ASA 5505 Unable to assign ip to DMZ vlan interface
hi all,
I have ASA 5505 with base license.
I created 3rd vlan on it.it was created.
but i am unable to assign IP to it.
i assign ip address it takes it.
But when i do sh int ip brief it does not show any ip.
ciscoasa# sh int ip brief
Interface IP-Address OK? Method Status Prot
ocol
Ethernet0/0 unassigned YES unset up up
Ethernet0/1 unassigned YES unset up up
Ethernet0/2 unassigned YES unset up up
Ethernet0/3 unassigned YES unset administratively down down
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down
Ethernet0/6 unassigned YES unset administratively down down
Ethernet0/7 unassigned YES unset administratively down down
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Vlan1 192.168.1.1 YES CONFIG up up
Vlan2 192.168.11.2 YES CONFIG up up
Vlan3 unassigned YES manual up up*************************************************************
Virtual0 127.0.0.1 YES unset up up
ciscoasa# config t
ciscoasa(config)# int vlan 3
ciscoasa(config-if)# ip ad
ciscoasa(config-if)# ip address 192.168.12.2 255.255.255.0
ciscoasa(config-if)# end
ciscoasa# wr mem
Building configuration...
Cryptochecksum: 808baaba ced2a226 07cfb41f 9f6ec4f8
4608 bytes copied in 1.630 secs (4608 bytes/sec)
[OK]
ciscoasa# sh int ip brief
Interface IP-Address OK? Method Status Prot
ocol
Ethernet0/0 unassigned YES unset up up
Ethernet0/1 unassigned YES unset up up
Ethernet0/2 unassigned YES unset up up
Ethernet0/3 unassigned YES unset administratively down down
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down
Ethernet0/6 unassigned YES unset administratively down down
Ethernet0/7 unassigned YES unset administratively down down
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Vlan1 192.168.1.1 YES CONFIG up up
Vlan2 192.168.11.2 YES CONFIG up up
Vlan3 unassigned YES manual up up
Virtual0 127.0.0.1 YES unset up up
ciscoasa# sh ver
Cisco Adaptive Security Appliance Software Version 8.2(5)
Device Manager Version 6.4(9)
Compiled on Fri 20-May-11 16:00 by builders
System image file is "disk0:/asa825-k8.bin"
Config file at boot was "startup-config"
ciscoasa up 3 days 17 hours
Hardware: ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
0: Int: Internal-Data0/0 : address is 001d.a24d.ed0e, irq 11
1: Ext: Ethernet0/0 : address is 001d.a24d.ed06, irq 255
2: Ext: Ethernet0/1 : address is 001d.a24d.ed07, irq 255
3: Ext: Ethernet0/2 : address is 001d.a24d.ed08, irq 255
4: Ext: Ethernet0/3 : address is 001d.a24d.ed09, irq 255
5: Ext: Ethernet0/4 : address is 001d.a24d.ed0a, irq 255
6: Ext: Ethernet0/5 : address is 001d.a24d.ed0b, irq 255
7: Ext: Ethernet0/6 : address is 001d.a24d.ed0c, irq 255
8: Ext: Ethernet0/7 : address is 001d.a24d.ed0d, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : Unlimited
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
SSL VPN Peers : 2
Total VPN Peers : 10
Dual ISPs : Disabled
VLAN Trunk Ports : 0
Shared License : Disabled
AnyConnect for Mobile : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials : Disabled
Advanced Endpoint Assessment : Disabled
UC Phone Proxy Sessions : 2
<--- More --->
Need to know does this License support IP to 3rd vlan ?
Thanks
Mahesh
Hi Julio,
I tried to config namef if but here is result
ciscoasa# sh run int vlan 3
interface Vlan3
description DMZ to 3550 New Switch
no nameif
security-level 50
ip address 192.168.12.2 255.255.255.0
ciscoasa# config t
ciscoasa(config)# int vlan 3
ciscoasa(config-if)# name
ciscoasa(config-if)# namei
ciscoasa(config-if)# nameif DMZ
ERROR: This license does not allow configuring more than 2 interfaces with
nameif and without a "no forward" command on this interface or on 1 interface(s)
with nameif already configured.
Similar Messages
-
ASA 5505 configured for WebVPN connecting to Citrix Web Interface
ASA 5505 configured for WebVPN connecting to Citrix Web Interface.
i have a ASA 5505 that I am attempting to configure for WebVPN with passthrough into Web Interface . The user authenticates into WebVPN OK and gets the option to click on the Citrix Link (which is i add bookmark citrix server http:// 172.30.40.5.) i enter the citrix and then for example i want to open to outlook it can not open. (when i want to open some application no application is open)).there is no alarm at asa. how i solve this issue?
thanks.Teymur,
Can you confim that after disabling the ssl/tls on the Citrix server (secure connectivity) that you are getting exactly the same error. It is possible that it is generating a different error.
The bug where we have see the existing error was CSCtf06303 but that has been fixed in 8.4.1. Can you confirm the exact version of code you are running on the ASA.
If you have confirmed the above two notes it may be adventageous to open a TAC case as we may need to do some live additional troubleshooting.
Thanks
-Jay -
ASA 5505 unable to connect inside or outside
Hello,
I'm extremely new to router configurations, and am attempting to configure a backup ASA 5505 to use as a temporary access point in the event that our main ASA becomes unavailable. What I have done is loaded the running config from our main ASA onto the backup, and have made changes to necessary routes, IPs, etc. I can connect to it from a remote computer without problem, but I cannot access any of our servers, nor can I access the internet. I have also tried modifying the access list and NAT rules every which way from Sunday, but I still cannot get this thing to allow any information through. I keep getting "failed to locate egress interface for UDP from outside" errors.
We are using Cisco AnyConnect to connect , and mind you, since the config for this backup ASA was taken from our main, it still has the original certificate info and profiles. I was told that this wouldn't matter, but I thought I should mention in case I need to remove any of it from the config.
Here is part of the config file. I took out some information, but tried to keep it understandable. If anyone could point me in the right direction, it would be greatly appreciated!
ciscoasa# show running-config
: Saved
: Serial Number: xxxxxxxxxxx
: Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
ASA Version 9.2(2)
hostname ciscoasa
domain-name domain
enable password encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd encrypted
names
ip local pool pool1 x.x.9.22-x.x.9.254 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address x.x.8.10 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.237 255.255.255.248
boot system disk0:/asa922-k8.bin
boot config disk0:/startup-config
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group Default
name-server x.x.8.100
domain-name domain
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network pool1
subnet x.x.9.0 255.255.255.0
object network outside-network
host x.x.x.237
object network Remote-Network
subnet x.x.8.0 255.255.255.0
object network local
object network obj-x.x.9.24
host x.x.9.24
object-group network Outside-Network-Group
description Outside Network Group
network-object x.x.x.232 255.255.255.248
object-group network Inside-Network-Group
description Inside Network Group
network-object x.x.8.0 255.255.255.0
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit ip any any
access-list NONAT extended permit ip x.x.8.0 255.255.255.0 x.x.9.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 30000
logging buffered debugging
logging asdm informational
no logging message 106015
no logging message 313001
no logging message 313008
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020
flow-export destination inside x.x.8.132 2055
flow-export template timeout-rate 1
flow-export delay flow-create 50
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
asdm image disk0:/asdm-722.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static pool1 pool1 no-proxy-arp route-lookup
nat (inside,outside) source static any any destination static Remote-Network Remote-Network no-proxy-arp route-lookup
nat (outside,outside) source dynamic pool1 interface
object network obj_any
nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 x.x.x.232 1
route inside x.x.11.0 255.255.255.0 x.x.11.1 1
If you have any questions, or need any other information, please let me know.
Thanks!Am I posting this in the wrong section? Anyone?
-
ASA 5505: unable to ping external hosts
Hi,
I have a LAN behind ASA 5505, interface NAT/PAT is configured.
External interface is configured for PPPoE.
Everything works fine except I cannot ping from a LAN PC external hosts. I can however ping external hosts from ASA itself. ICMP is allowed:
icmp permit any inside
icmp permit any outside
access-list outside_access_in extended permit icmp any any
Protocol inspections and fixups are default.
When I ping an external host 61.95.50.185 from the LAN host 10.2.32.68 I am getting the following in the log:
302020 61.95.50.185 10.2.32.68 Built ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 10.2.32.68/512
302020 61.95.50.185 202.xx.yy.zz Built ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 202.xx.yy.zz/1
313004 Denied ICMP type=0, from laddr 61.95.50.185 on interface outside to 202.xx.yy.zz: no matching session
313001 61.95.50.185 Denied ICMP type=0, code=0 from 61.95.50.185 on interface outside
302021 61.95.50.185 202.xx.yy.zz Teardown ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 202.xx.yy.zz/1
302021 61.95.50.185 10.2.32.68 Teardown ICMP connection for faddr 61.95.50.185/0 gaddr 202.xx.yy.zz/1 laddr 10.2.32.68/512
Where 202.xx.yy.zz is IP of external interface of ASA.
This is a very simple setup that runs on a number of othe PIXes/ASAs and pings to external IP normally work just fine. I can't understand why ping replies are getting dropped on the interface?
Any help will be highly appreciated.
Thank you.
AlexAlex / Kerry, you have couple of options for handling icmp outbound, either acl or icmp inspection :
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended permit icmp any any source-quench
access-list outside_access_in extended permit icmp any any unreachable
access-list outside_access_in extended permit icmp any any time-exceeded
access-group outside_access_in in interface outside
or icmp inspection instead of acl.
policy-map global_policy
class inspection_default
inspect icmp
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
HTH
Jorge -
ASA 5505 - L2TP over IPsec - Remote Address shows outside interface address
Using an ASA 5505 for firewall and VPN. We've enabled L2TP over IPsec to allow Windows clients to connect without third party software.
The devices complete the connection and authenticate fine, but then are unable to hit any internal resources. Split tunneling seems to be working, as they can still hit outside resources. Packet tracer shows tcp flowing freely between VPN clients (192.168.102.0/24) and internal resources (192.168.100.0/24). Even the NAT translation looks good in packet tracer.
I pulled up the session details for one of the VPN clients in the ASDM and under the IPsecOverNatT details, it is showing the VPN client's remote address correctly, but displays the local address as the address assigned to the outside interface (which the client is using to connect.) This seems to be the problem, as viewing detailed connection logs shows the internal resources trying to send packets back to the outside interface rather than the VPN client's assigned internal addresses. Details:
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: [OUTSIDE INTERFACE ADDRESS]
local ident (addr/mask/prot/port): ([OUTSIDE INTERFACE ADDRESS]/255.255.255.255/17/1701)
remote ident (addr/mask/prot/port): ([VPN CLIENT ADDRESS]/255.255.255.255/17/0)
current_peer: [VPN CLIENT ADDRESS], username: vpnuser
dynamic allocated peer ip: 192.168.102.1 [This is what I think it should be showing for local ident]
dynamic allocated peer ip(ipv6): 0.0.0.0
#pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16
#pkts decaps: 18, #pkts decrypt: 18, #pkts verify: 18
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 16, #pkts comp failed: 0, #pkts decomp failed: 0
#post-frag successes: 0, #post-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (rcv): 0,
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: [OUTSIDE INTERFACE ADDRESS]/4500, remote crypto endpt.: [VPN CLIENT ADDRESS]/8248
path mtu 1500, ipsec overhead 82(52), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 05BFAE20
current inbound spi : CF85B895
inbound esp sas:
spi: 0xCF85B895 (3481647253)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Transport, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 77824, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (kB/sec): (4373998/3591)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x000FFFFD
outbound esp sas:
spi: 0x05BFAE20 (96448032)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Transport, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 77824, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (kB/sec): (4373999/3591)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
Any ideas? The remote clients connect but when internal resources try to send traffic to the VPN clients, the packets are directed to the outside interface address instead of the local address assigned to the VPN client.I have what I believe to be a similar issue. Site to site vpn is working well. That is site b can ping and send traffic to site A but Site A can not. Site B is a 3rd party vpn router. Site A is a Cisco 5505.
It appears that when the crypto map inserts the route into the routing table it shows the route via the outside IP of the outside interface and not the IP of Site B. in the crypto map I can see the proper ip address for the peer. I can't figure out why when it inserts the route that it uses the wrong ip address -
Cannot Assign IP to a vlan interface SG-300 28MP
hI all a very simple configurations ... bought 10 smb sg-300 28mp switches . every thing goes fine in vlan configuration, port assigning .. but when I try to assign ip to one of the created vlan interface switch hangs GUI or CLI. Layer 3 is enabled. regards
Configure as below
Login to CLI:
switch(config):int vlan 1
switch(int-config):ip address 192.168.1.254 255.255.255.0
switch(int-config):no ip dhcp relay enable
switch(config):do wr
switch(config):int vlan 2 -----------------------> New vlan
switch(int-config):ip address 192.168.2.xx 255.255.255.0
switch(int-config):no ip dhcp relay enable
switch(config):do wr -
ASA 5505 unable to access ASDM ( just needs some ports ope and FWDing setup)
I was able to access the ASDM launcher in the browser yesterday via https://192.168.111.1/admin and I was stuck there as the browser version says that my ASA image does not work with my ASDM version... So i tried some trouble shooting and think that i may have changed the image to an image that does not exist. (I'm not sure where it is that I would actually place that image either) Now i am unable to access through the browser at all.
Anyways, I am ok with SSH/CLI and have been using my firewall in this manner. I am walking into this companies current configuration and simply need to do the following:
I need to OPEN ports 9000, 85, 40085, 49005 so that my mobile device can pull my security cameras in the office
I need to set port forwarding so that any connections that hit outside-in ip address 205.214.36.53:1610 >>> http://192.168.111.30:1610/AndroidWS/ for our new mobile CRM.
