Asa ftp uploadproblem

hi
I have a problemm i have a asa 5510 box running 7.2 ios. now asa has inspect configured for FTP on 21. Now the problem is that whether in active mode or pasv mode everything wrks fine like i can dwnload and brws the directory. now when i try to upload any file it starts and after transfering some bytes it stops n times out after some time.i tried many diff ftp servers and applying acl for matching ftp traffic and everything wrks fine (acl matches ftp traffic) problem persists only for ftp uploads (both activ n pasv)..

Not sure if this is the issue but you might do a sho asp drop and check to see if the out-of-order packet buffer count is increasing (need to do the sho asp drop several times). If it is increasing, you can increase the number of buffers on your ASA by increasing the queue-limit. Here is an example..
hostname(config)# tcp-map tmap
hostname(config-tcp-map)# queue-limit 60
hostname(config)# class-map cmap
hostname(config-cmap)# match port tcp eq telnet
hostname(config)# policy-map pmap
hostname(config-pmap)# class cmap
hostname(config-pmap)# set connection advanced-options tmap
hostname(config)# service-policy pmap global
hostname(config)#
http://www.cisco.com/en/US/products/ps6120/products_command_reference_chapter09186a008063f0fa.html#wp1644016
This may or may not be your problem, but it is worth a shot.
*** Please rate if this helps.*****
thanks.
Jay

Similar Messages

  • View individual connections by IP on ASA using a MIB

    I would like to see embryonic connections of some IP's but Id like to do this with SNMP and I´m looking for a MIB for this. I see the embryonic connections with the command "show local-host x.x.x.x" but Id like to do this with a MIB in SNMP. 

    Hello Kenneth,
    I looked through various docs and here is what I found:
    We can collect the statistics for total number of connections through the box, which is the output of "show connection count" using the following OID:
    SNMP OID: .1.3.6.1.4.1.9.9.147.1.2.2.2.1.5.40.6
    However, Ithere is no such OID which tracks the statistics you are looking for.
    Here is the reference link for SNMP on ASA and the MIBs supported:
    http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/monitor_snmp.html Per above document 8.4(1) onwards ASA supports connection-limit reached trap notifications, MIB's available on site.
    Here is the link from where we can download the MIBs supported by ASA:
    ftp://ftp-sj.cisco.com/pub/mibs/supportlists/asa/asa-supportlist.html
    If you wish to be alerted when embryonic connection limit reaches, you can set email alerts to do that.
    Whenever such limit exceeds, the firewall generates the following syslog:
    Error Message    %ASA-4-407002: Embryonic limit nconns/elimit for through connections
    exceeded.outside_address/outside_port to global_address
    (inside_address)/inside_port on interface interface_name
    http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4773060
    Setting email notifications such that whenever this sylog is generated, an email is sent across. Here is how we can do it: /----------------------------------Begin Output--------------------------------/ config t logging list test message 407002 logging mail test logging from-address [email protected] logging recipient-address [email protected] smtp-server /------------------------------------End Output--------------------------------/
    HTH.
    Sourav

  • FTP ERROR ASA CISCO

    Hi Am getting below error while am try to copy image from ftp server.
    aaaaaa# copy flash:flash:/asa821-k8.bin ftp
    Source filename [/flash:/asa821-k8.bin]? asa821-k8.bin
    Address or name of remote host []? xxxxxx
    Destination filename [asa821-k8.bin]?
    Writing file ftp://xxxxxx/asa821-k8.bin...
    %Error writing ftp://1xxxxxx/asa821-k8.bin ()

    Hi Vasanth,
    Try like this...
    ASA#copy flash: ftp:
    Source filename []? asa821-kb.bin
    Address or name of remote host []? xxxxxx
    Destination filename [asa821-k8.bin]?
    Make sure that you are able to ping the FTP server from ASA and FTP Server to ASA.... if needed you may need to allow the ACL to do with the FTP transfer......
    enable ftp in asa
    conf t# ftp mode passive to make asa to respond for ftp traffic.....
    also look at the logs in ftp server app
    Regards
    Karthik

  • FTP Port ERROR Forwarding in Cisco ASA 8.2(5), Very Intersting.

    Hi,
    I  have the following configuration on a Cisco ASA 8.2(5), all the traffic  to the port 5000 go to an IP Camera and www 80 it's forward throught static NAT to a Web Server without problem,  I have the same Configuration for a FTP SERVER Windows and FTP Server Linux and doesn't make the foward to an internal IP address.  Attach is  the configuration I would like to know what is causing the problems.
    The  FTP Server Are running locally without any problems, when I try to  reach it for the Outside interface then i  can't, this is in the only  port i can't forward.
    I really appreciate your help.
    Thanks
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password dAWCvYvyr2FRISo5 encrypted
    passwd dAWCvYvyr2FRISo5 encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.2 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    ftp mode passive
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 8.8.4.4
    name-server 8.8.8.8
    name-server 196.3.81.132
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service TEST2 tcp
    port-object eq www
    port-object eq https
    access-list 101 extended permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list 101 extended permit icmp any interface outside echo-reply
    access-list 101 extended permit udp any any eq 5000
    access-list 101 extended permit udp any any eq ntp
    access-list 101 extended permit udp any 192.168.1.0 255.255.255.0 eq tftp
    access-list 102 extended permit icmp any interface outside echo-reply
    access-list 102 extended permit icmp any interface outside
    access-list 102 extended permit ip any host 192.168.1.5
    access-list 102 extended permit tcp any host 192.168.1.5 eq 5000
    access-list 102 extended permit tcp any interface outside eq 5000
    access-list 102 extended permit tcp any host 192.168.1.5 eq https
    access-list 102 extended permit tcp any any eq 5000
    access-list 102 extended permit ip any host 192.168.1.8
    access-list 102 extended permit tcp any any eq telnet
    access-list 102 extended permit tcp any interface outside object-group TEST2
    access-list 102 extended permit ip any 192.168.1.0 255.255.255.0
    access-list 102 extended permit tcp any interface outside eq www
    access-list 102 extended permit tcp any interface outside eq ftp
    access-list 102 extended permit tcp any interface outside eq ftp-data
    access-list 102 extended permit tcp any any eq ftp
    access-list 103 extended permit udp any 192.168.1.0 255.255.255.0 eq tftp
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.1.0 255.255.255.0
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 5000 192.168.1.5 5000 netmask 255.255.255.255
    static (inside,outside) tcp interface www 192.168.1.15 www netmask 255.255.255.255
    static (inside,outside) tcp interface ftp 192.168.1.15 ftp netmask 255.255.255.255
    static (inside,outside) tcp interface ftp-data 192.168.1.15 ftp-data netmask 255.255.255.255
    access-group 102 in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 225.255.255.0 inside
    telnet timeout 30
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.10-192.168.1.41 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cabelen password tJPt4MkXkeex6ITZ encrypted
    class-map ftp-class
    match access-list 102
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect dns preset_dns_map
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:3465bc9d04198e9df80787c0c039db27
    : end
    ciscoasa#

