Asa 5505 Ipsec/ipad configuration

Hey Got some issues when setting up IPSEC/VPN on the asa 5505. I want to connect from the ipad with the built in IPSec client..
Get these errors when i run the debug crypto isakmp
Jan 28 22:03:26 [IKEv1]: Group = VPN_ipad, Username = Haq, IP = x.x.x.x, Tunnel Rejected: Conflicting protocols specified by tunnel-group and group-policy
Jan 28 22:03:26 [IKEv1]: Group = VPN_ipad, Username = Haq, IP = x.x.x.x, QM FSM error (P2 struct &0xd5d5f3d8, mess id 0x295bc3a)!
Jan 28 22:03:26 [IKEv1]: Group = VPN_ipad, Username = Haq, IP = x.x.x.x, Removing peer from correlator table failed, no match!
There is a bunch of vpn site-to-site and ipsec vpn profiles setup and those works fine..?
Here is the running config sh run crypto:
crypto ipsec transform-set DES esp-des esp-md5-hmac
crypto ipsec transform-set 3DES-TRANS esp-3des esp-sha-hmac
crypto ipsec transform-set 3DES-TRANS mode transport
crypto ipsec transform-set AES esp-aes esp-sha-hmac
crypto ipsec transform-set 3des esp-3des esp-md5-hmac
crypto ipsec transform-set IPAD-IPSEC esp-3des esp-sha-hmac
crypto ipsec transform-set IPAD-IPSEC mode transport
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map Plandent 10 set transform-set ESP-AES-128-SHA ESP-AES-256-SHA ESP-AES-128-MD5 ESP-AES-256-MD5 DES 3des 3DES-TRANS
crypto dynamic-map Plandent 10 set security-association lifetime seconds 84600
crypto dynamic-map Plandent 10 set security-association lifetime kilobytes 300000
crypto dynamic-map IPAD-MAP 5 set transform-set IPAD-IPSEC
crypto dynamic-map IPAD-MAP 5 set security-association lifetime seconds 28800
crypto dynamic-map IPAD-MAP 5 set security-association lifetime kilobytes 4608000
crypto map PD_VPN 10 match address ToGoteborg
crypto map PD_VPN 10 set peer PixGoteborg
crypto map PD_VPN 10 set transform-set DES
crypto map PD_VPN 10 set security-association lifetime seconds 84600
crypto map PD_VPN 10 set security-association lifetime kilobytes 4608000
crypto map PD_VPN 20 match address ToMalmo
crypto map PD_VPN 20 set peer PixMalmo
crypto map PD_VPN 20 set transform-set DES
crypto map PD_VPN 20 set security-association lifetime seconds 84600
crypto map PD_VPN 20 set security-association lifetime kilobytes 4608000
crypto map PD_VPN 30 match address ToPlanmeca
crypto map PD_VPN 30 set peer ASA_HKI ASA_HKI_BACKUP
crypto map PD_VPN 30 set transform-set AES
crypto map PD_VPN 30 set security-association lifetime seconds 86400
crypto map PD_VPN 30 set security-association lifetime kilobytes 4608000
crypto map PD_VPN 100 ipsec-isakmp dynamic Plandent
crypto map PD_VPN interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 28800
crypto isakmp policy 30
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
Anyone have any tips and tricks on what can be wrong here, will really be appreciated
Thanks
Shane

Well i created a new tunnel-group and a new group policy its still give me this error? that the tunnel is rejected:
Conflicting protocols specified by tunnel-group and group-policy
But as you can see the ipsec is allowed?
tunnel-group PLANDENT_IPAD type remote-access
tunnel-group PLANDENT_IPAD general-attributes
address-pool IPAD_VPN
default-group-policy PLANDENT_IPAD_Policy
tunnel-group PLANDENT_IPAD ipsec-attributes
pre-shared-key *
group-policy PLANDENT_IPAD_Policy internal
group-policy PLANDENT_IPAD_Policy attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_ipad_splitTunnelAcl
/Shane

Similar Messages

  • Cisco ASA 5505 Ipsec VPN and random connection dropping issues.

    Hello,
    We are currently having issues with a ASA 5505 Ipsec VPN. It was configured about 7-8 months ago and has been running very well..up until the last few weeks.  For some reason, the VPN tends to randomly disconnect any user clients connected a lot.  Furthermore, sometimes it actually connects; however does not put us on the local network for some reason and unable to browse file server.  We have tried rebooting the ASA a few times and our ISP Time Warner informed us there are no signs of packet loss but still unable to pinpoint the problem.  Sometimes users close out of VPN client completely, reopen several times and then it works.  However it's never really consistent enough and hasn't been the last few weeks.  No configuration changes have been made to ASA at all.  Furthermore, the Cisco Ipsec VPN client version is: 5.0.70
    Directly below is our current running config (modded for public).  Any help or ideas would be greatly appreciated.  Otherwise, if everything looks good...then I will defer back to our ISP Time Warner:
    : Saved
    ASA Version 8.4(2)
    hostname domainasa
    domain-name adomain.local
    enable password cTfsR84pqF5Xohw. encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 205.101.1.240 255.255.255.248
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 192.168.2.60
    domain-name adomain.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network SBS_2011
    host 192.168.2.60
    object network NETWORK_OBJ_192.168.2.0_24
    subnet 192.168.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.5.192_
    27
    subnet 192.168.5.192 255.255.255.224
    object network Https_Access
    host 192.168.2.90
    description Spam Hero
    object-group network DM_INLINE_NETWORK_1
    network-object object SPAM1
    network-object object SPAM2
    network-object object SPAM3
    network-object object SPAM4
    network-object object SPAM5
    network-object object SPAM6
    network-object object SPAM7
    network-object object SPAM8
    object-group service RDP tcp
    description Microsoft RDP
    port-object eq 3389
    access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_1 object SBS_2011 eq smtp
    access-list outside_access_in extended permit tcp any object SBS_2011 eq https
    access-list outside_access_in extended permit icmp any interface outside
    access-list outside_access_in remark External RDP Access
    access-list outside_access_in extended permit tcp any object SBS_2011 object-group RDP
    access-list domain_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool test 192.168.10.1-192.168.10.5 mask 255.255.255.0
    ip local pool VPN_Users 192.168.5.194-192.168.5.22
    0 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24
    NETWORK_OBJ_192.168.2.0_24
    destination static NETWORK_OBJ_192.168.5.192_
    27 NETWORK_OBJ_192.168.5.192_
    27 no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    object network SBS_2011
    nat (inside,outside) static interface service tcp smtp smtp
    object network Https_Access
    nat (inside,outside) static interface service tcp https https
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 205.101.1.239 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-reco
    rd DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.2.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.160-192.168.2.19
    9 inside
    dhcpd dns 192.168.2.60 24.29.99.36 interface inside
    dhcpd wins 192.168.2.60 24.29.99.36 interface inside
    dhcpd domain adomain interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy domain internal
    group-policy domain attributes
    wins-server value 192.168.2.60
    dns-server value 192.168.2.60
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value adomain.local
    username ben password zWCAaitV3CB.GA87 encrypted privilege 0
    username ben attributes
    vpn-group-policy domain
    username sdomain password FATqd4I1ZoqyQ/MN encrypted
    username sdomain attributes
    vpn-group-policy domain
    username adomain password V5.hvhZU4S8NwGg/ encrypted
    username adomain attributes
    vpn-group-policy domain
    service-type admin
    username jdomain password uODal3Mlensb8d.t encrypted privilege 0
    username jdomain attributes
    vpn-group-policy domain
    service-type admin
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool VPN_Users
    default-group-policy domain
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:e2466a5b754
    eebcdb0cef
    f051bef91d
    9
    : end
    no asdm history enable
    Thanks again

