Not Able to Telnet or SSH Cisco ASA

Hi,
I am not able to do the following to Cisco ASA with one IP address 172.19.1.11, below is the configuration in ASA. Earlier it was working, all of a sudden it stopped working.
Please help.
1. Not Able to SSH
2. Solarwinds not able to take information from ASA.
http 172.19.1.11 255.255.255.255 inside
snmp-server host inside 172.19.1.11 community srnemapd
telnet 172.19.1.11 255.255.255.255 inside
ssh 172.19.1.11 255.255.255.255 inside
ntp server 172.19.1.11 source inside prefer

Hi there,
Just add a new IP address for ssh to ASA, this will kick start the demon.
This new IP does not have to be a real one.
Hope this helps.
Thanks
Rizwan Rafeek

Similar Messages

  • Not able to telnet or ssh to outside interface of ASA and Cisco Router

    Dear All
    Please help me with following question, I have set up testing lab, but still not work.
    it is Hub and spoke site to site vpn case, connection between hub and spoke is metro-E, so we are using private ip for outside interface at each site.
    Hub -- Juniper SRX
    Spoke One - Cisco ASA with version 9.1(5)
    spoke two - Cisco router with version 12.3
    site to site vpn has been successful established. Customer would like to telnet/ssh to spoke's outside ip from Hub(using Hub's outside interface as source for telnet/ssh), or vise versa. Reason for setting up like this is they wants to be able to make configuration change even when site to site vpn is down. Sound like a easy job to do, I tried for a long time, search this forum and google too, but still not work.
    Now I can successfully telnet/ssh to Hub SRX's outside interface from spoke (ASA has no telnet/ssh client, tested using Cisco router).
    Anyone has ever done it before, please help to share your exp. Does Cisco ASA or router even support it?
    When I tested it, of cause site to site vpn still up and running.
    Thanks
    YK

    Hello YK,
    On this case on the ASA, you should have the following:
    CConfiguring Management Access Over a VPN Tunnel
    If your VPN tunnel terminates on one interface, but you want to manage the ASA by accessing a different interface, you can identify that interface as a management-access interface. For example, if you enter the ASA from the outside interface, this feature lets you connect to the inside interface using ASDM, SSH, Telnet, or SNMP; or you can ping the inside interface when entering from the outside interface. Management access is available via the following VPN tunnel types: IPsec clients, IPsec LAN-to-LAN, and the AnyConnect SSL VPN client.
    To specify an interface as a mangement-only interface, enter the following command:
    hostname(config)# management access management_interface
    where management_interface specifies the name of the management interface you want to access when entering the security appliance from another interface.
    You can define only one management-access interface
    Also make sure you have the pertinent configuration for SSH, telnet, ASDM and SNMP(if required), for a quick test you can enable on your lab Test:
      SSH
    - ssh 0 0 outside
    - aaa authentication ssh console LOCAL
    - Make sure you have a default RSA key, or create a new one either ways, with this command:
        *crypto key generate rsa modulus 2048
    Telnet
    - telnet 0 0 outside
    - aaa authentication telnet console LOCAL
    Afterwards, if this works you can define the subnets that should be permitted.
    On the router:
    !--- Step 1: Configure the hostname if you have not previously done so.
    hostname Router
    !--- aaa new-model causes the local username and password on the router
    !--- to be used in the absence of other AAA statements.
    aaa new-model
    username cisco password 0 cisco
    !--- Step 2: Configure the router's DNS domain.
    ip domain-name yourdomain.com
    !--- Step 3: Generate an SSH key to be used with SSH.
    crypto key generate rsa
    ip ssh time-out 60
    ip ssh authentication-retries 3
    !--- Step 4: By default the vtys' transport is Telnet. In this case, 
    !--- Telnet and SSH is supported with transport input all
    line vty 0 4
    transport input All
    *!--- Instead of aaa new-model, the login local command may be used.
    no aaa new-model
    line vty 0 4
      login local
    Let me know how it works out!
    Please don't forget to Rate and mark as correct the helpful Post!
    David Castro,
    Regards,

  • I am not able to telnet my content rule VIP address

    I am not able to telnet my content rule VIP address and port number. But I am able to direct to telnet to service servers, which are added into the content rule set. Can anyone tell me why. I have update the latest WEBOS 5.00 Build 69. The content switch model is 11050. thank you very much .

    Is possible one armed and in line in the same content switch ?
    Currently I have some content rule are using one armed solution, there is only one rule I need to make the server see the original IP. I guess my question is , can I have this rule use in -line solution only, so I will not have to impact other rules set.
    The other question since this content rule's service sever have only one interface only, Can I have this in-line solution go in the content switch and come out content switch in the same server farm switch ? Thank you for all the help.

  • Services are running in Server 2008. But still not able to telnet on localhost

    Hello Everybody,
    Desired services are running on server but still telnet on localhost not happening.
    From remote server I am able to telnet on same services.
    I am facing issue while doing telnet to remote server alos.
    Is there anything which could stopping telnet operation.
    From same server I am not able to telnet to other server for SQL services, whereas both servers in same LAN with adjacent IP address. 

    Hi Steven,
    Thanks for response.
    I have checked same. Services are listening on desired port.
    From events log we observed that server moving out of domain controller which root cause not identified yet.
    Will it be possible if sever moving out of domain and getting NETLOGON issue. Which could block communication to other server or localhost telnet.
    Regards,
    Mahesh D. 

