Cisco ASA IPS Monitor

Hello
I have configured IPS system in my ASA 5520 but I am unable find out my IPS is actually working or not. The only one thing i can see CPU utilization in IDM. Can you please assist me how I can view the IPS module activity? I have installed IDM & ASDM in my PC.
thanks.
Regards
Mannan

Please check the Inspection Load via IDM or IPS CLI (show stats virtual-sensor).
Using the "show stats virtual-sensor", it also shows, how many packets are being processed, which signatures are firing, etc.
Regards,
Sawan Gupta

Similar Messages

  • Cisco ASA IPS vs Bruteforce

    Who can help me, I need device that will block bruteforce attack to our webmail servers, 5 wrong password input = block for 10 min, for example.
    Can I use for this Cisco ASA IPS?

    Depending on how your specific webmail server works, perhaps you could use/tune:
    SIG 6256.0 (HTTP Authorization Failure)
    -or-
    SIG 20020.0 (HTTP Authentication Brute Force Attempt)
    Or, create a custom signature based off of one of the above.

  • Cisco ASA IPS SSM-10

    Hello,
    I just upgraded one of my Cisco ASA IPS SSM-10 from version 7.0 (6) E4 to version 7.0 (7) E4 and the Radius authentication stopped working. I use Microsoft 2008 Radius and I still have 10 more of these working with version 7.0 (6) E4.
    I used to have the same Radius authentication issue with version 6 until we upgraded to ver 7.0 (6) E4 and this latest version screwed up again.
    Does anyone know if there is a Radius authentication bug in this latest version 7.0 (7) E4?
    Thank you
    Si

    There is a known issue CSCty46104. However a show-tech log can give more details as to why there was a failure in your case.
    Regards
    Sawan Gupta

  • Cisco ASA SLA monitoring

    I'm trying to configure an SLA on some of our ASAs and I want to monitor the hostname of a destination rather than the IP address.  The CLI gives me an option to enter IP or hostname, but when I try and use a name rather than an IP address I get:
    (config-sla-monitor)# type echo protocol ipIcmpEcho ?
    sla-monitor mode commands/options:
      Hostname or A.B.C.D  IP address or hostname
    (config-sla-monitor)# type echo protocol ipIcmpEcho google.com
                                                                   ^
    ERROR: % Invalid Hostname
    (config)# ping google.com
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 173.194.37.128, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 40/46/50 ms
    Any ideas or suggestions?  I've tried local hostnames just to make sure it wasn't a resolution issue.  Substituting with the IP address works fine.  We just have a particluar vendor we depend on that has a propensity to change IP addresses to a cloud app we depend on and not tell us.
    If this posts answers your question or is helpful, please consider rating it and/or marking as answered.       

    Hi,
    Always used the IP address so I have no previous expirience of configuring with hostname.
    The Command Reference is very vague with regards to the definition of the hostname.
    Initially I thought that he problem might be that the DNS lookups are not enabled on the ASA so it is not able to determine the IP address itself.
    This didnt seem to make a difference.
    Then I configured the following
    name 1.1.1.1 test
    After which it accepted the command with the hostname configured as "test".
    So I am guessing the hostname refers to the "name" configurations of the  ASA and if that is the case then I would consider it a pretty useless option.
    I tried to configure an "object network GOOGLE" that uses "fqdn www.google.com" but it doesnt accept this "object" as the value for the hostname. So I am not really sure if I am missing something with regards to what else could be entered there other than something referenced in the "name" configuration.
    On a quick search I could not find anything online in which someone is actually using a hostname instead of the IP address.
    Also slightly adding to the confusion is the fact that the Configuration Guide makes no mention of hostname when giving instructions on configuring the target which to monitor for route tracking.
    Starting to seem to me that there is no option to use a DNS name as the target for monitoring.
    - Jouni

  • Cisco ASA Environmental Monitoring

    Greetings, we have an ASA5510 that i think is overheating as the fans periodically spin upto full speed for approx 10 mins.
    Is there a way to show the environmental settings on the ASA much like the "show environment" command on a router?
    Regards

    http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&topicID=.ee6e1fa&fromOutline=&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc1eba4

  • Correlating Cisco ASA-SSM-IPS Events/Logs

    I have just configured a Cisco ASA-SSM-IPS10. An exciting feature of this decice is the ability to monitor, analyse, and correlate security events. Can anybody help with a documentation to simplify daily (or periodic) analysis, and correlation of the IPS Logs? As I am not yet to up to speed with this task yet, a "How-to" document would be just fine.  Thank you.