I have been through some of your related discussions and am falling short somewhere. Please help
here is my "show run" and my "dir"
ciscoasa(config)# show run
: Saved
ASA Version 9.0(2)
hostname ciscoasa
domain-name scec.local
enable password ol40hHpZTtZQFXMJ encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd ol40hHpZTtZQFXMJ encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif INSIDE
security-level 100
ip address 192.168.111.1 255.255.255.0
interface Vlan2
nameif OUTSIDE
security-level 0
ip address 205.214.236.50 255.255.255.240
boot system disk0:/asa902-k8.bin
boot system disk0:/asa825-k8.bin
boot system disk0:/asa831-k8.bin
ftp mode passive
dns domain-lookup INSIDE
dns domain-lookup OUTSIDE
dns server-group DefaultDNS
name-server 192.168.111.50
name-server 8.8.8.8
domain-name scec.local
object network LAN
subnet 192.168.111.0 255.255.255.0
object network SERVER1
host 192.168.111.50
object network SERVER1_PUBLIC
host 205.214.236.51
object network SERVER2
host 192.168.111.20
object network SERVER2_PUBLIC
host 205.214.236.52
object network SERVER3
host 192.168.111.30
object network SERVER3_PUBLIC
host 205.214.236.53
object network SERVER4
host 192.168.111.40
object network SERVER4_PUBLIC
host 205.214.236.54
object network SERVER5
host 192.168.111.10
object network SERVER5_PUBLIC
host 205.214.236.55
object-group service SERVER1_PORTS tcp
port-object eq www
port-object eq https
port-object eq smtp
port-object eq pop3
port-object eq imap4
port-object eq 3389
object-group service SERVER2_PORTS tcp
port-object eq 3389
object-group service SERVER3_PORTS tcp
port-object eq 3389
object-group service SERVER4_PORTS tcp
port-object eq 3389
object-group service SERVER5_PORTS tcp
port-object eq 3389
port-object eq www
port-object eq https
access-list OUTSIDE_IN extended deny ip 10.0.0.0 255.0.0.0 any log
access-list OUTSIDE_IN extended deny ip 172.16.0.0 255.240.0.0 any log
access-list OUTSIDE_IN extended deny ip 192.168.0.0 255.255.0.0 any log
access-list OUTSIDE_IN extended deny ip 127.0.0.0 255.0.0.0 any log
access-list OUTSIDE_IN extended deny ip 0.0.0.0 255.255.255.0 any log
access-list OUTSIDE_IN extended deny ip 244.0.0.0 255.255.255.240 any log
access-list OUTSIDE_IN extended deny ip host 255.255.255.255 any log
access-list OUTSIDE_IN extended permit icmp any any echo-reply
access-list OUTSIDE_IN extended permit icmp any any time-exceeded
access-list OUTSIDE_IN extended permit icmp any any unreachable
access-list OUTSIDE_IN extended permit tcp any object SERVER1 object-group SERVER1_PORTS
access-list OUTSIDE_IN extended permit tcp any object SERVER2 object-group SERVER2_PORTS
access-list OUTSIDE_IN extended permit tcp any object SERVER3 object-group SERVER3_PORTS
access-list OUTSIDE_IN extended permit tcp any object SERVER4 object-group SERVER4_PORTS
access-list OUTSIDE_IN extended permit tcp any object SERVER5 object-group SERVER5_PORTS
access-list inside-out extended permit ip any any
pager lines 24
logging asdm informational
mtu INSIDE 1500
mtu OUTSIDE 1500
ip audit name OUTSIDE_ATTACK attack action alarm drop
ip audit name OUTSIDE_INFO info action alarm
ip audit name INSIDE_ATTACK attack action alarm drop reset
ip audit name INSIDE_INFO info action alarm
ip audit interface INSIDE INSIDE_INFO
ip audit interface OUTSIDE OUTSIDE_INFO
ip audit interface OUTSIDE OUTSIDE_ATTACK
ip audit signature 2000 disable
ip audit signature 2001 disable
ip audit signature 2004 disable
ip audit signature 2005 disable
ip audit signature 6051 disable
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-509.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (INSIDE,OUTSIDE) source static SERVER1 SERVER1_PUBLIC
nat (INSIDE,OUTSIDE) source static SERVER2 SERVER2_PUBLIC
nat (INSIDE,OUTSIDE) source static SERVER3 SERVER3_PUBLIC
nat (INSIDE,OUTSIDE) source static SERVER4 SERVER4_PUBLIC
nat (INSIDE,OUTSIDE) source static SERVER5 SERVER5_PUBLIC
object network LAN
nat (INSIDE,OUTSIDE) dynamic interface
access-group inside-out in interface INSIDE
access-group OUTSIDE_IN in interface OUTSIDE
route OUTSIDE 0.0.0.0 0.0.0.0 205.214.236.49 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authorization exec LOCAL
http server enable
http 0.0.0.0 0.0.0.0 INSIDE
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 INSIDE
ssh 0.0.0.0 0.0.0.0 OUTSIDE
ssh timeout 5
ssh version 2
console timeout 0
dhcpd option 3 ip 192.168.111.1
dhcpd address 192.168.111.100-192.168.111.200 INSIDE
dhcpd dns 192.168.111.50 8.8.8.8 interface INSIDE
dhcpd enable INSIDE
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username wti password OIEBfkGT1DRShCnN encrypted privilege 15
username admin password g/t7o/eHDKMomDrS encrypted privilege 15
username vpnuser password 8DcFkqJ9hi39UQw. encrypted privilege 15
username sysadmin password mi1AUI982JWkJuWt encrypted
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:6dd04d2527e7929343ebd090969e18a1
: end
ciscoasa(config)# dir
Directory of disk0:/
148 -rwx 15390720 09:08:54 Jul 31 2013 asa825-k8.bin
149 -rwx 27611136 09:43:48 Oct 31 2013 asa902-k8.bin
150 -rwx 2048 00:00:00 Jan 01 1980 FSCK0000.REC
20 drwx 2048 09:12:16 Jul 31 2013 coredumpinfo
151 -rwx 16280544 09:14:46 Jul 31 2013 asdm-645.bin
10 drwx 2048 09:19:42 Jul 31 2013 log
19 drwx 2048 09:20:08 Jul 31 2013 crypto_archive
153 -rwx 14240396 14:14:18 Jun 11 2014 asdm-631.bin
154 -rwx 4096 00:00:00 Jan 01 1980 FSCK0001.REC
155 -rwx 12998641 09:20:28 Jul 31 2013 csd_3.5.2008-k9.pkg
156 drwx 2048 09:20:30 Jul 31 2013 sdesktop
157 -rwx 6487517 09:20:32 Jul 31 2013 anyconnect-macosx-i386-2.5.2014-k9.pkg
158 -rwx 6689498 09:20:36 Jul 31 2013 anyconnect-linux-2.5.2014-k9.pkg
159 -rwx 4678691 09:20:38 Jul 31 2013 anyconnect-win-2.5.2014-k9.pkg
160 -rwx 4096 00:00:00 Jan 01 1980 FSCK0002.REC
161 -rwx 4096 00:00:00 Jan 01 1980 FSCK0003.REC
162 -rwx 4096 00:00:00 Jan 01 1980 FSCK0004.REC
163 -rwx 6144 00:00:00 Jan 01 1980 FSCK0005.REC
164 -rwx 6144 00:00:00 Jan 01 1980 FSCK0006.REC
165 -rwx 6144 00:00:00 Jan 01 1980 FSCK0007.REC
166 -rwx 22528 00:00:00 Jan 01 1980 FSCK0008.REC
167 -rwx 38912 00:00:00 Jan 01 1980 FSCK0009.REC
168 -rwx 34816 00:00:00 Jan 01 1980 FSCK0010.REC
169 -rwx 43008 00:00:00 Jan 01 1980 FSCK0011.REC
170 -rwx 2048 00:00:00 Jan 01 1980 FSCK0012.REC
171 -rwx 26624 00:00:00 Jan 01 1980 FSCK0013.REC
172 -rwx 2048 00:00:00 Jan 01 1980 FSCK0014.REC
173 -rwx 26624 00:00:00 Jan 01 1980 FSCK0015.REC
174 -rwx 2048 00:00:00 Jan 01 1980 FSCK0016.REC
175 -rwx 2505 09:46:08 Oct 31 2013 8_2_5_0_startup_cfg.sav
176 -rwx 1189 09:46:12 Oct 31 2013 upgrade_startup_errors_201310310946.log
177 -rwx 100 16:42:40 Jun 10 2014 upgrade_startup_errors_201406101642.log
178 -rwx 100 14:52:26 Jun 11 2014 upgrade_startup_errors_201406111452.log
127004672 bytes total (21886976 bytes free)
Please let me know if you need any other information from me so that i can get our mobile devices to connect to the new CRM from outside the network and allow the owner access on his mobile device to the company cameras.
************** (NOTE: I can do both of these things currently from within the network without any issues)*************
THANKSJgreene -
This doesn't specifically answer your question, but if you want to get ASDM functionality back you need to load a newer version onto flash memory and then point the ASA to that with the configuration command:
asdm image disk0:/asdm-version.bin
You are running ASA Version 9.0(2) so you need at least version 7 of ASDM to support that. Interestingly enough your "asdm image" statement in your config points to asdm-509.bin and you have asdm-631.bin and asdm-645.bin on flash. None of those will work. I suggest loading up asdm-721.bin and changing the asdm image statement accordingly. I am pretty sure a reboot is required after that is done.
Good Luck!
-Jeff -
ASA 5505, how to configure DMZ to Inside traffic flows
Dear.
We have a Cisco ASA 5505 with an outside, inside and DMZ interface.
We really need all these interfaces.
The DMZ interface has been configured to block any traffic to the inside (restrict traffic flow). This restriction can’t be disable, an error occurred when doing this.
I will allow only one single port has access from DMZ to the inside, is that possible? And how?
Thanks for the feedback.
Regards.
Peter.What i mean with "can't be disabled": when you navigate to Configuration/interfaces and select the DMZ interface / advanced, you can block traffic. By default Inside has been selected in the drop-down box. However, you can't leave it blank, you need to specify at least one. I can't create another, extra interfaces because the license is 3 max.
So, my question is: can I create a rule somewhere to overwrite this setting for only one specific port? And how?
Result of the command: "show version"
Cisco Adaptive Security Appliance Software Version 8.2(5)
Device Manager Version 6.4(5)
Compiled on Fri 20-May-11 16:00 by builders
System image file is "disk0:/asa825-k8.bin"
Config file at boot was "startup-config"
router up 100 days 1 hour
Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
0: Int: Internal-Data0/0 : address is a44c.11bb.5492, irq 11
1: Ext: Ethernet0/0 : address is a44c.11bb.548a, irq 255
2: Ext: Ethernet0/1 : address is a44c.11bb.548b, irq 255
3: Ext: Ethernet0/2 : address is a44c.11bb.548c, irq 255
4: Ext: Ethernet0/3 : address is a44c.11bb.548d, irq 255
5: Ext: Ethernet0/4 : address is a44c.11bb.548e, irq 255
6: Ext: Ethernet0/5 : address is a44c.11bb.548f, irq 255
7: Ext: Ethernet0/6 : address is a44c.11bb.5490, irq 255
8: Ext: Ethernet0/7 : address is a44c.11bb.5491, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 50
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
SSL VPN Peers : 2
Total VPN Peers : 10
Dual ISPs : Disabled
VLAN Trunk Ports : 0
Shared License : Disabled
AnyConnect for Mobile : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials : Disabled
Advanced Endpoint Assessment : Disabled
UC Phone Proxy Sessions : 2
Total UC Proxy Sessions : 2
Botnet Traffic Filter : Disabled
This platform has a Base license.
Serial Number: xxxxxxxxxxxxxx
Running Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
Configuration register is 0x1
Configuration last modified by enable_15 at 14:43:11.295 CEDT Mon Sep 9 2013 -
Hi. I have an ASA 5505 configured for Transparent Mode. The Outside interface connects to a router (RV042). The router manages DHCP. With the 5505 in the system, all computers can connect to the internet and to each other, except for a few. The problem computers can be made to work if they are set to a specific address, rather than automatically assigned by the router. Some of the iPads work correctly, some do not. At least one Apple Notebook cannot connect even if I enter a static address.
Consulting the documentation, I found that DHCP traffic (UPD Port 67 and 68) needed to be enabled via rules for the Inside and Outside interfaces. I did that in ASDM but now nothing works.
I have pulled the 5505 out of the system and restored it to the configuration that worked for most of the computers.
Any suggestions would be appreciated. I can pull a "show" run from CLI if it is useful.
Thanks...Understood. I tried adding the "inside_out extended permit ip any any" command, but it made no difference. Because the implicit rule (permit ip traffic to any less secure interface) is still in the access list table, it would seem the additional extended rule is not needed.
When I first received the 5505, it had an older version of firmware. At the time, when I entered any rule in ASDM it deleted the "less secure" implicit rule, which then broke the system since there was no path for internet traffic from inside to outside, as you have stated. With the newest firmware release, however, when I enter a rule, the "less secure" implicit rule does not go away.
So, with help from the folks here I have made progress. Right now the issue is that when the 5505 in Transparent Mode is between the router and user computers, the computers cannot reliably get addresses that are auto-assigned by the router.
Looking through the logs displayed on ASDM, I noticed the following curious statement:
"6 Mar 31 2014 07:16:42 fe80::1131:41c2:3627:8339 63575 ff02::1:3 5355 No management IP address configured for transparent firewall. Dropping protocol UDP packet from outside:fe80::1131:41c2:3627:8339/63575 to inside:ff02::1:3/5355"
However, I have configured a management IP address, and it is listed in the "show" document that I posted yesterday:
interface BVI1
ip address 192.168.1.10 255.255.255.0
So, I am confused.
I appreciate the help. I am new to the 5505, although I participated as a "friendly" in the ASA program some years ago. I recall a similar problem with that setup. Regrettably, I can't remember how we fixed it...
Regards... -
ASA 5505 Best Practice Guidance Requested
I am hoping to tap into the vast wealth of knowledge on this board in order to gain some "best practice" guidance to assist me with the overall setup using the ASA 5505 for a small business client. I'm fairly new to the ASA 5505 so any help would be most appreciated!
My current client configuration is as follows:
a) business internet service (cable) with a fixed IP address
b) a Netgear N600 Wireless Dual Band router (currently setup as gateway and used for internet/WiFi access)
c) a Cisco SG-500-28 switch
d) one server running Windows Small Business Server 2011 Standard (primary Domain Controller)
(This server is currently the DNS and DHCP server)
e) one server running Windows Server 2008 R2 (secondary Domain Controller)
f) approximately eight Windows 7 clients (connected via SG-500-28 switch)
g) approximately six printers connected via internal network (connected via SG-500-28 switch)
All the servers, clients, and printers are connected to the SG-500-28 switch.
The ISP provides the cable modem for the internet service.
The physical cable for internet is connected to the cable modem.
From the cable modem, a CAT 6 ethernet cable is connected to the internet (WAN) port of the Netgear N600 router.
A Cat 6 ethernet cable is connected from Port 1 of the local ethernet (LAN) port on the N600 router to the SG-500-28 switch.
cable modem -> WAN router port
LAN router port -> SG-500-28
The ASA 5505 will be setup with an "LAN" (inside) interface and a "WAN" (outside) interface. Port e0/0 on the ASA 5505 will be used for the outside interface and the remaining ports will be used for the inside interface.
So my basic question is, given the information above of our setup, where should the ASA 5505 be "inserted" to maximize its performance? Also, based on the answer to the previous question, can you provide some insight as to how the ethernet cables should be connected to achieve this?
Another concern I have is what device will be used as the default gateway. Currently, the Netgear N600 is set as the default gateway on both Windows servers. In your recommended best practice solution, does the ASA 5505 become the default gateway or does the router remain the default gateway?
And my final area of concern is with DHCP. As I stated earlier, I am running DHCP on Windows Small Business Server 2011 Standard. Most of the examples I have studied for the ASA 5505 utilize its DHCP functionality. I also have done some research on the "dhcprelay server" command. So I'm not quite sure which is the best way to go. First off, does the "dhcprelay server" even work with SBS 2011? And secondly, if it does work, is the best practice to use the "dhcprelay" command or to let the ASA 5505 perform the DHCP server role?