    Hello Belnet,
    What do the logs show from the ASA.
    Can you post them ??
    Any other question..Sure..Just remember to rate all of the community answers.
    Julio

  • ASA 5505 IPSEC VPN connected but can't access to LAN

    ASA : 8.2.5
    ASDM: 6.4.5
    LAN: 10.1.0.0/22
    VPN Pool: 172.16.10.0/24
    Hi, we purcahsed a new ASA 5505 and try to setup IPSEC VPN via ASDM; i just simply run the Wizards, setup vpnpool, split tunnelling,etc.
    I can connect to the ASA by using cisco VPN client and internet works fine on the local PC, but it cannot access to the LAN (can't ping. can't remote desktop). I tried the same thing on our Production ASA(those have both Remote VPN and Site-to-site VPN working), the new profile i created worked fine.
    Below is my configure, do I mis-configure anything?
    ASA Version 8.2(5)
    hostname asatest
    domain-name XXX.com
    enable password 8Fw1QFqthX2n4uD3 encrypted
    passwd g9NiG6oUPjkYrHNt encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.1.1.253 255.255.252.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address XXX.XXX.XXX.XXX 255.255.255.240
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name vff.com
    access-list vpntest_splitTunnelAcl standard permit 10.1.0.0 255.255.252.0
    access-list inside_nat0_outbound extended permit ip 10.1.0.0 255.255.252.0 172.16.10.0 255.255.255.0
    pager lines 24
    logging enable
    logging timestamp
    logging trap warnings
    logging asdm informational
    logging device-id hostname
    logging host inside 10.1.1.230
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 172.16.10.1-172.16.10.254 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (inside) host 10.1.1.108
    nt-auth-domain-controller 10.1.1.108
    http server enable
    http 10.1.0.0 255.255.252.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 10.1.0.0 255.255.252.0 inside
    ssh timeout 20
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy vpntest internal
    group-policy vpntest attributes
    wins-server value 10.1.1.108
    dns-server value 10.1.1.108
    vpn-tunnel-protocol IPSec l2tp-ipsec
    password-storage disable
    ip-comp disable
    re-xauth disable
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpntest_splitTunnelAcl
    default-domain value XXX.com
    split-tunnel-all-dns disable
    backup-servers keep-client-config
    address-pools value vpnpool
    username admin password WeiepwREwT66BhE9 encrypted privilege 15
    username user5 password yIWniWfceAUz1sUb encrypted privilege 5
    username user3 password umNHhJnO7McrLxNQ encrypted privilege 3
    tunnel-group vpntest type remote-access
    tunnel-group vpntest general-attributes
    address-pool vpnpool
    authentication-server-group AD
    authentication-server-group (inside) AD
    default-group-policy vpntest
    strip-realm
    tunnel-group vpntest ipsec-attributes
    pre-shared-key BEKey123456
    peer-id-validate nocheck
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege cmd level 3 mode exec command packet-tracer
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command vpnclient
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command dynamic-filter
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege clear level 3 mode exec command dynamic-filter
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:447bbbc60fc01e9f83b32b1e0304c6b4
    : end

    I change  a Machine's gateway to this ASA and capture again, now we can see some reply.
    All ohter PCs and switches gateway are point to another ASA, maybe that's the reason why i didn't work?
    what's the recommanded way to make our LAN to have two 2 gateways(for load balance or backup router, etc)?
    add two gateways to all PCs and swtichwes?
    1: 18:15:48.307875 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       2: 18:15:49.777685 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       3: 18:15:51.377147 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       4: 18:15:57.445777 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       5: 18:15:58.856324 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       6: 18:16:00.395090 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       7: 18:16:06.483464 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       8: 18:16:08.082805 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       9: 18:16:09.542406 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
      10: 18:16:20.640424 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      11: 18:16:20.642193 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      12: 18:16:21.169607 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      13: 18:16:21.171210 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      14: 18:16:22.179556 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      15: 18:16:22.181142 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      16: 18:16:23.237673 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      17: 18:16:23.239291 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      18: 18:16:27.676402 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 50
      19: 18:16:29.246935 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 50
      20: 18:16:30.676921 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 50
      21: 18:16:49.539660 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request
      22: 18:16:54.952602 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request
      23: 18:17:04.511463 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request

  • ASA 5505 IPSec VPN Question

    I have a number of ASA 5505 boxes which I need to reconfigure to work with a Watchguard XTM 850 over IPsec.  The 5505s were previously configured to connect back to a 5510 Firewall using EasyVPN.  With EasyVPN still enabled, the remote boxes attempt to make a connection back, but there are a few settings such as Identity and Encryption types I need to modify to connect to the Watchguard firewalls.  It appears that these settings cannot be changed with EasyVPN enabled.  If I disable it, and change the identity and authentication settings, the boxes do not attempt to make a connection back.  I'm not sure if what I am trying to do is even possible at this point, and I am in dire need of some direction.  

    It is not clear from this description what is the problem and it sounds like either some part of your config changes is not correct or that there is some mismatch between your config and the config of the remote device. A starting place would be to post your config (masking off sensitive information such as public addresses and passwords.
    HTH
    Rick

  • Cisco ASA 5505 IPSEC, one endpoint behind NAT device

    We have two Cisco ASA 5505 devices.
    Both are identical, however, one of them is behind a NAT device.
    We are attempting to create an IPSEC network.
    Site fg:
    <ipsec subnet1> -- ASA 5505 (ASA1) -- <internet>
    ASA1: 10.1.1.2/24 (inside), 212.xxx.xxx.xxx/28 (outside)
    Site be:
    <ipsec_subnet2> -- ASA 5505 (ASA3) -- Zywall USG (USG1) -- <internet>
    ASA3: 10.1.4.1/24 (inside), 192.168.4.50/24 (outside)
    USG1: 192.168.4.100/24 (inside), 195.xxx.xxx.xxx/30 (outside)
    USG1: UDP port 500/4500 forwarded to 192.168.4.50
    It seems that ASA1 stops the procedure (we verified this with debug crypto isakmp 254):
    Group = 195.xxx.xxx.xxx, IP = 195.xxx.xxx.xxx, QM FSM error (P2 struct &0xd1111cd8, mess id 0x81111a78)!
    Group = 195.xxx.xxx.xxx, IP = 195.xxx.xxx.xxx, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 192.168.4.50/255.255.255.255/0/0 local proxy 212.xxx.xxx.xxx/255.255.255.255/0/0 on interface outside
    Group = 195.xxx.xxx.xxx, IP = 195.xxx.xxx.xxx, PHASE 1 COMPLETED
    We verified / attempted the following:
    - NAT excemption on both sides for IPSEC subnets
    - Mirror image crypto maps
    - Disabled IKE peer ID validation (yes, pre-shared key but we ran out of ideas)
    - Toggled between static to dynamic crypto maps on ASA1
    Most search results turned up results referring to the incorrect settings of the crypto map or the lack of NAT excemption.
    Does anyone have any idea?
    195.txt contains show running-config of ASA3
    212.txt contains show running-config of ASA1
    log.txt contains somewhat entire log snipper of ASA1

    Hi,
    on 212 is see
    tunnel-group 195.xxx.xxx.xxx type ipsec-l2l
    tunnel-group 195.xxx.xxx.xxx ipsec-attributes
    pre-shared-key
    When you define the peer with static tunnel-group entry ASA is looking for peer configuration in static crypto map. If the peer is behind static NAT configure a proper static crypto map with matching acl and proposals.
    If the peer is behind dynamic nat refer this example :http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/81883-ipsec-iosrtr-dyn-pix-nat.html
    Regards,
    Abaji.