    Hi Chris,
    Good to have you get on the case. I am yet to setup and ips manager software. Presently, I use an ASDM 6 interface, with this interface, I am able to view events and alerts, and perform other adminsitrative cores... The IPS manager express does it comes bundle with our device purchase? Does it contain necesary templates/docs for correlating events/Logs?

  • SQL Injection detection with IDS/IPS on cisco ASA?

    Hi
    Is it possible to detect or prevent SQL injection attacks using Cisco IDS/ IPS on ASA or with regular expressions?
    Is there any signature available in IDS/IPS for this? And how effective it is in terms of generating correct alarms?
    Thanks in advance

    Deepak,
    We have several signatures that detect generic SQL injection attacks in the 5930-x family of signatures.

  • Cisco asa 5585 syslog options for ips?

    We have CISCO ASA 5585 with a separate module for IPS, I want to know what are the options for configuring syslog? Its nearly impossible to find ; and there are some forums on the internet which says that cisco ips stores logs in native / proprietary format and cannot be exported.
    Please elaborate
    Thanks.

    Some sensor-related events generate syslog messages. Those will be forwarded according to the parent ASA syslog settings.
    Detailed IPS events (signature triggers actions etc.) are stored locally and must be retrieved using the SDEE protocol (tcp-based). That requires use of a management system like Cisco Security Manager (CSM), IPS Manager Express (IME) etc. There is a good document here that explains SDEE in more detail.

  • Cisco ASA 5520 Traffic monitoring

    Hello ,
    We have a Cisco ASA 5520 and im looking for a way to monitor largest outgoing and incoming traffic per ip in real time so to know which of my internal computers are using the most of our Internet Line. Is there a way to this through ADSM ? We use version 6.3.
    Thanks a lot

    Hi,
    I dont think the ASA alone can give you a really clear picture of the real time situation.
    It however should be able to give you some clue and simple statistics on the ASDM Firewall Dashboard
    My ASDM version is 7.1 but it should be there in your version also.

  • Tools use to monitor cisco asa

    Hi all,
    I just roll out a cisco asa 5540 and use it as a SSL vpn concentrator.
    Can i know what tools you use to monitor the cisco ASA, eg account with most number of login attempts, number of fail attempts etc
    TIA!

    You can look at Cisco Prime Collaboration Assurance if you're willing to upgrade to 10.0; they have started providing a free Standard license. They of course hope to upsell you to Advanced but the goal is for Standard to be an alternative to RTMT. There are also a plethora of ecosystem partners with product offerings in the Developer Marketplace.
    Please remember to rate helpful responses and identify helpful or correct answers.

  • Security monitoring tool for Cisco ASA

    Please suggest a checp and best security monitoring tool for Cisco ASA devices.

    You can use ossec, open source tool installed on linux:
    http://www.ossec.net/

