mode trunk
    switchport voice vlan 100
    no ip address
    macro description cisco-switch
    interface GigabitEthernet0/1/1
    switchport voice vlan 100
    no ip address
    macro description cisco-phone
    spanning-tree portfast
    interface GigabitEthernet0/1/2
    no ip address
    macro description cisco-desktop
    spanning-tree portfast
    interface GigabitEthernet0/1/3
    description Interface used to communicate with integrated service module
    switchport access vlan 90
    no ip address
    service-module ip address 10.1.10.1 255.255.255.252
    service-module ip default-gateway 10.1.10.2
    interface Virtual-Template1 type tunnel
    ip unnumbered Vlan1
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile SDM_Profile1
    interface Vlan1
    description $FW_INSIDE$
    ip address 192.168.50.1 255.255.255.0
    ip access-group 101 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    h323-gateway voip bind srcaddr 192.168.50.1
    interface Vlan90
    description $FW_INSIDE$
    ip address 10.1.10.2 255.255.255.252
    ip access-group 103 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    interface Vlan100
    description $FW_INSIDE$
    ip address 10.1.1.1 255.255.255.0
    ip access-group 102 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    interface Dialer0
    description $FW_OUTSIDE$
    mtu 1492
    ip ddns update hostname xxxxxxxxxx.dyndns.biz
    ip ddns update sdm_ddns1
    ip address negotiated
    ip access-group 104 in
    ip mtu 1452
    ip nat outside
    ip inspect SDM_LOW out
    ip virtual-reassembly in
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname CCCCCC
    ppp chap password 7 071739545611015445
    ppp pap sent-username CCCCC password 7 122356324SDFDBDB
    ppp ipcp dns request
    ppp ipcp route default
    crypto map multisite
    ip local pool SDM_POOL_1 192.168.50.150 192.168.50.160
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip http path flash:/gui
    ip dns server
    ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip route 10.1.10.1 255.255.255.255 Vlan90
    access-list 100 remark auto generated by SDM firewall configuration
    access-list 100 remark SDM_ACL Category=1
    access-list 100 permit ip 192.168.10.0 0.0.0.255 any
    access-list 100 permit ip host 255.255.255.255 any
    access-list 100 permit ip 127.0.0.0 0.255.255.255 any
    access-list 100 permit ip any any
    access-list 101 remark auto generated by SDM firewall configuration##NO_ACES_5##
    access-list 101 remark SDM_ACL Category=1
    access-list 101 permit udp any host 192.168.50.1 eq non500-isakmp
    access-list 101 permit udp any host 192.168.50.1 eq isakmp
    access-list 101 permit esp any host 192.168.50.1
    access-list 101 permit ahp any host 192.168.50.1
    access-list 101 permit ip 192.168.10.0 0.0.0.255 any
    access-list 101 permit ip any any
    access-list 101 permit ip 10.1.10.0 0.0.0.3 any
    access-list 101 permit ip 10.1.1.0 0.0.0.255 any
    access-list 101 permit ip host 255.255.255.255 any
    access-list 101 permit ip 127.0.0.0 0.255.255.255 any
    access-list 102 remark auto generated by SDM firewall configuration##NO_ACES_7##
    access-list 102 remark SDM_ACL Category=1
    access-list 102 permit udp any host 10.1.1.1 eq non500-isakmp
    access-list 102 permit udp any host 10.1.1.1 eq isakmp
    access-list 102 permit esp any host 10.1.1.1
    access-list 102 permit ahp any host 10.1.1.1
    access-list 102 permit ip any any
    access-list 102 permit tcp 10.1.10.0 0.0.0.3 any eq 2000
    access-list 102 permit udp 10.1.10.0 0.0.0.3 any eq 2000
    access-list 102 permit ip 192.168.50.0 0.0.0.255 any
    access-list 102 permit ip 10.1.10.0 0.0.0.3 any
    access-list 102 permit ip host 255.255.255.255 any
    access-list 102 permit ip 127.0.0.0 0.255.255.255 any
    access-list 103 remark auto generated by SDM firewall configuration##NO_ACES_7##
    access-list 103 remark SDM_ACL Category=1
    access-list 103 permit udp any host 10.1.10.2 eq non500-isakmp
    access-list 103 permit udp any host 10.1.10.2 eq isakmp
    access-list 103 permit esp any host 10.1.10.2
    access-list 103 permit ahp any host 10.1.10.2
    access-list 103 permit tcp 10.1.1.0 0.0.0.255 eq 2000 any
    access-list 103 permit udp 10.1.1.0 0.0.0.255 eq 2000 any
    access-list 103 permit ip 192.168.50.0 0.0.0.255 any
    access-list 103 permit ip 10.1.1.0 0.0.0.255 any
    access-list 103 permit ip host 255.255.255.255 any
    access-list 103 permit ip 127.0.0.0 0.255.255.255 any
    access-list 103 permit ip any any
    access-list 104 remark auto generated by SDM firewall configuration##NO_ACES_13##
    access-list 104 remark SDM_ACL Category=1
    access-list 104 permit ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 104 permit udp any any eq non500-isakmp
    access-list 104 permit udp any any eq isakmp
    access-list 104 permit esp any any
    access-list 104 permit ahp any any
    access-list 104 permit ip any any
    access-list 104 permit ip 192.168.50.0 0.0.0.255 any
    access-list 104 permit ip 10.1.10.0 0.0.0.3 any
    access-list 104 permit ip 10.1.1.0 0.0.0.255 any
    access-list 104 permit icmp any any echo-reply
    access-list 104 permit icmp any any time-exceeded
    access-list 104 permit icmp any any unreachable
    access-list 104 permit ip 10.0.0.0 0.255.255.255 any
    access-list 104 permit ip 172.16.0.0 0.15.255.255 any
    access-list 104 permit ip 192.168.0.0 0.0.255.255 any
    access-list 104 permit ip 127.0.0.0 0.255.255.255 any
    access-list 104 permit ip host 255.255.255.255 any
    access-list 104 permit ip host 0.0.0.0 any
    access-list 105 remark CryptoACL for xxxxxxxxxx
    access-list 105 remark SDM_ACL Category=4
    access-list 105 permit ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 106 remark SDM_ACL Category=2
    access-list 106 deny   ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 106 permit ip 10.1.10.0 0.0.0.3 any