All input/guidance/suggestions with these issues would be greatly appreciated! I want to implement the ASA 5505 firewall solution following "best practices" recommendations in order to maximize its functionality and minimize the time to implement.
FYI, the information (from the "show version" command) for the ASA 5505 is shown below:
Cisco Adaptive Security Appliance Software Version 8.4(7)
Device Manager Version 7.1(5)100
Compiled on Fri 30-Aug-13 19:48 by builders
System image file is "disk0:/asa847-k8.bin"
Config file at boot was "startup-config"
ciscoasa up 2 days 9 hours
Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06
Number of accelerators: 1
0: Int: Internal-Data0/0 : address is a493.4c99.8c0b, irq 11
1: Ext: Ethernet0/0 : address is a493.4c99.8c03, irq 255
2: Ext: Ethernet0/1 : address is a493.4c99.8c04, irq 255
3: Ext: Ethernet0/2 : address is a493.4c99.8c05, irq 255
4: Ext: Ethernet0/3 : address is a493.4c99.8c06, irq 255
5: Ext: Ethernet0/4 : address is a493.4c99.8c07, irq 255
6: Ext: Ethernet0/5 : address is a493.4c99.8c08, irq 255
7: Ext: Ethernet0/6 : address is a493.4c99.8c09, irq 255
8: Ext: Ethernet0/7 : address is a493.4c99.8c0a, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8 perpetual
VLANs : 3 DMZ Restricted
Dual ISPs : Disabled perpetual
VLAN Trunk Ports : 0 perpetual
Inside Hosts : 10 perpetual
Failover : Disabled perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 10 perpetual
Total VPN Peers : 12 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has a Base license.Hey Jon,
Again, many thanks for the info!
I guess I left that minor detail out concerning the Guest network. I have a second Netgear router that I am using for Guest netowrk access. It is plugged in to one of the LAN network ports on the first Netgear router.
The second Netgear (Guest) router is setup on a different subnet and I am letting the router hand out IP addresses using DHCP.
Basic setup is the 192.168.1.x is the internal network and 192.168.11.x is the Guest network. As far as the SBS 2011 server, it knows nothing about the Guest network in terms of the DHCP addresses it hands out.
Your assumption about the Guest network is correct, I only want to allow guest access to the internet and no access to anything internal. I like your idea of using the restricted DMZ feature of the ASA for the Guest network. (I don't know how to do it, but I like it!) Perhaps you could share more of your knowledge on this?
One final thing, the (internal) Netgear router setup does provide the option for a separate Guest network, however it all hinges on the router being the DHCP server. This is what led me to the second (Guest) Netgear router because I wanted the (internal) Netgear router NOT to use DHCP. Instead I wanted SBS 2011 to be the DHCP server. That's what led to the idea of a second (Guest) router with DHCP enabled.
The other factor in all this is SBS 2011. Not sure what experience you've had with the Small Business Server OS's but they tend to get a little wonky if some of the server roles are disabled. For instance, this is a small busines with a total of about 20 devices including servers, workstations and printers. Early on I thought, "nah, I don't need this IPv6 stuff," so I found an article on how to disable it and did so. The server performance almost immediately took a nose dive. Rebooting the server went from a 5 minute process to a 20 minute process. And this was after I followed the steps of an MSDN article on disabling IPv6 on SBS 2011! Well, long story short, I enabled IPv6 again and the two preceeding issues cleared right up. So, since SBS 2011 by "default" wants DHCP setup I want to try my best to accomodate it. So, again, your opinion/experiece related to this is a tremendous help!
Thanks! -
Asa 5505 transparent firewall issue
hi i am having uc560 with voice and data vlan and i am having 3560 layer3 switch and my network is working fine the dhcp for voice and data both are running in uc560.
now i add asa 5505 between uc560 and switch in transparent mode means from uc560 to asa 5505 outside interface and from asa inside interface to switch,
i conigured vlan1 -- inside and vlan 2 as outside in asa 5505
in my uc 560 data is vlan 1 and my voice is vlan 100.
when i connect my network with transparent mode firewall no dhcp amd no phones are working . but if i remove asa and i connect with uc560 to switch everything is fine.
is there anyway to work multiple voice and data vlan in asa 5505 transparent mode.hi rojas,
here is my problem,
my internet and voice all connected in the uc 560 so wat i am doing i am connecting firewall outside to uc 560 trunk port and the from inside to my switch.
when i connec to my switch it is giving message inconsistant vlan and it is port is blocked. and my phones are not working.
my data vlan1 is 192.168.123.x
and my voice vlan100 is 10.1.1.x
and the firewall ip 192.168.123.3 -
ASA 5505 Vlan1/Inside Interface Down
I did an initial setup of an ASA 5505 using the setup wizard.
The inside interface is showing down/down. It is not shutdown in the running config.
The ethernet ports say "available but not configured via nameif."
Anyone have some ideas for me to check?
ethernet0/0 is working with no problems.Thank you for your question. This community is for Cisco Small Business products and your question is in reference to a Cisco Elite/Classic product. Please post your question in the Cisco NetPro forums located here: http://forums.cisco.com/eforum/servlet/NetProf?page=main This forum has subject matter experts on Cisco Elite/Classic products that may be able to answer your question.
Brian -
ASA 5545-X SVI/Vlan Interface
I am looking to deploy ASA 5545-X with Layer 3 Vlan Interfaces, the device out of the box dosent let you create vlan interfaces. Is there any module available which enables to create Switch Virtual Interfaces.
I was looking at I/O 6 ports Gigabit Ethernet card, but wanted to make sure before ordering.
Many ThanksHi,
You are only able to configure Sub Interfaces for the Vlan ID on your ASA model.
You can only configure actual Vlan interfaces with ASASM and ASA5505 model. This relates to the fact that ASA5505 has a switch module while your model does not.
I have no expirience with the ASASM but I would imagine its similiar to the FWSM which also used Vlan interfaces as its a module in an actual larger switch/router platform.
You can check this limitation from the Command Reference also
interface vlan For the ASA 5505 and ASASM, to configure a VLAN interface and enter interface configuration mode, use the interface vlan command in global configuration mode. To remove a VLAN interface, use the no form of this command. interface vlan number no interface vlan number Syntax Description
number
Specifies a VLAN ID.
For the ASA 5505, use an ID between 1 and 4090. The VLAN interface ID is enabled by default on VLAN 1.
For the ASASM, use an ID between 2 to 1000 and from 1025 to 4094.
- Jouni -
ASA 5505 ver 8.4 DMZ to Outside not working
I have an ASA 5505 ver 8.4. The configuration is provided below. My INSIDE hosts are able to get to the internet via the Outside interface. The DHCP for my INSIDE hosts are handled by my L3 3560 switch. My DMZ hosts DHCP is handled by the ASA 5505. I've included packet-tracer results for both from the DMZ to the Outside address (DNS server) and a return packet tracer from the Outside interface to the DMZ host address. I see that the return is failing, however everything I have tried so far hasn't worked. Thank you in advance for any assistance.
***************************************8
ASA Version 8.4(4)
hostname mxfw
domain-name moxiefl.com
enable password (removed)
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
shutdown
interface Ethernet0/4
shutdown
interface Ethernet0/5
switchport trunk allowed vlan 20,22
switchport mode trunk
interface Ethernet0/6
shutdown
interface Ethernet0/7
shutdown
interface Vlan1
nameif inside
security-level 100
ip address 10.0.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
interface Vlan20
nameif dmz
security-level 50
ip address 172.26.20.1 255.255.255.0
interface Vlan22
nameif dmz2
security-level 50
ip address 172.26.22.1 255.255.255.0
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 208.67.222.222
name-server 208.67.220.220
domain-name moxiefl.com
same-security-traffic permit inter-interface
object network Generic_All_Network
subnet 0.0.0.0 0.0.0.0
object network INSIDE_Hosts
subnet 10.1.0.0 255.255.0.0
object network AnyConnect_Hosts
subnet 192.168.60.0 255.255.255.0
object network NETWORK_OBJ_192.168.60.0_26
subnet 192.168.60.0 255.255.255.192
object network DMZ_Network
subnet 172.26.20.0 255.255.255.0
object network DMZ2_Network
subnet 172.26.22.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu outside 1500
mtu dmz 1500
mtu dmz2 1500
ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic Generic_All_Network interface
nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup
nat (dmz,outside) source dynamic Generic_All_Network interface
nat (dmz2,outside) source dynamic Generic_All_Network interface
route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
fqdn anyconnect.moxiefl.com
subject-name CN=AnyConnect.moxiefl.com
keypair AnyConnect
proxy-ldc-issuer
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 439a4452
3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
telnet timeout 5
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 208.67.222.222 208.67.220.220
dhcpd auto_config outside
dhcpd address 10.0.1.20-10.0.1.40 inside
dhcpd dns 208.67.222.222 208.67.220.220 interface inside
dhcpd enable inside
dhcpd address 172.26.20.21-172.26.20.60 dmz
dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
dhcpd enable dmz
dhcpd address 172.26.22.21-172.26.22.200 dmz2
dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
dhcpd enable dmz2
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_AnyConnect internal
group-policy GroupPolicy_AnyConnect attributes
wins-server none
dns-server value 208.67.222.222 208.67.220.220
vpn-tunnel-protocol ikev2 ssl-client
default-domain value moxiefl.com
webvpn
anyconnect profiles value AnyConnect_client_profile type user
username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
tunnel-group AnyConnect type remote-access
tunnel-group AnyConnect general-attributes
address-pool VPN_POOL
default-group-policy GroupPolicy_AnyConnect
tunnel-group AnyConnect webvpn-attributes
group-alias AnyConnect enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:f2c7362097b71bcada023c6bbfc45121
: end
Packet Tracer from DMZ to Outside
mxfw# packet-tracer input dmz icmp 172.26.20.22 8 0 208.67.222.222 detailed
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside
Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xac5bdb90, priority=0, domain=inspect-ip-options, deny=true
hits=22, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=dmz, output_ifc=any
Phase: 3
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xacff7ee0, priority=70, domain=inspect-icmp, deny=false
hits=8, user_data=0xad253a68, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0
input_ifc=dmz, output_ifc=any
Phase: 4
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xac5bd768, priority=66, domain=inspect-icmp-error, deny=false
hits=8, user_data=0xac5bcd80, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0
input_ifc=dmz, output_ifc=any
Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (dmz,outside) source dynamic Generic_All_Network interface
Additional Information:
Dynamic translate 172.26.20.22/0 to 192.168.1.231/23136
Forward Flow based lookup yields rule:
in id=0xac63c0e8, priority=6, domain=nat, deny=false
hits=7, user_data=0xac6209f0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=dmz, output_ifc=outside
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0xac578bf0, priority=0, domain=inspect-ip-options, deny=true
hits=7510, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=outside, output_ifc=any
Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 7561, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_inspect_icmp
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_inspect_icmp
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: dmz
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow
Packet Tracer for return from Outside:
mxfw(config)# packet-tracer input outside icmp 207.67.222.222 0 0 172.26.20.22$
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 172.26.20.0 255.255.255.0 dmz
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xacea45d8, priority=11, domain=permit, deny=true
hits=0, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
input_ifc=outside, output_ifc=any
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: dmz
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Settings of PC and PING & tracert results
C:\Users>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : MXW8DT01
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Wireless LAN adapter Local Area Connection* 11:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : 68-94-23-20-FA-C5
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Wireless LAN adapter Wi-Fi:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Ralink RT5390R 802.11bgn Wi-Fi Adapter
Physical Address. . . . . . . . . : 68-94-23-20-FA-C3
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe FE Family Controller
Physical Address. . . . . . . . . : 08-9E-01-3D-64-39
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.26.20.22(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Sunday, October 6, 2013 3:28:48 PM
Lease Expires . . . . . . . . . . : Sunday, October 6, 2013 4:28:48 PM
Default Gateway . . . . . . . . . : 172.26.20.1
DHCP Server . . . . . . . . . . . : 172.26.20.1
DNS Servers . . . . . . . . . . . : 208.67.222.222
208.67.220.220
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{9B004C7D-7A34-4A9C-BEDB-5212A582FAB1}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:3497:208a:53e5:ebe9(Pref
erred)
Link-local IPv6 Address . . . . . : fe80::3497:208a:53e5:ebe9%16(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled
C:\Users>ping 208.67.222.222
Pinging 208.67.222.222 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 208.67.222.222:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
C:\Users>tracert 208.67.222.222
Tracing route to 208.67.222.222 over a maximum of 30 hops
1 1 ms <1 ms <1 ms 172.26.20.1
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.Naveen & Julio,
The version is below along with the captures. The show cap asp | include 208.67.222.222 is fairly long.
Thank you again for your assistance.
Jerry
mxfw(config)# sho ver
Cisco Adaptive Security Appliance Software Version 8.4(4)
Device Manager Version 6.4(9)
Compiled on Mon 21-May-12 10:48 by builders
System image file is "disk0:/asa844-k8.bin"
Config file at boot was "startup-config"
mxfw up 23 hours 47 mins
Hardware: ASA5505, 1024 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 32768MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06
Number of accelerators: 1
0: Int: Internal-Data0/0 : address is 2c54.2df4.9c93, irq 11
1: Ext: Ethernet0/0 : address is 2c54.2df4.9c8b, irq 255
2: Ext: Ethernet0/1 : address is 2c54.2df4.9c8c, irq 255
3: Ext: Ethernet0/2 : address is 2c54.2df4.9c8d, irq 255
4: Ext: Ethernet0/3 : address is 2c54.2df4.9c8e, irq 255
5: Ext: Ethernet0/4 : address is 2c54.2df4.9c8f, irq 255
6: Ext: Ethernet0/5 : address is 2c54.2df4.9c90, irq 255
7: Ext: Ethernet0/6 : address is 2c54.2df4.9c91, irq 255
8: Ext: Ethernet0/7 : address is 2c54.2df4.9c92, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255
Licensed features for this platform:
Maximum Physical Interfaces : 8 perpetual
VLANs : 20 DMZ Unrestricted
Dual ISPs : Enabled perpetual
VLAN Trunk Ports : 8 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Standby perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
AnyConnect Premium Peers : 25 perpetual
AnyConnect Essentials : 25 perpetual
Other VPN Peers : 25 perpetual
Total VPN Peers : 25 perpetual
Shared License : Enabled perpetual
AnyConnect for Mobile : Enabled perpetual
AnyConnect for Cisco VPN Phone : Enabled perpetual
Advanced Endpoint Assessment : Enabled perpetual
UC Phone Proxy Sessions : 24 perpetual
Total UC Proxy Sessions : 24 perpetual
Botnet Traffic Filter : Enabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has an ASA 5505 Security Plus license.