  • ASA 5505, how to configure DMZ to Inside traffic flows

    Dear.
    We have a Cisco ASA 5505 with an outside, inside and DMZ interface.
    We really need all these interfaces.
    The DMZ interface has been configured to block any traffic to the inside (restrict traffic flow). This restriction can’t be disable, an error occurred when doing this.
    I will allow only one single port has access from DMZ to the inside, is that possible? And how?
    Thanks for the feedback.
    Regards.
    Peter.

    What i mean with "can't be disabled": when you navigate to Configuration/interfaces and select the DMZ interface / advanced, you can block traffic. By default Inside has been selected in the drop-down box. However, you can't leave it blank, you need to specify at least one. I can't create another, extra interfaces because the license is 3 max.
    So, my question is: can I create a rule somewhere to overwrite this setting for only one specific port? And how?
    Result of the command: "show version"
    Cisco Adaptive Security Appliance Software Version 8.2(5)
    Device Manager Version 6.4(5)
    Compiled on Fri 20-May-11 16:00 by builders
    System image file is "disk0:/asa825-k8.bin"
    Config file at boot was "startup-config"
    router up 100 days 1 hour
    Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.05
    0: Int: Internal-Data0/0    : address is a44c.11bb.5492, irq 11
    1: Ext: Ethernet0/0         : address is a44c.11bb.548a, irq 255
    2: Ext: Ethernet0/1         : address is a44c.11bb.548b, irq 255
    3: Ext: Ethernet0/2         : address is a44c.11bb.548c, irq 255
    4: Ext: Ethernet0/3         : address is a44c.11bb.548d, irq 255
    5: Ext: Ethernet0/4         : address is a44c.11bb.548e, irq 255
    6: Ext: Ethernet0/5         : address is a44c.11bb.548f, irq 255
    7: Ext: Ethernet0/6         : address is a44c.11bb.5490, irq 255
    8: Ext: Ethernet0/7         : address is a44c.11bb.5491, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces    : 8        
    VLANs                          : 3, DMZ Restricted
    Inside Hosts                   : 50       
    Failover                       : Disabled
    VPN-DES                        : Enabled  
    VPN-3DES-AES                   : Enabled  
    SSL VPN Peers                  : 2        
    Total VPN Peers                : 10       
    Dual ISPs                      : Disabled 
    VLAN Trunk Ports               : 0        
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled 
    AnyConnect for Cisco VPN Phone : Disabled 
    AnyConnect Essentials          : Disabled 
    Advanced Endpoint Assessment   : Disabled 
    UC Phone Proxy Sessions        : 2        
    Total UC Proxy Sessions        : 2        
    Botnet Traffic Filter          : Disabled 
    This platform has a Base license.
    Serial Number: xxxxxxxxxxxxxx
    Running Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
    Configuration register is 0x1
    Configuration last modified by enable_15 at 14:43:11.295 CEDT Mon Sep 9 2013

  • ASA 5505 can't configured it, no access inside to box

    Device is ASA 5505 with software version 7.2. Very bad problems: When i try access to ASA try conficuring it, i can't access to box inside. First time i get connect this ASAs configurationsofware and change password and restart it and now i can't access to box inside. ASDM notes: No found device or something else.
    NOTICE!
    And i can't reset a box to "factory default" because reset-button is reserved for future use?
    I try connect to ASA 5505 with Ethernetcable (ports 0, 1, 2...7) and
    Seroal communicateport with command line and telnet but not response?
    Is this new one ASA 5505 broken when it left your factorys?
    HOW can i connect to ASA 5505 and configure it now? I need Factory default reset but how it happens, because can't acces to box?
    Regards

    Okay, thanks. I set these parameters com ports, but still not working.
    I try connect with consoleport/terminal and with network cable port 0 - 7, but no connection, only note not found and Time session over or something else ):
    This Cisco's ASDM not even found this ASA 5505. I have bad feeling it is broken or jummed or some softwarebug what locked the box every ports (ethernet and console).
    I wonder, why this bos have RESET-button, but it is reserved for future use. Now when user need it so bad. And ofcourse usb-ports are future use.
    FINAL QUESTION:
    Where and how i can reset this ASA? Is it only way to change it my dealer a new one which working well like its designed.