  • VPN clients not able to ping Remote PCs & Servers : ASA 5520

    VPN is connected successfully. But not able to ping any remote ip or fqdn from client pc. But able to ping ASA 5520 firewalls inside interface. Also some clients able to access, some clients not able to access. I new to these firewalls. I tried most of ways from internet, please any one can help asap.
    Remote ip section : 192.168.1.0/24
    VPN IP Pool : 192.168.5.0/24
    Running Config :
     ip address 192.168.1.2 255.255.255.0
    interface GigabitEthernet0/2
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     shutdown
     no nameif
     no security-level
     no ip address
     management-only
    passwd z40TgSyhcLKQc3n1 encrypted
    boot system disk0:/asa722-k8.bin
    ftp mode passive
    clock timezone GST 4
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group DefaultDNS
     name-server 213.42.20.20
     domain-name default.domain.invalid
    access-list outtoin extended permit tcp any host 83.111.113.114 eq 3389
    access-list outtoin extended permit tcp any host 83.111.113.113 eq https
    access-list outtoin extended permit tcp any host 83.111.113.114 eq smtp
    access-list outtoin extended permit tcp any host 83.111.113.114 eq https
    access-list outtoin extended permit tcp any host 83.111.113.114 eq www
    access-list outtoin extended permit tcp any host 83.111.113.115 eq https
    access-list outtoin extended permit tcp any host 94.56.148.98 eq 3389
    access-list outtoin extended permit tcp any host 83.111.113.117 eq ssh
    access-list fualavpn_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list outside_nat0_outbound extended permit ip 192.168.5.0 255.255.255.0
    92.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 1
    2.168.5.0 255.255.255.0
    access-list inet_in extended permit icmp any any time-exceeded
    access-list inet_in extended permit icmp any any unreachable
    access-list inet_in extended permit icmp any any echo-reply
    access-list inet_in extended permit icmp any any echo
    pager lines 24
    logging enable
    logging asdm informational
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    logging recipient-address [email protected] level emergencies
    logging recipient-address [email protected] level errors
    mtu outside 1500
    mtu inside 1500
    ip local pool fualapool 192.168.5.10-192.168.5.50 mask 255.255.255.0
    ip local pool VPNPool 192.168.5.51-192.168.5.150 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound outside
    nat (inside) 1 192.168.1.0 255.255.255.0
    static (inside,outside) 94.56.148.98 192.168.1.11 netmask 255.255.255.255
    static (inside,outside) 83.111.113.114 192.168.1.111 netmask 255.255.255.255
    access-group inet_in in interface outside
    route outside 0.0.0.0 0.0.0.0 83.111.113.116 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy DfltGrpPolicy attributes
     banner none
     wins-server none
     dns-server none
     dhcp-network-scope none
     vpn-access-hours none
     vpn-simultaneous-logins 10
     vpn-idle-timeout 30
     vpn-session-timeout none
     vpn-filter none
     vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
     password-storage disable
     ip-comp disable
     re-xauth disable
     group-lock none
     pfs disable
     ipsec-udp disable
     ipsec-udp-port 10000
     split-tunnel-policy tunnelall
     split-tunnel-network-list none
     default-domain none
     split-dns none
     intercept-dhcp 255.255.255.255 disable
     secure-unit-authentication disable
     user-authentication disable
     user-authentication-idle-timeout 30
     ip-phone-bypass disable
     leap-bypass disable
     nem disable
     backup-servers keep-client-config
     msie-proxy server none
     msie-proxy method no-modify
     msie-proxy except-list none
     msie-proxy local-bypass disable
     nac disable
     nac-sq-period 300
     nac-reval-period 36000
     nac-default-acl none
     address-pools none
     client-firewall none
     client-access-rule none
     webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have no
     been met or due to some specific group policy, you do not have permission to u
    e any of the VPN features. Contact your IT administrator for more information
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy fualavpn internal
    group-policy fualavpn attributes
     dns-server value 192.168.1.111 192.168.1.100
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value fualavpn_splitTunnelAcl
    username test password I7ZgrgChfw4FV2AW encrypted privilege 0
    username Mohamed password Vqmmt8cR/.Qu7LhU encrypted privilege 0
    username Moghazi password GMr7xgdqmGEQ2SVR encrypted privilege 0
    username Moghazi attributes
     password-storage enable
    username fualauaq password E6CgvoOpTKphiM2U encrypted privilege 0
    username fualauaq attributes
     password-storage enable
    username fuala password IFtijSYb7LAOV/IW encrypted privilege 15
    username Basher password Djf15nXIJXmayfjY encrypted privilege 0
    username Basher attributes
     password-storage enable
    username fualafac password VGC/7cKXW1A6eyXS encrypted privilege 0
    username fualafac attributes
     password-storage enable
    username fualaab password ONTH8opuP4RKgRXD encrypted privilege 0
    username fualaab attributes
     password-storage enable
    username fualaadh2 password mNEgLxzPBeF4SyDb encrypted privilege 0
    username fualaadh2 attributes
     password-storage enable
    username fualaain2 password LSKk6slwsVn4pxqr encrypted privilege 0
    username fualaain2 attributes
     password-storage enable
    username fualafj2 password lE4Wu7.5s7VXwCqv encrypted privilege 0
    username fualafj2 attributes
     password-storage enable
    username fualakf2 password 38oMUuwKyShs4Iid encrypted privilege 0
    username fualakf2 attributes
     password-storage enable
    username fualaklb password .3AMGUZ1NWU1zzIp encrypted privilege 0
    username fualaklb attributes
     password-storage enable
    username fualastr password RDXSdBgMaJxNLnaH encrypted privilege 0
    username fualastr attributes
     password-storage enable
    username fualauaq2 password HnjodvZocYhDKrED encrypted privilege 0
    username fualauaq2 attributes
     password-storage enable
    username fualastore password wWDVHfUu9pdM9jGj encrypted privilege 0
    username fualastore attributes
     password-storage enable
    username fualadhd password GK8k1MkMlIDluqF4 encrypted privilege 0
    username fualadhd attributes
     password-storage enable
    username fualaabi password eYL0j16kscNhhci4 encrypted privilege 0
    username fualaabi attributes
     password-storage enable
    username fualaadh password GTs/9BVCAU0TRUQE encrypted privilege 0
    username fualaadh attributes
     password-storage enable
    username fualajuh password b9QGJ1GHhR88reM1 encrypted privilege 0
    username fualajuh attributes
     password-storage enable
    username fualadah password JwVlqQNIellNgxnZ encrypted privilege 0
    username fualadah attributes
     password-storage enable
    username fualarak password UE41e9hpvcMeChqx encrypted privilege 0
    username fualarak attributes
     password-storage enable
    username fualasnk password ZwZ7fVglexrCWFUH encrypted privilege 0
    username fualasnk attributes
     password-storage enable
    username rais password HrvvrIw5tEuam/M8 encrypted privilege 0
    username rais attributes
     password-storage enable
    username fualafuj password yY2jRMPqmNGS.3zb encrypted privilege 0
    username fualafuj attributes
     password-storage enable
    username fualamaz password U1YUfQzFYrsatEzC encrypted privilege 0
    username fualamaz attributes
     password-storage enable
    username fualashj password gN4AXk/oGBTEkelQ encrypted privilege 0
    username fualashj attributes
     password-storage enable
    username fualabdz password tg.pB7RXJx2CWKWi encrypted privilege 0
    username fualabdz attributes
     password-storage enable
    username fualamam password uwLjc0cV7LENI17Y encrypted privilege 0
    username fualamam attributes
     password-storage enable
    username fualaajm password u3yLk0Pz0U1n.Q0c encrypted privilege 0
    username fualaajm attributes
     password-storage enable
    username fualagrm password mUt3A60gLJ8N5HVr encrypted privilege 0
    username fualagrm attributes
     password-storage enable
    username fualakfn password ceTa6jmvnzOFNSgF encrypted privilege 0
    username fualakfn attributes
     password-storage enable
    username Fualaain password Yyhr.dlc6/J7WvF0 encrypted privilege 0
    username Fualaain attributes
     password-storage enable
    username fualaban password RCJKLGTrh7VM2EBW encrypted privilege 0
    username John password D9xGV1o/ONPM9YNW encrypted privilege 15
    username John attributes
     password-storage disable
    username wrkshopuaq password cFKpS5e6Whp0A7TZ encrypted privilege 0
    username wrkshopuaq attributes
     password-storage enable
    username Talha password 3VoAABwXxVonLmWi encrypted privilege 0
    username Houssam password Cj/uHUqsj36xUv/R encrypted privilege 0
    username Faraj password w2qYfE3DkYvS/oPq encrypted privilege 0
    username Faraj attributes
     password-storage enable
    username gowth password HQhALLeiQXuIzptCnTv1rA== nt-encrypted privilege 15
    username Hameed password 0Kr0N1VRmLuWdoDE encrypted privilege 0
    username Hameed attributes
     password-storage enable
    username Hassan password Uy4ASuiNyEd70LCw encrypted privilege 0
    username cisco password IPVBkPI1GLlHurPD encrypted privilege 15
    username Karim password 5iOtm58EKMyvruZA encrypted privilege 0
    username Shakir password BESX2bAvlbqbDha/ encrypted privilege 0
    username Riad password iB.miiOF7qMESlCL encrypted privilege 0
    username Azeem password 0zAqiCG8dmLyRQ8f encrypted privilege 15
    username Azeem attributes
     password-storage disable
    username Osama password xu66er.7duIVaP79 encrypted privilege 0
    username Osama attributes
     password-storage enable
    username Mahmoud password bonjr0B19aOQSpud encrypted privilege 0
    username alpha password x8WO0aiHL3pVFy2E encrypted privilege 15
    username Wissam password SctmeK/qKVNLh/Vv encrypted privilege 0
    username Wissam attributes
     password-storage enable
    username Nabil password m4fMvkTgVwK/O3Ms encrypted privilege 0
    aaa authentication telnet console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    http 192.168.1.4 255.255.255.255 inside
    http 192.168.1.100 255.255.255.255 inside
    http 192.168.1.111 255.255.255.255 inside
    http 192.168.1.200 255.255.255.255 inside
    http 83.111.113.117 255.255.255.255 outside
    http 192.168.1.17 255.255.255.255 inside
    http 192.168.1.16 255.255.255.255 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    tunnel-group fualavpn type ipsec-ra
    tunnel-group fualavpn type ipsec-ra
    tunnel-group fualavpn general-attributes
     address-pool fualapool
     address-pool VPNPool
     default-group-policy fualavpn
    tunnel-group fualavpn ipsec-attributes
     pre-shared-key *
    tunnel-group fualavpn ppp-attributes
     authentication pap
     authentication ms-chap-v2
     authentication eap-proxy
    telnet 0.0.0.0 0.0.0.0 outside
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access inside
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:38e41e83465d37f69542355df734db35
    : end

    Hi,
    What about translating the traffic on the local ASA (Active unit) for traffic received from the VPN tunnel to the internal interface IP address? You can try something like nat (outside,inside) source dynamic obj-VpnRemoteTraffic interface destination static StandbyIP StandbyIP
    Regards,

  • CiscoWorks: Using Windows 7, Not able to telnet from Network Topology

    I've been looking around the web and I can't seem to find a working solution to get telnet to work from Network topology.
    I've enabled telnet and telnet server in the Windows features.
    I've put in the reg hack that used to work to get telnet running through IE.
    Any of you had any luck in this area?

    Please read :
    * http://kb.mozillazine.org/MAPI_Support

  • Cisco ASA 8.2, cant access internet,

    Hi All,
    Hope some one can help me.
    I have spent the last two days trying to resolve this problem but had no luck.
    When I configure the ASA5520 from scratch every thin works fine, I can access the internet and surf with out a problem. The problem is when I save the config and reload the ASA then i'm not able to access the internet.
    the ASA is connected directly to a Business Grade Wireless broadband via PPOE, I have a outside network and an inside network.
    I have pasted the fonfig below, have I done somthing wrong....?
    ciscoasa# sh run
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password Jv79779910k1fr encrypted
    passwd 2K86079IdI.2KYOU encrypted
    names
    interface GigabitEthernet0/0
    description CIS_Internet
    nameif outside
    security-level 0
    pppoe client vpdn group Cis
    ip address pppoe
    interface GigabitEthernet0/1
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    description Internal_Local
    nameif inside
    security-level 100
    ip address 10.10.10.1 255.255.255.252
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    same-security-traffic permit inter-interface
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 101 interface
    nat (inside) 101 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 210.55.XX.XX 1
    route inside 10.1.1.0 255.255.255.0 10.10.10.1 1
    route inside 172.16.20.0 255.255.255.0 10.10.10.1 1
    route inside 172.16.30.0 255.255.255.0 10.10.10.1 1
    route inside 192.168.1.0 255.255.255.0 10.10.10.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.10.0 255.255.255.252 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group Cis request dialout pppoe
    vpdn group Cis localname [email protected]
    vpdn group Cis ppp authentication chap
    vpdn username [email protected] password *****
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    webvpn
    anyconnect-essentials
    username SystemUser password Khkx/sd/vu encrypted privilege 15
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:992c963510d5f2724a1a2d
    : end
    ciscoasa#