Serial Number: JMX1617Z2B0
Running Permanent Activation Key: 0x112dd960 0x68ba556a 0x9160b8f4 0xc4f49064 0x822ae087
Configuration register is 0x1
mxfw(config)# sho cap asp | include 208.67.222.222
1: 08:14:03.444953 802.1Q vlan#2 P0 192.168.60.20.50815 > 208.67.222.222.53: udp 38
4: 08:14:04.613920 802.1Q vlan#2 P0 192.168.60.20.49379 > 208.67.222.222.53: udp 36 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
9: 08:14:05.456168 802.1Q vlan#2 P0 192.168.60.20.50815 > 208.67.222.222.53: udp 38 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
19: 08:14:07.874283 802.1Q vlan#2 P0 192.168.60.20.52778 > 208.67.222.222.53: udp 39 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
26: 08:14:09.464407 802.1Q vlan#2 P0 192.168.60.20.50815 > 208.67.222.222.53: udp 38 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
31: 08:14:09.885559 802.1Q vlan#2 P0 192.168.60.20.52778 > 208.67.222.222.53: udp 39 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
36: 08:14:11.228427 802.1Q vlan#2 P0 192.168.60.20.57817 > 208.67.222.222.53: udp 36
37: 08:14:12.240847 802.1Q vlan#2 P0 192.168.60.20.57817 > 208.67.222.222.53: udp 36 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
38: 08:14:13.254533 802.1Q vlan#2 P0 192.168.60.20.57817 > 208.67.222.222.53: udp 36 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
44: 08:14:13.893889 802.1Q vlan#2 P0 192.168.60.20.52778 > 208.67.222.222.53: udp 39 Drop-reason: (unable-to-create-flow) Flow denied due to resource limitation
51: 08:14:15.266374 802.1Q vlan#2 P0 192.168.60.20.57817 > 208.67.222.222.53: udp 36
63: 08:14:19.274750 802.1Q vlan#2 P0 192.168.60.20.57817 > 208.67.222.222.53: udp 36
68: 08:14:20.509312 802.1Q vlan#2 P0 192.168.60.20.50543 > 208.67.222.222.53: udp 39
69: 08:14:21.520816 802.1Q vlan#2 P0 192.168.60.20.50543 > 208.67.222.222.53: udp 39
70: 08:14:22.534548 802.1Q vlan#2 P0 192.168.60.20.50543 > 208.67.222.222.53: udp 39
76: 08:14:24.547228 802.1Q vlan#2 P0 192.168.60.20.50543 > 208.67.222.222.53: udp 39
83: 08:14:28.554826 802.1Q vlan#2 P0 192.168.60.20.50543 > 208.67.222.222.53: udp 39
89: 08:14:29.803150 802.1Q vlan#2 P0 192.168.60.20.54948 > 208.67.222.222.53: udp 38
91: 08:14:31.816089 802.1Q vlan#2 P0 192.168.60.20.54948 > 208.67.222.222.53: udp 38
102: 08:14:35.822894 802.1Q vlan#2 P0 192.168.60.20.54948 > 208.67.222.222.53: udp 38
116: 08:14:42.885604 802.1Q vlan#2 P0 192.168.60.20.62505 > 208.67.222.222.53: udp 34
118: 08:14:43.883926 802.1Q vlan#2 P0 192.168.60.20.62505 > 208.67.222.222.53: udp 34
123: 08:14:44.884491 802.1Q vlan#2 P0 192.168.60.20.62505 > 208.67.222.222.53: udp 34
127: 08:14:46.884521 802.1Q vlan#2 P0 192.168.60.20.62505 > 208.67.222.222.53: udp 34
133: 08:14:48.882721 802.1Q vlan#2 P0 192.168.60.20.52421 > 208.67.222.222.53: udp 34
135: 08:14:49.881942 802.1Q vlan#2 P0 192.168.60.20.52421 > 208.67.222.222.53: udp 34
138: 08:14:50.882858 802.1Q vlan#2 P0 192.168.60.20.52421 > 208.67.222.222.53: udp 34
140: 08:14:50.885620 802.1Q vlan#2 P0 192.168.60.20.62505 > 208.67.222.222.53: udp 34
145: 08:14:52.883590 802.1Q vlan#2 P0 192.168.60.20.52421 > 208.67.222.222.53: udp 34
149: 08:14:53.983790 802.1Q vlan#2 P0 192.168.60.20.56343 > 208.67.222.222.53: udp 38
151: 08:14:54.982981 802.1Q vlan#2 P0 192.168.60.20.56343 > 208.67.222.222.53: udp 38
156: 08:14:55.982844 802.1Q vlan#2 P0 192.168.60.20.56343 > 208.67.222.222.53: udp 38
161: 08:14:56.884811 802.1Q vlan#2 P0 192.168.60.20.52421 > 208.67.222.222.53: udp 34
180: 08:14:57.983408 802.1Q vlan#2 P0 192.168.60.20.56343 > 208.67.222.222.53: udp 38
197: 08:14:59.441017 802.1Q vlan#2 P0 192.168.60.20.55495 > 208.67.222.222.53: udp 34
198: 08:14:59.441764 802.1Q vlan#2 P0 192.168.60.20.52091 > 208.67.222.222.53: udp 42
199: 08:14:59.442756 802.1Q vlan#2 P0 192.168.60.20.52233 > 208.67.222.222.53: udp 40
200: 08:14:59.442985 802.1Q vlan#2 P0 192.168.60.20.57413 > 208.67.222.222.53: udp 40
201: 08:14:59.443794 802.1Q vlan#2 P0 192.168.60.20.65042 > 208.67.222.222.53: udp 40
202: 08:14:59.448753 802.1Q vlan#2 P0 192.168.60.20.62151 > 208.67.222.222.53: udp 34
204: 08:14:59.504978 802.1Q vlan#2 P0 192.168.60.20.60528 > 208.67.222.222.53: udp 33
206: 08:14:59.524234 802.1Q vlan#2 P0 192.168.60.20.54032 > 208.67.222.222.53: udp 34
213: 08:15:00.505161 802.1Q vlan#2 P0 192.168.60.20.60528 > 208.67.222.222.53: udp 33
214: 08:15:00.524066 802.1Q vlan#2 P0 192.168.60.20.54032 > 208.67.222.222.53: udp 34
225: 08:15:01.441124 802.1Q vlan#2 P0 192.168.60.20.55495 > 208.67.222.222.53: udp 34
229: 08:15:01.442893 802.1Q vlan#2 P0 192.168.60.20.57413 > 208.67.222.222.53: udp 40
230: 08:15:01.443168 802.1Q vlan#2 P0 192.168.60.20.52233 > 208.67.222.222.53: udp 40
235: 08:15:01.444663 802.1Q vlan#2 P0 192.168.60.20.65042 > 208.67.222.222.53: udp 40
241: 08:15:01.563584 802.1Q vlan#2 P0 192.168.60.20.49326 > 208.67.222.222.53: udp 32
242: 08:15:01.582458 802.1Q vlan#2 P0 192.168.60.20.64011 > 208.67.222.222.53: udp 33
244: 08:15:01.598983 802.1Q vlan#2 P0 192.168.60.20.55971 > 208.67.222.222.53: udp 33
246: 08:15:01.628278 802.1Q vlan#2 P0 192.168.60.20.54709 > 208.67.222.222.53: udp 37
248: 08:15:01.982920 802.1Q vlan#2 P0 192.168.60.20.56343 > 208.67.222.222.53: udp 38
254: 08:15:02.598861 802.1Q vlan#2 P0 192.168.60.20.55971 > 208.67.222.222.53: udp 33
256: 08:15:02.622785 802.1Q vlan#2 P0 192.168.60.20.54709 > 208.67.222.222.53: udp 37
266: 08:15:04.438301 802.1Q vlan#2 P0 192.168.60.20.57642 > 208.67.222.222.53: udp 34
267: 08:15:04.440040 802.1Q vlan#2 P0 192.168.60.20.49886 > 208.67.222.222.53: udp 40
268: 08:15:04.440284 802.1Q vlan#2 P0 192.168.60.20.64655 > 208.67.222.222.53: udp 40
269: 08:15:04.441078 802.1Q vlan#2 P0 192.168.60.20.57383 > 208.67.222.222.53: udp 40
279: 08:15:05.441551 802.1Q vlan#2 P0 192.168.60.20.55495 > 208.67.222.222.53: udp 34
285: 08:15:05.443168 802.1Q vlan#2 P0 192.168.60.20.52233 > 208.67.222.222.53: udp 40
286: 08:15:05.443443 802.1Q vlan#2 P0 192.168.60.20.57413 > 208.67.222.222.53: udp 40
293: 08:15:05.445396 802.1Q vlan#2 P0 192.168.60.20.65042 > 208.67.222.222.53: udp 40
314: 08:15:07.438911 802.1Q vlan#2 P0 192.168.60.20.57642 > 208.67.222.222.53: udp 34
318: 08:15:07.440040 802.1Q vlan#2 P0 192.168.60.20.49886 > 208.67.222.222.53: udp 40
322: 08:15:07.441322 802.1Q vlan#2 P0 192.168.60.20.64655 > 208.67.222.222.53: udp 40
326: 08:15:07.443412 802.1Q vlan#2 P0 192.168.60.20.57383 > 208.67.222.222.53: udp 40
335: 08:15:09.374400 802.1Q vlan#2 P0 192.168.60.20.59105 > 208.67.222.222.53: udp 38
362: 08:15:11.439399 802.1Q vlan#2 P0 192.168.60.20.57642 > 208.67.222.222.53: udp 34
363: 08:15:11.440101 802.1Q vlan#2 P0 192.168.60.20.49886 > 208.67.222.222.53: udp 40
370: 08:15:11.441627 802.1Q vlan#2 P0 192.168.60.20.64655 > 208.67.222.222.53: udp 40
374: 08:15:11.442543 802.1Q vlan#2 P0 192.168.60.20.57383 > 208.67.222.222.53: udp 40
381: 08:15:11.995279 802.1Q vlan#2 P0 192.168.60.20.58440 > 208.67.222.222.53: udp 34
382: 08:15:12.003127 802.1Q vlan#2 P0 192.168.60.20.63442 > 208.67.222.222.53: udp 40
383: 08:15:12.003356 802.1Q vlan#2 P0 192.168.60.20.65017 > 208.67.222.222.53: udp 40
384: 08:15:12.003585 802.1Q vlan#2 P0 192.168.60.20.62373 > 208.67.222.222.53: udp 40
387: 08:15:12.994989 802.1Q vlan#2 P0 192.168.60.20.58440 > 208.67.222.222.53: udp 34
388: 08:15:13.001922 802.1Q vlan#2 P0 192.168.60.20.63442 > 208.67.222.222.53: udp 40
389: 08:15:13.004455 802.1Q vlan#2 P0 192.168.60.20.65017 > 208.67.222.222.53: udp 40
390: 08:15:13.004974 802.1Q vlan#2 P0 192.168.60.20.62373 > 208.67.222.222.53: udp 40
391: 08:15:13.005660 802.1Q vlan#2 P0 192.168.60.20.59092 > 208.67.222.222.53: udp 33
392: 08:15:13.995065 802.1Q vlan#2 P0 192.168.60.20.58440 > 208.67.222.222.53: udp 34
394: 08:15:14.001922 802.1Q vlan#2 P0 192.168.60.20.63442 > 208.67.222.222.53: udp 40
396: 08:15:14.002868 802.1Q vlan#2 P0 192.168.60.20.62373 > 208.67.222.222.53: udp 40
397: 08:15:14.003082 802.1Q vlan#2 P0 192.168.60.20.65017 > 208.67.222.222.53: udp 40
400: 08:15:14.004104 802.1Q vlan#2 P0 192.168.60.20.59092 > 208.67.222.222.53: udp 33
418: 08:15:15.995416 802.1Q vlan#2 P0 192.168.60.20.58440 > 208.67.222.222.53: udp 34
422: 08:15:16.002334 802.1Q vlan#2 P0 192.168.60.20.63442 > 208.67.222.222.53: udp 40
426: 08:15:16.003570 802.1Q vlan#2 P0 192.168.60.20.62373 > 208.67.222.222.53: udp 40
427: 08:15:16.003738 802.1Q vlan#2 P0 192.168.60.20.65017 > 208.67.222.222.53: udp 40
446: 08:15:17.302062 802.1Q vlan#2 P0 192.168.60.20.63130 > 208.67.222.222.53: udp 34
451: 08:15:18.172003 802.1Q vlan#2 P0 192.168.60.20.63438 > 208.67.222.222.53: udp 39
466: 08:15:18.993829 802.1Q vlan#2 P0 192.168.60.20.62143 > 208.67.222.222.53: udp 34
467: 08:15:19.000717 802.1Q vlan#2 P0 192.168.60.20.62168 > 208.67.222.222.53: udp 40
468: 08:15:19.000945 802.1Q vlan#2 P0 192.168.60.20.53798 > 208.67.222.222.53: udp 40
469: 08:15:19.002670 802.1Q vlan#2 P0 192.168.60.20.49384 > 208.67.222.222.53: udp 40
474: 08:15:19.695703 802.1Q vlan#2 P0 192.168.60.20.60662 > 208.67.222.222.53: udp 45
478: 08:15:19.994882 802.1Q vlan#2 P0 192.168.60.20.58440 > 208.67.222.222.53: udp 34
486: 08:15:20.002120 802.1Q vlan#2 P0 192.168.60.20.63442 > 208.67.222.222.53: udp 40
490: 08:15:20.003066 802.1Q vlan#2 P0 192.168.60.20.62373 > 208.67.222.222.53: udp 40
492: 08:15:20.003539 802.1Q vlan#2 P0 192.168.60.20.65017 > 208.67.222.222.53: udp 40
500: 08:15:20.303008 802.1Q vlan#2 P0 192.168.60.20.63130 > 208.67.222.222.53: udp 34
504: 08:15:20.411660 802.1Q vlan#2 P0 192.168.60.20.55911 > 208.67.222.222.53: udp 38
510: 08:15:20.984369 802.1Q vlan#2 P0 192.168.60.20.50215 > 208.67.222.222.53: udp 38
511: 08:15:21.171850 802.1Q vlan#2 P0 192.168.60.20.63438 > 208.67.222.222.53: udp 39
525: 08:15:21.983744 802.1Q vlan#2 P0 192.168.60.20.50215 > 208.67.222.222.53: udp 38
526: 08:15:21.993555 802.1Q vlan#2 P0 192.168.60.20.62143 > 208.67.222.222.53: udp 34
530: 08:15:22.000366 802.1Q vlan#2 P0 192.168.60.20.54586 > 208.67.222.222.53: udp 34
531: 08:15:22.001602 802.1Q vlan#2 P0 192.168.60.20.62168 > 208.67.222.222.53: udp 40
532: 08:15:22.001846 802.1Q vlan#2 P0 192.168.60.20.53798 > 208.67.222.222.53: udp 40
539: 08:15:22.004150 802.1Q vlan#2 P0 192.168.60.20.49384 > 208.67.222.222.53: udp 40
547: 08:15:22.986216 802.1Q vlan#2 P0 192.168.60.20.50215 > 208.67.222.222.53: udp 38
549: 08:15:22.999444 802.1Q vlan#2 P0 192.168.60.20.54586 > 208.67.222.222.53: udp 34
565: 08:15:23.999170 802.1Q vlan#2 P0 192.168.60.20.54586 > 208.67.222.222.53: udp 34
576: 08:15:24.303252 802.1Q vlan#2 P0 192.168.60.20.63130 > 208.67.222.222.53: udp 34
584: 08:15:24.985254 802.1Q vlan#2 P0 192.168.60.20.50215 > 208.67.222.222.53: udp 38
592: 08:15:25.172186 802.1Q vlan#2 P0 192.168.60.20.63438 > 208.67.222.222.53: udp 39
604: 08:15:25.994012 802.1Q vlan#2 P0 192.168.60.20.62143 > 208.67.222.222.53: udp 34
608: 08:15:25.998926 802.1Q vlan#2 P0 192.168.60.20.54586 > 208.67.222.222.53: udp 34
610: 08:15:26.001953 802.1Q vlan#2 P0 192.168.60.20.62168 > 208.67.222.222.53: udp 40
611: 08:15:26.002441 802.1Q vlan#2 P0 192.168.60.20.53798 > 208.67.222.222.53: udp 40
618: 08:15:26.004226 802.1Q vlan#2 P0 192.168.60.20.49384 > 208.67.222.222.53: udp 40
643: 08:15:28.986582 802.1Q vlan#2 P0 192.168.60.20.50215 > 208.67.222.222.53: udp 38
657: 08:15:29.999307 802.1Q vlan#2 P0 192.168.60.20.54586 > 208.67.222.222.53: udp 34
681: 08:15:31.458914 802.1Q vlan#2 P0 192.168.60.20.63467 > 208.67.222.222.53: udp 37
685: 08:15:31.724190 802.1Q vlan#2 P0 192.168.60.20.53683 > 208.67.222.222.53: udp 39
691: 08:15:31.875671 802.1Q vlan#2 P0 192.168.60.20.54302 > 208.67.222.222.53: udp 37
700: 08:15:32.723961 802.1Q vlan#2 P0 192.168.60.20.53683 > 208.67.222.222.53: udp 39
706: 08:15:33.724877 802.1Q vlan#2 P0 192.168.60.20.53683 > 208.67.222.222.53: udp 39
712: 08:15:35.725670 802.1Q vlan#2 P0 192.168.60.20.53683 > 208.67.222.222.53: udp 39
724: 08:15:39.726814 802.1Q vlan#2 P0 192.168.60.20.53683 > 208.67.222.222.53: udp 39
732: 08:15:41.453269 802.1Q vlan#2 P0 192.168.60.20.64218 > 208.67.222.222.53: udp 34
754: 08:15:43.453315 802.1Q vlan#2 P0 192.168.60.20.64218 > 208.67.222.222.53: udp 34
764: 08:15:43.995737 802.1Q vlan#2 P0 192.168.60.20.53749 > 208.67.222.222.53: udp 34
786: 08:15:45.994760 802.1Q vlan#2 P0 192.168.60.20.53749 > 208.67.222.222.53: udp 34
795: 08:15:47.451194 802.1Q vlan#2 P0 192.168.60.20.64429 > 208.67.222.222.53: udp 34
797: 08:15:47.454276 802.1Q vlan#2 P0 192.168.60.20.64218 > 208.67.222.222.53: udp 34
806: 08:15:48.285110 802.1Q vlan#2 P0 192.168.60.20.55170 > 208.67.222.222.53: udp 39
821: 08:15:49.451209 802.1Q vlan#2 P0 192.168.60.20.64429 > 208.67.222.222.53: udp 34
826: 08:15:49.979868 802.1Q vlan#2 P0 192.168.60.20.53423 > 208.67.222.222.53: udp 38
828: 08:15:49.994058 802.1Q vlan#2 P0 192.168.60.20.53749 > 208.67.222.222.53: udp 34
830: 08:15:50.285217 802.1Q vlan#2 P0 192.168.60.20.55170 > 208.67.222.222.53: udp 39
845: 08:15:51.979777 802.1Q vlan#2 P0 192.168.60.20.53423 > 208.67.222.222.53: udp 38
856: 08:15:53.450660 802.1Q vlan#2 P0 192.168.60.20.64429 > 208.67.222.222.53: udp 34
864: 08:15:54.008330 802.1Q vlan#2 P0 192.168.60.20.58160 > 208.67.222.222.53: udp 34
865: 08:15:54.285507 802.1Q vlan#2 P0 192.168.60.20.55170 > 208.67.222.222.53: udp 39
872: 08:15:55.008437 802.1Q vlan#2 P0 192.168.60.20.58160 > 208.67.222.222.53: udp 34
876: 08:15:55.980250 802.1Q vlan#2 P0 192.168.60.20.53423 > 208.67.222.222.53: udp 38
880: 08:15:56.009185 802.1Q vlan#2 P0 192.168.60.20.58160 > 208.67.222.222.53: udp 34
886: 08:15:58.009902 802.1Q vlan#2 P0 192.168.60.20.58160 > 208.67.222.222.53: udp 34
902: 08:16:00.006957 802.1Q vlan#2 P0 192.168.60.20.58798 > 208.67.222.222.53: udp 34
908: 08:16:00.837679 802.1Q vlan#2 P0 192.168.60.20.58163 > 208.67.222.222.53: udp 39
910: 08:16:01.006377 802.1Q vlan#2 P0 192.168.60.20.58798 > 208.67.222.222.53: udp 34
914: 08:16:01.837221 802.1Q vlan#2 P0 192.168.60.20.58163 > 208.67.222.222.53: udp 39
915: 08:16:01.991724 802.1Q vlan#2 P0 192.168.60.20.55645 > 208.67.222.222.53: udp 34
916: 08:16:02.007217 802.1Q vlan#2 P0 192.168.60.20.58798 > 208.67.222.222.53: udp 34
918: 08:16:02.010161 802.1Q vlan#2 P0 192.168.60.20.58160 > 208.67.222.222.53: udp 34
923: 08:16:02.838182 802.1Q vlan#2 P0 192.168.60.20.58163 > 208.67.222.222.53: udp 39
925: 08:16:02.991007 802.1Q vlan#2 P0 192.168.60.20.55645 > 208.67.222.222.53: udp 34
931: 08:16:03.990885 802.1Q vlan#2 P0 192.168.60.20.55645 > 208.67.222.222.53: udp 34
932: 08:16:04.007842 802.1Q vlan#2 P0 192.168.60.20.58798 > 208.67.222.222.53: udp 34
938: 08:16:04.838823 802.1Q vlan#2 P0 192.168.60.20.58163 > 208.67.222.222.53: udp 39
945: 08:16:05.990610 802.1Q vlan#2 P0 192.168.60.20.55645 > 208.67.222.222.53: udp 34
957: 08:16:08.009215 802.1Q vlan#2 P0 192.168.60.20.58798 > 208.67.222.222.53: udp 34
964: 08:16:08.840425 802.1Q vlan#2 P0 192.168.60.20.58163 > 208.67.222.222.53: udp 39
970: 08:16:09.991052 802.1Q vlan#2 P0 192.168.60.20.55645 > 208.67.222.222.53: udp 34
1005: 08:16:16.981287 802.1Q vlan#2 P0 192.168.60.20.53038 > 208.67.222.222.53: udp 38
1008: 08:16:17.391352 802.1Q vlan#2 P0 192.168.60.20.49778 > 208.67.222.222.53: udp 39
1010: 08:16:18.981348 802.1Q vlan#2 P0 192.168.60.20.53038 > 208.67.222.222.53: udp 38
1015: 08:16:19.391428 802.1Q vlan#2 P0 192.168.60.20.49778 > 208.67.222.222.53: udp 39
1022: 08:16:22.982645 802.1Q vlan#2 P0 192.168.60.20.53038 > 208.67.222.222.53: udp 38
1027: 08:16:23.403650 802.1Q vlan#2 P0 192.168.60.20.49778 > 208.67.222.222.53: udp 39
1032: 08:16:24.014434 802.1Q vlan#2 P0 192.168.60.20.54274 > 208.67.222.222.53: udp 34
1059: 08:16:26.014113 802.1Q vlan#2 P0 192.168.60.20.54274 > 208.67.222.222.53: udp 34
1096: 08:16:29.956737 802.1Q vlan#2 P0 192.168.60.20.61328 > 208.67.222.222.53: udp 39
1097: 08:16:30.013381 802.1Q vlan#2 P0 192.168.60.20.54274 > 208.67.222.222.53: udp 34
1099: 08:16:30.939343 802.1Q vlan#2 P0 192.168.60.20.58681 > 208.67.222.222.53: udp 40