  • Cisco ASA 5520 Failover with DMZ

    I have a pair of Cisco ASA 5520s running as a primary/standby. Everything is working properly with the primary ASA, however when I trigger a failover, everything works except for the DMZ interface on the standby ASA. I've poured over the configs, but perhaps I have been staring at them too long because I am just not seeing anything.
    Below is the output of the sh run failover, sh failover, and sh run interface commands for each unit...
    PRIMARY ASA
    Primary-ASA# sh run failover
    failover
    failover lan unit primary
    failover lan interface stateful1 GigabitEthernet0/3
    failover key *****
    failover link stateful1 GigabitEthernet0/3
    failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
    Primary-ASA# sh failover
    Failover On
    Failover unit Primary
    Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 20:39:23 CDT Sep 3 2013
    This host: Primary - Active
    Active time: 69648 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
         Interface outside (184.61.38.254): Normal
         Interface inside (192.168.218.252): Normal
         Interface dmz (192.168.215.254): Normal (Waiting)
         Interface management (192.168.1.1): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Other host: Secondary - Standby Ready
    Active time: 2119 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.253): Normal
    Interface inside (192.168.218.253): Normal
    Interface dmz (192.168.215.252): Normal (Waiting)
    Interface management (192.168.1.2): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
    IPS, 6.0(3)E1, Up
    Primary-ASA# sh run interface
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
    ospf cost 10
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
    ospf cost 10
    interface GigabitEthernet0/2
    nameif dmz
    security-level 50
    ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
    ospf cost 10
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
    ospf cost 10
    management-only
    STANDBY ASA
    Standby-ASA# sh run failover
    failover
    failover lan unit secondary
    failover lan interface stateful1 GigabitEthernet0/3
    failover key *****
    failover link stateful1 GigabitEthernet0/3
    failover interface ip stateful1 192.168.216.1 255.255.255.0 standby 192.168.216.2
    Standby-ASA# sh failover
    Failover On
    Failover unit Secondary
    Failover LAN Interface: stateful1 GigabitEthernet0/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 3 of 160 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 20:39:23 CDT Sep 3 2013
    This host: Secondary - Standby Ready
    Active time: 2119 (sec)
    slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.253): Normal
    Interface inside (192.168.218.253): Normal
    Interface dmz (192.168.215.252): Normal (Waiting)
    Interface management (192.168.1.2): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Other host: Primary - Active
    Active time: 70110 (sec)
          slot 0: ASA5520 hw/sw rev (2.0/8.2(5)) status (Up Sys)
    Interface outside (184.61.38.254): Normal
    Interface inside (192.168.218.252): Normal
    Interface dmz (192.168.215.254): Normal (Waiting)
    Interface management (192.168.1.1): Normal (Not-Monitored)
    slot 1: ASA-SSM-10 hw/sw rev (1.0/6.0(3)E1) status (Up/Up)
         IPS, 6.0(3)E1, Up
    Standby-ASA# sh run interface
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 184.61.38.254 255.255.255.128 standby 184.61.38.253
    ospf cost 10
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.168.218.252 255.255.255.0 standby 192.168.218.253
    ospf cost 10
    interface GigabitEthernet0/2
    nameif dmz
    security-level 50
    ip address 192.168.215.254 255.255.255.0 standby 192.168.215.252
    ospf cost 10
    interface GigabitEthernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
    ospf cost 10
    management-only
    Does anyone see something I might be missing? I am at a loss...

    I'll just answer my own question...the configs are correct, but it the interface on the standby ASA was plugged into an improperly configured switchport. That'll do it everytime.

  • Need help with LAN Architecture - ASA/IPS, and ISR placement

    Dear friends, I am new to Cisco community, had no previous experience with managed networks and desperately need an advice setting up a LAN for my small business. Here is what I did so far:
    ASA w IPS is facing internet, has a webserver connected to DMZ and then ISR on the inside interface. ISR is used for running CCME/CUE VOIP and VLAN NAT. Switch is connected to the ISR with a trunk interface. I setup multiple VLANs with ACL to separate engineering/management/sales/fileserver. Inter VLAN routing is enabled on the switch to allow Gigabit routing from the Fileserver VLAN to the Engineering VLAN.
    I know this is probably overkill for a 4 people company, but my objective is to be ready for possible attacks form both outside and inside and to ensure business continuity and minimal service interruptions.
    My question, would it be more practical to connect ASA directly to the switch and do VLAN NAT on the ASA instead of the router? This way if router fails, I loose VOIP but not Internet and if ASA fails, I only loose internet, while phones will stay operational. This approach should also let me use ASA IPS to monitor inter VLAN traffic, so if 1 of the user PCs gets infected, hopefully IPS will contain the damage to a single VLAN.
    What would experienced network architect do in my case? Any suggestions?
    Please, forgive me if I misunderstood something or did something silly, as this is my first network setup (not including household grade routers)
    Thank you very much in advance!