  • Cisco ASA 5505 - IPsec Tunnel issue

    Issue with IPsec Child SA
    Hi,
    I have a site to site VPN tunnel setup with a Cisco ASA5505 and a Checkpoint Firewall. The version of software is 9.22. I am using IKEv2 for Phase 1 encryption. The following is my cisco asa configuration:
    hostname GARPR-COM1-WF01
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    interface Ethernet0/0
     description Failover Link
     switchport access vlan 950
    interface Ethernet0/1
     description Outside FW Link
     switchport access vlan 999
    interface Ethernet0/2
     description Inside FW Link
     switchport access vlan 998
    interface Ethernet0/3
     description Management Link
     switchport access vlan 6
    interface Ethernet0/4
     shutdown
    interface Ethernet0/5
     shutdown
    interface Ethernet0/6
     shutdown
    interface Ethernet0/7
     shutdown
    interface Vlan1
     no nameif
     no security-level
     no ip address
    interface Vlan6
     nameif management
     security-level 100
     ip address 10.65.1.20 255.255.255.240
    interface Vlan950
     description LAN Failover Interface
    interface Vlan998
     nameif inside
     security-level 100
     ip address 10.65.1.5 255.255.255.252
    interface Vlan999
     nameif outside
     security-level 0
     ip address ************* 255.255.255.248
    boot system disk0:/asa922-4-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
     domain-name ***************
    object network North_American_LAN
     subnet 10.73.0.0 255.255.0.0
     description North American LAN
    object network Queretaro_LAN
     subnet 10.74.0.0 255.255.0.0
     description Queretaro_LAN
    object network Tor_LAN
     subnet 10.75.0.0 255.255.0.0
     description Tor LAN
    object network Mor_LAN
     subnet 10.76.0.0 255.255.0.0
     description Mor LAN
    object network Tus_LAN
     subnet 10.79.128.0 255.255.128.0
     description North American LAN
    object network Mtl_LAN
     subnet 10.88.0.0 255.255.0.0
     description Mtl LAN
    object network Wic_LAN
     subnet 10.90.0.0 255.254.0.0
     description Wic LAN
    object network Wic_LAN_172
     subnet 172.18.0.0 255.255.0.0
     description Wic Servers/Legacy Client LAN
    object network Mtl_LAN_172
     subnet 172.19.0.0 255.255.0.0
     description Mtl Servers/Legacy Client LAN
    object network Tor_LAN_172
     subnet 172.20.0.0 255.255.0.0
     description Tor Servers/Legacy Client LAN
    object network Bridge_LAN_172
     subnet 172.23.0.0 255.255.0.0
     description Bridge Servers/Legacy Client LAN
    object network Mtl_WLAN
     subnet 10.114.0.0 255.255.0.0
     description Mtl Wireless LAN
    object network Bel_WLAN
     subnet 10.115.0.0 255.255.0.0
     description Bel Wireless LAN
    object network Wic_WLAN
     subnet 10.116.0.0 255.255.0.0
     description Wic Wireless LAN
    object network Mtl_Infrastructure_10
     subnet 10.96.0.0 255.255.0.0
     description Mtl Infrastructre LAN
    object network BA_Small_Site_Blocks
     subnet 10.68.0.0 255.255.0.0
     description BA Small Sites Blocks
    object network Bel_LAN
     subnet 10.92.0.0 255.255.0.0
     description Bel LAN 10 Network
    object network LAN_172
     subnet 172.25.0.0 255.255.0.0
     description  LAN 172 Network
    object network Gar_LAN
     subnet 10.65.1.0 255.255.255.0
     description Gar LAN
    object network garpr-com1-wf01.net.aero.bombardier.net
     host **************
     description Garching Firewall
    object-group network BA_Sites
     description Internal Networks
     network-object object BA_Small_Site_Blocks
     network-object object Bel_LAN
     network-object object Bel_LAN_172
     network-object object Bel_WLAN
     network-object object Bridge_LAN_172
     network-object object Mtl_Infrastructure_10
     network-object object Mtl_LAN
     network-object object Mtl_LAN_172
     network-object object Mtl_WLAN
     network-object object Mor_LAN
     network-object object North_American_LAN
     network-object object Queretaro_LAN
     network-object object Tor_LAN
     network-object object Tor_LAN_172
     network-object object Tus_LAN
     network-object object Wic_LAN
     network-object object Wic_LAN_172
     network-object object Wic_WLAN
    access-list 101 extended permit ip object garpr-com1-wf01.net.aero.bombardier.net object Bel_LAN_172
    access-list 101 extended permit ip object Garching_LAN object-group BA_Sites
    pager lines 24
    logging enable
    logging timestamp
    logging buffered warnings
    logging trap informational
    logging asdm informational
    logging host outside 172.25.5.102
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    failover
    failover lan unit primary
    failover lan interface Failover_Link Vlan950
    failover polltime interface msec 500 holdtime 5
    failover key *****
    failover interface ip Failover_Link 192.168.124.1 255.255.255.0 standby 192.168.124.2
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-731-101.bin
    asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static Gar_LAN Gar_LAN destination static BA_Sites BA_Sites no-proxy-arp route-lookup
    route outside 0.0.0.0 0.0.0.0 ************* 1
    route inside 10.65.1.0 255.255.255.255 10.65.1.6 1
    route inside 10.65.1.16 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.32 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.48 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.64 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.128 255.255.255.128 10.65.1.6 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 10.65.1.0 255.255.255.0 inside
    http 172.25.5.0 255.255.255.0 inside
    http 10.65.1.21 255.255.255.255 management
    snmp-server host inside 172.25.49.0 community ***** udp-port 161
    snmp-server host outside 172.25.49.0 community *****
    snmp-server host inside 172.25.5.101 community ***** udp-port 161
    snmp-server host outside 172.25.5.101 community *****
    snmp-server host inside 172.25.81.88 poll community *****
    snmp-server host outside 172.25.81.88 poll community *****
    snmp-server location:
    snmp-server contact
    snmp-server community *****
    snmp-server enable traps syslog
    crypto ipsec ikev2 ipsec-proposal aes256
     protocol esp encryption aes-256
     protocol esp integrity sha-1
    crypto ipsec security-association lifetime seconds 3600
    crypto ipsec security-association pmtu-aging infinite
    crypto map GARCH 10 match address 101
    crypto map GARCH 10 set pfs group19
    crypto map GARCH 10 set peer *******************
    crypto map GARCH 10 set ikev2 ipsec-proposal aes256
    crypto map GARCH 10 set security-association lifetime seconds 3600
    crypto map GARCH interface outside
    crypto ca trustpool policy
    no crypto isakmp nat-traversal
    crypto ikev2 policy 10
     encryption aes-256
     integrity sha256
     group 19
     prf sha256
     lifetime seconds 86400
    crypto ikev2 enable outside
    telnet 10.65.1.6 255.255.255.255 inside
    telnet timeout 5
    ssh stricthostkeycheck
    ssh 172.25.5.0 255.255.255.0 inside
    ssh 172.19.9.49 255.255.255.255 inside
    ssh 172.25.5.0 255.255.255.0 outside
    ssh 172.19.9.49 255.255.255.255 outside
    ssh timeout 30
    ssh version 2
    ssh key-exchange group dh-group1-sha1
    console timeout 30
    management-access inside
    dhcprelay server 172.25.81.1 outside
    dhcprelay server 172.25.49.1 outside
    dhcprelay enable inside
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 172.19.109.41
    ntp server 172.19.109.42
    ntp server 172.19.9.49 source outside
    tunnel-group ********* type ipsec-l2l
    tunnel-group ********* ipsec-attributes
     ikev2 remote-authentication pre-shared-key *****
     ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:25ad9bf6db66a31e840ad96f49cd7e37
    : end
    I believe when a VPN tunnel is setup there should be one Child sa per subnet. The internal network of 10.65.1.0/24 should be setup with a child sa to the networks that were specified above depending on if there is traffic destined for them. What I am seeing is multiple child sa setup for the same subnet like the example below:
    GARPR-COM1-WF01# sh crypto ikev2 sa | i 172.19
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
    where for destination network 10.92.0.0/16 there is only one child sa:
    GARPR-COM1-WF01# sh crypto ikev2 sa | i 10.92
              remote selector 10.92.0.0/0 - 10.92.255.255/6553
    Should this be the case or does anyone have any idea why there is multiple child sa setup for the same subnet?
    Thanks
    Jonathan

    Hi there,
    I had same issue with PIX 506E and it was not even a circuit issue and I got ride of it and problem got fixed with PIX515E
    I don't know, the device is too old to stay alive.
    thanks