    This is the results of the log it didn't not find the public ip address which im making FTP connection.
    ciscoasa#  sh logg | i 147.197.115.171
    ciscoasa#  sh logg
    Syslog logging: enabled
        Facility: 20
        Timestamp logging: disabled
        Standby logging: disabled
        Debug-trace logging: disabled
        Console logging: disabled
        Monitor logging: disabled
        Buffer logging: level debugging, 88 messages logged
        Trap logging: disabled
        History logging: disabled
        Device ID: disabled
        Mail logging: disabled
        ASDM logging: level informational, 68 messages logged
    connection 125407 for outside:111.221.74.28/443 to inside:192.168.1.24/24483 duration 0:02:01 bytes
    44
    %ASA-7-609002: Teardown local-host outside:111.221.74.28 duration 0:02:01
    %ASA-7-710005: UDP request discarded from 192.168.1.24/138 to inside:192.168.1.255/138
    %ASA-6-302016: Teardown UDP connection 125402 for outside:177.0.186.239/57036 to inside:192.168.1.24
    /24483 duration 0:02:02 bytes 220
    %ASA-7-609002: Teardown local-host outside:177.0.186.239 duration 0:02:02
    %ASA-6-302016: Teardown UDP connection 125408 for outside:89.240.135.18/47096 to inside:192.168.1.24
    /24483 duration 0:02:01 bytes 44
    %ASA-7-609002: Teardown local-host outside:89.240.135.18 duration 0:02:01
    %ASA-6-302016: Teardown UDP connection 125409 for outside:111.221.77.145/40037 to inside:192.168.1.2
    4/24483 duration 0:02:01 bytes 486
    %ASA-7-609002: Teardown local-host outside:111.221.77.145 duration 0:02:01
    %ASA-6-302016: Teardown UDP connection 125410 for outside:64.4.23.148/40014 to inside:192.168.1.24/2
    4483 duration 0:02:01 bytes 178
    %ASA-7-609002: Teardown local-host outside:64.4.23.148 duration 0:02:01
    %ASA-6-305012: Teardown dynamic UDP translation from inside:192.168.1.24/24483 to outside:69.86.151.
    109/54119 duration 0:03:00
    %ide:216.146.39.70/80 to inside:192.168.1.5/3628 duration 0:00:00 bytes 303 TCP FINs
    %ASA-7-609002: Teardown local-host outside:216.146.39.70 duration 0:00:00
    nable_15' executed the 'configure terminal' command.
    %ASA-6-302015: Built inbound UDP connection 125412 for inside:192.168.1.20/68 (192.168.1.20/68) to i
    dentity:192.168.1.2/67 (192.168.1.2/67)
    %ASA-6-604103: DHCP daemon interface inside:  address granted 0128.987b.d28e.e7 (192.168.1.20)
    %ASA-6-302016: Teardown UDP connection 125411 for inside:192.168.1.27/68 to identity:192.168.1.2/67
    duration 0:02:01 bytes 623
    %ASA-5-111008: User 'enable_15' executed the 'no access-list 102 extended permit ip any 192.168.1.0
    255.255.255.0' command.
    %ASA-6-302010: 20 in use, 234 most used
    %ASA-5-111008: User 'enable_15' executed the 'no access-list 102 extended permit ip any host 192.168
    .1.8' command.
    %ASA-5-111005: 192.168.1.24 end configuration: OK
    %ASA-6-302016: Teardown UDP connection 125412 for inside:192.168.1.20/68 to identity:192.168.1.2/67
    duration 0:02:01 bytes 641
    %ASA-7-609001: Built local-host outside:209.128.96.248
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.20/57764 to outside:69.86.151.109
    /50424
    %ASA-6-302013: Built outbound TCP connection 125413 for outside:209.128.96.248/80 (209.128.96.248/80
    ) to inside:192.168.1.20/57764 (69.86.151.109/50424)
    %ASA-7-111009: User 'enable_15' executed cmd: show running-config
    %ASA-7-111009: User 'enable_15' executed cmd: show logging
    %ASA-7-609001: Built local-host outside:174.35.22.69
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.24/51106 to outside:69.86.151.109
    /53818
    %ASA-6-302013: Built outbound TCP connection 125414 for outside:174.35.22.69/80 (174.35.22.69/80) to
    inside:192.168.1.24/51106 (69.86.151.109/53818)
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.24/51107 to outside:69.86.151.109
    /12433
    %ASA-6-302013: Built outbound TCP connection 125415 for outside:174.35.22.69/80 (174.35.22.69/80) to
    inside:192.168.1.24/51107 (69.86.151.109/12433)
    %ASA-7-609001: Built local-host outside:8.8.8.8
    %ASA-6-305011: Built dynamic UDP translation from inside:192.168.1.24/51214 to outside:69.86.151.109
    /42103
    %ASA-6-302015: Built outbound UDP connection 125416 for outside:8.8.8.8/53 (8.8.8.8/53) to inside:19
    2.168.1.24/51214 (69.86.151.109/42103)
    %ASA-6-302016: Teardown UDP connection 125416 for outside:8.8.8.8/53 to inside:192.168.1.24/51214 du
    ration 0:00:00 bytes 176
    %ASA-7-609002: Teardown local-host outside:8.8.8.8 duration 0:00:00
    %ASA-6-302014: Teardown TCP connection 125414 for outside:174.35.22.69/80 to inside:192.168.1.24/511
    06 duration 0:00:06 bytes 2075 TCP FINs
    %ASA-6-302014: Teardown TCP connection 125415 for outside:174.35.22.69/80 to inside:192.168.1.24/511
    07 duration 0:00:06 bytes 3016 TCP FINs
    %ASA-7-609002: Teardown local-host outside:174.35.22.69 duration 0:00:06
    ciscoasa#

  • Windows FTP download to ASA, default password = root

    I was able to set up a Windows 2003 server as an FTP server, and was able to transfer files.  However, I had to view the Windows FTP log to determine the default password was root@DallasRouter.   I can not find any documentation on this, and it's the first time I've seen "root" in the Cisco world.   Can anyone point me to a web site or help me understand this?                  

    Jimmyc,
    On the ASA you can include the any userID as part of the ftp URL like this one below
    KUSANKAR-ASA-5505# copy ftp://kusankar:[email protected]/asa.txt flash:asa.tx                        t
    Address or name of remote host [192.168.2.2]?
    Source username [kusankar]?
    Source password [kusankar]?
    Source filename [asa.txt]?
    Destination filename [asa.txt]?
    Accessing ftp://kusankar:[email protected]/asa.txt...!!!!!!!!!!!!!!!!!!!!!!!!                        !!!!!!!!!!!!!!!!!!
    Writing file disk0:/asa.txt...
    56097 bytes copied in 0.140 secs
    KUSANKAR-ASA-5505#
    http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/c4.html#wp2171368
    -Kureli

  • FTPS on cisco asa

    I have an ASA 5505 code version 9.0(3) and FTPS seems to be working with some but not others. The ones who can transfer files have full ip completely, but the ones who can't are able to authenticate but cannot transfer files. This led me to believe that this was an ACL issue, but then I looked at the logs and I am getting this error for the user that cannot connect:
     tcp flow from outside:x.x.x.x/56721 to inside:x.x.x.x/21 terminated by inspection engine, reason - inspector drop reset.
    Does anyone know why they would be getting this error?
    Thanks in advance!

    I will tell you why:
    Let say when you allow ftp from external to internal, normally your ACL will look like this:
    static (inside,outside) 1.1.1.1 192.168.1.1 netmask 255.255.255.255
    access-list outside permit tcp any host 1.1.1.1 eq 21 log
    access-list outside deny ip any any log
    Now when host 2.2.2.2 want to connect to 1.1.1.1 on ftp, the firewall knows that connect is ftp so it will allow inspect ftp to handle the data connection properly.
    Now let say if you disable inspect ftp, when the client 2.2.2.2 connect to host 1.1.1.1 via ftp and let say he issues an "passive" to enter passive mode.  Without inspect ftp, you would have to to allow:
    access-list outside permit tcp any host 1.1.1.1 gt 1024
    because passive allows the client to connect to the server on tcp high-ports, nature of FTP.  By disabling inspect ftp, this is no longer possible thus breaking ftp connection, unless you implement the ACL above, which I don't think your security department will approve.
    The alternative is to use SecureFTP or sFTP which will a perfectly secure protocol.  This is 2014, not 1999.  FTP and FTPs should be banned.

  • Configure ASA 5515 to allow FTP server behind it.

                       We have one Cisco ASA5515 firewall, I configured ftp mode to passive, inspect ftp in service, use anoother public to do NAT with ftp server, and also configued ACL in outside interface, but I failed to access the ftp server from internet use that public ip address, no problem to acces the ftp server use its inside address in LAN.
    Anyone can help on this is appreciated!