    Thank you for your response!
    I still keep debating if it has any advantages to use a Router in between ASA and the switch, or should I connect switch directly to
    ASA, so the only function of the router is to run VOIP?
    I saw multiple network diagrams which all had a border router, then ASA then switches. In my case router runs VOIP and I would want it to be behind ASA. Any benefits of running internet traffic through both ASA and a router?
    For redundancy, we can’t really afford 2nd ASA at this time, for now I would want to make sure there is as little chance as possible that both phones and internet go out simultaneously. 

  • CISCO ASA SSM-10

    I have an ASA 5520, and I have Cisco ASA SSM-10, but I'm not sure how to work with it. My problems are here:
    1. What software do I need to get this to work
    2. From the rj45 connection on this module, where does it connects to.
    3. Give me some guide to configure it and test to see if it works.

    Hi,
    you need to do couple of things to get this to work.
    1. Configuration on ASA to forward the traffic to the module
    2. Chose whether you are going to plug the IPS in inline/promiscious mode
    3. Configure the IPS module
    Configuring ASA to forward the traffic to the module:-
    access-l IPS permit ip any any
    class-IPS
    match access-list IPS
    policy-map global-policy
    class IPS
    IPS inline/promiscious fail-open/fail-close
    When you do this ASa is configured to send the traffic to the module.
    Now you need to get in to the IPS
    you can get in to the through CLI on ASA:-
    do session 1
    it will ask you for username and password
    both are cisco by default
    run the command setup
    and it will walk you through the initial configuration of the sensor.
    once the sensor is configured
    log in to the IDM
    and need to go to configuration>> policies and assign vs0 to the backplane interface of the module so that sigs come in to the act of the traffic.
    you can connect the module in front of the IPS to the switch vlan where the other interface exist from where you want to see this traffic and want ips to come into act.
    Suppose you want to apply the IPS on inside network
    ASA inside interface ip:-192.168.1.1
    Module ip:-192.168.1.3/192.168.1.1
    Here the gateway for the module is the ASA inside interface.
    now all the traffic going outbound or coming in from the inside itnerface will be monitored by the IPS.
    now connect the ethernet interface of the module to the same vlan on switch where your inside interface is connected.
    Now you can even manage the IDM of the IPS just like you manage the ASDM for the ASA, you just need to have your host/network allowed to gain access to it.
    Thanks

  • Cisco ASA 5505 site to site Multiple subnet.