1100: 08:16:30.939572 802.1Q vlan#2 P0 192.168.60.20.51180 > 208.67.222.222.53: udp 40
1101: 08:16:30.939801 802.1Q vlan#2 P0 192.168.60.20.53388 > 208.67.222.222.53: udp 40
1102: 08:16:30.956081 802.1Q vlan#2 P0 192.168.60.20.61328 > 208.67.222.222.53: udp 39
1106: 08:16:31.938870 802.1Q vlan#2 P0 192.168.60.20.58681 > 208.67.222.222.53: udp 40
1107: 08:16:31.939099 802.1Q vlan#2 P0 192.168.60.20.51180 > 208.67.222.222.53: udp 40
1108: 08:16:31.939785 802.1Q vlan#2 P0 192.168.60.20.53388 > 208.67.222.222.53: udp 40
1109: 08:16:31.956890 802.1Q vlan#2 P0 192.168.60.20.61328 > 208.67.222.222.53: udp 39
1112: 08:16:32.938916 802.1Q vlan#2 P0 192.168.60.20.51180 > 208.67.222.222.53: udp 40
1113: 08:16:32.939145 802.1Q vlan#2 P0 192.168.60.20.58681 > 208.67.222.222.53: udp 40
1116: 08:16:32.940075 802.1Q vlan#2 P0 192.168.60.20.53388 > 208.67.222.222.53: udp 40
1140: 08:16:33.956401 802.1Q vlan#2 P0 192.168.60.20.61328 > 208.67.222.222.53: udp 39
1148: 08:16:34.939740 802.1Q vlan#2 P0 192.168.60.20.58681 > 208.67.222.222.53: udp 40
1149: 08:16:34.939999 802.1Q vlan#2 P0 192.168.60.20.51180 > 208.67.222.222.53: udp 40
1150: 08:16:34.940228 802.1Q vlan#2 P0 192.168.60.20.53388 > 208.67.222.222.53: udp 40
1161: 08:16:36.936810 802.1Q vlan#2 P0 192.168.60.20.59595 > 208.67.222.222.53: udp 40
1162: 08:16:36.937970 802.1Q vlan#2 P0 192.168.60.20.59578 > 208.67.222.222.53: udp 40
1163: 08:16:36.938244 802.1Q vlan#2 P0 192.168.60.20.64549 > 208.67.222.222.53: udp 40
1168: 08:16:37.936002 802.1Q vlan#2 P0 192.168.60.20.59595 > 208.67.222.222.53: udp 40
1169: 08:16:37.936948 802.1Q vlan#2 P0 192.168.60.20.59578 > 208.67.222.222.53: udp 40
1170: 08:16:37.938046 802.1Q vlan#2 P0 192.168.60.20.64549 > 208.67.222.222.53: udp 40
1171: 08:16:37.955883 802.1Q vlan#2 P0 192.168.60.20.61328 > 208.67.222.222.53: udp 39
1175: 08:16:38.936948 802.1Q vlan#2 P0 192.168.60.20.59595 > 208.67.222.222.53: udp 40
1177: 08:16:38.937817 802.1Q vlan#2 P0 192.168.60.20.59578 > 208.67.222.222.53: udp 40
1179: 08:16:38.938763 802.1Q vlan#2 P0 192.168.60.20.64549 > 208.67.222.222.53: udp 40
1181: 08:16:38.939709 802.1Q vlan#2 P0 192.168.60.20.58681 > 208.67.222.222.53: udp 40
1185: 08:16:38.941006 802.1Q vlan#2 P0 192.168.60.20.51180 > 208.67.222.222.53: udp 40
1186: 08:16:38.941220 802.1Q vlan#2 P0 192.168.60.20.53388 > 208.67.222.222.53: udp 40
1195: 08:16:40.937512 802.1Q vlan#2 P0 192.168.60.20.59578 > 208.67.222.222.53: udp 40
1196: 08:16:40.937741 802.1Q vlan#2 P0 192.168.60.20.59595 > 208.67.222.222.53: udp 40
1199: 08:16:40.939602 802.1Q vlan#2 P0 192.168.60.20.64549 > 208.67.222.222.53: udp 40
1208: 08:16:42.005874 802.1Q vlan#2 P0 192.168.60.20.61007 > 208.67.222.222.53: udp 38
1216: 08:16:43.005202 802.1Q vlan#2 P0 192.168.60.20.61007 > 208.67.222.222.53: udp 38
1229: 08:16:44.006026 802.1Q vlan#2 P0 192.168.60.20.61007 > 208.67.222.222.53: udp 38
1237: 08:16:44.939419 802.1Q vlan#2 P0 192.168.60.20.59595 > 208.67.222.222.53: udp 40
1238: 08:16:44.939908 802.1Q vlan#2 P0 192.168.60.20.59578 > 208.67.222.222.53: udp 40
1245: 08:16:44.941494 802.1Q vlan#2 P0 192.168.60.20.64549 > 208.67.222.222.53: udp 40
1275: 08:16:46.006011 802.1Q vlan#2 P0 192.168.60.20.61007 > 208.67.222.222.53: udp 38
1321: 08:16:50.007079 802.1Q vlan#2 P0 192.168.60.20.61007 > 208.67.222.222.53: udp 38
1398: 08:17:10.994073 802.1Q vlan#2 P0 192.168.60.20.63745 > 208.67.222.222.53: udp 38
1401: 08:17:12.992517 802.1Q vlan#2 P0 192.168.60.20.63745 > 208.67.222.222.53: udp 38
1426: 08:17:15.766638 802.1Q vlan#2 P0 192.168.60.20.64128 > 208.67.222.222.53: udp 39
1429: 08:17:16.992761 802.1Q vlan#2 P0 192.168.60.20.63745 > 208.67.222.222.53: udp 38
1433: 08:17:17.766729 802.1Q vlan#2 P0 192.168.60.20.64128 > 208.67.222.222.53: udp 39
1441: 08:17:21.767050 802.1Q vlan#2 P0 192.168.60.20.64128 > 208.67.222.222.53: udp 39
1452: 08:17:26.504170 802.1Q vlan#2 P0 192.168.60.20.51346 > 208.67.222.222.53: udp 39
1463: 08:17:27.504032 802.1Q vlan#2 P0 192.168.60.20.51346 > 208.67.222.222.53: udp 39
1465: 08:17:28.318953 802.1Q vlan#2 P0 192.168.60.20.49753 > 208.67.222.222.53: udp 39
1466: 08:17:28.504887 802.1Q vlan#2 P0 192.168.60.20.51346 > 208.67.222.222.53: udp 39
1468: 08:17:29.319212 802.1Q vlan#2 P0 192.168.60.20.49753 > 208.67.222.222.53: udp 39
1475: 08:17:30.319746 802.1Q vlan#2 P0 192.168.60.20.49753 > 208.67.222.222.53: udp 39
1479: 08:17:30.505512 802.1Q vlan#2 P0 192.168.60.20.51346 > 208.67.222.222.53: udp 39
1484: 08:17:32.320356 802.1Q vlan#2 P0 192.168.60.20.49753 > 208.67.222.222.53: udp 39
1493: 08:17:34.507297 802.1Q vlan#2 P0 192.168.60.20.51346 > 208.67.222.222.53: udp 39
1498: 08:17:35.987299 802.1Q vlan#2 P0 192.168.60.20.50211 > 208.67.222.222.53: udp 38
1504: 08:17:36.321623 802.1Q vlan#2 P0 192.168.60.20.49753 > 208.67.222.222.53: udp 39
1512: 08:17:36.986475 802.1Q vlan#2 P0 192.168.60.20.50211 > 208.67.222.222.53: udp 38
1513: 08:17:37.987406 802.1Q vlan#2 P0 192.168.60.20.50211 > 208.67.222.222.53: udp 38
1521: 08:17:39.988001 802.1Q vlan#2 P0 192.168.60.20.50211 > 208.67.222.222.53: udp 38
1940: 08:19:32.749732 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65521: udp 91
2126: 08:19:46.482335 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61347: udp 50
2169: 08:19:50.479681 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61347: udp 50
2200: 08:19:54.485921 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61347: udp 50
2235: 08:19:58.700113 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57408: udp 50
2275: 08:20:02.700113 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57408: udp 50
2300: 08:20:06.380931 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61124: udp 139
2303: 08:20:06.697321 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57408: udp 50
2310: 08:20:07.624113 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59656: udp 184
2313: 08:20:08.222202 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63181: udp 112
2314: 08:20:08.222263 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50007: udp 70
2335: 08:20:09.764441 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51040: udp 91
2345: 08:20:10.380839 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61124: udp 139
2354: 08:20:11.624235 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59656: udp 184
2361: 08:20:12.093821 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56090: udp 131
2362: 08:20:12.202458 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63181: udp 112
2363: 08:20:12.206364 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50007: udp 70
2373: 08:20:12.696466 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51948: udp 50
2384: 08:20:14.200886 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64562: udp 112
2385: 08:20:14.205311 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63143: udp 70
2387: 08:20:14.378062 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61124: udp 139
2399: 08:20:22.627012 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50607: udp 108
2407: 08:20:23.801136 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51512: udp 195
2417: 08:20:24.940777 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62374: udp 184
2423: 08:20:25.811771 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61821: udp 91
2432: 08:20:26.646801 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60226: udp 108
2433: 08:20:26.692606 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54228: udp 50
2452: 08:20:27.801167 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51512: udp 195
2461: 08:20:28.941510 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62374: udp 184
2463: 08:20:29.230990 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52123: udp 139
2465: 08:20:29.912260 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61877: udp 65
2467: 08:20:30.000976 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57311: udp 112
2474: 08:20:30.646664 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60226: udp 108
2476: 08:20:30.689737 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54228: udp 50
2491: 08:20:31.800678 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51512: udp 195
2500: 08:20:32.938428 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62374: udp 184
2503: 08:20:33.229037 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52123: udp 139
2507: 08:20:33.444541 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51060: udp 70
2512: 08:20:33.909590 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61877: udp 65
2514: 08:20:34.001296 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57311: udp 112
2522: 08:20:34.646511 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60226: udp 108
2524: 08:20:34.690027 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54228: udp 50
2530: 08:20:35.997705 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52341: udp 112
2538: 08:20:37.228656 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52123: udp 139
2540: 08:20:37.441886 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51060: udp 70
2544: 08:20:37.909926 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61877: udp 65
2548: 08:20:38.001113 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57311: udp 112
2555: 08:20:38.651318 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56407: udp 108
2561: 08:20:39.440818 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53603: udp 70
2569: 08:20:39.997857 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52341: udp 112
2575: 08:20:41.228519 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63240: udp 185
2578: 08:20:41.446708 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51060: udp 70
2589: 08:20:42.646664 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56407: udp 108
2598: 08:20:43.440666 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53603: udp 70
2604: 08:20:43.997354 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52341: udp 112
2618: 08:20:45.163275 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63149: udp 65
2619: 08:20:45.227817 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63240: udp 185
2621: 08:20:45.251924 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57764: udp 112
2626: 08:20:46.130547 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61026: udp 195
2632: 08:20:46.643567 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56407: udp 108
2638: 08:20:47.440742 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53603: udp 70
2644: 08:20:48.162879 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63149: udp 65
2646: 08:20:48.251512 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57764: udp 112
2648: 08:20:48.694986 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49312: udp 70
2652: 08:20:49.130867 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61026: udp 195
2654: 08:20:49.228625 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63240: udp 185
2663: 08:20:51.251146 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61384: udp 112
2666: 08:20:51.647091 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52622: udp 108
2667: 08:20:51.694589 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49312: udp 70
2670: 08:20:52.160193 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63149: udp 65
2674: 08:20:52.251360 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57764: udp 112
2679: 08:20:53.100306 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56042: udp 131
2680: 08:20:53.129448 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61026: udp 195
2685: 08:20:54.250765 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61384: udp 112
2687: 08:20:54.646161 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52622: udp 108
2689: 08:20:54.696726 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52496: udp 70
2691: 08:20:55.697412 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49312: udp 70
2693: 08:20:56.097971 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56042: udp 131
2700: 08:20:57.693369 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52496: udp 70
2703: 08:20:58.250109 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61384: udp 112
2705: 08:20:58.646008 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52622: udp 108
2708: 08:21:00.097819 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56042: udp 131
2713: 08:21:01.693308 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52496: udp 70
2718: 08:21:02.823626 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63251: udp 91
2719: 08:21:02.948177 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51292: udp 70
2722: 08:21:03.646023 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63250: udp 108
2729: 08:21:05.947399 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51292: udp 70
2734: 08:21:06.648678 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63250: udp 108
2743: 08:21:08.911467 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61647: udp 195
2744: 08:21:08.946865 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60298: udp 70
2748: 08:21:09.950069 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51292: udp 70
2751: 08:21:10.643521 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63250: udp 108
2754: 08:21:11.910627 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61647: udp 195
2756: 08:21:11.946530 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60298: udp 70
2767: 08:21:15.130623 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61338: udp 117
2770: 08:21:15.646527 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51375: udp 108
2774: 08:21:15.909453 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61647: udp 195
2776: 08:21:15.943844 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60298: udp 70
2783: 08:21:17.200947 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64763: udp 70
2787: 08:21:18.130104 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61338: udp 117
2790: 08:21:18.645565 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51375: udp 108
2793: 08:21:20.198033 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64763: udp 70
2799: 08:21:22.127434 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61338: udp 117
2802: 08:21:22.513309 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51759: udp 70
2803: 08:21:22.643460 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51375: udp 108
2805: 08:21:23.197652 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49516: udp 70
2811: 08:21:24.202885 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64763: udp 70
2814: 08:21:24.904906 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60682: udp 236
2817: 08:21:25.510471 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51759: udp 70
2821: 08:21:26.196797 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49516: udp 70
2825: 08:21:27.646023 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59714: udp 108
2827: 08:21:27.883941 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60682: udp 236
2833: 08:21:29.407174 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60724: udp 65
2834: 08:21:29.510273 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51759: udp 70
2838: 08:21:30.196629 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49516: udp 70
2843: 08:21:30.645703 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59714: udp 108
2844: 08:21:30.883072 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53426: udp 236
2846: 08:21:31.451636 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62205: udp 70
2848: 08:21:31.886230 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60682: udp 236
2851: 08:21:32.406946 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60724: udp 65
2858: 08:21:33.882171 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53426: udp 236