    access-list 106 permit ip 192.168.50.0 0.0.0.255 any
    access-list 106 permit ip 10.1.1.0 0.0.0.255 any
    dialer-list 1 protocol ip permit
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    snmp-server community public RO
    tftp-server flash:/phones/521_524/cp524g-8-1-17.bin alias cp524g-8-1-17.bin
    tftp-server flash:/ringtones/Analog1.raw alias Analog1.raw
    tftp-server flash:/ringtones/Analog2.raw alias Analog2.raw
    tftp-server flash:/ringtones/AreYouThere.raw alias AreYouThere.raw
    tftp-server flash:/ringtones/DistinctiveRingList.xml alias DistinctiveRingList.xml
    tftp-server flash:/ringtones/RingList.xml alias RingList.xml
    tftp-server flash:/ringtones/AreYouThereF.raw alias AreYouThereF.raw
    tftp-server flash:/ringtones/Bass.raw alias Bass.raw
    tftp-server flash:/ringtones/CallBack.raw alias CallBack.raw
    tftp-server flash:/ringtones/Chime.raw alias Chime.raw
    tftp-server flash:/ringtones/Classic1.raw alias Classic1.raw
    tftp-server flash:/ringtones/Classic2.raw alias Classic2.raw
    tftp-server flash:/ringtones/ClockShop.raw alias ClockShop.raw
    tftp-server flash:/ringtones/Drums1.raw alias Drums1.raw
    tftp-server flash:/ringtones/Drums2.raw alias Drums2.raw
    tftp-server flash:/ringtones/FilmScore.raw alias FilmScore.raw
    tftp-server flash:/ringtones/HarpSynth.raw alias HarpSynth.raw
    tftp-server flash:/ringtones/Jamaica.raw alias Jamaica.raw
    tftp-server flash:/ringtones/KotoEffect.raw alias KotoEffect.raw
    tftp-server flash:/ringtones/MusicBox.raw alias MusicBox.raw
    tftp-server flash:/ringtones/Piano1.raw alias Piano1.raw
    tftp-server flash:/ringtones/Piano2.raw alias Piano2.raw
    tftp-server flash:/ringtones/Pop.raw alias Pop.raw
    tftp-server flash:/ringtones/Pulse1.raw alias Pulse1.raw
    tftp-server flash:/ringtones/Ring1.raw alias Ring1.raw
    tftp-server flash:/ringtones/Ring2.raw alias Ring2.raw
    tftp-server flash:/ringtones/Ring3.raw alias Ring3.raw
    tftp-server flash:/ringtones/Ring4.raw alias Ring4.raw
    tftp-server flash:/ringtones/Ring5.raw alias Ring5.raw
    tftp-server flash:/ringtones/Ring6.raw alias Ring6.raw
    tftp-server flash:/ringtones/Ring7.raw alias Ring7.raw
    tftp-server flash:/ringtones/Sax1.raw alias Sax1.raw
    tftp-server flash:/ringtones/Sax2.raw alias Sax2.raw
    tftp-server flash:/ringtones/Vibe.raw alias Vibe.raw
    tftp-server flash:/Desktops/CampusNight.png
    tftp-server flash:/Desktops/TN-CampusNight.png
    tftp-server flash:/Desktops/CiscoFountain.png
    tftp-server flash:/Desktops/TN-CiscoFountain.png
    tftp-server flash:/Desktops/CiscoLogo.png
    tftp-server flash:/Desktops/TN-CiscoLogo.png
    tftp-server flash:/Desktops/Fountain.png
    tftp-server flash:/Desktops/TN-Fountain.png
    tftp-server flash:/Desktops/MorroRock.png
    tftp-server flash:/Desktops/TN-MorroRock.png
    tftp-server flash:/Desktops/NantucketFlowers.png
    tftp-server flash:/Desktops/TN-NantucketFlowers.png
    tftp-server flash:Desktops/320x212x16/List.xml
    tftp-server flash:Desktops/320x212x12/List.xml
    tftp-server flash:Desktops/320x216x16/List.xml
    tftp-server flash:/bacdprompts/en_bacd_allagentsbusy.au alias en_bacd_allagentsbusy.au
    tftp-server flash:/bacdprompts/en_bacd_disconnect.au alias en_bacd_disconnect.au
    tftp-server flash:/bacdprompts/en_bacd_enter_dest.au alias en_bacd_enter_dest.au
    tftp-server flash:/bacdprompts/en_bacd_invalidoption.au alias en_bacd_invalidoption.au
    tftp-server flash:/bacdprompts/en_bacd_music_on_hold.au alias en_bacd_music_on_hold.au
    tftp-server flash:/bacdprompts/en_bacd_options_menu.au alias en_bacd_options_menu.au
    tftp-server flash:/bacdprompts/en_bacd_welcome.au alias en_bacd_welcome.au
    tftp-server flash:/bacdprompts/en_bacd_xferto_operator.au alias en_bacd_xferto_operator.au
    radius-server attribute 31 send nas-port-detail
    control-plane
    voice-port 0/0/0
    station-id number 401
    caller-id enable
    voice-port 0/0/1
    station-id number 402
    caller-id enable
    voice-port 0/0/2
    station-id number 403
    caller-id enable
    voice-port 0/0/3
    station-id number 404
    caller-id enable
    voice-port 0/1/0
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/0-OP
    caller-id enable
    voice-port 0/1/1
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/1-OP
    caller-id enable
    voice-port 0/1/2
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/2-OP
    caller-id enable
    voice-port 0/1/3
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/3-OP
    caller-id enable
    voice-port 0/4/0
    auto-cut-through
    signal immediate
    input gain auto-control -15
    description Music On Hold Port
    sccp local Vlan90
    sccp ccm 10.1.1.1 identifier 1 version 4.0
    sccp
    sccp ccm group 1
    associate ccm 1 priority 1
    associate profile 2 register mtpd0d0fd057a40
    dspfarm profile 2 transcode 
    description CCA transcoding for SIP Trunk Multisite Only
    codec g729abr8
    codec g729ar8
    codec g711alaw
    codec g711ulaw
    maximum sessions 10
    associate application SCCP
    dial-peer cor custom
    name internal
    name local
    name local-plus
    name international
    name national
    name national-plus
    name emergency
    name toll-free
    dial-peer cor list call-internal
    member internal
    dial-peer cor list call-local
    member local
    dial-peer cor list call-local-plus
    member local-plus
    dial-peer cor list call-national
    member national
    dial-peer cor list call-national-plus
    member national-plus
    dial-peer cor list call-international
    member international
    dial-peer cor list call-emergency
    member emergency
    dial-peer cor list call-toll-free
    member toll-free
    dial-peer cor list user-internal
    member internal
    member emergency
    dial-peer cor list user-local
    member internal
    member local
    member emergency
    member toll-free