    Hi. I need some help configuring my cisco asa 5505.
    I've set up a VPN tunnel between two ASA 5505
    Site 1:
    Subnet 192.168.77.0
    Site 2:
    Have multiple vlans and now the tunnel goes to vlan400 - 192.168.1.0
    What I need help with:
    From site 1 i need to be able to reach another vlan on site 2. vlan480 - 192.168.20.0
    And from site 1 I need to reach 192.168.77.0 subnet from vlan480 - 192.168.20.0
    Vlan480 is used for phones. In vlan480 we have a PABX central.
    Is this possible to do?
    Any help would be greatfully appreciated!
    Config site 2:
    : Saved
    ASA Version 7.2(2)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    names
    name 192.168.1.250 DomeneServer
    name 192.168.1.10 NotesServer
    name 192.168.1.90 OvServer
    name 192.168.1.97 TerminalServer
    name 192.168.1.98 w8-eyeshare
    name 192.168.50.10 w8-print
    name 192.168.1.94 w8-app
    name 192.168.1.89 FonnaFlyMedia
    interface Vlan1
    nameif Vlan1
    security-level 100
    ip address 192.168.200.100 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address 79.x.x.226 255.255.255.224
    ospf cost 10
    interface Vlan400
    nameif vlan400
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    ospf cost 10
    interface Vlan450
    nameif Vlan450
    security-level 100
    ip address 192.168.210.1 255.255.255.0
    ospf cost 10
    interface Vlan460
    nameif Vlan460-SuldalHotell
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    ospf cost 10
    interface Vlan461
    nameif Vlan461-SuldalHotellGjest
    security-level 100
    ip address 192.168.3.1 255.255.255.0
    ospf cost 10
    interface Vlan462
    nameif Vlan462-Suldalsposten
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    ospf cost 10
    interface Vlan470
    nameif vlan470-Kyrkjekontoret
    security-level 100
    ip address 192.168.202.1 255.255.255.0
    ospf cost 10
    interface Vlan480
    nameif vlan480-Telefoni
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    ospf cost 10
    interface Vlan490
    nameif Vlan490-QNapBackup
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    ospf cost 10
    interface Vlan500
    nameif Vlan500-HellandBadlands
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    ospf cost 10
    interface Vlan510
    nameif Vlan510-IsTak
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    ospf cost 10
    interface Vlan600
    nameif Vlan600-SafeQ
    security-level 100
    ip address 192.168.50.1 255.255.255.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 500
    switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610
    switchport mode trunk
    interface Ethernet0/3
    switchport access vlan 490
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd x encrypted
    ftp mode passive
    clock timezone WAT 1
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service Lotus_Notes_Utgaaande tcp
    description Frim Notes og ut til alle
    port-object eq domain
    port-object eq ftp
    port-object eq www
    port-object eq https
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq pptp
    port-object eq smtp
    object-group service Lotus_Notes_inn tcp
    description From alle og inn til Notes
    port-object eq www
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq smtp
    object-group service Reisebyraa tcp-udp
    port-object range 3702 3702
    port-object range 5500 5500
    port-object range 9876 9876
    object-group service Remote_Desktop tcp-udp
    description Tilgang til Remote Desktop
    port-object range 3389 3389
    object-group service Sand_Servicenter_50000 tcp-udp
    description Program tilgang til Sand Servicenter AS
    port-object range 50000 50000
    object-group service VNC_Remote_Admin tcp
    description Frå oss til alle
    port-object range 5900 5900
    object-group service Printer_Accept tcp-udp
    port-object range 9100 9100
    port-object eq echo
    object-group icmp-type Echo_Ping
    icmp-object echo
    icmp-object echo-reply
    object-group service Print tcp
    port-object range 9100 9100
    object-group service FTP_NADA tcp
    description Suldalsposten NADA tilgang
    port-object eq ftp
    port-object eq ftp-data
    object-group service Telefonsentral tcp
    description Hoftun
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    port-object eq telnet
    object-group service Printer_inn_800 tcp
    description Fra 800  nettet og inn til 400 port 7777
    port-object range 7777 7777
    object-group service Suldalsposten tcp
    description Sending av mail vha Mac Mail programmet - åpner smtp
    port-object eq pop3
    port-object eq smtp
    object-group service http2 tcp
    port-object range 81 81
    object-group service DMZ_FTP_PASSIVE tcp-udp
    port-object range 55536 56559
    object-group service DMZ_FTP tcp-udp
    port-object range 20 21
    object-group service DMZ_HTTPS tcp-udp
    port-object range 443 443
    object-group service DMZ_HTTP tcp-udp
    port-object range 8080 8080
    object-group service DNS_Query tcp
    port-object range domain domain
    object-group service DUETT_SQL_PORT tcp-udp
    description For kobling mellom andre nett og duett server
    port-object range 54659 54659
    access-list outside_access_in extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list vlan400_access_in extended deny ip any host 149.20.56.34
    access-list vlan400_access_in extended deny ip any host 149.20.56.32
    access-list vlan400_access_in extended permit ip any any
    access-list Vlan450_access_in extended deny ip any host 149.20.56.34
    access-list Vlan450_access_in extended deny ip any host 149.20.56.32
    access-list Vlan450_access_in extended permit ip any any
    access-list Vlan460_access_in extended deny ip any host 149.20.56.34
    access-list Vlan460_access_in extended deny ip any host 149.20.56.32
    access-list Vlan460_access_in extended permit ip any any
    access-list vlan400_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande
    access-list vlan400_access_out extended permit tcp any host DomeneServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host TerminalServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host OvServer object-group http2
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_inn
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-eyeshare object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-app object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host FonnaFlyMedia range 8400 8600
    access-list vlan400_access_out extended permit udp any host FonnaFlyMedia range 9000 9001
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host DomeneServer
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host w8-app object-group DUETT_SQL_PORT
    access-list Vlan500_access_in extended deny ip any host 149.20.56.34
    access-list Vlan500_access_in extended deny ip any host 149.20.56.32
    access-list Vlan500_access_in extended permit ip any any
    access-list vlan470_access_in extended deny ip any host 149.20.56.34
    access-list vlan470_access_in extended deny ip any host 149.20.56.32
    access-list vlan470_access_in extended permit ip any any
    access-list Vlan490_access_in extended deny ip any host 149.20.56.34
    access-list Vlan490_access_in extended deny ip any host 149.20.56.32
    access-list Vlan490_access_in extended permit ip any any
    access-list Vlan450_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan1_access_out extended permit ip any any
    access-list Vlan1_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan1_access_out extended deny ip any any
    access-list Vlan1_access_out extended permit icmp any any echo-reply
    access-list Vlan460_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTPS
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTP
    access-list Vlan500_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit tcp any host 192.168.202.10 object-group Remote_Desktop
    access-list Vlan510_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan480_access_out extended permit ip any any
    access-list Vlan510_access_in extended permit ip any any
    access-list Vlan600_access_in extended permit ip any any
    access-list Vlan600_access_out extended permit icmp any any
    access-list Vlan600_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan600_access_out extended permit tcp 192.168.1.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.202.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.210.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_in_1 extended permit ip any any
    access-list Vlan461_access_in extended permit ip any any
    access-list Vlan461_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list Vlan462-Suldalsposten_access_in extended permit ip any any
    access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_in_1 extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu Vlan1 1500
    mtu outside 1500
    mtu vlan400 1500
    mtu Vlan450 1500
    mtu Vlan460-SuldalHotell 1500
    mtu Vlan461-SuldalHotellGjest 1500
    mtu vlan470-Kyrkjekontoret 1500
    mtu vlan480-Telefoni 1500
    mtu Vlan490-QNapBackup 1500
    mtu Vlan500-HellandBadlands 1500
    mtu Vlan510-IsTak 1500
    mtu Vlan600-SafeQ 1500
    mtu Vlan462-Suldalsposten 1500
    no failover
    monitor-interface Vlan1
    monitor-interface outside
    monitor-interface vlan400
    monitor-interface Vlan450
    monitor-interface Vlan460-SuldalHotell
    monitor-interface Vlan461-SuldalHotellGjest
    monitor-interface vlan470-Kyrkjekontoret
    monitor-interface vlan480-Telefoni
    monitor-interface Vlan490-QNapBackup
    monitor-interface Vlan500-HellandBadlands
    monitor-interface Vlan510-IsTak
    monitor-interface Vlan600-SafeQ
    monitor-interface Vlan462-Suldalsposten
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (vlan400) 0 access-list vlan400_nat0_outbound
    nat (vlan400) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan450) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0
    nat (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0
    nat (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0
    nat (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0
    nat (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0
    nat (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0
    nat (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0
    static (vlan400,outside) 79.x.x.x DomeneServer netmask 255.255.255.255
    static (vlan470-Kyrkjekontoret,outside) 79.x.x.x 192.168.202.10 netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.x NotesServer netmask 255.255.255.255 dns
    static (vlan400,outside) 79.x.x.231 TerminalServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.234 OvServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.232 w8-eyeshare netmask 255.255.255.255
    static (Vlan490-QNapBackup,outside) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns
    static (Vlan600-SafeQ,outside) 79.x.x.235 w8-print netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.236 w8-app netmask 255.255.255.255
    static (Vlan450,vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (Vlan500-HellandBadlands,vlan400) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
    static (vlan400,Vlan500-HellandBadlands) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan450) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,outside) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255
    static (Vlan462-Suldalsposten,vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0
    static (vlan400,Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan450,Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (vlan470-Kyrkjekontoret,Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0
    access-group Vlan1_access_out out interface Vlan1
    access-group outside_access_in in interface outside
    access-group outside_access_out out interface outside
    access-group vlan400_access_in in interface vlan400
    access-group vlan400_access_out out interface vlan400