  • Cisco ASA 5505 IPsec client VPN - Cannot connect to local hosts

    I have created a Cisco IPsec vpn on my ASA using the VPN creation wizard. I am able to successfully connect to the vpn and seemingly join the network, but after I connect I am unable to connect to or ping any of the hosts on the network.
    Checking the ASA I can see that a VPN session is open and my client reports that it is connected. If I attempt to ping the client from the ASA all packets are dropped.
    I suspect it may be an issue with my firewall, but I am not really sure where to begin.
    Here is a copy of my config, any pointers or tips are aprpeciated:
    hostname mcfw
    enable password Pt8fQ27yMZplioYq encrypted
    passwd 2qaO2Gd6IBRkrRFm encrypted
    names
    interface Ethernet0/0
    switchport access vlan 400
    interface Ethernet0/1
    switchport access vlan 400
    interface Ethernet0/2
    switchport access vlan 420
    interface Ethernet0/3
    switchport access vlan 420
    interface Ethernet0/4
    switchport access vlan 450
    interface Ethernet0/5
    switchport access vlan 450
    interface Ethernet0/6
    switchport access vlan 500
    interface Ethernet0/7
    switchport access vlan 500
    interface Vlan400
    nameif outside
    security-level 0
    ip address 58.13.254.10 255.255.255.248
    interface Vlan420
    nameif public
    security-level 20
    ip address 192.168.20.1 255.255.255.0
    interface Vlan450
    nameif dmz
    security-level 50
    ip address 192.168.10.1 255.255.255.0
    interface Vlan500
    nameif inside
    security-level 100
    ip address 192.168.0.1 255.255.255.0
    ftp mode passive
    clock timezone JST 9
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network DM_INLINE_NETWORK_1
    network-object host 58.13.254.11
    network-object host 58.13.254.13
    object-group service ssh_2220 tcp
    port-object eq 2220
    object-group service ssh_2251 tcp
    port-object eq 2251
    object-group service ssh_2229 tcp
    port-object eq 2229
    object-group service ssh_2210 tcp
    port-object eq 2210
    object-group service DM_INLINE_TCP_1 tcp
    group-object ssh_2210
    group-object ssh_2220
    object-group service zabbix tcp
    port-object range 10050 10051
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq www
    group-object zabbix
    port-object eq 9000
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service http_8029 tcp
    port-object eq 8029
    object-group network DM_INLINE_NETWORK_2
    network-object host 192.168.20.10
    network-object host 192.168.20.30
    network-object host 192.168.20.60
    object-group service imaps_993 tcp
    description Secure IMAP
    port-object eq 993
    object-group service public_wifi_group
    description Service allowed on the Public Wifi Group. Allows Web and Email.
    service-object tcp-udp eq domain
    service-object tcp-udp eq www
    service-object tcp eq https
    service-object tcp-udp eq 993
    service-object tcp eq imap4
    service-object tcp eq 587
    service-object tcp eq pop3
    service-object tcp eq smtp
    access-list outside_access_in remark http traffic from outside
    access-list outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_1 eq www
    access-list outside_access_in remark ssh from outside to web1
    access-list outside_access_in extended permit tcp any host 58.13.254.11 object-group ssh_2251
    access-list outside_access_in remark ssh from outside to penguin
    access-list outside_access_in extended permit tcp any host 58.13.254.10 object-group ssh_2229
    access-list outside_access_in remark http from outside to penguin
    access-list outside_access_in extended permit tcp any host 58.13.254.10 object-group http_8029
    access-list outside_access_in remark ssh from outside to hub & studio
    access-list outside_access_in extended permit tcp any host 58.13.254.13 object-group DM_INLINE_TCP_1
    access-list outside_access_in remark dns service to hub
    access-list outside_access_in extended permit object-group TCPUDP any host 58.13.254.13 eq domain
    access-list dmz_access_in extended permit ip 192.168.10.0 255.255.255.0 any
    access-list dmz_access_in extended permit tcp any host 192.168.10.251 object-group DM_INLINE_TCP_2
    access-list public_access_in remark Web access to DMZ websites (mediastudio/civicrm)
    access-list public_access_in extended permit object-group TCPUDP any object-group DM_INLINE_NETWORK_2 eq www
    access-list public_access_in remark General web access. (HTTP, DNS & ICMP and  Email)
    access-list public_access_in extended permit object-group public_wifi_group any any
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.0.80 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 192.168.0.64 255.255.255.192
    pager lines 24
    logging enable
    logging timestamp
    logging buffered notifications
    logging trap notifications
    logging asdm debugging
    logging from-address [email protected]
    logging recipient-address [email protected] level warnings
    logging host dmz 192.168.10.90 format emblem
    logging permit-hostdown
    mtu outside 1500
    mtu public 1500
    mtu dmz 1500
    mtu inside 1500
    ip local pool OfficePool 192.168.0.80-192.168.0.90 mask 255.255.255.0
    ip local pool VPN_Pool 192.168.0.91-192.168.0.99 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 60
    global (outside) 1 interface
    global (dmz) 2 interface
    nat (public) 1 0.0.0.0 0.0.0.0
    nat (dmz) 1 0.0.0.0 0.0.0.0
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 2229 192.168.0.29 2229 netmask 255.255.255.255
    static (inside,outside) tcp interface 8029 192.168.0.29 www netmask 255.255.255.255
    static (dmz,outside) 58.13.254.13 192.168.10.10 netmask 255.255.255.255 dns
    static (dmz,outside) 58.13.254.11 192.168.10.30 netmask 255.255.255.255 dns
    static (inside,dmz) 192.168.10.0 192.168.0.0 netmask 255.255.255.0 dns
    static (dmz,inside) 192.168.0.251 192.168.10.251 netmask 255.255.255.255
    static (dmz,public) 192.168.20.30 192.168.10.30 netmask 255.255.255.255 dns
    static (dmz,public) 192.168.20.10 192.168.10.10 netmask 255.255.255.255 dns
    access-group outside_access_in in interface outside
    access-group public_access_in in interface public
    access-group dmz_access_in in interface dmz
    route outside 0.0.0.0 0.0.0.0 58.13.254.9 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.0.0 255.255.255.0 inside
    http 59.159.40.188 255.255.255.255 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt noproxyarp dmz
    sysopt noproxyarp inside
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map public_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map public_map interface public
    crypto isakmp enable outside
    crypto isakmp enable public
    crypto isakmp enable inside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 59.159.40.188 255.255.255.255 outside
    ssh 192.168.0.0 255.255.255.0 inside
    ssh timeout 20
    console timeout 0
    dhcpd dns 61.122.112.97 61.122.112.1
    dhcpd auto_config outside
    dhcpd address 192.168.20.200-192.168.20.254 public
    dhcpd enable public
    dhcpd address 192.168.10.190-192.168.10.195 dmz
    dhcpd enable dmz
    dhcpd address 192.168.0.200-192.168.0.254 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics host number-of-rate 2
    no threat-detection statistics tcp-intercept
    ntp server 130.54.208.201 source public
    webvpn
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 61.122.112.97 61.122.112.1
    vpn-tunnel-protocol l2tp-ipsec
    group-policy CiscoASA internal
    group-policy CiscoASA attributes
    dns-server value 61.122.112.97 61.122.112.1
    vpn-tunnel-protocol IPSec
    username mcit password 4alT9CZ8ayD8O8Xg encrypted privilege 15
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPN_Pool
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *****
    tunnel-group ocmc type remote-access
    tunnel-group ocmc general-attributes
    address-pool OfficePool
    tunnel-group ocmc ipsec-attributes
    pre-shared-key *****
    tunnel-group CiscoASA type remote-access
    tunnel-group CiscoASA general-attributes
    address-pool VPN_Pool
    default-group-policy CiscoASA
    tunnel-group CiscoASA ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    smtp-server 192.168.10.10
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:222d6dcb583b5f5abc51a2251026f7f2
    : end
    asdm location 192.168.10.10 255.255.255.255 inside
    asdm location 192.168.0.29 255.255.255.255 inside
    asdm location 58.13.254.10 255.255.255.255 inside
    no asdm history enable

    Hi Conor,
    What is your local net ? I see only one default route for outside network. Dont you need a route inside for your local network.
    Regards,
    Umair