    Thanks!
    I did packet tracer in asdm, all is green.
    here is configuration file:
    ciscoasa# sh run
    : Saved
    ASA Version 9.1(1)
    hostname ciscoasa
    enable password qZTcCWWJxxdsdsxcxcxxr encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd qZTcxxcxcxcxxdcxJglvMyNxr encrypted
    names
    ip local pool VPNAddressPool 10.115.135.100-10.115.135.254 mask 255.255.255.0
    interface GigabitEthernet0/0
    description Outside Internet
    nameif Outside
    security-level 0
    ip address xxx.xx.xxx.xxx 255.255.255.248
    interface GigabitEthernet0/1
    shutdown    
    no nameif   
    no security-level
    no ip address
    interface GigabitEthernet0/2
    description MPLS Circuit
    shutdown    
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown    
    no nameif   
    no security-level
    no ip address
    interface GigabitEthernet0/4
    description Inside LAN
    nameif LAN  
    security-level 100
    ip address 172.28.144.11 255.255.255.0
    interface GigabitEthernet0/5
    shutdown    
    no nameif   
    no security-level
    no ip address
    interface Management0/0
    management-only
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    boot system disk0:/asa911-smp-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup Outside
    dns server-group DefaultDNS
    name-server xxx.xxx.xx.xxx
    name-server xxx.xxx.xx.xxx
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network VPNNetwork
    subnet 10.115.135.0 255.255.255.0
    object network 172.28.144.11
    host 172.28.144.11
    object network NETWORK_OBJ_10.115.135.0_24
    subnet 10.115.135.0 255.255.255.0
    object network NETWORK_OBJ_172.28.144.0_24
    subnet 172.28.144.0 255.255.255.0
    object network NETWORK_OBJ_10.100.1.0_30
    subnet 10.100.1.0 255.255.255.252
    object network NETWORK_OBJ_172.28.76.0_24
    subnet 172.28.76.0 255.255.255.0
    object network FTP_Outside
    host xxx.xx.xxx.xxx
    object network FTP_Inside
    host 172.28.144.6
    object network NAT_FTP
    host xxx.xx.xxx.xxx
    description FTP
    object network FTP-Data
    host xxx.xx.xxx.xxx
    description FTP-Data
    access-list NMA_VPNSplitTunnelAcl extended permit ip object VPNNetwork 172.28.144.0 255.255.255.0
    access-list NMA_VPNSplitTunnelAcl extended permit ip 172.28.144.0 255.255.255.0 object VPNNetwork
    access-list Outside_access_in extended permit tcp any any eq ssh
    access-list Outside_access_in extended permit ip any object NETWORK_OBJ_172.28.144.0_24
    access-list NMA_splitTunnelAcl standard permit 172.28.144.0 255.255.255.0
    access-list LAN_access_in extended permit ip any any
    access-list acl_out extended permit tcp any host xxx.xx.xxx.xxx eq ftp
    access-list acl_out extended permit tcp any host xxx.xx.xxx.xxx eq ftp-data
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu LAN 1500 
    mtu MPLS 1500
    mtu Outside 1500 
    no failover  
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-712.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (Outside,LAN) source static VPNNetwork VPNNetwork destination static NETWORK_OBJ_172.28.144.0_24
    NETWORK_OBJ_172.28.144.0_24 no-proxy-arp route-lookup
    nat (LAN,Outside) source dynamic any interface
    object network NAT_FTP
    nat (Outside,LAN) static FTP_Inside service tcp ftp ftp
    object network FTP-Data
    nat (Outside,LAN) static FTP_Inside service tcp ftp-data ftp-data
    access-group LAN_access_in in interface LAN
    access-group acl_out in interface Outside
    route Outside 0.0.0.0 0.0.0.0 xxx.xx.xxx.xxx 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 172.28.144.0 255.255.255.0 LAN
    http 172.28.144.6 255.255.255.255 LAN
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Outside_map interface Outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca trustpool policy
    crypto ca certificate chain _SmartCallHome_ServerCA
    crypto ikev1 enable Outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha    
    group 2     
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha    
    group 2     
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 LAN
    telnet 172.28.144.0 255.255.255.0 LAN
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption 3des-sha1 des-sha1
    group-policy NMA internal
    group-policy NMA attributes
    dns-server value 172.28.144.2 172.28.76.8
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value NMA_VPNSplitTunnelAcl
    default-domain value test1.test2.com
    vpn-group-policy NMA
    service-type remote-access
    tunnel-group NMA type remote-access
    tunnel-group NMA general-attributes
    address-pool VPNAddressPool
    authorization-server-group LOCAL
    default-group-policy NMA
    tunnel-group NMA ipsec-attributes
    ikev1 pre-shared-key xxxxcxxxx
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters  
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    policy-map global_poliy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:e603c4e7da420d445507ceb5bac213f9
    : end

  • Upgrade ASA-SSM-10 via FTP

    Hi all,
    I am trying to upgrade an ASA-SSM-10 running version 5.1 software.
    I have set up an FTP server using Serv-u and can connect to it successfully.
    When I attempt to upgrade using the following command, I get the error below.
    sensor(config)# upgrade ftp://[email protected]//IPS/IPS-K9-6.0-3-E1.pkg
    The filename IPS-K9-6.0-3-E1.pkg is not a valid upgrade file type.
    Continue with upgrade? []: yes
    Error: execUpgradeSoftware : Connect failed
    I have tried 2 FTP servers and receive the same error I have tried 4 upgrade packages and receive the same error.
    Does anyone have any advice on how to fix this issue.
    Thank you
    Greg

    Your upgrade commands look correct. http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliImage.html#wp1243115
    I've had some problems with Serv-U in the past year or so. I had to switch to FileZilla to perform my last upgrade.
    http://filezilla-project.org/
    - Bob

  • Ftp through ASA stuck @ Opening data connection

    hi,
    i have a problem with an ASA and connect from outside to an inside ftp server. The connection stuck at Opening data connection....
    [R] 227 Entering Passive Mode (<external ip>,198,49).
    [R] Opening data connection IP: <external ip> PORT: 50737
    [R] QUIT
    [R] 221  Have a nice day.
    [R] Logged off: <external ip>
    I have configured an ACL for FTP and FTP-DATA and activate inspect rule.
    Any suggestions?
    Thanks and regards
    Jason

    Hi Sankar,
    I dont know if you are able to assist as i am having a similar issue.
    I had issues in the past  connecting to external ftp sites so i created an inspection rule on my wan interfaces and ask any staff trying to connect to any ftp site to send me the ip address so i can add under the inspection rule and this has always worked for me.
    I had to do this because we also have ftp sites internally that people try to connect to from outside too.
    But lately ,i have done this for an external ftp site and it connects but doesnt list directories.
    The log message is
    terminated by inspection engine,reason -inspector drop reset.
    Below is the internal host trying to connect to the ftp server service policy command output :
    External ftp server is 81.144.145.6.
    # sh service-policy flow tcp host x.x.x.x host 81.144.145.6 eq ftp
    Global policy:
      Service-policy: global_policy
        Class-map: cmap
          Match: access-list TCP
            Access rule: permit tcp any any
          Action:
            Input flow:  set connection advanced-options tmap
        Class-map: netflow-export-class
          Match: access-list netflow-export
            Access rule: permit ip any any
          Action:
            Output flow:  flow-export event-type all destination 10.120.3.226 10.120                                                                                        .16.220
        Class-map: class-default
          Match: any
          Action:
            Output flow:
    Interface MAN_CORE_TO_WAN:
      Service-policy: STV_IPS_POLICY
        Class-map: STV_IPS_CLASS
          Match: access-list STV_IPS_ACL
            Access rule: permit ip any host 81.144.145.6
          Match: default-inspection-traffic
          Action:
            Input flow:  inspect ftp
        Class-map: class-default
          Match: any
          Action:
            Output flow:
    Interface MAN_CORE_TO_WAN_ELXSI:
      Service-policy: STV_IPS_POLICY
        Class-map: STV_IPS_CLASS
          Match: access-list STV_IPS_ACL
            Access rule: permit ip any host 81.144.145.6
          Match: default-inspection-traffic
          Action:
            Input flow:  inspect ftp
        Class-map: class-default
          Match: any
          Action:
            Output flow:
    Interface MAN_CORE-TO-WAN-THUS:
      Service-policy: STV_IPS_POLICY
        Class-map: STV_IPS_CLASS
          Match: access-list STV_IPS_ACL
            Access rule: permit ip any host 81.144.145.6
          Match: default-inspection-traffic
          Action:
            Input flow:  inspect ftp
        Class-map: class-default
          Match: any
          Action:
    I just cant understand why it has worked for tens of external ftp sites and it doesnt work for this particular one.
    Cheers

  • FTP issue inside to outside on ASA

    we have user who are on DHCP and would require some user to access FTP server which is on the outside.
    However being on DHCP it is not possible so suggested to use a internal server and ftp from their but it still doesn't work after allowing through the ASA

    did you configure "inspect ftp"?

  • WCCP on ASA for FTP over HTTP

    Hello,
    We have a WSA appliance that we have in explicit mode and want to configure as transparent. The protocols we cache and analyze with WSA are HTTP, HTTPS, native FTP and FTP over HTTP.
    Is there a service number on WCCP for FTP over HTTP protocol? Or it is included within HTTP?
    Thanks a lot in advance.
    Best regards,
    Igor

    Igor,
    The service number 60 (ftp-native service) only applies  to transparent redirection of FTP native requests and does not apply to  FTP-over-HTTP requests.
    On the other hand; the Content Engine listens for redirected HTTP  requests on the standard HTTP port (default port 80). To enable the  Content Engine to listen for WCCP-intercepted HTTP traffic on ports  other than the default port, configure the custom-web-cache service (98 and 99) or a  user-defined WCCP service (services 90 to 97).
    I hope this helps.
    Regards,
    Juan Lombana
    Please rate helpful posts.