    access-group Vlan450_access_in in interface Vlan450
    access-group Vlan450_access_out out interface Vlan450
    access-group Vlan460_access_in in interface Vlan460-SuldalHotell
    access-group Vlan460_access_out out interface Vlan460-SuldalHotell
    access-group Vlan461_access_in in interface Vlan461-SuldalHotellGjest
    access-group Vlan461_access_out out interface Vlan461-SuldalHotellGjest
    access-group vlan470_access_in in interface vlan470-Kyrkjekontoret
    access-group vlan470_access_out out interface vlan470-Kyrkjekontoret
    access-group vlan480_access_out out interface vlan480-Telefoni
    access-group Vlan490_access_in in interface Vlan490-QNapBackup
    access-group Vlan490_access_out out interface Vlan490-QNapBackup
    access-group Vlan500_access_in in interface Vlan500-HellandBadlands
    access-group Vlan500_access_out out interface Vlan500-HellandBadlands
    access-group Vlan510_access_in in interface Vlan510-IsTak
    access-group Vlan510_access_out out interface Vlan510-IsTak
    access-group Vlan600_access_in_1 in interface Vlan600-SafeQ
    access-group Vlan600_access_out out interface Vlan600-SafeQ
    access-group Vlan462-Suldalsposten_access_in_1 in interface Vlan462-Suldalsposten
    access-group Vlan462-Suldalsposten_access_out_1 out interface Vlan462-Suldalsposten
    route outside 0.0.0.0 0.0.0.0 79.x.x.225 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    username x password x encrypted privilege 15
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.210.0 255.255.255.0 Vlan450
    http 192.168.200.0 255.255.255.0 Vlan1
    http 192.168.1.0 255.255.255.0 vlan400
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 20 match address outside_20_cryptomap_1
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer 62.92.159.137
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp enable vlan400
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group 62.92.159.137 type ipsec-l2l
    tunnel-group 62.92.159.137 ipsec-attributes
    pre-shared-key *
    telnet 192.168.200.0 255.255.255.0 Vlan1
    telnet 192.168.1.0 255.255.255.0 vlan400
    telnet timeout 5
    ssh 171.68.225.216 255.255.255.255 outside
    ssh timeout 5
    console timeout 0
    dhcpd update dns both
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface outside
    dhcpd address 192.168.1.100-192.168.1.225 vlan400
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface vlan400
    dhcpd option 3 ip 192.168.1.1 interface vlan400
    dhcpd enable vlan400
    dhcpd address 192.168.210.100-192.168.210.200 Vlan450
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450
    dhcpd option 3 ip 192.168.210.1 interface Vlan450
    dhcpd enable Vlan450
    dhcpd address 192.168.2.100-192.168.2.150 Vlan460-SuldalHotell
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell
    dhcpd option 3 ip 192.168.2.1 interface Vlan460-SuldalHotell
    dhcpd enable Vlan460-SuldalHotell
    dhcpd address 192.168.3.100-192.168.3.200 Vlan461-SuldalHotellGjest
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest
    dhcpd option 3 ip 192.168.3.1 interface Vlan461-SuldalHotellGjest
    dhcpd enable Vlan461-SuldalHotellGjest
    dhcpd address 192.168.202.100-192.168.202.199 vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.202.1 interface vlan470-Kyrkjekontoret
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret
    dhcpd enable vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.20.1 interface vlan480-Telefoni
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni
    dhcpd address 192.168.10.80-192.168.10.90 Vlan490-QNapBackup
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup
    dhcpd option 3 ip 192.168.10.1 interface Vlan490-QNapBackup
    dhcpd address 192.168.30.100-192.168.30.199 Vlan500-HellandBadlands
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands
    dhcpd option 3 ip 192.168.30.1 interface Vlan500-HellandBadlands
    dhcpd enable Vlan500-HellandBadlands
    dhcpd address 192.168.40.100-192.168.40.150 Vlan510-IsTak
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak
    dhcpd option 3 ip 192.168.40.1 interface Vlan510-IsTak
    dhcpd enable Vlan510-IsTak
    dhcpd address 192.168.50.150-192.168.50.199 Vlan600-SafeQ
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ
    dhcpd enable Vlan600-SafeQ
    dhcpd address 192.168.4.100-192.168.4.150 Vlan462-Suldalsposten
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface Vlan462-Suldalsposten
    dhcpd option 3 ip 192.168.4.1 interface Vlan462-Suldalsposten
    dhcpd enable Vlan462-Suldalsposten
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    prompt hostname context
    Cryptochecksum:x
    : end
    Config site 1:
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    passwd x encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.77.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group Telenor
    ip address pppoe setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 15
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_access_in extended permit icmp any any echo-reply log disable
    access-list outside_1_cryptomap extended permit ip 192.168.77.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.77.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.77.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 79.160.252.226
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.77.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group Telenor request dialout pppoe
    vpdn group Telenor localname x
    vpdn group Telenor ppp authentication chap
    vpdn username x password x store-local
    dhcpd auto_config outside
    dhcpd address 192.168.77.100-192.168.77.130 inside
    dhcpd dns 192.168.77.1 interface inside
    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside
    dhcpd enable inside
    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface outside
    tunnel-group 79.160.252.226 type ipsec-l2l
    tunnel-group 79.160.252.226 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:x
    : end