    Jouni
    not able to receive email i am able to send but not receive.
    can you please look at the config below and see if I have missed anything
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password Jv1hg0k1fr encrypted
    passwd 2KFQnbNYOU encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    pppoe client vpdn group Cirrus_Internet
    ip address pppoe setroute
    interface GigabitEthernet0/1
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    nameif inside
    security-level 100
    ip address 10.10.10.1 255.255.255.0
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa825-k8.bin
    ftp mode passive
    object-group network Exchange_Server
    access-list OUTSIDE-IN remark Allow SMTP
    access-list OUTSIDE-IN extended permit tcp any interface outside eq smtp
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-714.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 101 interface
    nat (inside) 101 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp 192.168.1.205 smtp netmask 255.255.255.255
    access-group OUTSIDE-IN in interface outside
    route inside 10.1.1.0 255.255.255.0 10.10.10.1 1
    route inside 172.16.20.0 255.255.255.0 10.10.10.1 1
    route inside 172.16.30.0 255.255.255.0 10.10.10.1 1
    route inside 192.168.1.0 255.255.255.0 10.10.10.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.10.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group Telstra_Internet request dialout pppoe
    vpdn group Telstra_Internet localname [email protected]
    vpdn group Cirrus_Internet ppp authentication chap
    vpdn username [email protected] password *****
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username XXXXXX password Khkx/sd/vu encrypted privilege 15
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:c68da9839bcbaa7205a4d7babdcc6eae
    : end
    ciscoasa(config)#

  • CISCO ASA denies certain websites

    hi,
    I have a user with Vista who is unable to access certain websites, for example http://www.hsbc.co.uk. Most others on the network can access the website however it appears another user can't. Both users can access the site from home but not from the office using the same laptops. I am not sure which settings on the CISCO ASA I should change to resolve this issue.
    I wondered if anyone had any ideas?
    thanks
    Gavin

    You may have enabled URL filtering on ASA which will block the websites which you have configured to be blocked by the filter.Check if you have configured URL filtering and if so remove the URLS which you want to be accessed from the filtering configuration.