  • Two Cisco ASA 5505, IPSec Multiple Subnets, Problem with Phase2, DSL

    Hi all.
    we have following IPSec configuration:
    ASA Site 1:
    Cisco Adaptive Security Appliance Software Version 9.1(1)
    crypto ipsec ikev1 transform-set TSAES esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set TSMD5 esp-3des esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal PropAES256
    access-list SITE_2 extended permit ip 172.27.0.0 255.255.0.0 172.27.97.0 255.255.255.0
    access-list SITE_2 extended permit ip 172.28.60.0 255.255.254.0 172.27.97.0 255.255.255.0
    access-list SITE_2 extended permit ip 172.22.0.0 255.255.0.0 172.27.97.0 255.255.255.0
    access-list SITE_2 extended permit ip 172.27.0.0 255.255.0.0 172.27.99.0 255.255.255.0
    access-list SITE_2 extended permit ip 172.22.0.0 255.255.0.0 172.27.99.0 255.255.255.0
    crypto map CMVPN 5 match address SITE_2
    crypto map CMVPN 5 set peer IP_SITE2
    crypto map CMVPN 5 set ikev2 ipsec-proposal PropAES256
    crypto map CMVPN interface OUTSIDE
    route OUTSIDE 172.27.97.0 255.255.255.0 citic-internet-gw 255
    route OUTSIDE 172.27.99.0 255.255.255.0 citic-internet-gw 255
    tunnel-group IP_SITE2 type ipsec-l2l
    tunnel-group IP_SITE2 general-attributes
    default-group-policy VPN_S2S_WAN
    tunnel-group IP_SITE2 ipsec-attributes
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    ASA Site 2:
    Cisco Adaptive Security Appliance Software Version 9.1(4)
    access-list SITE_1 extended permit ip 172.27.97.0 255.255.255.0 172.28.60.0 255.255.254.0
    access-list SITE_1 extended permit ip 172.27.97.0 255.255.255.0 172.27.0.0 255.255.0.0
    access-list SITE_1 extended permit ip 172.27.97.0 255.255.255.0 172.22.0.0 255.255.0.0
    access-list SITE_1 extended permit ip 172.27.99.0 255.255.255.0 172.27.0.0 255.255.0.0
    access-list SITE_1 extended permit ip 172.27.99.0 255.255.255.0 172.22.0.0 255.255.0.0
    crypto map CMVPN 10 match address SITE_1
    crypto map CMVPN 10 match address SITE_1
    crypto map CMVPN 10 set peer IP_SITE1
    crypto map CMVPN 10 set ikev2 ipsec-proposal IKEV2AES
    crypto map CMVPN 10 set reverse-route
    crypto map CMVPN interface OUTSIDE
    tunnel-group IP_SITE1 type ipsec-l2l
    tunnel-group IP_SITE1 general-attributes
    default-group-policy VPN_S2S_WAN
    tunnel-group IP_SITE1 ipsec-attributes
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    We are not able to reach from 172.22.20.x ips 172.27.99.x.
    It seems so that the phase2 for this subnet is missing…...... as long as we try to reach from 172.27.99.x any ip in 172.22.20.x.
    We are using similar configuration on many sites and it works correctly expect sites with DSL line.
    We can exclude problem with NAT,ACL or routing. The connection is working fine as long as “we open all phase 2 manually” . After re-open (idle timeout) the tunnel the problem comes back.
    Thanks in advance for your help.
    Regards.
    Jan
    ASA Site 1# sh vpn-sessiondb detail l2l filter ipaddress ASA Site 2
    Session Type: LAN-to-LAN Detailed
    Connection   : IP ASA Site 2
    Index        : 3058                   IP Addr      : IP ASA Site 2
    Protocol     : IKEv2 IPsec
    Encryption   : IKEv2: (1)AES256  IPsec: (3)AES256
    Hashing      : IKEv2: (1)SHA512  IPsec: (3)SHA1
    Bytes Tx     : 423634                 Bytes Rx     : 450526
    Login Time   : 19:59:35 HKT Tue Apr 29 2014
    Duration     : 1h:50m:45s
    IKEv2 Tunnels: 1
    IPsec Tunnels: 3
    IKEv2:
      Tunnel ID    : 3058.1
      UDP Src Port : 500                    UDP Dst Port : 500
      Rem Auth Mode: preSharedKeys
      Loc Auth Mode: preSharedKeys
      Encryption   : AES256                 Hashing      : SHA512
      Rekey Int (T): 86400 Seconds          Rekey Left(T): 79756 Seconds
      PRF          : SHA512                 D/H Group    : 5
      Filter Name  :
      IPv6 Filter  :
    IPsec:
      Tunnel ID    : 3058.2
      Local Addr   : 172.22.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.97.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 22156 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4607648 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 312546                 Bytes Rx     : 361444
      Pkts Tx      : 3745                   Pkts Rx      : 3785
    IPsec:
      Tunnel ID    : 3058.3
      Local Addr   : 172.27.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.97.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 22165 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4607952 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 50014                  Bytes Rx     : 44621
      Pkts Tx      : 496                    Pkts Rx      : 503
    IPsec:
      Tunnel ID    : 3058.4
      Local Addr   : 172.27.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.99.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 22324 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4607941 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 61074                  Bytes Rx     : 44461
      Pkts Tx      : 402                    Pkts Rx      : 437
    NAC:
      Reval Int (T): 0 Seconds              Reval Left(T): 0 Seconds
      SQ Int (T)   : 0 Seconds              EoU Age(T)   : 6648 Seconds
      Hold Left (T): 0 Seconds              Posture Token:
      Redirect URL :
    ....  after ping from 172.27.99.x any ip in 172.22.20.x.
    ASA Site 1# sh vpn-sessiondb detail l2l filter ipaddress ASA Site 2
    Session Type: LAN-to-LAN Detailed
    Connection   : IP ASA Site 2
    Index        : 3058                   IP Addr      : IP ASA Site 2
    Protocol     : IKEv2 IPsec
    Encryption   : IKEv2: (1)AES256  IPsec: (4)AES256
    Hashing      : IKEv2: (1)SHA512  IPsec: (4)SHA1
    Bytes Tx     : 784455                 Bytes Rx     : 1808965
    Login Time   : 19:59:35 HKT Tue Apr 29 2014
    Duration     : 2h:10m:48s
    IKEv2 Tunnels: 1
    IPsec Tunnels: 4
    IKEv2:
      Tunnel ID    : 3058.1
      UDP Src Port : 500                    UDP Dst Port : 500
      Rem Auth Mode: preSharedKeys
      Loc Auth Mode: preSharedKeys
      Encryption   : AES256                 Hashing      : SHA512
      Rekey Int (T): 86400 Seconds          Rekey Left(T): 78553 Seconds
      PRF          : SHA512                 D/H Group    : 5
      Filter Name  :
      IPv6 Filter  :
    IPsec:
      Tunnel ID    : 3058.2
      Local Addr   : 172.22.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.97.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 20953 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4606335 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 652492                 Bytes Rx     : 1705136
      Pkts Tx      : 7419                   Pkts Rx      : 7611
    IPsec:
      Tunnel ID    : 3058.3
      Local Addr   : 172.27.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.97.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 20962 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4607942 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 60128                  Bytes Rx     : 52359
      Pkts Tx      : 587                    Pkts Rx      : 594
    IPsec:
      Tunnel ID    : 3058.4
      Local Addr   : 172.27.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.99.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 21121 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4607931 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 70949                  Bytes Rx     : 50684
      Pkts Tx      : 475                    Pkts Rx      : 514
    IPsec:
      Tunnel ID    : 3058.5
      Local Addr   : 172.22.0.0/255.255.0.0/0/0
      Remote Addr  : 172.27.99.0/255.255.255.0/0/0
      Encryption   : AES256                 Hashing      : SHA1
      Encapsulation: Tunnel
      Rekey Int (T): 28800 Seconds          Rekey Left(T): 28767 Seconds
      Rekey Int (D): 4608000 K-Bytes        Rekey Left(D): 4608000 K-Bytes
      Idle Time Out: 25 Minutes             Idle TO Left : 24 Minutes
      Bytes Tx     : 961                    Bytes Rx     : 871
      Pkts Tx      : 17                     Pkts Rx      : 14
    NAC:
      Reval Int (T): 0 Seconds              Reval Left(T): 0 Seconds
      SQ Int (T)   : 0 Seconds              EoU Age(T)   : 7852 Seconds
      Hold Left (T): 0 Seconds              Posture Token:
      Redirect URL :