    dial-peer cor list user-local-plus
    member internal
    member local
    member local-plus
    member emergency
    member toll-free
    dial-peer cor list user-national
    member internal
    member local
    member local-plus
    member national
    member emergency
    member toll-free
    dial-peer cor list user-national-plus
    member internal
    member local
    member local-plus
    member national
    member national-plus
    member emergency
    member toll-free
    dial-peer cor list user-international
    member internal
    member local
    member local-plus
    member international
    member national
    member national-plus
    member emergency
    member toll-free
    dial-peer voice 1 pots
    destination-pattern 401
    port 0/0/0
    no sip-register
    dial-peer voice 2 pots
    destination-pattern 402
    port 0/0/1
    no sip-register
    dial-peer voice 3 pots
    destination-pattern 403
    port 0/0/2
    no sip-register
    dial-peer voice 4 pots
    destination-pattern 404
    port 0/0/3
    no sip-register
    dial-peer voice 5 pots
    description ** MOH Port **
    destination-pattern ABC
    port 0/4/0
    no sip-register
    dial-peer voice 6 pots
    description ôcatch all dial peer for BRI/PRIö
    translation-profile incoming nondialable
    incoming called-number .%
    direct-inward-dial
    dial-peer voice 50 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/0
    dial-peer voice 51 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/1
    dial-peer voice 52 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/2
    dial-peer voice 53 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/3
    dial-peer voice 54 pots
    description ** FXO pots dial-peer **
    destination-pattern A0
    port 0/1/0
    no sip-register
    dial-peer voice 55 pots
    description ** FXO pots dial-peer **
    destination-pattern A1
    port 0/1/1
    no sip-register
    dial-peer voice 56 pots
    description ** FXO pots dial-peer **
    destination-pattern A2
    port 0/1/2
    no sip-register
    dial-peer voice 57 pots
    description ** FXO pots dial-peer **
    destination-pattern A3
    port 0/1/3
    no sip-register
    dial-peer voice 2000 voip
    description ** cue voicemail pilot number **
    translation-profile outgoing XFER_TO_VM_PROFILE
    destination-pattern 399
    b2bua
    session protocol sipv2
    session target ipv4:10.1.10.1
    voice-class sip outbound-proxy ipv4:10.1.10.1 
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    dial-peer voice 58 pots
    trunkgroup ALL_FXO
    corlist outgoing call-emergency
    description **CCA*North American-7-Digit*Emergency**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9911
    forward-digits all
    no sip-register
    dial-peer voice 59 pots
    trunkgroup ALL_FXO
    corlist outgoing call-emergency
    description **CCA*North American-7-Digit*Emergency**
    preference 5
    destination-pattern 911
    forward-digits all
    no sip-register
    dial-peer voice 60 pots
    trunkgroup ALL_FXO
    corlist outgoing call-local
    description **CCA*North American-7-Digit*7-Digit Local**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9[2-9]......
    forward-digits all
    no sip-register
    dial-peer voice 61 pots
    trunkgroup ALL_FXO
    corlist outgoing call-local
    description **CCA*North American-7-Digit*Service Numbers**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9[2-9]11
    forward-digits all
    no sip-register
    dial-peer voice 62 pots
    trunkgroup ALL_FXO
    corlist outgoing call-national
    description **CCA*North American-7-Digit*Long Distance**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91[2-9]..[2-9]......
    forward-digits all
    no sip-register
    dial-peer voice 63 pots
    trunkgroup ALL_FXO
    corlist outgoing call-international
    description **CCA*North American-7-Digit*International**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9011T
    forward-digits all
    no sip-register
    dial-peer voice 64 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91800.......
    forward-digits all
    no sip-register
    dial-peer voice 65 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91888.......
    forward-digits all
    no sip-register
    dial-peer voice 66 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91877.......
    forward-digits all
    no sip-register
    dial-peer voice 67 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91866.......
    forward-digits all
    no sip-register
    dial-peer voice 68 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91855.......
    forward-digits all
    no sip-register
    dial-peer voice 2100 voip
    corlist incoming call-internal
    description **CCA*INTERSITE inbound call to xxxxxxxxxx
    translation-profile incoming multisiteInbound
    incoming called-number 82...
    voice-class h323 1
    dtmf-relay h245-alphanumeric
    fax protocol cisco
    no vad
    dial-peer voice 2101 voip
    corlist incoming call-internal
    description **CCA*INTERSITE outbound calls to xxxxxxxxxx
    translation-profile outgoing multisiteOutbound
    destination-pattern 81...
    session target ipv4:192.168.10.1
    voice-class h323 1
    dtmf-relay h245-alphanumeric
    fax protocol cisco
    no vad
    no dial-peer outbound status-check pots
    telephony-service
    sdspfarm units 5
    sdspfarm transcode sessions 10
    sdspfarm tag 2 mtpd0d0fd057a40
    video
    fxo hook-flash
    max-ephones 138
    max-dn 600
    ip source-address 10.1.1.1 port 2000
    auto assign 1 to 1 type bri
    calling-number initiator
    service phone videoCapability 1
    service phone ehookenable 1
    service dnis overlay
    service dnis dir-lookup
    service dss
    timeouts interdigit 5
    system message Cisco Small Business
    url services http://10.1.10.1/voiceview/common/login.do
    url authentication http://10.1.10.1/voiceview/authentication/authenticate