  • S2S between Cisco ASA 5505 and Sonicwall TZ-170 but not able to ping across

    Hi,
    I am helping out a friend of mine with his Site-to-Site VPN between his companies Cisco ASA another company's SonicWall TZ-170.  I have checked the screenshots proivded by the other end and tried to match with ours.  The Tunnel shows but we are not able to Ping resources on the other end.  The other side insists that the problem is on our end but I am not sure where the issue resides.  Please take a look at our config and let me know if there is anything that I have missed.  I am pretty sure I didn't but extra eyes may be of need here.
    Our LAN is 10.200.x.x /16 and theirs is 192.168.9.0 /24
    ASA Version 8.2(2)
    terminal width 300
    hostname company-asa
    domain-name Company.com
    no names
    name 10.1.0.0 sacramento-network
    name 10.3.0.0 irvine-network
    name 10.2.0.0 portland-network
    name x.x.x.x MailLive
    name 192.168.9.0 revit-vpn-remote-subnet
    dns-guard
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.128
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.200.200.1 255.255.0.0
    interface Ethernet0/2
    nameif dmz
    security-level 50
    ip address 172.22.22.1 255.255.255.0
    interface Ethernet0/3
    description Internal Wireless
    shutdown
    nameif Wireless
    security-level 100
    ip address 10.201.201.1 255.255.255.0
    interface Management0/0
    shutdown
    nameif management
    security-level 100
    no ip address
    management-only
    boot system disk0:/asa822-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name company.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network local_net_group
    network-object 10.1.0.0 255.255.0.0
    network-object 10.2.0.0 255.255.0.0
    network-object 10.200.0.0 255.255.0.0
    network-object 10.3.0.0 255.255.0.0
    network-object 10.4.0.0 255.255.0.0
    network-object 10.5.0.0 255.255.0.0
    network-object 10.6.0.0 255.255.0.0
    network-object 10.7.0.0 255.255.0.0
    network-object 192.168.200.0 255.255.255.0
    object-group network NACIO123
    network-object 1.1.1.1 255.255.255.224
    object-group service MAIL_HTTPS_BORDERWARE tcp
    port-object eq smtp
    port-object eq https
    port-object eq 10101
    object-group service SYSLOG_SNMP_NETFLOW udp
    port-object eq syslog
    port-object eq snmp
    port-object eq 2055
    object-group service HTTP_HTTPS tcp
    port-object eq www
    port-object eq https
    object-group network OUTSIDECO_SERVERS
    network-object host x.x.x.34
    network-object host x.x.x.201
    network-object host x.x.x.63
    object-group network NO-LOG
    network-object host 10.200.200.13
    network-object host 10.200.200.25
    network-object host 10.200.200.32
    object-group service iPhoneSync-Services-TCP tcp
    port-object eq 993
    port-object eq 990
    port-object eq 998
    port-object eq 5678
    port-object eq 5721
    port-object eq 26675
    object-group service termserv tcp
    description terminal services
    port-object eq 3389
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DTI tcp
    description DCS CONTROL PROTOCOL
    port-object eq 3333
    object-group service H.245 tcp
    description h.245 signaling
    port-object range 1024 4999
    object-group service RAS udp
    port-object eq 1719
    port-object range 1718 1720
    object-group service XML tcp
    port-object range 3336 3341
    object-group service mpi tcp
    port-object eq 2010
    object-group service mvp_control tcp
    port-object eq 2946
    object-group service rpc tcp-udp
    port-object eq 1809
    object-group service tcp8080 tcp
    port-object eq 8080
    object-group service tcp8011 tcp
    port-object eq 8011
    object-group service rtp_rtcp_udp udp
    port-object range 1024 65535
    object-group service ecs_xml tcp-udp
    port-object eq 3271
    object-group service rtp20000 udp
    description 10000-65535
    port-object range 20000 25000
    port-object range 10000 65535
    object-group service tcp5222 tcp
    port-object range 5222 5269
    object-group service tcp7070 tcp
    port-object eq 7070
    object-group network videoco
    network-object host x.x.x.144
    network-object host x.x.x.145
    object-group service video tcp
    port-object range 1718 h323
    object-group service XML2 tcp-udp
    port-object range 3336 3345
    object-group service tcp_tls tcp
    port-object eq 5061
    object-group service Autodesk tcp
    port-object eq 2080
    port-object range 27000 27009
    access-list outside_policy remark ====== Begin Mail From Postini Network ======
    access-list outside_policy extended permit tcp x.x.x.x 255.255.240.0 host x.x.x.x eq smtp
    access-list outside_policy extended permit tcp x.x.x.x 255.255.255.240 host x.x.x.x eq smtp
    access-list outside_policy extended permit tcp x.x.x.0 255.255.240.0 host x.x.x.x eq smtp
    access-list outside_policy remark ****** End Mail From Postini Network ******
    access-list outside_policy remark ====== Begin Inbound Web Mail Access ======
    access-list outside_policy extended permit tcp any host x.x.x.x object-group HTTP_HTTPS
    access-list outside_policy remark ****** End Inbound Web Mail Access ******
    access-list outside_policy remark ====== Begin iPhone Sync Rules to Mail Server ======
    access-list outside_policy extended permit tcp any host x.x.x.x object-group iPhoneSync-Services-TCP
    access-list outside_policy remark ****** End iPhone Sync Rules to Mail Server ******
    access-list outside_policy remark ====== Begin MARS Monitoring ======
    access-list outside_policy extended permit udp x.x.x.x 255.255.255.128 host x.x.x.x object-group SYSLOG_SNMP_NETFLOW
    access-list outside_policy extended permit icmp x.x.x.x 255.255.255.128 host x.x.x.x
    access-list outside_policy remark ****** End MARS Monitoring ******
    access-list outside_policy extended permit tcp object-group NACIO123 host x.x.x.141 eq ssh
    access-list outside_policy extended permit tcp any host x.x.x.x eq www
    access-list outside_policy extended permit tcp any host x.x.x.x eq https
    access-list outside_policy extended permit tcp any host x.x.x.x eq h323
    access-list outside_policy extended permit tcp any host x.x.x.x range 60000 60001
    access-list outside_policy extended permit udp any host x.x.x.x range 60000 60007
    access-list outside_policy remark radvision 5110   port 80 both
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco eq www
    access-list outside_policy remark radvision
    access-list outside_policy extended permit tcp any object-group videoco object-group termserv
    access-list outside_policy remark radvision 5110  port21 out
    access-list outside_policy extended permit tcp any object-group videoco eq ftp
    access-list outside_policy remark rad5110   port22 both
    access-list outside_policy extended permit tcp any object-group videoco eq ssh
    access-list outside_policy remark rad 5110  port161 udp both
    access-list outside_policy extended permit udp any object-group videoco eq snmp
    access-list outside_policy remark rad5110 port443 both
    access-list outside_policy extended permit tcp any object-group videoco eq https
    access-list outside_policy remark rad5110 port 1024-4999  both
    access-list outside_policy extended permit tcp any object-group videoco object-group H.245
    access-list outside_policy remark rad5110 port 1719 udp both
    access-list outside_policy extended permit udp any object-group videoco object-group RAS
    access-list outside_policy remark rad5110 port 1720 both
    access-list outside_policy extended permit tcp any any eq h323
    access-list outside_policy remark RAD 5110 port 3333 tcp both
    access-list outside_policy extended permit tcp any object-group videoco object-group DTI
    access-list outside_policy remark rad5110 port 3336-3341 both
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco object-group XML2
    access-list outside_policy remark port 5060 tcp/udp
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco eq sip
    access-list outside_policy remark rad 5110port 1809 rpc both
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco object-group rpc
    access-list outside_policy remark rad 5110 port 2010 both
    access-list outside_policy extended permit tcp any object-group videoco object-group mpi
    access-list outside_policy remark rad 5110 port 2946 both
    access-list outside_policy extended permit tcp any object-group videoco object-group mvp_control
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp8080
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp8011
    access-list outside_policy remark 1024-65535
    access-list outside_policy extended permit udp any object-group videoco object-group rtp_rtcp_udp
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco object-group ecs_xml
    access-list outside_policy extended permit udp any object-group videoco object-group rtp20000
    access-list outside_policy extended permit tcp any object-group videoco eq telnet
    access-list outside_policy remark port 53 dns
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco eq domain
    access-list outside_policy remark 7070
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp7070
    access-list outside_policy remark 5222-5269 tcp
    access-list outside_policy extended permit tcp any object-group videoco range 5222 5269
    access-list outside_policy extended permit tcp any object-group videoco object-group video
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp_tls
    access-list outside_policy remark ====== Begin Autodesk Activation access ======
    access-list outside_policy extended permit tcp any any object-group Autodesk
    access-list outside_policy remark ****** End Autodesk Activation access ******
    access-list outside_policy extended permit tcp x.x.x.x 255.255.255.248 host x.x.x.x eq smtp
    access-list outside_policy remark ****** End Autodesk Activation access ******
    access-list inside_policy extended deny tcp host 10.200.200.25 10.1.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.3.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.2.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.4.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.5.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny udp object-group NO-LOG any eq 2967 log disable
    access-list inside_policy extended deny tcp object-group NO-LOG any eq 2967 log disable
    access-list inside_policy remark ====== Begin Outbound Mail Server Rules ======
    access-list inside_policy extended permit udp host 10.200.200.222 any eq 5679
    access-list inside_policy extended permit tcp host 10.200.200.222 any eq smtp
    access-list inside_policy remark ****** End Outbound Mail Server Rules ******
    access-list inside_policy extended permit ip object-group local_net_group any
    access-list inside_policy extended permit icmp object-group local_net_group any
    access-list OUTSIDECO_VPN extended permit ip host x.x.x.x object-group OUTSIDECO_SERVERS
    access-list company-split-tunnel standard permit 10.1.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.2.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.3.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.4.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.200.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.5.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.6.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.7.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 172.22.22.0 255.255.255.0
    access-list company-split-tunnel remark Video
    access-list company-split-tunnel standard permit 192.168.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.1.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.2.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.3.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.200.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.4.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.5.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.6.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.7.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 172.22.22.0 255.255.255.0
    access-list SSL_SPLIT remark Video
    access-list SSL_SPLIT standard permit 192.168.0.0 255.255.0.0
    access-list NONAT_SSL extended permit ip object-group local_net_group 172.20.20.0 255.255.255.0
    access-list NONAT_SSL extended permit ip 10.200.0.0 255.255.0.0 192.168.9.0 255.255.255.0
    access-list tom extended permit tcp host x.x.x.x any eq smtp
    access-list tom extended permit tcp host 10.200.200.222 any eq smtp
    access-list tom extended permit tcp any host x.x.x.x
    access-list aaron extended permit tcp any any eq 2967
    access-list capauth extended permit ip host 10.200.200.1 host 10.200.200.220
    access-list capauth extended permit ip host 10.200.200.220 host 10.200.200.1
    access-list DMZ extended permit icmp any any
    access-list dmz_access_in extended permit tcp any eq 51024 any eq 3336
    access-list dmz_access_in extended permit icmp any any
    access-list dmz_access_in extended permit tcp any any eq ftp
    access-list dmz_access_in extended permit tcp any any eq https
    access-list dmz_access_in remark rad5110 port 162 out
    access-list dmz_access_in extended permit udp any any eq snmptrap
    access-list dmz_access_in remark port 23 out
    access-list dmz_access_in extended permit tcp any any eq telnet
    access-list dmz_access_in remark port 53 dns out
    access-list dmz_access_in extended permit object-group TCPUDP any any eq domain
    access-list dmz_access_in extended permit object-group TCPUDP any any eq www
    access-list dmz_access_in extended permit tcp any any eq h323
    access-list dmz_access_in extended permit tcp any any object-group XML
    access-list dmz_access_in extended permit udp any any object-group RAS
    access-list dmz_access_in extended permit tcp any any range 1718 h323
    access-list dmz_access_in extended permit tcp any any object-group H.245
    access-list dmz_access_in extended permit object-group TCPUDP any any eq sip
    access-list dmz_access_in extended permit udp any any object-group rtp_rtcp_udp
    access-list dmz_access_in extended permit object-group TCPUDP any any object-group XML2
    access-list dmz_access_in extended permit ip object-group local_net_group any
    access-list dmz_access_in remark port 5061
    access-list dmz_access_in extended permit tcp any any object-group tcp_tls
    access-list outside_cryptomap extended permit ip 10.200.0.0 255.255.0.0 192.168.9.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffered warnings
    logging trap informational
    logging history informational
    logging asdm warnings
    logging host outside x.x.x.x
    mtu outside 1500
    mtu inside 1500
    mtu dmz 1500
    mtu Wireless 1500
    mtu management 1500
    ip local pool SSL_VPN_POOL 172.20.20.1-172.20.20.75 mask 255.255.255.0
    ip verify reverse-path interface outside
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-631.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT_SSL
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) x.x.x.12 10.200.200.15 netmask 255.255.255.255
    static (inside,outside) x.x.x.15 10.5.0.11 netmask 255.255.255.255
    static (inside,outside) x.x.x.13 10.200.200.240 netmask 255.255.255.255
    static (inside,outside) x.x.x.16 10.200.200.222 netmask 255.255.255.255
    static (inside,outside) x.x.x.14 10.200.200.155 netmask 255.255.255.255
    static (inside,dmz) 10.200.200.0 10.200.200.0 netmask 255.255.255.0
    static (inside,dmz) 10.4.0.0 10.4.0.0 netmask 255.255.0.0
    static (dmz,outside) x.x.x.18 172.22.22.15 netmask 255.255.255.255
    static (dmz,outside) x.x.x.19 172.22.22.16 netmask 255.255.255.255
    static (inside,dmz) 10.3.0.0 10.3.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.2.0.0 10.2.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.1.0.0 10.1.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.6.0.0 10.6.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.7.0.0 10.7.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.5.0.0 10.5.0.0 netmask 255.255.0.0
    access-group outside_policy in interface outside
    access-group inside_policy in interface inside
    access-group dmz_access_in in interface dmz
    route outside 0.0.0.0 0.0.0.0 x.x.x.12 1
    route inside 10.1.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.2.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.3.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.4.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.5.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.6.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.7.0.0 255.255.0.0 10.200.200.150 1
    route inside x.x.x.0 255.255.255.0 10.200.200.2 1
    route inside x.x.x.0 255.255.255.0 10.200.200.2 1
    route inside 192.168.1.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.2.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.3.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.4.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.5.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.6.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.7.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.200.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.201.0 255.255.255.0 10.200.200.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 2:00:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server COMPANY-NT-AUTH protocol nt
    aaa-server COMPANY-NT-AUTH (inside) host 10.200.200.220
    nt-auth-domain-controller DC
    aaa authentication ssh console LOCAL
    aaa authorization command LOCAL
    http server enable
    http 10.200.200.0 255.255.255.0 inside
    http 10.200.0.0 255.255.0.0 inside
    http 10.3.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set AES256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set asa2transform esp-3des esp-sha-hmac
    crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set transform-set 3DES-SHA
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto map OUTSIDE_MAP 5 match address outside_cryptomap
    crypto map OUTSIDE_MAP 5 set pfs
    crypto map OUTSIDE_MAP 5 set peer x.x.x.53
    crypto map OUTSIDE_MAP 5 set transform-set 3DES-SHA
    crypto map OUTSIDE_MAP 5 set security-association lifetime seconds 28800
    crypto map OUTSIDE_MAP 10 match address OUTSIDECO_VPN
    crypto map OUTSIDE_MAP 10 set peer x.x.x.25
    crypto map OUTSIDE_MAP 10 set transform-set AES256-SHA
    crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800
    crypto map OUTSIDE_MAP 10 set security-association lifetime kilobytes 4608000
    crypto map OUTSIDE_MAP 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map OUTSIDE_MAP interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 28800
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 20
    console timeout 0
    dhcpd dns 10.200.200.220 10.200.200.225
    dhcpd wins 10.200.200.220 10.200.200.225
    dhcpd lease 18000
    dhcpd domain company.com
    dhcpd dns 10.200.200.220 10.200.200.225 interface Wireless
    dhcpd wins 10.200.200.220 10.200.200.225 interface Wireless
    dhcpd lease 18000 interface Wireless
    dhcpd domain company.com interface Wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 192.5.41.40 source outside prefer
    ssl trust-point vpn.company.com outside
    webvpn
    enable outside
    anyconnect-essentials
    svc image disk0:/anyconnect-win-2.5.0217-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.5.2017-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy SSL_Client_Policy internal
    group-policy SSL_Client_Policy attributes
    wins-server value 10.200.200.220
    dns-server value 10.200.200.220
    vpn-tunnel-protocol IPSec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SSL_SPLIT
    default-domain value company.com
    webvpn
      sso-server none
      auto-signon allow uri * auth-type all
    group-policy no-split-test internal
    group-policy no-split-test attributes
    banner value Welcome to company and Associates
    banner value Welcome to company and Associates
    dns-server value 10.200.200.220
    vpn-tunnel-protocol IPSec
    ipsec-udp enable
    split-tunnel-policy tunnelall
    default-domain value company.com
    group-policy DfltGrpPolicy attributes
    dns-server value 10.200.200.220
    default-domain value company.com
    group-policy company internal
    group-policy company attributes
    banner value Welcome to company and Associates
    banner value Welcome to company and Associates
    dns-server value 10.200.200.220
    vpn-tunnel-protocol IPSec
    ipsec-udp enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SSL_SPLIT
    default-domain value company.com
    username ciscoadmin password xxxxxxxxxxx encrypted privilege 15
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool SSL_VPN_POOL
    authentication-server-group COMPANY-NT-AUTH
    default-group-policy SSL_Client_Policy
    tunnel-group DefaultWEBVPNGroup webvpn-attributes
    group-alias company_SSL_VPN enable
    tunnel-group company_group type remote-access
    tunnel-group company_group general-attributes
    address-pool SSL_VPN_POOL
    authentication-server-group COMPANY-NT-AUTH LOCAL
    default-group-policy company
    tunnel-group company_group ipsec-attributes
    pre-shared-key *****
    tunnel-group x.x.x.53 type ipsec-l2l
    tunnel-group x.x.x.53 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect tftp
      inspect esmtp
      inspect ftp
      inspect icmp
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect skinny
      inspect sqlnet
      inspect sunrpc
      inspect xdmcp
      inspect mgcp
      inspect h323 h225
      inspect h323 ras
      inspect sip
    service-policy global_policy global
    privilege cmd level 5 mode exec command ping
    privilege cmd level 6 mode exec command write
    privilege show level 5 mode exec command running-config
    privilege show level 5 mode exec command version
    privilege show level 5 mode exec command conn
    privilege show level 5 mode exec command memory
    privilege show level 5 mode exec command cpu
    privilege show level 5 mode exec command xlate
    privilege show level 5 mode exec command traffic
    privilege show level 5 mode exec command interface
    privilege show level 5 mode exec command clock
    privilege show level 5 mode exec command ip
    privilege show level 5 mode exec command failover
    privilege show level 5 mode exec command arp
    privilege show level 5 mode exec command route
    privilege show level 5 mode exec command blocks
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:a0689b4c837c79a51e7a0cfed591dec9
    : end
    COMPANY-asa#