  • Internet Connection Became Slow after Introduction of Cisco ASA 5505 to the Network

    I configured a Cisco ASA 5505 (Version Cisco Adaptive Security Appliance Software Version 7.2(3)
    Device Manager Version 5.2(3)
    in transparent firewall mode and inserted after Cisco 1700 router. However, the internet connection became very slow and users are compaining that they cannot load any pages.
    My setup looks like:
    Internet --> Cisco 1700 --> Cisco ASA 5505 --> LAN
    The license information is:
    Licensed features for this platform:
    Maximum Physical Interfaces : 8
    VLANs                       : 3, DMZ Restricted
    Inside Hosts                : Unlimited
    Failover                    : Disabled
    VPN-DES                     : Enabled
    VPN-3DES-AES                : Enabled
    VPN Peers                   : 10
    WebVPN Peers                : 2
    Dual ISPs                   : Disabled
    VLAN Trunk Ports            : 0
    This platform has a Base license.
    The flash activation key is the SAME as the running key.
    My running-config looks like:
    ASA Version 7.2(3)
    firewall transparent
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    no shut
    interface Vlan2
    nameif outside
    security-level 0
    no shut
    interface Ethernet0/0
    switchport access vlan 2
    no shut
    interface Ethernet0/1
    no shut
    interface Ethernet0/2
    no shut
    interface Ethernet0/3
    no shut
    interface Ethernet0/4
    no shut
    interface Ethernet0/5
    no shut
    interface Ethernet0/6
    no shut
    interface Ethernet0/7
    no shut
    passwd 2KFQnbNIdI.2KYOU encrypted
    regex urllist1 ".*\.([Ee][Xx][Ee]|[Cc][Oo][Mm]|[Bb][Aa][Tt]) HTTP/1.[01]"
    regex urllist2 ".*\.([Pp][Ii][Ff]|[Vv][Bb][Ss]|[Ww][Ss][Hh]) HTTP/1.[01]"
    regex urllist3 ".*\.([Dd][Oo][Cc]|[Xx][Ll][Ss]|[Pp][Pp][Tt]) HTTP/1.[01]"
    regex urllist4 ".*\.([Zz][Ii][Pp]|[Tt][Aa][Rr]|[Tt][Gg][Zz]) HTTP/1.[01]"
    regex domainlist1 "\.facebook\.com"
    regex domainlist2 "\.diretube\.com"
    regex domainlist3 "\.youtube\.com"
    regex domainlist4 "\.vimeo\.com"
    regex applicationheader "application/.*"
    regex contenttype "Content-Type"
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_in extended permit ip any any
    access-list inside_mpc extended permit tcp any any eq www
    access-list inside_mpc extended permit tcp any any eq 8080
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    ip address 192.168.1.254 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    class-map type regex match-any DomainBlockList
    match regex domainlist1
    match regex domainlist2
    match regex domainlist3
    match regex domainlist4
    class-map type inspect http match-all BlockDomainsClass
    match request header host regex class DomainBlockList
    class-map type regex match-any URLBlockList
    match regex urllist1
    match regex urllist2
    match regex urllist3
    match regex urllist4
    class-map inspection_default
    match default-inspection-traffic
    class-map type inspect http match-all AppHeaderClass
    match response header regex contenttype regex applicationheader
    class-map httptraffic
    match access-list inside_mpc
    class-map type inspect http match-all BlockURLsClass
    match request uri regex class URLBlockList
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map type inspect http http_inspection_policy
    parameters
      protocol-violation action drop-connection
    class AppHeaderClass
      drop-connection log
    match request method connect
      drop-connection log
    class BlockDomainsClass
      reset log
    class BlockURLsClass
      reset log
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    policy-map inside-policy
    class httptraffic
      inspect http http_inspection_policy
    service-policy global_policy global
    service-policy inside-policy interface inside
    prompt hostname context
    Cryptochecksum:8ab1a53df6ae3c202aee236d6080edfd
    : end
    Could the slow internet connection be due to license limitations? Or is there something wrong with my configuration?
    Please see the configuration and help.
    Thanks