    On 12/01/12 12:06, JebediahShapnacker wrote:
    >
    > Hello.
    >
    > I would like to setup a site to site VPN between 2 of our site. We have
    > Bordermanager .7 on one end and IPCop on the other.
    i'm not familiar with Bordermanager version but be sure you're using 3.9
    with sp2 and sp2_it1 applied.
    There are not specific documents that i'm aware that explains conf
    between ipcop and bm but if ipcop behaves as standard ipsec device, you
    can use as a guideline some of the docs that explains how to configure
    bm with third party firewalls.
    - AppNote: CISCO IOS 12.2(11) T with NBM 3.8 Server
    Novell Cool Solutions: AppNote
    By Upendra Gopu
    - BorderManager and Novell Security Manager Site-to-Site VPN
    Novell Cool Solutions: Feature
    By Jenn Bitondo
    - Setting Up an IPSec VPN Tunnel between Nortel and an NBM 3.8.4 Server
    Author Info
    8 November 2006 - 7:37pm
    Submitted by: kchendil
    - AppNote: NBM to Openswan: Site-to-site VPN Made Easy
    Novell Cool Solutions: AppNote
    By Gaurav Vaidya
    - AppNote: Interoperability of Cisco PIX 500 and NBM 3.8 VPN
    Novell Cool Solutions: AppNote
    By Sreekanth Settipalli
    Digg This - Slashdot This
    Posted: 28 Oct 2004
    etc