    Hi Sian,
    Yes on their end the PFS is enabled for DH Group 2.
    Here is the information that you requested:
    company-asa# sh crypto isakmp sa
       Active SA: 3
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 3
    1   IKE Peer: x.x.x.87
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    2   IKE Peer: x.x.x.53
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    3   IKE Peer: x.x.x.25
        Type    : user            Role    : initiator
        Rekey   : no              State   : MM_WAIT_MSG4
    company-asa# sh crypto ipsec sa
    interface: outside
        Crypto map tag: OUTSIDE_MAP, seq num: 5, local addr: x.x.x.13
          access-list outside_cryptomap extended permit ip 10.200.0.0 255.255.0.0 192.168.9.0 255.255.255.0
          local ident (addr/mask/prot/port): (10.200.0.0/255.255.0.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.9.0/255.255.255.0/0/0)
          current_peer: x.x.x.53
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 10744, #pkts decrypt: 10744, #pkts verify: 10744
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: x.x.x.13, remote crypto endpt.: x.x.x.53
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: 500EC8BF
          current inbound spi : 8DAE3436
        inbound esp sas:
          spi: 0x8DAE3436 (2377004086)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 32768, crypto-map: OUTSIDE_MAP
             sa timing: remaining key lifetime (kB/sec): (3914946/24388)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0x500EC8BF (1343146175)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 32768, crypto-map: OUTSIDE_MAP
             sa timing: remaining key lifetime (kB/sec): (3915000/24388)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
        Crypto map tag: outside_dyn_map, seq num: 20, local addr: x.x.x.13
          local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
          remote ident (addr/mask/prot/port): (172.20.20.8/255.255.255.255/0/0)
          current_peer: x.x.x.87, username: ewebb
          dynamic allocated peer ip: 172.20.20.8
          #pkts encaps: 16434, #pkts encrypt: 16464, #pkts digest: 16464
          #pkts decaps: 19889, #pkts decrypt: 19889, #pkts verify: 19889
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 16434, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 30, #pre-frag failures: 0, #fragments created: 60
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 60
          #send errors: 0, #recv errors: 0
          local crypto endpt.: x.x.x.13/4500, remote crypto endpt.: x.x.x.87/2252
          path mtu 1500, ipsec overhead 66, media mtu 1500
          current outbound spi: 2D712C9F
          current inbound spi : 0EDB79C8
        inbound esp sas:
          spi: 0x0EDB79C8 (249264584)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, }
             slot: 0, conn_id: 65536, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 18262
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0x2D712C9F (762391711)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, }
             slot: 0, conn_id: 65536, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 18261
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001