    I have re-configured the ASA 5505 yesterday and so far it's working fine. I am not sure if the problem will re-appear later on. Anyways here is my sh tech-support
    ciscoasa# sh tech-support
    Cisco Adaptive Security Appliance Software Version 7.2(3)
    Device Manager Version 5.2(3)
    Compiled on Wed 15-Aug-07 16:08 by builders
    System image file is "disk0:/asa723-k8.bin"
    Config file at boot was "startup-config"
    ciscoasa up 14 hours 16 mins
    Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
    Internal ATA Compact Flash, 128MB
    BIOS Flash M50FW080 @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                                 Boot microcode   : CNlite-MC-Boot-Cisco-1.2
                                 SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
    0: Int: Internal-Data0/0    : address is 001f.9ee8.ffa2, irq 11
    1: Ext: Ethernet0/0         : address is 001f.9ee8.ff9a, irq 255
    2: Ext: Ethernet0/1         : address is 001f.9ee8.ff9b, irq 255
    3: Ext: Ethernet0/2         : address is 001f.9ee8.ff9c, irq 255
    4: Ext: Ethernet0/3         : address is 001f.9ee8.ff9d, irq 255
    5: Ext: Ethernet0/4         : address is 001f.9ee8.ff9e, irq 255
    6: Ext: Ethernet0/5         : address is 001f.9ee8.ff9f, irq 255
    <--- More --->
    7: Ext: Ethernet0/6         : address is 001f.9ee8.ffa0, irq 255
    8: Ext: Ethernet0/7         : address is 001f.9ee8.ffa1, irq 255
    9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
    10: Int: Not used            : irq 255
    11: Int: Not used            : irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces : 8        
    VLANs                       : 3, DMZ Restricted
    Inside Hosts                : Unlimited
    Failover                    : Disabled
    VPN-DES                     : Enabled  
    VPN-3DES-AES                : Enabled  
    VPN Peers                   : 10       
    WebVPN Peers                : 2        
    Dual ISPs                   : Disabled 
    VLAN Trunk Ports            : 0        
    This platform has a Base license.
    Serial Number: JMX1211Z2N4
    Running Activation Key: 0xaf0ed046 0xbcf18ebf 0x80b38508 0xba785cc0 0x05250493
    Configuration register is 0x1
    Configuration has not been modified since last system restart.
    <--- More --->
    ------------------ show clock ------------------
    18:32:58.254 UTC Tue Nov 26 2013
    ------------------ show memory ------------------
    Free memory:       199837144 bytes (74%)
    Used memory:        68598312 bytes (26%)
    Total memory:      268435456 bytes (100%)
    ------------------ show conn count ------------------
    1041 in use, 2469 most used
    ------------------ show xlate count ------------------
    0 in use, 0 most used
    ------------------ show blocks ------------------
      SIZE    MAX    LOW    CNT
         0    100     68    100
    <--- More --->
         4    300    299    299
        80    100     92    100
       256    100     94    100
      1550   6174   6166   6174
      2048   1124    551    612
    ------------------ show blocks queue history detail ------------------
    History buffer memory usage: 2136 bytes (default)
    ------------------ show interface ------------------
    Interface Internal-Data0/0 "", is up, line protocol is up
      Hardware is y88acs06, BW 1000 Mbps
    (Full-duplex), (1000 Mbps)
    MAC address 001f.9ee8.ffa2, MTU not set
    IP address unassigned
    18491855 packets input, 11769262614 bytes, 0 no buffer
    Received 213772 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops, 0 demux drops
    18185861 packets output, 11626494317 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 late collisions, 0 deferred
    <--- More --->
    0 input reset drops, 0 output reset drops
    input queue (curr/max packets): hardware (0/0) software (0/0)
    output queue (curr/max packets): hardware (0/55) software (0/0)
      Control Point Interface States:
    Interface number is unassigned
    Interface Internal-Data0/1 "", is administratively down, line protocol is up
      Hardware is 88E6095, BW 1000 Mbps
    (Full-duplex), (1000 Mbps)
    MAC address 0000.0003.0002, MTU not set
    IP address unassigned
    18184216 packets input, 11625360131 bytes, 0 no buffer
    Received 206655 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 switch ingress policy drops
    18490057 packets output, 11768078777 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Loopback0 "_internal_loopback", is up, line protocol is up
      Hardware is VirtualMAC address 0000.0000.0000, MTU 1500
    IP address 127.1.0.1, subnet mask 255.255.0.0
    <--- More --->
      Traffic Statistics for "_internal_loopback":
    1 packets input, 28 bytes
    1 packets output, 28 bytes
    1 packets dropped
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
      Control Point Interface States:
    Interface number is 28
    Interface config status is active
    Interface state is active
    Interface Vlan1 "inside", is up, line protocol is up
      Hardware is EtherSVI
    MAC address 001f.9ee8.ffa2, MTU 1500
    IP address 192.168.1.254, subnet mask 255.255.255.0
      Traffic Statistics for "inside":
    7742275 packets input, 903584114 bytes
    10645034 packets output, 10347291114 bytes
    184883 packets dropped
          1 minute input rate 320 pkts/sec,  35404 bytes/sec
          1 minute output rate 325 pkts/sec,  313317 bytes/sec
    <--- More --->
          1 minute drop rate, 17 pkts/sec
          5 minute input rate 399 pkts/sec,  59676 bytes/sec
          5 minute output rate 483 pkts/sec,  503200 bytes/sec
          5 minute drop rate, 9 pkts/sec
      Control Point Interface States:
    Interface number is 1
    Interface config status is active
    Interface state is active
    Interface Vlan2 "outside", is up, line protocol is up
      Hardware is EtherSVI
    MAC address 001f.9ee8.ffa3, MTU 1500
    IP address 192.168.1.254, subnet mask 255.255.255.0
      Traffic Statistics for "outside":
    10750090 packets input, 10432619059 bytes
    7541331 packets output, 870613684 bytes
    109911 packets dropped
          1 minute input rate 328 pkts/sec,  313770 bytes/sec
          1 minute output rate 301 pkts/sec,  32459 bytes/sec
          1 minute drop rate, 2 pkts/sec
          5 minute input rate 485 pkts/sec,  503789 bytes/sec
          5 minute output rate 387 pkts/sec,  57681 bytes/sec
          5 minute drop rate, 2 pkts/sec
      Control Point Interface States:
    Interface number is 2
    <--- More --->
    Interface config status is active
    Interface state is active
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9a, MTU not set
    IP address unassigned
    10749794 packets input, 10630700889 bytes, 0 no buffer
    Received 2506 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    3 switch ingress policy drops
    7541070 packets output, 1028190148 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/1 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
    <--- More --->
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9b, MTU not set
    IP address unassigned
    7741977 packets input, 1064586806 bytes, 0 no buffer
    Received 211282 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    10644663 packets output, 10543362751 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/2 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9c, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    <--- More --->
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/3 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9d, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    <--- More --->
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/4 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9e, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    <--- More --->
    Interface number is unassigned
    Interface Ethernet0/5 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ff9f, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/6 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    <--- More --->
    MAC address 001f.9ee8.ffa0, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    Interface Ethernet0/7 "", is down, line protocol is down
      Hardware is 88E6095, BW 100 Mbps
    Auto-Duplex, Auto-Speed
    Available but not configured via nameif
    MAC address 001f.9ee8.ffa1, MTU not set
    IP address unassigned
    0 packets input, 0 bytes, 0 no buffer
    Received 0 broadcasts, 0 runts, 0 giants
    0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
    <--- More --->
    0 L2 decode drops
    0 switch ingress policy drops
    0 packets output, 0 bytes, 0 underruns
    0 output errors, 0 collisions, 0 interface resets
    0 babbles, 0 late collisions, 0 deferred
    0 lost carrier, 0 no carrier
    0 rate limit drops
    0 switch egress policy drops
      Control Point Interface States:
    Interface number is unassigned
    ------------------ show cpu usage ------------------
    CPU utilization for 5 seconds = 12%; 1 minute: 11%; 5 minutes: 11%
