Cisco ASA 5505 config cleanup / revision

Question

Hello all,
I have been assigned the task of "cleaning" up and revising one of our customer's ASA 5505. I am going through the config and I have some questions that I am hoping can be clarified for me. The config is rather simple with the inclusion of a remote-access VPN.
I am seeing the follwoing ACLs and Static PAT statements and I am wondering why the previous admin chose this design. IP address 192.168.0.6 is on of their MVbase (database) servers.
access-list acl_out extended permit tcp any interface outside eq 2043
access-list acl_out extended permit tcp any interface outside eq 2044
access-list acl_out extended permit udp any interface outside eq 2040
access-list acl_out extended permit udp any interface outside eq 2041
static (inside,outside) udp interface 2041 192.168.0.6 2041 netmask 255.255.255.255
static (inside,outside) udp interface 2043 192.168.0.6 2043 netmask 255.255.255.255
static (inside,outside) tcp interface 2043 192.168.0.6 2043 netmask 255.255.255.255
static (inside,outside) udp interface 2044 192.168.0.6 2044 netmask 255.255.255.255
static (inside,outside) tcp interface 2044 192.168.0.6 2044 netmask 255.255.255.255
Can I replace the following portion of the config with the one below it?
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA 
ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto dynamic-map remote_map10 set transform-set ESP-AES-256-MD5
crypto map outside_map10 ipsec-isakmp dynamic remote_map
crypto map outside_map interface outside
crypto isakmp enable outside
I have attached the full ASA config in order for my questions to make more sense.
Thanks in advance,
Adrian

Answer 1

Douglas,
In that case seems like there are many issues.
One thing I notized on the router is :
interface FastEthernet0/1.1
description vlan 1$FW_OUTSIDE$
interface FastEthernet0/1.10
description vlan 10$FW_INSIDE$
You can't have the same physical port for inside and outside.
Meaning this port can't be connected to the ASA and the PC or switch at the same time.
Try to find how far can the PC go; if it can ping the router and if the router can ping the ASA
Then on the ASA you have:
nat (inside) 1 0.0.0.0 0.0.0.0
But there is no global command, you need to add:
global (outside) 1 interface
You should be able to ping 192.168.1.1 from the ASA,
make sure  Ethernet0/0 is up
Regards,
Felipe.