  • Cisco ASA 5505 not able to access flash

    Hi All:
    I have searched and searched all over the net for an answer to this question and have decided to just post it. I have a 5505 that was given to me by my job to use for working on my CCNA Sec. cert and did the following:
    I plugged it in and booted it up just fine. Made config changes as I followed along with the examples in my CCNA Security book. Got to the point in chapter 14 where the initial setup happens to configure it for working with ASDM. I never did a write mem on it and decided to take it back to square one by unplugging it to allow it to lose the changes that I made. This is where things got ugly.
    When it booted back up it got stuck in a bootup loop and couldn't find an IOS. After following all kinds of steps to boot to rommon and tftp another IOS and such (several times) I decided to follow another posting that said that the flash could be corrupted and to just delete it and start anew. Did that and through rommon as it would not boot up normally any more. After trying this over and over for the last couple hours I realized that it would boot from tftp so I did that in hopes of fixing the flash issue.
    I've tried deleting it, and re-initializing it and formating it. But the thing is that it no longer SEES the disk0: mount point. I've used two different flash cards...the one that came with it and the one that I already had. With the cover off I can see that there is no activity light next to the flash drive when I issue a delete or initialize or format command.
    Here is a copy of some of the output file. Any help or suggestions are greatly appreciated.
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Please set ADDRESS Variable.
    Please set SERVER Variable.
    Please set IMAGE Variable.
    Launching BootLoader...
    Default configuration file contains 1 entry.
    Boot mode is 1. Default entry is 1.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    Failsafe booting engaged.
    Default configuration file contains 1 entry.
    Searching / for images to boot.
    No images in /
    Error 15: File not found
    unable to boot an image
    CISCO SYSTEMS
    Embedded BIOS Version 1.0(12)11 04/30/08 15:45:41.19
    Low Memory: 632 KB
    High Memory: 507 MB
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
    00  01  00   1022   2080  Host Bridge       
    00  01  02   1022   2082  Chipset En/Decrypt 11
    00  0C  00   1148   4320  Ethernet           11
    00  0D  00   177D   0003  Network En/Decrypt 10
    00  0F  00   1022   2090  ISA Bridge        
    00  0F  02   1022   2092  IDE Controller    
    00  0F  03   1022   2093  Audio              10
    00  0F  04   1022   2094  Serial Bus         9
    00  0F  05   1022   2095  Serial Bus         9
    Evaluating BIOS Options ...
    Launch BIOS Extension to setup ROMMON
    Cisco Systems ROMMON Version (1.0(12)11) #4: Thu May  1 14:50:05 PDT 2008
    Platform ASA5505
    Use BREAK or ESC to interrupt boot.
    Use SPACE to begin boot immediately.
    Boot interrupted.                              
    Ethernet0/0
    MAC Address: 0023.339e.2a91
    Link is UP
    Use ? for help.
    rommon #0> format disk0:
    Invalid or incorrect command.  Use 'help' for help.
    rommon #0> ADDRESS=10.10.10.110
    rommon #1> GATEWAY=10.10.10.1
    rommon #2> SERVER=10.10.10.98
    rommon #3> IMAGE=asa914-k8.bin
    rommon #4> tftp
    ROMMON Variable Settings:
      ADDRESS=10.10.10.110
      SERVER=10.10.10.98
      GATEWAY=10.10.10.1
      PORT=Ethernet0/0
      VLAN=untagged
      IMAGE=asa914-k8.bin
      CONFIG=
      LINKTIMEOUT=20
      PKTTIMEOUT=4
      RETRY=20
    tftp [email protected] via 10.10.10.1
    Received 27076608 bytes
    Launching TFTP Image...
    Cisco Security Appliance admin loader (3.0) #0: Thu Dec  5 19:38:43 PST 2013
    Platform ASA5505
    Loading...
    IO memory blocks requested from bigphys 32bit: 9956
    Àdosfsck 2.11, 12 Mar 2005, FAT32, LFN
    Currently, only 1 or 2 FATs are supported, not 42.
    dosfsck(/dev/hda1) returned 1
    mount: mounting /dev/hda1 on /mnt/disk0 failed: Invalid argument
    mount: mounting /dev/hda1 on /mnt/disk0 failed: Invalid argument
    Processor memory 343932928, Reserved memory: 62914560
    Total SSMs found: 0
    Total NICs found: 10
    88E6095 rev 2 Gigabit Ethernet @ index 09 MAC: 0000.0003.0002
    88E6095 rev 2 Ethernet @ index 08 MAC: 0023.339e.2a90
    88E6095 rev 2 Ethernet @ index 07 MAC: 0023.339e.2a8f
    88E6095 rev 2 Ethernet @ index 06 MAC: 0023.339e.2a8e
    88E6095 rev 2 Ethernet @ index 05 MAC: 0023.339e.2a8d
    88E6095 rev 2 Ethernet @ index 04 MAC: 0023.339e.2a8c
    88E6095 rev 2 Ethernet @ index 03 MAC: 0023.339e.2a8b
    88E6095 rev 2 Ethernet @ index 02 MAC: 0023.339e.2a8a
    88E6095 rev 2 Ethernet @ index 01 MAC: 0023.339e.2a89
    y88acs06 rev16 Gigabit Ethernet @ index 00 MAC: 0023.339e.2a91
    INFO: Unable to read firewall mode from flash
           Writing default firewall mode (single) to flash
    INFO: Unable to read cluster interface-mode from flash
           Writing default mode "None" to flash
    Verify the activation-key, it might take a while...
    Failed to retrieve permanent activation key.
    Running Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
    The Running Activation Key is not valid, using default settings:
    Licensed features for this platform:
    Maximum Physical Interfaces       : 8              perpetual
    VLANs                             : 3              DMZ Restricted
    Dual ISPs                         : Disabled       perpetual
    VLAN Trunk Ports                  : 0              perpetual
    Inside Hosts                      : 10             perpetual
    Failover                          : Disabled       perpetual
    Encryption-DES                    : Enabled        perpetual
    Encryption-3DES-AES               : Disabled       perpetual
    AnyConnect Premium Peers          : 2              perpetual
    AnyConnect Essentials             : Disabled       perpetual
    Other VPN Peers                   : 10             perpetual
    Total VPN Peers                   : 12             perpetual
    Shared License                    : Disabled       perpetual
    AnyConnect for Mobile             : Disabled       perpetual
    AnyConnect for Cisco VPN Phone    : Disabled       perpetual
    Advanced Endpoint Assessment      : Disabled       perpetual
    UC Phone Proxy Sessions           : 2              perpetual
    Total UC Proxy Sessions           : 2              perpetual
    Botnet Traffic Filter             : Disabled       perpetual
    Intercompany Media Engine         : Disabled       perpetual
    Cluster                           : Disabled       perpetual
    This platform has a Base license.
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode        : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2_05
                                 IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.09
    Cisco Adaptive Security Appliance Software Version 9.1(4)
      ****************************** Warning *******************************
      This product contains cryptographic features and is
      subject to United States and local country laws
      governing, import, export, transfer, and use.
      Delivery of Cisco cryptographic products does not
      imply third-party authority to import, export,
      distribute, or use encryption. Importers, exporters,
      distributors and users are responsible for compliance
      with U.S. and local country laws. By using this
      product you agree to comply with applicable laws and
      regulations. If you are unable to comply with U.S.
      and local laws, return the enclosed items immediately.
      A summary of U.S. laws governing Cisco cryptographic
      products may be found at:
      http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
      If you require further assistance please contact us by
      sending email to [email protected].
      ******************************* Warning *******************************
    This product includes software developed by the OpenSSL Project
    for use in the OpenSSL Toolkit (http://www.openssl.org/)
    Copyright (C) 1995-1998 Eric Young ([email protected])
    All rights reserved.
    Copyright (c) 1998-2011 The OpenSSL Project.
    All rights reserved.
    This product includes software developed at the University of
    California, Irvine for use in the DAV Explorer project
    (http://www.ics.uci.edu/~webdav/)
    Copyright (c) 1999-2005 Regents of the University of California.
    All rights reserved.
    Busybox, version 1.16.1, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    Busybox comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    DOSFSTOOLS, version 2.11, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111-1307
    675 Mass Ave, Cambridge, MA 02139
    DOSFSTOOLS comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    grub, version 0.94, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111-1307
    grub comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    libgcc, version 4.3, Copyright (C) 2007 Free Software Foundation, Inc.
    libgcc comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenseSee User Manual (''Licensing'') for details.
    libstdc++, version 4.3, Copyright (C) 2007 Free Software Foundation, Inc.
    libstdc++ comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    Linux kernel, version 2.6.29.6, Copyright (C) 1989, 1991 Free Software
    Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    Linux kernel comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    module-init-tools, version 3.10, Copyright (C) 1989, 1991 Free Software
    Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
    module-init-tools comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    numactl, version 2.0.3, Copyright (C) 2008 SGI.
    Author: Andi Kleen, SUSE Labs
    Version 2.0.0 by Cliff Wickman, Chritopher Lameter and Lee Schermerhorn
    numactl comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    pciutils, version 3.1.4, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    pciutils comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    readline, version 5.2, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    59 Temple Place, Suite 330, Boston, MA 02111 USA
    readline comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    udev, version 146, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
    udev comes with ABSOLUTELY NO WARRANTY.
    This is free software, and you are welcome to redistribute it under the General
    Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
    See User Manual (''Licensing'') for details.
    Cisco Adapative Security Appliance Software, version 9.1,
    Copyright (c) 1996-2013 by Cisco Systems, Inc.
    Certain components of Cisco ASA Software, Version 9.1 are licensed under the GNU
    Lesser Public License (LGPL) Version 2.1.  The software code licensed under LGPL
    Version 2.1 is free software that comes with ABSOLUTELY NO WARRANTY.  You can
    redistribute and/or modify such LGPL code under the terms of LGPL Version 2.1
    (http://www.gnu.org/licenses/lgpl-2.1.html).  See User Manual for licensing
    details.
                    Restricted Rights Legend
    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software - Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
                    Cisco Systems, Inc.
                    170 West Tasman Drive
                    San Jose, California 95134-1706
    Insufficient flash space available for this request:
      Size info: request:32 free:0  delta:32
    Could not initialize system files in flash.
    config_fetcher: channel open failed
    ERROR: MIGRATION - Could not get the startup configuration.
    INFO: Power-On Self-Test in process.
    INFO: Power-On Self-Test complete.
    INFO: MIGRATION - Saving the startup errors to file 'flash:upgrade_startup_errors_200804300128.log'
    Pre-configure Firewall now through interactive prompts [yes]? n
    Type help or '?' for a list of available commands.
    ciscoasa> en
    Password:
    ciscoasa# format disk0:
    Format operation may take a while. Continue? [confirm]
    Format operation will destroy all data in "disk0:".  Continue? [confirm]
    Initializing partition - done!
    Creating FAT16 filesystem
    mkdosfs 2.11 (12 Mar 2005)
    System tables written to disk
    Format of disk0 complete
    ciscoasa# format disk:
                     ^
    ERROR: % Invalid input detected at '^' marker.
    ciscoasa# format flash:
    Format operation may take a while. Continue? [confirm]
    Format operation will destroy all data in "flash:".  Continue? [confirm]
    Initializing partition - done!

    Yeah...I think I found that one out the hard way already. I'll cross that bridge when I get to it. I want to get this issue fixed before I start thinking about the license issue.
    ciscoasa#
    ciscoasa#
    ciscoasa#
    ciscoasa# sh flash
    --#--  --length--  -----date/time------  path
    2403  0           Apr 30 2008 02:00:56  test
    2285  196         Apr 30 2008 01:28:20  upgrade_startup_errors_200804300128.log
    2283  0           Apr 30 2008 01:28:20  coredumpinfo
    2284  59          Apr 30 2008 01:28:20  coredumpinfo/coredump.cfg
    2280  0           Apr 30 2008 01:27:56  crypto_archive
    2267  0           Apr 30 2008 01:27:38  log
    0 bytes total (0 bytes free)
    ciscoasa#
    ciscoasa#
    ciscoasa#
    ciscoasa# sh disk0
    --#--  --length--  -----date/time------  path
    2403  0           Apr 30 2008 02:00:56  test
    2285  196         Apr 30 2008 01:28:20  upgrade_startup_errors_200804300128.log
    2283  0           Apr 30 2008 01:28:20  coredumpinfo
    2284  59          Apr 30 2008 01:28:20  coredumpinfo/coredump.cfg
    2280  0           Apr 30 2008 01:27:56  crypto_archive
    2267  0           Apr 30 2008 01:27:38  log
    0 bytes total (0 bytes free)
    ciscoasa#

  • Crypto isakmp key invalid input. not able to add pre-share key to cisco asa

    Hello!
    I am setting up a site to site VPN using 2 cisco asa the remote site is configured with a dynamic IP and the main office with a static IP.
    after the initial ISAKMP setup: on remote asa
    crypto isakmp policy 1
     encr 3des
     hash md5
     authentication pre-share
     group 2
     lifetime 86400
    I am running the following command to add the pre-share key:
    crypto isakmp key xxxxxxxxx address 0.0.0.0 0.0.0.0
    but I am getting an error:
    invalid input under "key"
    any idea?
    thanks

    Duplicate post. 
    Go HERE.