    Hi,
    on 212 is see
    tunnel-group 195.xxx.xxx.xxx type ipsec-l2l
    tunnel-group 195.xxx.xxx.xxx ipsec-attributes
    pre-shared-key
    When you define the peer with static tunnel-group entry ASA is looking for peer configuration in static crypto map. If the peer is behind static NAT configure a proper static crypto map with matching acl and proposals.
    If the peer is behind dynamic nat refer this example :http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/81883-ipsec-iosrtr-dyn-pix-nat.html
    Regards,
    Abaji.

  • Cisco ASA 5505 IPSec tunnel won't establish until remote site attempts to connect

    I have a site to site IPSec tunnel setup and operational but periodically the remote site goes down, because of a somewhat reliable internet connection. The only way to get the tunnel to re-establish is to go to the remote site and simply issue a ping from a workstation on the remote network. We were having this same issue with a Cisco PIX 506E but decided to upgrade the hardware and see if that resolve the issue. It ran for well over a year and our assumtions was that the issue was resolved. I was looking in the direction of the security-association lifetime but if we power cycle the unit, I would expect that it would kill the SA but even after power cycling, the VPN does not come up automatically.
    Any assistance would be appreciated.
    ASA Version 8.2(1)
    hostname KRPS-FW
    domain-name lottonline.org
    enable password uniQue
    passwd uniQue
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.20.30.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address xxx.xxx.xxx.xxx 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    description Inside Network on VLAN1
    interface Ethernet0/2
    shutdown
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    description Inside Network on VLAN1
    ftp mode passive
    dns server-group DefaultDNS
    domain-name lottonline.org
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group OUTSIDE_ACCESS_IN in interface outside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.20.30.0 255.255.255.0 inside
    http 10.20.20.0 255.255.255.0 inside
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map DYNMAP 65535 set transform-set ESP-AES-256-SHA
    crypto map VPNMAP 1 match address KWPS-BITP
    crypto map VPNMAP 1 set peer xxx.xxx.xxx.001
    crypto map VPNMAP 1 set transform-set ESP-AES-256-SHA
    crypto map VPNMAP 65535 ipsec-isakmp dynamic DYNMAP
    crypto map VPNMAP interface outside
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    ssh timeout 5
    console timeout 0
    management-access inside
    tunnel-group xxx.xxx.xxx.001 type ipsec-l2l
    tunnel-group xxx.xxx.xxx.001 ipsec-attributes
    pre-shared-key somekey

    Hi there,
    I had same issue with PIX 506E and it was not even a circuit issue and I got ride of it and problem got fixed with PIX515E
    I don't know, the device is too old to stay alive.
    thanks

  • Cisco ASA 5505 VPN Routing/Networking Question

    I have a very basic question about Cisco ASA 5505 IPsec Site to Site VPNs.  I want to install a Cisco ASA 5505 at a Data Center, in a LAN subnet that utilizes publicly routable IP addresses.  I would like to install a second Cisco ASA 5505 in a remote branch office as its peer. 
    Regardless of whether I use publicly routable IPs at the branch office in the "inside" network or non-routable IPs, how would the devices and servers at the Data Center know to route IP packets destined for the branch office back through the Cisco ASA instead of through the default gateway at the Data Center?  I can see accomplishing this if every single device at the Data Center is configured with routing table entries, but that isn't feasible.  It also isn't feasible to use the Cisco ASA 5505 as the default gateway for all of the devices as the Data Center, allowing it to decide where the traffic should go.
    What am I missing?  Is the solution to try to map branch office IPs to IP addresses within the Data Center's LAN subnet so that all of the traffic is on the same subnet?

    You can do it in several different ways.
    One way is to tell the server that if it has traffic to network x then it needs to go to the ASA all other traffic is to head for the default gateway.
    In windows this is done via the route command
    do not forget to make it "persistent" otherwise the route will disapear when your reboot the server.
    in unix/linux
    It is also the route command
    Or you can tell your "default gateway" to route that network to the ASA
    Good luck
    HTH

  • Problems with basic config ASA 5505

    new ASA 5505, tying to configure it, inside LAN is 192.168.2.x/23 (255.255.254.0). I connect to ASA5505 using ASDM ok when it is on the default 192.168.1.1. I change the ip on 'inside' vlan, and of course lose connection to it. It apparently doesn't totally save the info, though, because I can't connect to it using the new info. So, I made a vlan3, using port 0/2, using ip of 192.168.2.x/23 while connected to 192.168.1.1. Then I changed ip of my computer from 192.168.1.x to 192.168.2.x/23 but cannot even ping that port/ip on the ASA while connected to port 0/2. I switched computer back, and connected again to 192.168.1.1 and it does appear that my new settings for 0/2 are still there, so I'm not sure how to proceed? Thanks.

    Sorry, had family emergency and was off for 2 weeks, then when came back had other work to catch up on.
    Thanks for the reply. It would appear that the command you provided sets it back to default settings. I was able to set it back to default settings, but am now unsure as how to proceed to get the "inside" set to 192.168.2.0/23 and still be able to access it.
    If I go back in, I can change "inside" to 192.168.2.1/23, but lose connection, so it "sort of" gets saved, in the respect that sometimes I can ping it, sometimes not. But can never connect to it.
    Thanks, and sorry again about the delay.

  • 2 ISP link failover in ASA 5505

    Hi,
    I have ASA 5505, want to configure the 2 ISP link Tata and Airtel with failover.
    I want to configure the WebVPN with failover, so that user don't need to change the public address when one link goes down.
    thanks with regards
    Ashish Kumar

    Hi michael,
    First of thanks for reply.
    Can we do it by public certificate or DNS entry e.g. both ISP Public ip address entry will be in DNS and user will hit particular DNS name. You r right that once link down so user will disconnect but when he will retry then he will connect via another link.
    Is it possible??
    Ashish

  • Cisco ASA 5505 Failover issue..

    Hi,
     I am having two firewalls (cisco ASA 5505) which is configured as active/standby Mode.It was running smoothly for more than an year,but last week the secondary firewall got failed and It made my whole network down.then I just removed the connectivity of the secondary firewall and run only the primary one.when I login  by console i found out that the failover has been disabled .So again I connected  to the Network and enabled the firewall.After a couple of days same issue happen.This time I take down the Secondary firewall erased the Flash.Reloaded the IOS image.Configured the failover and connected to the primary for the replication of configs.It found out the Active Mate.Replicated the configs and got synced...But after sync the same thing happened,The whole network gone down .I juz done the same thing removed the secondary firewall.Network came up.I feel there is some thing with failover thing ,but couldnt fin out :( .And the firewalls are in Router Mode.