2862: 08:21:34.451209 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62205: udp 70
2864: 08:21:34.642941 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59714: udp 108
2871: 08:21:35.948116 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60127: udp 195
2872: 08:21:36.406595 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60724: udp 65
2875: 08:21:36.909331 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65140: udp 222
2877: 08:21:37.449866 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59320: udp 70
2878: 08:21:37.880005 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53426: udp 236
2883: 08:21:38.456137 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62205: udp 70
2884: 08:21:38.944699 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60127: udp 195
2886: 08:21:39.888427 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65140: udp 222
2890: 08:21:40.449485 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59320: udp 70
2893: 08:21:41.321714 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62421: udp 237
2899: 08:21:42.885528 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60796: udp 222
2900: 08:21:42.945065 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60127: udp 195
2904: 08:21:43.657345 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50140: udp 65
2906: 08:21:43.890731 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65140: udp 222
2909: 08:21:44.298278 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62421: udp 237
2912: 08:21:44.449531 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59320: udp 70
2919: 08:21:45.704828 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50687: udp 70
2920: 08:21:45.884658 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60796: udp 222
2925: 08:21:46.657497 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50140: udp 65
2928: 08:21:47.297958 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57907: udp 237
2930: 08:21:48.300582 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62421: udp 237
2934: 08:21:48.703653 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50687: udp 70
2937: 08:21:49.831789 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57908: udp 91
2938: 08:21:49.884491 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60796: udp 222
2942: 08:21:50.297714 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57907: udp 237
2943: 08:21:50.657299 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50140: udp 65
2946: 08:21:51.703119 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55290: udp 70
2950: 08:21:52.706308 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50687: udp 70
2951: 08:21:53.303741 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53899: udp 237
2952: 08:21:54.297363 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57907: udp 237
2956: 08:21:54.702402 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55290: udp 70
2960: 08:21:56.302810 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53899: udp 237
2965: 08:21:57.908095 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60934: udp 117
2968: 08:21:58.702035 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55290: udp 70
2972: 08:21:59.302428 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63799: udp 237
2975: 08:21:59.977564 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51380: udp 76
2979: 08:22:00.307631 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53899: udp 237
2984: 08:22:00.907667 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60934: udp 117
2986: 08:22:01.284164 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51226: udp 108
2990: 08:22:02.302688 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63799: udp 237
2993: 08:22:02.956646 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51380: udp 76
2995: 08:22:02.987848 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55596: udp 195
3001: 08:22:04.283783 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51226: udp 108
3004: 08:22:04.907072 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60934: udp 117
3009: 08:22:05.955822 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64295: udp 76
3010: 08:22:05.984934 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55596: udp 195
3012: 08:22:06.301864 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63799: udp 237
3016: 08:22:06.958934 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51380: udp 76
3022: 08:22:08.280640 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51226: udp 108
3029: 08:22:08.955440 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64295: udp 76
3032: 08:22:09.910627 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57632: udp 117
3033: 08:22:09.987238 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55596: udp 195
3035: 08:22:10.246538 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60678: udp 131
3042: 08:22:11.959514 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62946: udp 76
3044: 08:22:12.909758 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57632: udp 117
3046: 08:22:12.952709 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64295: udp 76
3049: 08:22:13.245653 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60678: udp 131
3056: 08:22:14.956554 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62946: udp 76
3062: 08:22:16.906996 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57632: udp 117
3065: 08:22:17.248507 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60678: udp 131
3068: 08:22:17.957820 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57216: udp 76
3071: 08:22:18.956493 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.62946: udp 76
3077: 08:22:20.958004 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57216: udp 76
3083: 08:22:23.961543 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64402: udp 76
3086: 08:22:24.957271 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57216: udp 76
3089: 08:22:25.054562 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60597: udp 237
3092: 08:22:26.958675 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64402: udp 76
3096: 08:22:28.046246 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60597: udp 237
3100: 08:22:29.960353 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51515: udp 76
3102: 08:22:30.029570 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51928: udp 195
3105: 08:22:30.958049 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64402: udp 76
3108: 08:22:31.020689 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54204: udp 70
3110: 08:22:31.032819 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64172: udp 237
3113: 08:22:32.036069 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60597: udp 237
3115: 08:22:32.960002 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51515: udp 76
3117: 08:22:33.024214 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51928: udp 195
3120: 08:22:34.019850 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54204: udp 70
3122: 08:22:34.032392 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64172: udp 237
3126: 08:22:35.963649 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58593: udp 76
3127: 08:22:36.918943 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52177: udp 117
3128: 08:22:36.957302 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51515: udp 76
3131: 08:22:37.024031 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51928: udp 195
3134: 08:22:38.020155 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54204: udp 70
3137: 08:22:38.034971 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64172: udp 237
3138: 08:22:38.963451 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58593: udp 76
3141: 08:22:39.916075 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52177: udp 117
3144: 08:22:41.962337 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55848: udp 76
3147: 08:22:42.905608 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54153: udp 260
3149: 08:22:42.965037 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58593: udp 76
3153: 08:22:43.915739 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52177: udp 117
3159: 08:22:44.961498 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55848: udp 76
3162: 08:22:45.904860 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54153: udp 260
3165: 08:22:46.842790 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54154: udp 91
3169: 08:22:47.966121 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50849: udp 76
3170: 08:22:48.894881 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55040: udp 236
3171: 08:22:48.918317 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63098: udp 117
3172: 08:22:48.959026 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55848: udp 76
3177: 08:22:49.905165 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54153: udp 260
3180: 08:22:50.965282 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50849: udp 76
3182: 08:22:51.894179 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55040: udp 236
3183: 08:22:51.917417 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63098: udp 117
3188: 08:22:53.964839 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64023: udp 76
3192: 08:22:54.893157 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57213: udp 236
3193: 08:22:54.963039 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50849: udp 76
3199: 08:22:55.898970 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55040: udp 236
3200: 08:22:55.917707 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63098: udp 117
3205: 08:22:56.963954 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64023: udp 76
3207: 08:22:57.064953 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56311: udp 195
3211: 08:22:57.892760 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57213: udp 236
3219: 08:22:59.968089 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63271: udp 76
3220: 08:23:00.064877 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56311: udp 195
3223: 08:23:00.899382 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52883: udp 222
3224: 08:23:00.918241 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63492: udp 65
3225: 08:23:00.964015 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64023: udp 76
3228: 08:23:01.892562 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57213: udp 236
3233: 08:23:02.967235 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63271: udp 76
3237: 08:23:03.898650 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52883: udp 222
3240: 08:23:03.917433 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63492: udp 65
3242: 08:23:04.061871 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.56311: udp 195
3248: 08:23:05.966853 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49426: udp 76
3249: 08:23:06.105661 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59421: udp 260
3250: 08:23:06.897582 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54348: udp 222
3253: 08:23:06.969966 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63271: udp 76
3254: 08:23:07.104395 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59421: udp 260
3256: 08:23:07.900817 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52883: udp 222
3258: 08:23:07.917188 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63492: udp 65
3260: 08:23:08.121102 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59421: udp 260
3262: 08:23:08.965968 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49426: udp 76
3267: 08:23:09.894790 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54348: udp 222
3269: 08:23:10.103510 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59421: udp 260
3273: 08:23:12.966594 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.49426: udp 76
3276: 08:23:13.894591 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54348: udp 222
3278: 08:23:14.105325 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59421: udp 260
3283: 08:23:15.168524 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64971: udp 65
3290: 08:23:18.168692 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64971: udp 65
3297: 08:23:22.167975 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64971: udp 65
3300: 08:23:24.102426 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59518: udp 195
3304: 08:23:25.966487 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63456: udp 70
3311: 08:23:27.101526 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59518: udp 195
3317: 08:23:28.965602 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63456: udp 70
3320: 08:23:29.418755 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63330: udp 117
3326: 08:23:31.101343 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59518: udp 195
3329: 08:23:31.919706 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52792: udp 108
3330: 08:23:31.962825 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51619: udp 70
3331: 08:23:32.415872 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63330: udp 117
3337: 08:23:32.968532 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63456: udp 70
3342: 08:23:34.921384 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52792: udp 108
3343: 08:23:34.962093 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51619: udp 70
3347: 08:23:36.416161 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.63330: udp 117
3355: 08:23:38.918653 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52792: udp 108
3357: 08:23:38.961681 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51619: udp 70
3362: 08:23:40.219242 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52373: udp 70
3367: 08:23:41.420983 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60196: udp 117
3368: 08:23:41.426140 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52680: udp 70
3374: 08:23:43.218341 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52373: udp 70
3378: 08:23:44.417840 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60196: udp 117
3381: 08:23:44.422967 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52680: udp 70
3391: 08:23:46.217991 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51938: udp 70
3398: 08:23:47.220706 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52373: udp 70
3403: 08:23:48.418160 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60196: udp 117
3406: 08:23:48.423058 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52680: udp 70
3411: 08:23:49.217655 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51938: udp 70
3422: 08:23:51.141533 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55883: udp 195
3433: 08:23:53.214939 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51938: udp 70
3440: 08:23:54.145637 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55883: udp 195
3441: 08:23:54.469442 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53554: udp 70
3450: 08:23:57.469061 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53554: udp 70
3455: 08:23:58.140999 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55883: udp 195
3461: 08:24:00.468695 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58757: udp 70
3464: 08:24:01.468969 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53554: udp 70
3469: 08:24:03.467810 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58757: udp 70
3480: 08:24:07.427132 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51241: udp 117
3483: 08:24:07.467733 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58757: udp 70
3487: 08:24:08.722130 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53884: udp 70
3491: 08:24:10.430275 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51241: udp 117