    ------------------ show cpu hogging process ------------------
    Process:      Dispatch Unit, NUMHOG: 1, MAXHOG: 133, LASTHOG: 140
    LASTHOG At:   04:45:59 UTC Nov 26 2013
    PC:           8be0f7
    Traceback:    8bed19  8bf553  302b87  3030a5  2fad69  7674bf  75ca16
                  c6251d  c62a4c  c62f6c  75c653  767820  797f64  769c85
    <--- More --->
    ------------------ show process ------------------
        PC       SP       STATE       Runtime    SBASE     Stack Process
    Mwe 00c9bb24 01bb8700 013e3250          0 01733fc8 15616/16384 emweb/cifs
    Lwe 001072ac 0176f9c4 013e32d0          0 0176d9f0 8132/8192 block_diag
    Mrd 00223a67 01783d5c 013e33b0     314854 0177be18 25752/32768 Dispatch Unit
    Msi 00f82847 01b07b84 013e3250        229 01b05bc0 7984/8192 y88acs06 OneSec Thread
    Mwe 0011b1a5 01b09cfc 013e3250          0 01b07d88 7864/8192 Reload Control Thread
    Mwe 00120606 01b1260c 013e5258          0 01b10988 7256/8192 aaa
    Mwe 001486aa 01b19404 013e5ae8          0 01b15450 16020/16384 CMGR Server Process
    Mwe 0014c3c5 01b1b4d4 013e3250          0 01b19570 7968/8192 CMGR Timer Process
    Lwe 002227a1 01b239b4 013ee360          0 01b219f0 7524/8192 dbgtrace
    Mwe 004e1ba5 01b29c34 013e3250        157 01b27d50 6436/8192 eswilp_svi_init
    Mwe 01064b1d 01b4a7f4 013e3250          0 01b48890 7848/8192 Chunk Manager
    Msi 008b61b6 01b52d54 013e3250        230 01b50da0 7856/8192 PIX Garbage Collector
    Lsi 00ecb6ac 01b54e94 013e3250         12 01b52ec0 7552/8192 route_process
    Mwe 008a5ddc 01b5dc04 0133b430          0 01b5bc40 8116/8192 IP Address Assign
    Mwe 00acb779 01b60604 01346e10          0 01b5e640 8116/8192 QoS Support Module
    Mwe 0091eba9 01b6275c 0133c530          0 01b60798 8116/8192 Client Update Task
    Lwe 01083c8e 01b656d4 013e3250     123088 01b63770 7840/8192 Checkheaps
    Mwe 00acfd7d 01b6b824 013e3250        623 01b69ad0 3476/8192 Quack process
    Mwe 00b2a260 01b6dad4 013e3250         22 01b6bbf0 7364/8192 Session Manager
    Mwe 00c55efd 01b78564 031d0478          4 01b74a50 14768/16384 uauth
    <--- More --->
    Mwe 00be3c9e 01b7aaec 0135c010          0 01b78b28 7524/8192 Uauth_Proxy
    Mwe 00c52759 01b80e0c 01361770          0 01b7ee88 7712/8192 SMTP
    Mwe 00c3f7b9 01b82eec 01361710          0 01b80fa8 7412/8192 Logger
    Mwe 00c3fd26 01b8502c 013e3250          0 01b830c8 7492/8192 Thread Logger
    Mwe 00f62272 01b9596c 013ac520          0 01b939c8 7188/8192 vpnlb_thread
    Msi 00b4097c 01c598c4 013e3250        190 01c578f0 8000/8192 emweb/cifs_timer
    Msi 005bd338 017a909c 013e3250      25855 017a7108 7412/8192 arp_timer
    Mwe 005c76bc 01b486e4 013fba50      20643 01b46770 7348/8192 arp_forward_thread
    Mwe 00c5a919 023fa5fc 013619e0          0 023f8648 7968/8192 tcp_fast
    Mwe 00c5a6e5 023fc624 013619e0          0 023fa670 7968/8192 tcp_slow
    Mwe 00c754d1 0240d42c 013628a0          0 0240b478 8100/8192 udp_timer
    Mwe 0019cb17 01b404a4 013e3250          0 01b3e530 7984/8192 CTCP Timer process
    Mwe 00efe8b3 0308c15c 013e3250          0 0308a208 7952/8192 L2TP data daemon
    Mwe 00efef23 0308e194 013e3250          0 0308c230 7968/8192 L2TP mgmt daemon
    Mwe 00eea02b 030c62ac 013a5c10         43 030c2338 16244/16384 ppp_timer_thread
    Msi 00f62d57 030c82f4 013e3250        264 030c6360 7924/8192 vpnlb_timer_thread
    Mwe 001b96e6 01b7cbbc 01b1e9c8          1 01b7ac48 7728/8192 IPsec message handler
    Msi 001c9bac 01b8d4dc 013e3250       2917 01b8b548 7648/8192 CTM message handler
    Mwe 00af93b8 031465b4 013e3250          0 03144640 7984/8192 ICMP event handler
    Mwe 00831003 0314a724 013e3250        387 031467b0 16100/16384 IP Background
    Mwe 0021b267 031a83c4 013123c0         31 03188450 123488/131072 tmatch compile thread
    Mwe 009f2405 03290044 013e3250          0 0328c0c0 16072/16384 Crypto PKI RECV
    Mwe 009f305a 03294144 013e3250          0 032901e0 16040/16384 Crypto CA
    Mwe 0064d4fd 01b3e24c 013e3250          8 01b3c2f8 7508/8192 ESW_MRVL switch interrupt service
    <--- More --->
    Msi 00646f5c 032c134c 013e3250    3059378 032bf448 7184/8192 esw_stats
    Lsi 008cbb80 032dc704 013e3250          3 032da730 7908/8192 uauth_urlb clean
    Lwe 008afee7 034a0914 013e3250        197 0349e9b0 6636/8192 pm_timer_thread
    Mwe 0052f0bf 034a35ac 013e3250          0 034a1648 7968/8192 IKE Timekeeper
    Mwe 00520f6b 034a8adc 0132e2b0          0 034a4e38 15448/16384 IKE Daemon
    Mwe 00bf5c78 034ac7ac 01360680          0 034aa7f8 8100/8192 RADIUS Proxy Event Daemon
    Mwe 00bc32de 034ae79c 034dcbe0          0 034ac918 7208/8192 RADIUS Proxy Listener
    Mwe 00bf5e0f 034b099c 013e3250          0 034aea38 7968/8192 RADIUS Proxy Time Keeper
    Mwe 005aac4c 034b3154 013fb980          0 034b1250 7492/8192 Integrity FW Task
    M*  008550a5 0009fefc 013e33b0       3183 034e3b20 24896/32768 ci/console
    Msi 008eb694 034ed9d4 013e3250       2370 034ebc40 6176/8192 update_cpu_usage
    Msi 008e6415 034f7dac 013e3250       1096 034f5eb8 6124/8192 NIC status poll
    Mwe 005b63e6 03517d1c 013fbd10       1963 03515d78 7636/8192 IP Thread
    Mwe 005becbe 03519e4c 013fbcb0          3 03517e98 7384/8192 ARP Thread
    Mwe 004c2b36 0351befc 013fbae0          0 03519fe8 7864/8192 icmp_thread
    Mwe 00c7722e 0351e06c 013e3250          0 0351c108 7848/8192 udp_thread
    Mwe 00c5d126 0352008c 013fbd00          0 0351e228 7688/8192 tcp_thread
    Mwe 00bc32de 03a6982c 03a5ee18          0 03a679b8 7512/8192 EAPoUDP-sock
    Mwe 00266c15 03a6b614 013e3250          0 03a699e0 7032/8192 EAPoUDP
    Mwe 005a6728 01b27b94 013e3250          0 01b25c30 7968/8192 Integrity Fw Timer Thread
    -     -        -         -      47686621    -         -     scheduler
    -     -        -         -      51253819    -         -     total elapsed
    ------------------ show failover ------------------
    <--- More --->
    ERROR: Command requires failover license
    ------------------ show traffic ------------------
    inside:
    received (in 51429.740 secs):
    7749585 packets905087345 bytes
    67 pkts/sec17013 bytes/sec
    transmitted (in 51429.740 secs):
    10653162 packets10355908020 bytes
    40 pkts/sec201026 bytes/sec
          1 minute input rate 412 pkts/sec,  51803 bytes/sec
          1 minute output rate 475 pkts/sec,  522952 bytes/sec
          1 minute drop rate, 24 pkts/sec
          5 minute input rate 399 pkts/sec,  59676 bytes/sec
          5 minute output rate 483 pkts/sec,  503200 bytes/sec
          5 minute drop rate, 9 pkts/sec
    outside:
    received (in 51430.240 secs):
    10758403 packets10441440193 bytes
    42 pkts/sec203021 bytes/sec
    transmitted (in 51430.240 secs):
    7548339 packets872053854 bytes
    <--- More --->
    63 pkts/sec16037 bytes/sec
          1 minute input rate 479 pkts/sec,  523680 bytes/sec
          1 minute output rate 387 pkts/sec,  46796 bytes/sec
          1 minute drop rate, 3 pkts/sec
          5 minute input rate 485 pkts/sec,  503789 bytes/sec
          5 minute output rate 387 pkts/sec,  57681 bytes/sec
          5 minute drop rate, 2 pkts/sec
    _internal_loopback:
    received (in 51430.740 secs):
    1 packets28 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51430.740 secs):
    1 packets28 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Aggregated Traffic on Physical Interface
    <--- More --->
    Ethernet0/0:
    received (in 51431.740 secs):
    10758462 packets10640075825 bytes
    42 pkts/sec206042 bytes/sec
    transmitted (in 51431.740 secs):
    7548383 packets1029818127 bytes
    63 pkts/sec20023 bytes/sec
          1 minute input rate 485 pkts/sec,  537048 bytes/sec
          1 minute output rate 395 pkts/sec,  54546 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 485 pkts/sec,  511723 bytes/sec
          5 minute output rate 387 pkts/sec,  65495 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/1:
    received (in 51433.570 secs):
    7749780 packets1066328930 bytes
    67 pkts/sec20064 bytes/sec
    transmitted (in 51433.570 secs):
    10653359 packets10552787020 bytes
    40 pkts/sec205006 bytes/sec
          1 minute input rate 419 pkts/sec,  59621 bytes/sec
          1 minute output rate 480 pkts/sec,  533950 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 399 pkts/sec,  67618 bytes/sec
    <--- More --->
          5 minute output rate 482 pkts/sec,  511073 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/2:
    received (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/3:
    received (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.730 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
    <--- More --->
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/4:
    received (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/5:
    received (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51434.870 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    <--- More --->
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/6:
    received (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Ethernet0/7:
    received (in 51435.010 secs):
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
    transmitted (in 51435.010 secs):
    <--- More --->
    0 packets0 bytes
    0 pkts/sec0 bytes/sec
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/0:
    received (in 51435.510 secs):
    18513901 packets11784250044 bytes
    25 pkts/sec229023 bytes/sec
    transmitted (in 51435.510 secs):
    18207269 packets11641332179 bytes
    19 pkts/sec226078 bytes/sec
          1 minute input rate 891 pkts/sec,  595715 bytes/sec
          1 minute output rate 863 pkts/sec,  588935 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 885 pkts/sec,  584035 bytes/sec
          5 minute output rate 870 pkts/sec,  580393 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Internal-Data0/1:
    received (in 51436.010 secs):
    18207323 packets11641364184 bytes
    <--- More --->
    19 pkts/sec226076 bytes/sec
    transmitted (in 51436.010 secs):
    18513954 packets11784281987 bytes
    25 pkts/sec229022 bytes/sec
          1 minute input rate 855 pkts/sec,  575808 bytes/sec
          1 minute output rate 884 pkts/sec,  582339 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 869 pkts/sec,  578350 bytes/sec
          5 minute output rate 883 pkts/sec,  581924 bytes/sec
          5 minute drop rate, 0 pkts/sec
    ------------------ show perfmon ------------------
    PERFMON STATS:    Current      Average
    Xlates               0/s          0/s
    Connections         17/s          6/s
    TCP Conns            8/s          2/s
    UDP Conns            7/s          2/s
    URL Access           0/s          0/s
    URL Server Req       0/s          0/s
    TCP Fixup            0/s          0/s
    TCP Intercept        0/s          0/s
    HTTP Fixup           0/s          0/s
    <--- More --->
    FTP Fixup            0/s          0/s
    AAA Authen           0/s          0/s
    AAA Author           0/s          0/s
    AAA Account          0/s          0/s
    ------------------ show counters ------------------
    Protocol     Counter                     Value   Context
    IP           IN_PKTS                  168960   Summary
    IP           OUT_PKTS                 169304   Summary
    IP           TO_ARP                       61   Summary
    ------------------ show history ------------------
    ------------------ show firewall ------------------
    Firewall mode: Transparent
    ------------------ show running-config ------------------
    <--- More --->
    : Saved
    ASA Version 7.2(3)
    firewall transparent
    hostname ciscoasa
    enable password
    names
    interface Vlan1
    nameif inside
    security-level 100
    interface Vlan2
    nameif outside
    security-level 0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    <--- More --->
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd
    regex domain1 ".facebook\.com"
    regex domain2 ".fb\.com"
    regex domain3 ".youtube\.com"
    ftp mode passive
    access-list ACL_IN extended permit ip any any
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    ip address 192.168.1.254 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    <--- More --->
    arp timeout 14400
    access-group ACL_IN in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    class-map type regex match-any DomainBlockList
    match regex domain1
    match regex domain2
    match regex domain3
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    <--- More --->
      message-length maximum 512
    match domain-name regex class DomainBlockList
      drop-connection log
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:bb5115ea1d14ee42e7961ef0c9aaed86
    : end
    <--- More --->
    ------------------ show startup-config errors ------------------
    INFO: No configuration errors
    ------------------ console logs ------------------
    Message #1 : Message #2 : Message #3 : Message #4 : Message #5 : Message #6 : Message #7 : Message #8 : Message #9 : Message #10 : Message #11 : Message #12 : Message #13 : Message #14 :
    Total SSMs found: 0
    Message #15 :
    Total NICs found: 10
    Message #16 : 88E6095 rev 2 Gigabit Ethernet @ index 09Message #17 :  MAC: 0000.0003.0002
    Message #18 : 88E6095 rev 2 Ethernet @ index 08Message #19 :  MAC: 001f.9ee8.ffa1
    Message #20 : 88E6095 rev 2 Ethernet @ index 07Message #21 :  MAC: 001f.9ee8.ffa0
    Message #22 : 88E6095 rev 2 Ethernet @ index 06Message #23 :  MAC: 001f.9ee8.ff9f
    Message #24 : 88E6095 rev 2 Ethernet @ index 05Message #25 :  MAC: 001f.9ee8.ff9e
    Message #26 : 88E6095 rev 2 Ethernet @ index 04Message #27 :  MAC: 001f.9ee8.ff9d
    Message #28 : 88E6095 rev 2 Ethernet @ index 03Message #29 :  MAC: 001f.9ee8.ff9c
    Message #30 : 88E6095 rev 2 Ethernet @ index 02Message #31 :  MAC: 001f.9ee8.ff9b
    Message #32 : 88E6095 rev 2 Ethernet @ index 01Message #33 :  MAC: 001f.9ee8.ff9a
    Message #34 : y88acs06 rev16 Gigabit Ethernet @ index 00 MAC: 001f.9ee8.ffa2
    Message #35 :
    Licensed features for this platform:
    Message #36 : Maximum Physical Interfaces : 8        
    <--- More --->
    Message #37 : VLANs                       : 3, DMZ Restricted
    Message #38 : Inside Hosts                : Unlimited
    Message #39 : Failover                    : Disabled
    Message #40 : VPN-DES                     : Enabled  
    Message #41 : VPN-3DES-AES                : Enabled  
    Message #42 : VPN Peers                   : 10       
    Message #43 : WebVPN Peers                : 2        
    Message #44 : Dual ISPs                   : Disabled 
    Message #45 : VLAN Trunk Ports            : 0        
    Message #46 :
    This platform has a Base license.
    Message #47 :
    Message #48 : Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
    Message #49 :                              Boot microcode   : CNlite-MC-Boot-Cisco-1.2
    Message #50 :                              SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
    Message #51 :                              IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
    Message #52 :   --------------------------------------------------------------------------
    Message #53 :                                  .            .                            
    Message #54 :                                  |            |                            
    Message #55 :                                 |||          |||                           
    Message #56 :                               .|| ||.      .|| ||.                         
    Message #57 :                            .:||| | |||:..:||| | |||:.                      
    Message #58 :                             C i s c o  S y s t e m s                       
    Message #59 :   --------------------------------------------------------------------------
    <--- More --->
    Message #60 :
    Cisco Adaptive Security Appliance Software Version 7.2(3)
    Message #61 :
    Message #62 :   ****************************** Warning *******************************
    Message #63 :   This product contains cryptographic features and is
    Message #64 :   subject to United States and local country laws
    Message #65 :   governing, import, export, transfer, and use.
    Message #66 :   Delivery of Cisco cryptographic products does not
    Message #67 :   imply third-party authority to import, export,
    Message #68 :   distribute, or use encryption. Importers, exporters,
    Message #69 :   distributors and users are responsible for compliance
    Message #70 :   with U.S. and local country laws. By using this
    Message #71 :   product you agree to comply with applicable laws and
    Message #72 :   regulations. If you are unable to comply with U.S.
    Message #73 :   and local laws, return the enclosed items immediately.
    Message #74 :
    Message #75 :   A summary of U.S. laws governing Cisco cryptographic
    Message #76 :   products may be found at:
    Message #77 :   http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    Message #78 :
    Message #79 :   If you require further assistance please contact us by
    Message #80 :   sending email to [email protected].
    Message #81 :   ******************************* Warning *******************************
    Message #82 :
    <--- More --->
    Message #83 : Copyright (c) 1996-2007 by Cisco Systems, Inc.
    Message #84 :                 Restricted Rights Legend
    Message #85 : Use, duplication, or disclosure by the Government is
    Message #86 : subject to restrictions as set forth in subparagraph
    Message #87 : (c) of the Commercial Computer Software - Restricted
    Message #88 : Rights clause at FAR sec. 52.227-19 and subparagraph
    Message #89 : (c) (1) (ii) of the Rights in Technical Data and Computer
    Message #90 : Software clause at DFARS sec. 252.227-7013.
    Message #91 :                 Cisco Systems, Inc.
    Message #92 :                 170 West Tasman Drive
    Message #93 :                 San Jose, California 95134-1706
    ciscoasa#   