    Please find the logs...
    Secondary Firewall While Sync..
    cisco-asa(config)# sh failover 
    Failover On 
    Failover unit Secondary
    Failover LAN Interface: e0/7 Vlan3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 4 of 23 maximum
    Version: Ours 8.2(5), Mate 8.2(5)
    Last Failover at: 06:01:10 GMT Apr 29 2015
    This host: Secondary - Sync Config 
    Active time: 55 (sec)
    slot 0: ASA5505 hw/sw rev (1.0/8.2(5)) status (Up Sys)
     Interface outside (27.251.167.246): No Link (Waiting)
     Interface inside (10.11.0.20): No Link (Waiting)
     Interface mgmt (10.11.200.21): No Link (Waiting)
    slot 1: empty
    Other host: Primary - Active 
    Active time: 177303 (sec)
    slot 0: ASA5505 hw/sw rev (1.0/8.2(5)) status (Up Sys)
     Interface outside (27.251.167.247): Unknown (Waiting)
     Interface inside (10.11.0.21): Unknown (Waiting)
     Interface mgmt (10.11.200.22): Unknown (Waiting)
    slot 1: empty
    =======================================================================================
    Secondary Firewall Just after Sync ,Active (primary Firewall got rebootted)
    cisco-asa# sh failover 
    Failover On 
    Failover unit Secondary
    Failover LAN Interface: e0/7 Vlan3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 4 of 23 maximum
    Version: Ours 8.2(5), Mate Unknown
    Last Failover at: 06:06:12 GMT Apr 29 2015
    This host: Secondary - Active 
    Active time: 44 (sec)
    slot 0: ASA5505 hw/sw rev (1.0/8.2(5)) status (Up Sys)
     Interface outside (27.251.167.246): Normal (Waiting)
     Interface inside (10.11.0.20): No Link (Waiting)
     Interface mgmt (10.11.200.21): No Link (Waiting)
    slot 1: empty
    Other host: Primary - Not Detected 
    Active time: 0 (sec)
    slot 0: empty
     Interface outside (27.251.167.247): Unknown (Waiting)
     Interface inside (10.11.0.21): Unknown (Waiting)
     Interface mgmt (10.11.200.22): Unknown (Waiting)
    slot 1: empty
    ==========================================================================================
    After Active firewall got rebootted failover off,whole network gone down.
    cisco-asa# sh failover 
    Failover Off 
    Failover unit Secondary
    Failover LAN Interface: e0/7 Vlan3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 4 of 23 maximum
    ===========================================================================================
    Primary Firewall after rebootting
    cisco-asa# sh failover
    Failover On
    Failover unit Primary
    Failover LAN Interface: e0/7 Vlan3 (Failed - No Switchover)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 4 of 23 maximum
    Version: Ours 8.2(5), Mate Unknown
    Last Failover at: 06:17:29 GMT Apr 29 2015
            This host: Primary - Active
                    Active time: 24707 (sec)
                    slot 0: ASA5505 hw/sw rev (1.0/8.2(5)) status (Up Sys)
                      Interface outside (27.251.167.246): Normal (Waiting)
                      Interface inside (10.11.0.20): Normal (Waiting)
                      Interface mgmt (10.11.200.21): Normal (Waiting)
                    slot 1: empty
            Other host: Secondary - Failed
                    Active time: 0 (sec)
                    slot 0: empty
                      Interface outside (27.251.167.247): Unknown (Waiting)
                      Interface inside (10.11.0.21): Unknown (Waiting)
                      Interface mgmt (10.11.200.22): Unknown (Waiting)
                    slot 1: empty
    cisco-asa# sh failover history
    ==========================================================================
    From State                 To State                   Reason
    ==========================================================================
    06:16:43 GMT Apr 29 2015
    Not Detected               Negotiation                No Error
    06:17:29 GMT Apr 29 2015
    Negotiation                Just Active                No Active unit found
    06:17:29 GMT Apr 29 2015
    Just Active                Active Drain               No Active unit found
    06:17:29 GMT Apr 29 2015
    Active Drain               Active Applying Config     No Active unit found
    06:17:29 GMT Apr 29 2015
    Active Applying Config     Active Config Applied      No Active unit found
    06:17:29 GMT Apr 29 2015
    Active Config Applied      Active                     No Active unit found
    ==========================================================================
    cisco-asa#
    cisco-asa# sh failover state
                   State          Last Failure Reason      Date/Time
    This host  -   Primary
                   Active         None
    Other host -   Secondary
                   Failed         Comm Failure             06:17:43 GMT Apr 29 2015
    ====Configuration State===
    ====Communication State===
    ==================================================================================
    Secondary Firewall
    cisc-asa# sh failover h
    ==========================================================================
    From State                 To State                   Reason
    ==========================================================================
    06:16:32 GMT Apr 29 2015
    Not Detected               Negotiation                No Error
    06:17:05 GMT Apr 29 2015
    Negotiation                Disabled                   Set by the config command
    ==========================================================================
    cisco-asa# sh failover
    Failover Off
    Failover unit Secondary
    Failover LAN Interface: e0/7 Vlan3 (down)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 4 of 23 maximum
    ecs-pune-fw-01# sh failover h
    ==========================================================================
    From State                 To State                   Reason
    ==========================================================================
    06:16:32 GMT Apr 29 2015
    Not Detected               Negotiation                No Error
    06:17:05 GMT Apr 29 2015
    Negotiation                Disabled                   Set by the config command
    ==========================================================================
    cisco-asa# sh failover state
                   State          Last Failure Reason      Date/Time
    This host  -   Secondary
                   Disabled       None
    Other host -   Primary
                   Not Detected   None
    ====Configuration State===
    ====Communication State===
    Thanks...

Maybe you are looking for

  • Photoshop CS activation help needed

    My desktop computer died and had to be replaced.  I installed Photoshop CS and have had the world's worst nightmare trying to get it activated. 1.  Attempts at on-line activation produce repeated messages that the on-line activation service is not av

  • Implementing password policie using Role and CoS

    Hy all, I have created a directory with the following partial structure (Sun directory 5.2 patch 2): ou=people,o=accounts,c=an |----- cn=user1 |----- cn=user2 |----- cn=user3 ou=services,o=accounts,c=an |---------cn=user4 |---------cn=user5 |--------

  • Error on SQL Developer startup

    All: I'm suddenly receiving the following popup when I try to run SQL Developer: Unable to create an instance of the Java Virtual Machine Located at path: c:\sun\AppServer\jdk\jre\bin\client\jvm.dll The only change I've made recently is installing .n

  • Batch Import of User Parameters

    Hello, I've got situation as follows: - UME J2EE datasource is corporate LDAP, - users are available in J2EE ume. I need to load initial information about portal roles assigned to users and mapping info to backend systems. Is it allowed via Batch Imp

  • Concept of currency conversion.

    In a report user is getting currency conversion issue. In report  all currency which is in Pound is not converting into EUROS.  So can any one tell me  concept of currency conversion. I am not able to understand where currency conversion is happing i