Maybe you are looking for

  • CS3 issues fixed in CS4?

    Have the following issues in CS3 been fixed in CS4: (Note: a few of these I've found already in the forum, but I am including an all comprehensive list anyway). 1. Self resizing title pane. 2. Still tiff image import incorrectly interpreted as an ima

  • ERROR unsupported video format

    When i packaging the video, it shows: 093 ERROR [com.adobe.cli.EXCEPTIONS] Error: com.adobe.flashaccess.core.media.FormatException: Content contains an unsupported video format at com.adobe.flashaccess.core.media.drm.flv.FLVEncryptingStreamer.writeTa

  • Flex 2.01 and Flash 8 movie SOS, Help

    Hi I need to Know when it finishes Flash 8 movies ? Let me explain. I have powerpoint presentation move to flash( http://www.dreamingsoft.com/powerpointtoflash/quicktour.htm), and work fine. I need to put a mx:Button at the end of the movie presentat

  • Error on office for mac

    hi purchased a new macbook, initital set up was via firewire from my powerbook, then loaded in office mac 2004 all ok except this message when i load up excel and powerpoint 'an unexpected error occured while trying to load microsoft framework' can a

  • Imac 8.1 OS X 10.5.8 reboot loop at startup

    I have an Imac 8.1 running OS X 10.5.8 After I had shut it down yesterday I'm doing a start-up end it ends up in loop of rebooting. So I hear the chime it loads for a while (apple plus loader), then the screen goes black and restarts again, and that