3496: 08:24:11.722237 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53884: udp 70
3505: 08:24:14.426064 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.51241: udp 117
3507: 08:24:14.720864 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59532: udp 70
3511: 08:24:14.906035 802.1Q vlan#2 P0 208.67.222.222 > 172.26.20.22: icmp: echo reply
3515: 08:24:15.724068 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.53884: udp 70
3521: 08:24:17.720498 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59532: udp 70
3523: 08:24:18.181677 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52120: udp 195
3526: 08:24:19.428612 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58045: udp 117
3528: 08:24:19.887054 802.1Q vlan#2 P0 208.67.222.222 > 172.26.20.22: icmp: echo reply
3531: 08:24:21.178304 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52120: udp 195
3535: 08:24:21.720299 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59532: udp 70
3538: 08:24:22.428231 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58045: udp 117
3540: 08:24:22.975321 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55981: udp 70
3542: 08:24:24.885620 802.1Q vlan#2 P0 208.67.222.222 > 172.26.20.22: icmp: echo reply
3544: 08:24:25.178777 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52120: udp 195
3549: 08:24:25.977915 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55981: udp 70
3550: 08:24:26.428093 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.58045: udp 117
3553: 08:24:26.571671 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54072: udp 108
3557: 08:24:28.974055 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61441: udp 70
3558: 08:24:29.571351 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54072: udp 108
3560: 08:24:29.885864 802.1Q vlan#2 P0 208.67.222.222 > 172.26.20.22: icmp: echo reply
3562: 08:24:29.979273 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.55981: udp 70
3564: 08:24:31.973139 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61441: udp 70
3566: 08:24:33.573639 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54072: udp 108
3572: 08:24:35.973963 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61441: udp 70
3575: 08:24:37.225574 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54778: udp 70
3578: 08:24:40.227695 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54778: udp 70
3586: 08:24:43.224780 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61415: udp 70
3588: 08:24:44.225009 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.54778: udp 70
3594: 08:24:45.218357 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59345: udp 195
3599: 08:24:46.225909 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61415: udp 70
3603: 08:24:48.217472 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59345: udp 195
3605: 08:24:48.437309 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64239: udp 117
3609: 08:24:50.223697 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.61415: udp 70
3612: 08:24:51.435310 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64239: udp 117
3614: 08:24:51.478262 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60625: udp 76
3616: 08:24:52.217807 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59345: udp 195
3619: 08:24:52.798359 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57029: udp 70
3622: 08:24:54.477926 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60625: udp 76
3625: 08:24:55.433113 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.64239: udp 117
3629: 08:24:55.798222 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57029: udp 70
3634: 08:24:57.477499 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65124: udp 76
3638: 08:24:58.483281 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.60625: udp 76
3642: 08:24:59.797306 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57029: udp 70
3645: 08:25:00.438408 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50075: udp 117
3646: 08:25:00.478857 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65124: udp 76
3651: 08:25:03.435371 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50075: udp 117
3652: 08:25:03.480749 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57210: udp 76
3654: 08:25:04.474020 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.65124: udp 76
3660: 08:25:06.480352 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57210: udp 76
3662: 08:25:07.435066 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.50075: udp 117
3667: 08:25:09.479497 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52037: udp 76
3670: 08:25:10.487187 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.57210: udp 76
3673: 08:25:12.258485 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.59263: udp 195
3674: 08:25:12.478612 802.1Q vlan#2 P0 208.67.222.222.53 > 172.26.20.22.52037: udp 76
mxfw(config)# sho cap capo
16 packets captured
1: 08:49:55.933347 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
2: 08:49:55.961345 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
3: 08:50:00.697122 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
4: 08:50:00.723915 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
5: 08:50:05.696283 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
6: 08:50:05.721947 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
7: 08:50:10.695474 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
8: 08:50:10.722466 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
9: 08:24:14.880508 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
10: 08:24:14.906004 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
11: 08:24:19.860780 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
12: 08:24:19.887023 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
13: 08:24:24.859971 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
14: 08:24:24.885574 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
15: 08:24:29.859147 802.1Q vlan#2 P0 192.168.1.231 > 208.67.222.222: icmp: echo request
16: 08:24:29.885833 802.1Q vlan#2 P0 208.67.222.222 > 192.168.1.231: icmp: echo reply
16 packets shown
mxfw(config)# sho cap capdmz
ERROR: Capture does not exist
mxfw(config)# sho cap capd
0 packet captured
0 packet shown
mxfw(config)# -
AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside network
My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.
I have seen other people that appeared to have similar posts but none of those solutions have worked for me. I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly. I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.
My configuration is included below.
Thank you in advance for your assistance.
Jerry
ASA Version 8.4(4)
hostname mxfw
domain-name moxiefl.com
enable password (removed)
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
shutdown
interface Ethernet0/4
shutdown
interface Ethernet0/5
switchport trunk allowed vlan 20,22
switchport mode trunk
interface Ethernet0/6
shutdown
interface Ethernet0/7
shutdown
interface Vlan1
nameif inside
security-level 100
ip address 10.0.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
interface Vlan20
nameif dmz
security-level 50
ip address 172.26.20.1 255.255.255.0
interface Vlan22
nameif dmz2
security-level 50
ip address 172.26.22.1 255.255.255.0
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 208.67.222.222
name-server 208.67.220.220
domain-name moxiefl.com
same-security-traffic permit inter-interface
object network Generic_All_Network
subnet 0.0.0.0 0.0.0.0
object network INSIDE_Hosts
subnet 10.1.0.0 255.255.0.0
object network AnyConnect_Hosts
subnet 192.168.60.0 255.255.255.0
object network NETWORK_OBJ_192.168.60.0_26
subnet 192.168.60.0 255.255.255.192
object network DMZ_Network
subnet 172.26.20.0 255.255.255.0
object network DMZ2_Network
subnet 172.26.22.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu outside 1500
mtu dmz 1500
mtu dmz2 1500
ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic Generic_All_Network interface
nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup
nat (dmz,outside) source dynamic Generic_All_Network interface
nat (dmz2,outside) source dynamic Generic_All_Network interface
route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
fqdn anyconnect.moxiefl.com
subject-name CN=AnyConnect.moxiefl.com
keypair AnyConnect
proxy-ldc-issuer
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 439a4452
3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
telnet timeout 5
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 208.67.222.222 208.67.220.220
dhcpd auto_config outside
dhcpd address 10.0.1.20-10.0.1.40 inside
dhcpd dns 208.67.222.222 208.67.220.220 interface inside
dhcpd enable inside
dhcpd address 172.26.20.21-172.26.20.60 dmz
dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
dhcpd enable dmz
dhcpd address 172.26.22.21-172.26.22.200 dmz2
dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
dhcpd enable dmz2
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_AnyConnect internal
group-policy GroupPolicy_AnyConnect attributes
wins-server none
dns-server value 208.67.222.222 208.67.220.220
vpn-tunnel-protocol ikev2 ssl-client
default-domain value moxiefl.com
webvpn
anyconnect profiles value AnyConnect_client_profile type user
username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
tunnel-group AnyConnect type remote-access
tunnel-group AnyConnect general-attributes
address-pool VPN_POOL
default-group-policy GroupPolicy_AnyConnect
tunnel-group AnyConnect webvpn-attributes
group-alias AnyConnect enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:f2c7362097b71bcada023c6bbfc45121
: endHi,
Yes, I have saved the config and did a write erase and reloaded the config, no difference. I rebuilt it once a couple of weeks ago, but that was before I had gotten this far with your assistance. I'll include my ASA and switches configs after this. Here is a little background (took it form the Firewall section issue just because it gives a little insight for the network). I have 2 3560s, one as a L3 switch the other L2 with an etherchannel between them (one of the cables was bad so I am waiting on the replacement to have 2 - Gigabit channels between the switches).
I think our issue with the VPN not getting to the Inside is posibly related to my DMZ issue not getting to the internet.
I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.
I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.
The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet. I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.
E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).
So for a simple diagram:
PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)
I will be back at this tomorrow morning - I've been up since 4pm yesterday and it is almost 3pm.
Thank you for all of your assistance.
Jerry
Current ASA Config:
ASA Version 8.4(4)
hostname mxfw
domain-name moxiefl.com
enable password $$$$$$$$$$$$$$$ encrypted
passwd $$$$$$$$$$$$$$$$ encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
shutdown
interface Ethernet0/4
switchport access vlan 20
interface Ethernet0/5
switchport trunk allowed vlan 20,22
switchport mode trunk
interface Ethernet0/6
shutdown
interface Ethernet0/7
shutdown
interface Vlan1
nameif inside
security-level 100
ip address 10.0.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
interface Vlan20
nameif dmz
security-level 50
ip address 172.26.20.1 255.255.255.0
interface Vlan22
nameif dmz2
security-level 50
ip address 172.26.22.1 255.255.255.0
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 208.67.222.222
name-server 208.67.220.220
domain-name moxiefl.com
same-security-traffic permit inter-interface
object network Generic_All_Network
subnet 0.0.0.0 0.0.0.0
object network INSIDE_Hosts
subnet 10.1.0.0 255.255.0.0
object network AnyConnect_Hosts
subnet 192.168.60.0 255.255.255.0
object network NETWORK_OBJ_192.168.60.0_26
subnet 192.168.60.0 255.255.255.192
object network DMZ_Network
subnet 172.26.20.0 255.255.255.0
object network DMZ2_Network
subnet 172.26.22.0 255.255.255.0
object network INSIDE
subnet 10.0.1.0 255.255.255.0
access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222
access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22
access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222
access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231
access-list capvpn extended permit icmp host 192.168.60.20 host 10.1.10.23
access-list capvpn extended permit icmp host 10.1.10.23 host 192.168.60.20
access-list AnyConnect_Client_Local_Print extended deny ip any any
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0
access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0
access-list capins extended permit icmp host 10.1.10.23 host 10.0.1.1
access-list capins extended permit icmp host 10.0.1.1 host 10.1.10.23
pager lines 24
mtu inside 1500
mtu outside 1500
mtu dmz 1500
mtu dmz2 1500
ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
nat (dmz,outside) source dynamic Generic_All_Network interface
nat (dmz2,outside) source dynamic Generic_All_Network interface
nat (inside,outside) after-auto source dynamic Generic_All_Network interface
route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
fqdn anyconnect.moxiefl.com
subject-name CN=AnyConnect.moxiefl.com
keypair AnyConnect
proxy-ldc-issuer
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 439a4452
3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
telnet timeout 5
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 208.67.222.222 208.67.220.220
dhcpd auto_config outside
dhcpd address 10.0.1.20-10.0.1.40 inside
dhcpd dns 208.67.222.222 208.67.220.220 interface inside
dhcpd enable inside
dhcpd address 172.26.20.21-172.26.20.60 dmz
dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
dhcpd enable dmz
dhcpd address 172.26.22.21-172.26.22.200 dmz2
dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
dhcpd enable dmz2
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_AnyConnect internal
group-policy GroupPolicy_AnyConnect attributes
wins-server none
dns-server value 208.67.222.222 208.67.220.220
vpn-tunnel-protocol ikev2 ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL
default-domain value moxiefl.com
webvpn
anyconnect profiles value AnyConnect_client_profile type user
username user1 password $$$$$$$$$$$$$ encrypted privilege 15
username user2 password $$$$$$$$$$$ encrypted privilege 15
tunnel-group AnyConnect type remote-access
tunnel-group AnyConnect general-attributes
address-pool VPN_POOL
default-group-policy GroupPolicy_AnyConnect
tunnel-group AnyConnect webvpn-attributes
group-alias AnyConnect enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:f6d9bbacca2a5c8b5af946a8ddc12550
: end
L3 3560 connects to ASA via port f0/3 routed port 10.0.1.0/24 network
Connects to second 3560 via G0/3 & G0/4
version 12.2
no service pad
no service timestamps debug uptime
no service timestamps log uptime
service password-encryption
hostname mx3560a
boot-start-marker
boot-end-marker
enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
no aaa new-model
system mtu routing 1500
authentication mac-move permit
ip subnet-zero
ip routing
ip dhcp excluded-address 10.1.10.1 10.1.10.20
ip dhcp excluded-address 10.1.12.1 10.1.12.20
ip dhcp excluded-address 10.1.14.1 10.1.14.20
ip dhcp excluded-address 10.1.16.1 10.1.16.20
ip dhcp excluded-address 10.1.30.1 10.1.30.20
ip dhcp excluded-address 10.1.35.1 10.1.35.20
ip dhcp excluded-address 10.1.50.1 10.1.50.20
ip dhcp excluded-address 10.1.80.1 10.1.80.20
ip dhcp excluded-address 10.1.90.1 10.1.90.20
ip dhcp excluded-address 10.1.100.1 10.1.100.20
ip dhcp excluded-address 10.1.101.1 10.1.101.20
ip dhcp pool VLAN10
network 10.1.10.0 255.255.255.0
default-router 10.1.10.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN12