  • Not able to connecct SSH

    Hi
    I configured Cisco ASA5510 firewall, but i am facing the problem with ssh login, i gave ssh for inside and outside access, but i am getting "server ... error" i enabled LOCAL  for the authentication for ssh and HTTP. and i am able to acees the device through HTTP using ASDM, but not able to access from outside.
    please find the configuration
    thanks in advance
    regards
    Javahar
    ASA Version 8.2(1)
    hostname ASA5510
    domain-name default.domain.invalid
    enable password Nbxmt7LFbcxtLo.o encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.251.38.0 SAP_remote
    interface Ethernet0/0
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Ethernet0/1
    nameif outside
    security-level 0
    ip address xxx.xxx.xxx.xxx 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 SAP_remote 255.255.255.128
    access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 SAP_remote 255.255.255.128
    access-list outside_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 SAP_remote 255.255.255.128
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm image disk0:/asdm-621.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 115.115.169.241 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_cryptomap_1
    crypto map outside_map 1 set peer XXX.XXX.XXX.20
    crypto map outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 2 match address outside_cryptomap
    crypto map outside_map 2 set pfs group5
    crypto map outside_map 2 set peer XXX.XXX.XXX.20
    crypto map outside_map 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map interface outside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 5
    lifetime 28800
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outsde
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outsde
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    username test1234 password /FzQ9W6s1KjC0YQ7 encrypted
    username cisco1234 password 5sSb..e9ZNWMmk2e encrypted privilege 15
    tunnel-group Remote-p2p-vpn type ipsec-l2l
    tunnel-group Remote-p2p-vpn ipsec-attributes
    pre-shared-key *
    tunnel-group XXX.XXX.XXXX.20 type ipsec-l2l
    tunnel-group XXX.XXX.XXXX.20 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    message-length maximum client auto
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:83eab0b7ae2d2d9e74f8ea0b005076ea
    : end

    Hi,
    Did you issue the command
    ASA(config)# crypto key generate rsa modulus 2048
    So that you can use SSH.
    EDIT: I would suggest narrowing down the source address from where you can connect to the ASA from "outside" if possible.
    - Jouni

  • ASA 5510 Not able to route traffic between 2 LAN interfaces

    Hi everybody,
    I need help to enable traffic between two physical ports on my Cisco ASA 5510. I created access rules and NAT but traffic doe not go from accounting interface to Inside. I am able to access internet from both interfaces. Can someone pin point me in the right direction since I am not an expert in Cisco but has to finish this by the end of the week.
    Thank you,
    Sigor
    Here is my configuration:
    ASA Version 8.2(2)
    hostname Cisco
    domain-name xxx.com
    names
    interface Ethernet0/0
     description Outside
     nameif Outside
     security-level 0
     ip address 101.101.101.101 255.255.240.0
    interface Ethernet0/1
     description Inside Network
     nameif Inside
     security-level 90
     ip address 192.168.10.1 255.255.255.0
    interface Ethernet0/2
     description Accounting
     nameif Accounting
     security-level 100
     ip address 20.0.1.1 255.255.255.0
    interface Ethernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0
     management-only
    ftp mode passive
    clock timezone EST -5
    dns domain-lookup Outside
    dns server-group DefaultDNS
     name-server 8.8.8.8
     domain-name xxx.com
    same-security-traffic permit inter-interface
    object-group service Port-10000 tcp
     port-object eq 10000
    object-group service Port-8080 tcp
     port-object eq 8080
    object-group service Port-8011 tcp
     port-object eq 8011
    object-group service DM_INLINE_TCP_1 tcp
     group-object Port-8080
     port-object eq www
     group-object Port-8011
    object-group service DM_INLINE_TCP_2 tcp
     group-object Port-10000
     port-object eq https
     port-object eq www
    object-group service rdp tcp
     port-object eq 3389
    object-group service DM_INLINE_TCP_3 tcp
     group-object rdp
     port-object eq ftp
    object-group service DM_INLINE_TCP_4 tcp
     group-object Port-10000
     port-object eq www
     port-object eq https
     port-object eq ssh
    object-group service DM_INLINE_TCP_5 tcp
     group-object Port-8011
     group-object Port-8080
     port-object eq www
    object-group service DM_INLINE_TCP_6 tcp
     group-object Port-10000
     port-object eq www
     port-object eq https
    object-group service DM_INLINE_TCP_7 tcp
     group-object rdp
     port-object eq ftp
    access-list Outside_access_in extended permit tcp any host 101.101.101.104 object-group DM_INLINE_TCP_5
    access-list Outside_access_in extended permit tcp any host 101.101.101.102 object-group DM_INLINE_TCP_6
    access-list Outside_access_in extended permit tcp any host 101.101.101.103 object-group DM_INLINE_TCP_7
    access-list Outside_access_in extended permit tcp any host 101.101.101.106 eq smtp                                                              
    access-list Outside_1_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.50.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.50.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.80.0 255.255.255.0
    access-list CiscoIPsec_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0                                                                
    access-list Accounting extended permit ip 20.0.1.0 255.255.255.0 192.168.10.0 255.255.255.0
    access-list Accounting extended permit ip 20.0.1.0 255.255.255.0 any
    pager lines 24
    logging asdm informational
    mtu Outside 1500
    mtu Inside 1500
    mtu Accounting 1500
    mtu management 1500
    ip local pool IPSecDHCP 192.168.80.100-192.168.80.200 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (Outside) 1 interface
    nat (Inside) 0 access-list Inside_nat0_outbound
    nat (Inside) 1 0.0.0.0 0.0.0.0
    nat (Accounting) 1 0.0.0.0 0.0.0.0
    static (Inside,Outside) tcp 101.101.101.104 www 192.168.10.14 www netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.104 8011 192.168.10.14 8011 netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.104 8080 192.168.10.14 8080 netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.102 10000 192.168.10.3 10000 netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.102 https 192.168.10.3 https netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.102 www 192.168.10.3 www netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.103 ftp 192.168.10.17 ftp netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.103 3389 192.168.10.32 3389 netmask 255.255.255.255
    static (Inside,Outside) tcp 101.101.101.106 smtp 192.168.10.23 smtp netmask 255.255.255.255
    static (Inside,Accounting) 192.168.10.0 192.168.10.0 netmask 255.255.255.0
    access-group Outside_access_in in interface Outside
    access-group Accounting in interface Accounting
    route Outside 0.0.0.0 0.0.0.0 101.101.101.101 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.10.0 255.255.255.0 Inside
    http 20.0.1.0 255.255.255.0 Accounting
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 32608000
    crypto ipsec security-association replay disable
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256
    -SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set pfs group1
    crypto map Outside_map 1 set peer 89.216.17.35
    crypto map Outside_map 1 set transform-set ESP-3DES-SHA
    crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Outside_map interface Outside
    crypto isakmp enable Outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh 192.168.10.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    dhcpd address 20.0.1.100-20.0.1.200 Accounting
    dhcpd dns 192.168.10.19 8.8.8.8 interface Accounting
    dhcpd lease 306800 interface Accounting
    dhcpd domain abtscs.com interface Accounting
    dhcpd enable Accounting
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy CiscoIPsec internal
    group-policy CiscoIPsec attributes
     dns-server value 192.168.10.30 192.168.10.19
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value CiscoIPsec_splitTunnelAcl
     default-domain value xxx.com
     vpn-group-policy CiscoIPsec
    tunnel-group 198.226.20.35 type ipsec-l2l
    tunnel-group 198.226.20.35 ipsec-attributes
     pre-shared-key *****
    tunnel-group CiscoIPsec type remote-access
    tunnel-group CiscoIPsec general-attributes
     address-pool IPSecDHCP
     default-group-policy CiscoIPsec
    tunnel-group CiscoIPsec ipsec-attributes
     pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:2a7c97a7a22397908ef83ca6f0065919
    : end

    Without diving too deep into your config, I noticed a couple of things:
    interface Ethernet0/1
     description Inside Network
     nameif Inside
     security-level 90
     ip address 192.168.10.1 255.255.255.0
    interface Ethernet0/2
     description Accounting
     nameif Accounting
     security-level 100
     ip address 20.0.1.1 255.255.255.0
    On an ASA, higher security level interfaces are always allowed, by default, to lower security levels, but not the other way around. So, if you want to keep this config, you would need an acl on the Inside interface to allow traffic to go from level 90 to 100:
    access-list Inside permit ip any any
    access-group Inside in interface Inside
    The acl will permit the traffic into either interface (outside or Accounting). As long as you have your other rules set up correctly, this should resolve your issue...
    HTH,
    John