    Hi,
    The addition of a new network to the existing L2L VPN should be a pretty simple process.
    Essentially you will have to add the network to the Crypto ACL present in the "crypto map" configurations. You will also have to configure the NAT0 configuration for it in the proper interfaces of the ASA. These configurations are all done on both ends of the L2L VPN connection.
    Looking at your above configurations it would seem that you will need the following configurations
    SITE 1
    We add the new network to both the crypto ACL and the NAT0 ACL
    access-list outside_1_cryptomap extended permit ip 192.168.77.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.77.0 255.255.255.0 192.168.20.0 255.255.255.0
    SITE 2
    We add the new network to the crypto ACL
    We create a new NAT0 configuration for the Vlan480 interface as it has no previous NAT0 configuration
    access-list outside_20_cryptomap_1 extended permit ip 192.168.20.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list VLAN480-NAT0 remark NAT0 for VPN
    access-list VLAN480-NAT0 permit ip 192.168.20.0 255.255.255.0 192.168.77.0 255.255.255.0
    nat (vlan480-Telefoni) 0 access-list VLAN480-NAT0
    These configurations should pretty much do the trick.
    Let me know if it worked
    - Jouni

Maybe you are looking for

  • Just recently setup a new machine and can't get Story to load

    I built a new PC, installed Creative Cloud CS6 and all the software loads and runs except for Adobe Story.  When I launch it from the web I get "Failed to get user preferences."  All I can do at this point is Sign Out.  I can never sign in.  My Adobe

  • F110 - Payment proposal parameter

    Hi all, Pls tell me if I have created a payment proposal but not yet run, if I change the parameter, let say, "Posting date" or "Document entered up to date", will this changes get logged? Where can I check for the changes made by whom and when? Than

  • IMovie icloud photo sharing just in iOS

    dear experts, i have iMovie in iOS and with iOX. in iOS there is a function 'icloud photo sharing'. I can't find it in the version in Yosemite? i found it to be the way to share my videos withmy family. thanks.

  • Blurred Text With Lower Resolution

    I have a question regarding lower than maximum resolution. When I change it in the displays control panel to anything other than 1280x854 the text and the screen in general isn't sharp and clear. Anyone else experience this?

  • No enough freespace when upgrading a database

    I'm upgrading a 8.1.7 database to 9.2 on windows 2000. The database upgrade assistent tells me that there is no enough freespace on the drive where the database residents. It says "ODMA_RBS" needs 90MB freespace but actually I have 23GB available on