network 10.1.12.0 255.255.255.0
default-router 10.1.12.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN14
network 10.1.14.0 255.255.255.0
default-router 10.1.14.1
option 150 ip 10.1.13.1
ip dhcp pool VLAN16
network 10.1.16.0 255.255.255.0
default-router 10.1.16.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN30
network 10.1.30.0 255.255.255.0
default-router 10.1.30.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN35
network 10.1.35.0 255.255.255.0
default-router 10.1.35.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN50
network 10.1.50.0 255.255.255.0
default-router 10.1.50.1
option 43 hex f104.0a01.6564
ip dhcp pool VLAN80
network 10.1.80.0 255.255.255.0
default-router 10.1.80.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN90
network 10.1.90.0 255.255.255.0
default-router 10.1.90.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool VLAN100
network 10.1.100.0 255.255.255.0
default-router 10.1.100.1
ip dhcp pool VLAN101
network 10.1.101.0 255.255.255.0
default-router 10.1.101.1
ip dhcp pool VLAN40
dns-server 208.67.222.222 208.67.220.220
port-channel load-balance src-dst-mac
spanning-tree mode pvst
spanning-tree etherchannel guard misconfig
spanning-tree extend system-id
vlan internal allocation policy ascending
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
link state group 1 downstream
interface FastEthernet0/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 100
switchport mode trunk
power inline never
interface FastEthernet0/2
switchport access vlan 10
switchport mode access
power inline never
interface FastEthernet0/3
description Interface to MXFW E0/1
no switchport
ip address 10.0.1.2 255.255.255.0
power inline never
interface FastEthernet0/4
switchport mode access
shutdown
power inline never
interface FastEthernet0/5
switchport mode access
shutdown
power inline never
interface FastEthernet0/6
switchport mode access
shutdown
power inline never
interface FastEthernet0/7
switchport trunk encapsulation dot1q
switchport trunk native vlan 30
switchport mode trunk
switchport voice vlan 14
power inline never
spanning-tree portfast
interface FastEthernet0/8
switchport access vlan 30
switchport mode access
power inline never
interface FastEthernet0/9
switchport mode access
shutdown
power inline never
interface FastEthernet0/10
switchport mode access
shutdown
power inline never
interface FastEthernet0/11
switchport mode access
shutdown
power inline never
interface FastEthernet0/12
switchport access vlan 40
switchport mode access
interface FastEthernet0/13
switchport access vlan 40
switchport mode access
interface FastEthernet0/14
switchport access vlan 40
switchport mode access
interface FastEthernet0/15
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/16
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/17
switchport access vlan 50
switchport mode access
interface FastEthernet0/18
switchport mode access
shutdown
power inline never
interface FastEthernet0/19
switchport mode access
shutdown
power inline never
interface FastEthernet0/20
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport mode trunk
switchport voice vlan 14
spanning-tree portfast
interface FastEthernet0/21
switchport mode access
shutdown
power inline never
interface FastEthernet0/22
switchport mode access
shutdown
power inline never
interface FastEthernet0/23
switchport trunk encapsulation dot1q
switchport trunk native vlan 30
switchport mode trunk
switchport voice vlan 14
spanning-tree portfast
interface FastEthernet0/24
switchport access vlan 35
switchport mode access
power inline never
interface FastEthernet0/25
switchport mode access
shutdown
power inline never
interface FastEthernet0/26
switchport mode access
shutdown
power inline never
interface FastEthernet0/27
switchport mode access
shutdown
power inline never
interface FastEthernet0/28
switchport access vlan 40
switchport mode access
interface FastEthernet0/29
switchport access vlan 40
switchport mode access
interface FastEthernet0/30
switchport access vlan 40
switchport mode access
interface FastEthernet0/31
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/32
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/33
switchport access vlan 50
switchport mode access
interface FastEthernet0/34
switchport mode access
shutdown
power inline never
interface FastEthernet0/35
switchport mode access
shutdown
power inline never
interface FastEthernet0/36
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport mode trunk
switchport voice vlan 14
spanning-tree portfast
interface FastEthernet0/37
switchport mode access
shutdown
power inline never
interface FastEthernet0/38
switchport mode access
shutdown
power inline never
interface FastEthernet0/39
switchport access vlan 30
switchport mode access
power inline never
interface FastEthernet0/40
switchport access vlan 90
switchport mode access
power inline never
interface FastEthernet0/41
switchport mode access
shutdown
power inline never
interface FastEthernet0/42
switchport mode access
shutdown
power inline never
interface FastEthernet0/43
switchport mode access
shutdown
power inline never
interface FastEthernet0/44
switchport access vlan 40
switchport mode access
interface FastEthernet0/45
switchport access vlan 40
switchport mode access
interface FastEthernet0/46
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/47
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/48
switchport mode access
shutdown
power inline never
interface GigabitEthernet0/1
description Interface to MXC2911 Port G0/0
no switchport
ip address 10.1.13.2 255.255.255.0
interface GigabitEthernet0/2
shutdown
interface GigabitEthernet0/3
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
interface GigabitEthernet0/4
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
interface Vlan1
no ip address
shutdown
interface Vlan10
ip address 10.1.10.1 255.255.255.0
interface Vlan12
ip address 10.1.12.1 255.255.255.0
interface Vlan14
ip address 10.1.14.1 255.255.255.0
interface Vlan16
ip address 10.1.16.1 255.255.255.0
interface Vlan20
ip address 172.26.20.1 255.255.255.0
interface Vlan22
ip address 172.26.22.1 255.255.255.0
interface Vlan30
ip address 10.1.30.1 255.255.255.0
interface Vlan35
ip address 10.1.35.1 255.255.255.0
interface Vlan40
ip address 10.1.40.1 255.255.255.0
interface Vlan50
ip address 10.1.50.1 255.255.255.0
interface Vlan80
ip address 172.16.80.1 255.255.255.0
interface Vlan86
no ip address
shutdown
interface Vlan90
ip address 10.1.90.1 255.255.255.0
interface Vlan100
ip address 10.1.100.1 255.255.255.0
interface Vlan101
ip address 10.1.101.1 255.255.255.0
router eigrp 1
network 10.0.0.0
network 10.1.13.0 0.0.0.255
network 10.1.14.0 0.0.0.255
passive-interface default
no passive-interface GigabitEthernet0/1
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet0/3 10.0.1.1
ip route 192.168.60.0 255.255.255.0 FastEthernet0/3 10.0.1.1 2
ip http server
ip sla enable reaction-alerts
line con 0
logging synchronous
line vty 0 4
login
line vty 5 15
login
end
L3 3560 Route Table (I added 192.168.60.0/24 instead of just using the default route just in case it wasn't routing for some reason - no change)
mx3560a#sho ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.1.1 to network 0.0.0.0
S 192.168.60.0/24 [2/0] via 10.0.1.1, FastEthernet0/3
172.16.0.0/24 is subnetted, 1 subnets
C 172.16.80.0 is directly connected, Vlan80
172.26.0.0/24 is subnetted, 2 subnets
C 172.26.22.0 is directly connected, Vlan22
C 172.26.20.0 is directly connected, Vlan20
10.0.0.0/8 is variably subnetted, 14 subnets, 2 masks
C 10.1.10.0/24 is directly connected, Vlan10
D 10.1.13.5/32 [90/3072] via 10.1.13.1, 4d02h, GigabitEthernet0/1
C 10.1.14.0/24 is directly connected, Vlan14
C 10.1.13.0/24 is directly connected, GigabitEthernet0/1
C 10.1.12.0/24 is directly connected, Vlan12
C 10.0.1.0/24 is directly connected, FastEthernet0/3
C 10.1.30.0/24 is directly connected, Vlan30
C 10.1.16.0/24 is directly connected, Vlan16
C 10.1.40.0/24 is directly connected, Vlan40
C 10.1.35.0/24 is directly connected, Vlan35
C 10.1.50.0/24 is directly connected, Vlan50
C 10.1.90.0/24 is directly connected, Vlan90
C 10.1.101.0/24 is directly connected, Vlan101
C 10.1.100.0/24 is directly connected, Vlan100
S* 0.0.0.0/0 [1/0] via 10.0.1.1, FastEthernet0/3
I have a C2911 for CME on G0/1 - using it only for that purpose at this time.
L2 3560 Config it connects to the ASA as a trunk on e0/5 of the ASA and port f0/3 of the switch - I am using L2 switching for the DMZ networks from the switches to the ASA and allowing the ASA to provide the DHCP and routing out of the network. DMZ networks: 172.26.20.0/24 and 172.26.22.0/24.
version 12.2
no service pad
no service timestamps debug uptime
no service timestamps log uptime
service password-encryption
hostname mx3560b
boot-start-marker
boot-end-marker
enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
no aaa new-model
system mtu routing 1500
crypto pki trustpoint TP-self-signed-3877365632
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3877365632
revocation-check none
rsakeypair TP-self-signed-3877365632
crypto pki certificate chain TP-self-signed-3877365632
certificate self-signed 01
30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 33383737 33363536 3332301E 170D3933 30333031 30303031
30395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 38373733
36353633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DF81 DA515E0B 7FC760CF 2CC98400 42DCA007 215E4DDE D0C3FBF2 D974CE85
C46A8700 6AE44C2C 79D9BD2A A9297FA0 2D9C2BE4 B3941A2F 435AC4EA 17E89DFE
34EC8E93 63BD4CDF 784E91D7 2EE0093F 06CC97FD 83CB818B 1ED624E6 F0F5DA51
1DE4B8A7 169EED2B 40575B81 BADDE052 85BA9D19 4C206DCB 00878FF3 89E74028
B3F30203 010001A3 68306630 0F060355 1D130101 FF040530 030101FF 30130603
551D1104 0C300A82 086D7833 35363062 2E301F06 03551D23 04183016 80147125
78CE8540 DB95D852 3C0BD975 5D9C6EB7 58FC301D 0603551D 0E041604 14712578
CE8540DB 95D8523C 0BD9755D 9C6EB758 FC300D06 092A8648 86F70D01 01040500
03818100 94B98410 2D9CD602 4BD16181 BCB7C515 77C8F947 7C4AF5B8 281E3131
59298655 B12FAB1D A6AAA958 8473483C E993D896 5251770B 557803C0 531DEB62
A349C057 CB473F86 DCEBF8B8 7DDE5728 048A49D0 AB18CE8C 8257C00A C2E06A63
B91F872C 5F169FF9 77DC523B AB1E3965 C6B67FCC 84AE11E9 02DD10F0 C45EAFEA 41D7FA6C
quit
port-channel load-balance src-dst-mac
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface Port-channel1
switchport trunk encapsulation dot1q
switchport mode trunk
interface FastEthernet0/1
switchport access vlan 50
switchport mode access
interface FastEthernet0/2
switchport access vlan 30
switchport mode access
power inline never
interface FastEthernet0/3
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 20,22
switchport mode trunk
power inline never
interface FastEthernet0/4
switchport mode access
shutdown
power inline never
interface FastEthernet0/5
shutdown
power inline never
interface FastEthernet0/6
shutdown
power inline never
interface FastEthernet0/7
switchport trunk encapsulation dot1q
switchport trunk native vlan 30
switchport mode trunk
switchport voice vlan 14
spanning-tree portfast
interface FastEthernet0/8
switchport access vlan 30
switchport mode access
power inline never
interface FastEthernet0/9
shutdown
power inline never
interface FastEthernet0/10
switchport access vlan 20
switchport mode access
power inline never
interface FastEthernet0/11
shutdown
power inline never
interface FastEthernet0/12
switchport access vlan 40
switchport mode access
interface FastEthernet0/13
switchport access vlan 40
switchport mode access
interface FastEthernet0/14
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/15
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/16
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/17
switchport access vlan 10
switchport mode access
power inline never
interface FastEthernet0/18
shutdown
power inline never
interface FastEthernet0/19
shutdown
power inline never
interface FastEthernet0/20
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport mode trunk
switchport voice vlan 14
spanning-tree portfast
interface FastEthernet0/21
shutdown
power inline never
interface FastEthernet0/22
shutdown
power inline never
interface FastEthernet0/23
switchport access vlan 30
switchport mode access
power inline never
interface FastEthernet0/24
shutdown
power inline never
interface FastEthernet0/25
switchport access vlan 20
switchport mode access
power inline never
interface FastEthernet0/26
shutdown
power inline never
interface FastEthernet0/27
shutdown
power inline never
interface FastEthernet0/28
switchport access vlan 40
switchport mode access
interface FastEthernet0/29
switchport access vlan 40
switchport mode access
interface FastEthernet0/30
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/31
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/32
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/33
switchport access vlan 20
switchport mode access
power inline never
interface FastEthernet0/34
shutdown
power inline never
interface FastEthernet0/35
shutdown
power inline never
interface FastEthernet0/36
switchport mode access
switchport voice vlan 14
spanning-tree portfast
interface FastEthernet0/37
shutdown
power inline never
interface FastEthernet0/38
shutdown
power inline never
interface FastEthernet0/39
switchport access vlan 30
switchport mode access
power inline never
interface FastEthernet0/40
switchport access vlan 90
switchport mode access
power inline never
interface FastEthernet0/41
shutdown
power inline never
interface FastEthernet0/42
shutdown
power inline never
interface FastEthernet0/43
shutdown
power inline never
interface FastEthernet0/44
switchport access vlan 40
switchport mode access
interface FastEthernet0/45
switchport access vlan 40
switchport mode access
interface FastEthernet0/46
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/47
switchport access vlan 40
switchport mode access
shutdown
interface FastEthernet0/48
switchport access vlan 40
switchport mode access
shutdown
interface GigabitEthernet0/1
shutdown
interface GigabitEthernet0/2
switchport access vlan 40
switchport mode access
interface GigabitEthernet0/3
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
interface GigabitEthernet0/4
switchport trunk encapsulation dot1q
switchport mode trunk
channel-group 1 mode on
interface Vlan1
no ip address
ip classless
ip http server
ip http secure-server
ip sla enable reaction-alerts
line con 0
logging synchronous
line vty 0 4
login
line vty 5 15
login
end
Maybe you are looking for
-
How to cancel an order if transaction not complete
How to cancel an order if transaction not complete
-
Reader can't sign pdf signature field
I have a problem with digital signatures in Adobe Reader. I have Adobe Acrobat 9. I am including a form with multiple signature fields in a pdf portfolio. This portfolio is circulated to collect signatures from users in different departments, some
-
Problem with Print Preview and Print events
Hello Experts, We have developed a program, in which, I m trying to display the % values in the Sub Totals and Grand Total lines, The logic and program functionality is performing very well. The report is displaying the output the way end user is wil
-
Business Partner Reference No to be printed in outstanding statement
Dear All, I need to get the Business Partner reference no. Column printed on the One page per Busines Partner PLD in Outstanding statement (Ageing report). I have tried to put reference but it only prints the first row details in all the subsequent r
-
CO02 goods reciept tab fields change history
Hi SAP Gurus, Is it possible to get history in CO02 transaction regarding changes in goods receipt tab fields or is there any separate transaction where we can see the changes regarding CO02 field changes or else we should go for any enhancement ? Pl