  • Not able to login after configuring SSH.Please reply

    i have configured AAA on Cisco aeronet 1400 series wireless bridge (AIR-BR1410A-A-K9).After configuring i am not able to login to the device via telnet and via putty.Soon after enabling SSH i am not able to login even through SSH.The below are the commands i have configured on the device.I used to configure the same commands on my Cisco Switches also.
    Layer -2
    ip domain-name NETS
    crypto key generate rsa general-keys modulus 1024
    ip ssh version 2
    aaa new-model
    aaa authentication login Login-LAN group tacacs+ line
    aaa authentication enable default group tacacs+ enable
    aaa accounting exec EXEC-LAN-L2 start-stop group tacacs+
    aaa accounting commands 1 Level-1-LAN-L2 start-stop group tacacs+
    aaa accounting commands 15 Level-15-LAN-L2 start-stop group tacacs+
    tacacs-server host 10.254.0.140 key !n01#zh3r3@|2
    line vty 0 4
    accounting commands 1 Level-1-LAN-L2
    accounting commands 15 Level-15-LAN-L2
    accounting exec EXEC-LAN-L2
    login authentication Login-LAN
    transport input ssh

    Hi,
    Check out the connectivity between cisco aeronet and TACAS server and what is the failed logs says in tacas server.
    If possible try to change the configuration to aaa authentication login Login-LAN(default) group tacacs+ line and then try what exactly happens.
    Hope that helps
    Regards
    Ganesh.H

  • Cisco ASA & Router Site to Site VPN up but not passing traffic

    Dear all,
    Please help me the attached document vpn issue, site-to-site vpn is up but I am not able to passing traffic.
    Advance Thanks
    ahossain

    ASA#
    ASA Version 8.2(1)
    hostname Active
    domain-name test.com
    interface Ethernet0/0
    description LAN/STATE Failover Interface
    interface Ethernet0/1
    speed 100
    nameif outside
    security-level 0
    ip address 212.71.53.38 255.255.255.224 standby 212.71.53.37
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.50.1 255.255.255.0 standby 192.168.50.4
    interface Ethernet0/3
    description INSIDE
    speed 100
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa821-k8.bin
    boot config disk0:/running-config
    ftp mode passive
    dns server-group DefaultDNS
    domain-name test.com
    access-list deny-flow-max 1
    access-list alert-interval 2
    access-list allow extended permit ip any any
    access-list VPN extended permit ip any any
    access-list OUTSIDE extended permit ip any any
    access-list al-outside extended permit ip any host 212.107.106.129
    access-list al-outside extended permit ip any any
    access-list encrypt_acl extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit ip any any
    access-list DMZ_access_out extended permit ip any any
    access-list inside_access_in extended permit ip any any
    access-list DMZ_access_in extended permit ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list no-nat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu DMZ 1500
    mtu inside 1500
    failover
    failover lan unit primary
    failover lan interface failover Ethernet0/0
    failover key *****
    failover link failover Ethernet0/0
    failover interface ip failover 10.10.10.1 255.255.255.252 standby 10.10.10.2
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any DMZ
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 212.71.53.36 1
    route outside 10.2.2.0 255.255.255.0 212.71.53.36 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    service resetoutside
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mal 10 set peer 212.107.106.129
    crypto map IPSec_map 10 match address encrypt_acl
    crypto map IPSec_map 10 set peer 212.107.106.129
    crypto map IPSec_map 10 set transform-set mal
    crypto map IPSec_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 outside
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXXX address 212.71.53.38
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto map mal 10 ipsec-isakmp
    set peer 212.71.53.38
    set transform-set mal
    match address 120
    interface Loopback0
    ip address 10.3.3.1 255.255.255.0
    ip virtual-reassembly in
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 172.20.34.54 255.255.255.252
    ip nat outside
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/1
    ip address 212.107.106.129 255.255.255.248
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/2
    description *!* LAN *!*
    ip address 10.2.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip nat pool OUTPOOL 212.107.106.132 212.107.106.132 netmask 255.255.255.248
    ip nat inside source route-map nonat pool OUTPOOL overload
    ip route 0.0.0.0 0.0.0.0 172.20.34.53
    ip route 10.1.1.0 255.255.255.0 212.107.106.130
    ip route 192.168.50.0 255.255.255.0 212.71.53.38
    ip access-list extended outside
    remark CCP_ACL Category=1
    permit ip any any log
    ip access-list extended outside1
    remark CCP_ACL Category=1
    permit ip any any log
    access-list 110 permit tcp 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 130 permit ip 10.2.2.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 130
    control-plane
    ASA Version 8.2(1)
    hostname Active
    domain-name test.com
    interface Ethernet0/0
    description LAN/STATE Failover Interface
    interface Ethernet0/1
    speed 100
    nameif outside
    security-level 0
    ip address 212.71.53.38 255.255.255.224 standby 212.71.53.37
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.50.1 255.255.255.0 standby 192.168.50.4
    interface Ethernet0/3
    description INSIDE
    speed 100
    nameif inside
    security-level 100
    ip address 10.1.1.1 255.255.255.0 standby 10.1.1.2
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa821-k8.bin
    boot config disk0:/running-config
    ftp mode passive
    dns server-group DefaultDNS
    domain-name test.com
    access-list deny-flow-max 1
    access-list alert-interval 2
    access-list allow extended permit ip any any
    access-list VPN extended permit ip any any
    access-list OUTSIDE extended permit ip any any
    access-list al-outside extended permit ip any host 212.107.106.129
    access-list al-outside extended permit ip any any
    access-list encrypt_acl extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list outside_access_in extended permit ip any any
    access-list inside_access_out extended permit ip any any
    access-list DMZ_access_out extended permit ip any any
    access-list inside_access_in extended permit ip any any
    access-list DMZ_access_in extended permit ip any any
    access-list outside_access_in_1 extended permit ip any any
    access-list no-nat extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
    pager lines 24
    mtu outside 1500
    mtu DMZ 1500
    mtu inside 1500
    failover
    failover lan unit primary
    failover lan interface failover Ethernet0/0
    failover key *****
    failover link failover Ethernet0/0
    failover interface ip failover 10.10.10.1 255.255.255.252 standby 10.10.10.2
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any DMZ
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 212.71.53.36 1
    route outside 10.2.2.0 255.255.255.0 212.71.53.36 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    service resetoutside
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map mal 10 set peer 212.107.106.129
    crypto map IPSec_map 10 match address encrypt_acl
    crypto map IPSec_map 10 set peer 212.107.106.129
    crypto map IPSec_map 10 set transform-set mal
    crypto map IPSec_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 outside
    ==================================================================
    Remote-Router#
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXXX address 212.71.53.38
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec transform-set mal esp-3des esp-md5-hmac
    crypto map mal 10 ipsec-isakmp
    set peer 212.71.53.38
    set transform-set mal
    match address 120
    interface Loopback0
    ip address 10.3.3.1 255.255.255.0
    ip virtual-reassembly in
    interface Embedded-Service-Engine0/0
    no ip address
    shutdown
    interface GigabitEthernet0/0
    ip address 172.20.34.54 255.255.255.252
    ip nat outside
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/1
    ip address 212.107.106.129 255.255.255.248
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache
    duplex auto
    speed auto
    crypto map mal
    interface GigabitEthernet0/2
    description *!* LAN *!*
    ip address 10.2.2.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    duplex auto
    speed auto
    ip forward-protocol nd
    ip http server
    ip http secure-server
    ip nat pool OUTPOOL 212.107.106.132 212.107.106.132 netmask 255.255.255.248
    ip nat inside source route-map nonat pool OUTPOOL overload
    ip route 0.0.0.0 0.0.0.0 172.20.34.53
    ip route 10.1.1.0 255.255.255.0 212.107.106.130
    ip route 192.168.50.0 255.255.255.0 212.71.53.38
    ip access-list extended outside
    remark CCP_ACL Category=1
    permit ip any any log
    ip access-list extended outside1
    remark CCP_ACL Category=1
    permit ip any any log
    access-list 110 permit tcp 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 120 permit ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 10.1.1.0 0.0.0.255
    access-list 130 deny   ip 10.2.2.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 130 permit ip 10.2.2.0 0.0.0.255 any
    route-map nonat permit 10
    match ip address 130
    control-plane

Maybe you are looking for

  • How to refresh the list of SCs?

    Hello All, Here's what I have done so far. -Installed NWDI. -Ran the configuration wizard which created MYCOMPONENT, MYPRODUCT and SANDBOX track. -When I go to SLD, I see that MYCOMPONENT has 3 "BuildTime" "Dependencies" 1) DI BUILD TOOL 7.0 2) SAP J

  • Keyboard Update Clarification

    OK, so a number of folks seem to have an issue with their keyboard going dead for a time and then coming back to life as if it never happened (including me). Does this update do something that is not addressed by Software Update? http://www.apple.com

  • Vendor consignment pick up value when doing stock count

    Hi experts! I'm seeking your kindness to help me solve a problem.My client has done a stock count of vendor consignment stock.But why the system pick up the value of the stock when they do adjustment to the system which this item should not have any

  • Can I reinstall software without losing iTunes library?

    No probs with my 20 GB color iPod until I updated new software. There's a moral there somewhere...anyhow, after a brief problem where the PC wouldn't recognise the iPod and the iPod software couldn't be updated, the iPod today spontaneously froze cou

  • SharePoint 2013 Default Groups removal

    Hi Everyone I would like to know if any harm in breaking inheritance and removing SharePoint 2013 default groups. Groups like 1) Approvers 2) Designers 3) Translation Managers 4) Restricted Readers Any help will be greatly appreciated. Regards Prasha