  • Cisco ASA 5505 site to site Multiple subnet.

    Hi. I need some help configuring my cisco asa 5505.
    I've set up a VPN tunnel between two ASA 5505
    Site 1:
    Subnet 192.168.77.0
    Site 2:
    Have multiple vlans and now the tunnel goes to vlan400 - 192.168.1.0
    What I need help with:
    From site 1 i need to be able to reach another vlan on site 2. vlan480 - 192.168.20.0
    And from site 1 I need to reach 192.168.77.0 subnet from vlan480 - 192.168.20.0
    Vlan480 is used for phones. In vlan480 we have a PABX central.
    Is this possible to do?
    Any help would be greatfully appreciated!
    Config site 2:
    : Saved
    ASA Version 7.2(2)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    names
    name 192.168.1.250 DomeneServer
    name 192.168.1.10 NotesServer
    name 192.168.1.90 OvServer
    name 192.168.1.97 TerminalServer
    name 192.168.1.98 w8-eyeshare
    name 192.168.50.10 w8-print
    name 192.168.1.94 w8-app
    name 192.168.1.89 FonnaFlyMedia
    interface Vlan1
    nameif Vlan1
    security-level 100
    ip address 192.168.200.100 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address 79.x.x.226 255.255.255.224
    ospf cost 10
    interface Vlan400
    nameif vlan400
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    ospf cost 10
    interface Vlan450
    nameif Vlan450
    security-level 100
    ip address 192.168.210.1 255.255.255.0
    ospf cost 10
    interface Vlan460
    nameif Vlan460-SuldalHotell
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    ospf cost 10
    interface Vlan461
    nameif Vlan461-SuldalHotellGjest
    security-level 100
    ip address 192.168.3.1 255.255.255.0
    ospf cost 10
    interface Vlan462
    nameif Vlan462-Suldalsposten
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    ospf cost 10
    interface Vlan470
    nameif vlan470-Kyrkjekontoret
    security-level 100
    ip address 192.168.202.1 255.255.255.0
    ospf cost 10
    interface Vlan480
    nameif vlan480-Telefoni
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    ospf cost 10
    interface Vlan490
    nameif Vlan490-QNapBackup
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    ospf cost 10
    interface Vlan500
    nameif Vlan500-HellandBadlands
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    ospf cost 10
    interface Vlan510
    nameif Vlan510-IsTak
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    ospf cost 10
    interface Vlan600
    nameif Vlan600-SafeQ
    security-level 100
    ip address 192.168.50.1 255.255.255.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 500
    switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610
    switchport mode trunk
    interface Ethernet0/3
    switchport access vlan 490
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd x encrypted
    ftp mode passive
    clock timezone WAT 1
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service Lotus_Notes_Utgaaande tcp
    description Frim Notes og ut til alle
    port-object eq domain
    port-object eq ftp
    port-object eq www
    port-object eq https
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq pptp
    port-object eq smtp
    object-group service Lotus_Notes_inn tcp
    description From alle og inn til Notes
    port-object eq www
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq smtp
    object-group service Reisebyraa tcp-udp
    port-object range 3702 3702
    port-object range 5500 5500
    port-object range 9876 9876
    object-group service Remote_Desktop tcp-udp
    description Tilgang til Remote Desktop
    port-object range 3389 3389
    object-group service Sand_Servicenter_50000 tcp-udp
    description Program tilgang til Sand Servicenter AS
    port-object range 50000 50000
    object-group service VNC_Remote_Admin tcp
    description Frå oss til alle
    port-object range 5900 5900
    object-group service Printer_Accept tcp-udp
    port-object range 9100 9100
    port-object eq echo
    object-group icmp-type Echo_Ping
    icmp-object echo
    icmp-object echo-reply
    object-group service Print tcp
    port-object range 9100 9100
    object-group service FTP_NADA tcp
    description Suldalsposten NADA tilgang
    port-object eq ftp
    port-object eq ftp-data
    object-group service Telefonsentral tcp
    description Hoftun
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    port-object eq telnet
    object-group service Printer_inn_800 tcp
    description Fra 800  nettet og inn til 400 port 7777
    port-object range 7777 7777
    object-group service Suldalsposten tcp
    description Sending av mail vha Mac Mail programmet - åpner smtp
    port-object eq pop3
    port-object eq smtp
    object-group service http2 tcp
    port-object range 81 81
    object-group service DMZ_FTP_PASSIVE tcp-udp
    port-object range 55536 56559
    object-group service DMZ_FTP tcp-udp
    port-object range 20 21
    object-group service DMZ_HTTPS tcp-udp
    port-object range 443 443
    object-group service DMZ_HTTP tcp-udp
    port-object range 8080 8080
    object-group service DNS_Query tcp
    port-object range domain domain
    object-group service DUETT_SQL_PORT tcp-udp
    description For kobling mellom andre nett og duett server
    port-object range 54659 54659
    access-list outside_access_in extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list vlan400_access_in extended deny ip any host 149.20.56.34
    access-list vlan400_access_in extended deny ip any host 149.20.56.32
    access-list vlan400_access_in extended permit ip any any
    access-list Vlan450_access_in extended deny ip any host 149.20.56.34
    access-list Vlan450_access_in extended deny ip any host 149.20.56.32
    access-list Vlan450_access_in extended permit ip any any
    access-list Vlan460_access_in extended deny ip any host 149.20.56.34
    access-list Vlan460_access_in extended deny ip any host 149.20.56.32
    access-list Vlan460_access_in extended permit ip any any
    access-list vlan400_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande
    access-list vlan400_access_out extended permit tcp any host DomeneServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host TerminalServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host OvServer object-group http2
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_inn
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-eyeshare object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-app object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host FonnaFlyMedia range 8400 8600
    access-list vlan400_access_out extended permit udp any host FonnaFlyMedia range 9000 9001
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host DomeneServer
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host w8-app object-group DUETT_SQL_PORT
    access-list Vlan500_access_in extended deny ip any host 149.20.56.34
    access-list Vlan500_access_in extended deny ip any host 149.20.56.32
    access-list Vlan500_access_in extended permit ip any any
    access-list vlan470_access_in extended deny ip any host 149.20.56.34
    access-list vlan470_access_in extended deny ip any host 149.20.56.32
    access-list vlan470_access_in extended permit ip any any
    access-list Vlan490_access_in extended deny ip any host 149.20.56.34
    access-list Vlan490_access_in extended deny ip any host 149.20.56.32
    access-list Vlan490_access_in extended permit ip any any
    access-list Vlan450_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan1_access_out extended permit ip any any
    access-list Vlan1_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan1_access_out extended deny ip any any
    access-list Vlan1_access_out extended permit icmp any any echo-reply
    access-list Vlan460_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTPS
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTP
    access-list Vlan500_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit tcp any host 192.168.202.10 object-group Remote_Desktop
    access-list Vlan510_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan480_access_out extended permit ip any any
    access-list Vlan510_access_in extended permit ip any any
    access-list Vlan600_access_in extended permit ip any any
    access-list Vlan600_access_out extended permit icmp any any
    access-list Vlan600_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan600_access_out extended permit tcp 192.168.1.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.202.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.210.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_in_1 extended permit ip any any
    access-list Vlan461_access_in extended permit ip any any
    access-list Vlan461_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list Vlan462-Suldalsposten_access_in extended permit ip any any
    access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_in_1 extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu Vlan1 1500
    mtu outside 1500
    mtu vlan400 1500
    mtu Vlan450 1500
    mtu Vlan460-SuldalHotell 1500
    mtu Vlan461-SuldalHotellGjest 1500
    mtu vlan470-Kyrkjekontoret 1500
    mtu vlan480-Telefoni 1500
    mtu Vlan490-QNapBackup 1500
    mtu Vlan500-HellandBadlands 1500
    mtu Vlan510-IsTak 1500
    mtu Vlan600-SafeQ 1500
    mtu Vlan462-Suldalsposten 1500
    no failover
    monitor-interface Vlan1
    monitor-interface outside
    monitor-interface vlan400
    monitor-interface Vlan450
    monitor-interface Vlan460-SuldalHotell
    monitor-interface Vlan461-SuldalHotellGjest
    monitor-interface vlan470-Kyrkjekontoret
    monitor-interface vlan480-Telefoni
    monitor-interface Vlan490-QNapBackup
    monitor-interface Vlan500-HellandBadlands
    monitor-interface Vlan510-IsTak
    monitor-interface Vlan600-SafeQ
    monitor-interface Vlan462-Suldalsposten
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (vlan400) 0 access-list vlan400_nat0_outbound
    nat (vlan400) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan450) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0
    nat (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0
    nat (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0
    nat (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0
    nat (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0
    nat (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0
    nat (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0
    static (vlan400,outside) 79.x.x.x DomeneServer netmask 255.255.255.255
    static (vlan470-Kyrkjekontoret,outside) 79.x.x.x 192.168.202.10 netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.x NotesServer netmask 255.255.255.255 dns
    static (vlan400,outside) 79.x.x.231 TerminalServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.234 OvServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.232 w8-eyeshare netmask 255.255.255.255
    static (Vlan490-QNapBackup,outside) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns
    static (Vlan600-SafeQ,outside) 79.x.x.235 w8-print netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.236 w8-app netmask 255.255.255.255
    static (Vlan450,vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (Vlan500-HellandBadlands,vlan400) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
    static (vlan400,Vlan500-HellandBadlands) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan450) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,outside) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255
    static (Vlan462-Suldalsposten,vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0
    static (vlan400,Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan450,Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (vlan470-Kyrkjekontoret,Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0
    access-group Vlan1_access_out out interface Vlan1
    access-group outside_access_in in interface outside
    access-group outside_access_out out interface outside
    access-group vlan400_access_in in interface vlan400
    access-group vlan400_access_out out interface vlan400
    access-group Vlan450_access_in in interface Vlan450
    access-group Vlan450_access_out out interface Vlan450
    access-group Vlan460_access_in in interface Vlan460-SuldalHotell
    access-group Vlan460_access_out out interface Vlan460-SuldalHotell
    access-group Vlan461_access_in in interface Vlan461-SuldalHotellGjest
    access-group Vlan461_access_out out interface Vlan461-SuldalHotellGjest
    access-group vlan470_access_in in interface vlan470-Kyrkjekontoret
    access-group vlan470_access_out out interface vlan470-Kyrkjekontoret
    access-group vlan480_access_out out interface vlan480-Telefoni
    access-group Vlan490_access_in in interface Vlan490-QNapBackup
    access-group Vlan490_access_out out interface Vlan490-QNapBackup
    access-group Vlan500_access_in in interface Vlan500-HellandBadlands
    access-group Vlan500_access_out out interface Vlan500-HellandBadlands
    access-group Vlan510_access_in in interface Vlan510-IsTak
    access-group Vlan510_access_out out interface Vlan510-IsTak
    access-group Vlan600_access_in_1 in interface Vlan600-SafeQ
    access-group Vlan600_access_out out interface Vlan600-SafeQ
    access-group Vlan462-Suldalsposten_access_in_1 in interface Vlan462-Suldalsposten
    access-group Vlan462-Suldalsposten_access_out_1 out interface Vlan462-Suldalsposten
    route outside 0.0.0.0 0.0.0.0 79.x.x.225 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    username x password x encrypted privilege 15
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.210.0 255.255.255.0 Vlan450
    http 192.168.200.0 255.255.255.0 Vlan1
    http 192.168.1.0 255.255.255.0 vlan400
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 20 match address outside_20_cryptomap_1
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer 62.92.159.137
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp enable vlan400
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group 62.92.159.137 type ipsec-l2l
    tunnel-group 62.92.159.137 ipsec-attributes
    pre-shared-key *
    telnet 192.168.200.0 255.255.255.0 Vlan1
    telnet 192.168.1.0 255.255.255.0 vlan400
    telnet timeout 5
    ssh 171.68.225.216 255.255.255.255 outside
    ssh timeout 5
    console timeout 0
    dhcpd update dns both
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface outside
    dhcpd address 192.168.1.100-192.168.1.225 vlan400
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface vlan400
    dhcpd option 3 ip 192.168.1.1 interface vlan400
    dhcpd enable vlan400
    dhcpd address 192.168.210.100-192.168.210.200 Vlan450
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450
    dhcpd option 3 ip 192.168.210.1 interface Vlan450
    dhcpd enable Vlan450
    dhcpd address 192.168.2.100-192.168.2.150 Vlan460-SuldalHotell
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell
    dhcpd option 3 ip 192.168.2.1 interface Vlan460-SuldalHotell
    dhcpd enable Vlan460-SuldalHotell
    dhcpd address 192.168.3.100-192.168.3.200 Vlan461-SuldalHotellGjest
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest
    dhcpd option 3 ip 192.168.3.1 interface Vlan461-SuldalHotellGjest
    dhcpd enable Vlan461-SuldalHotellGjest
    dhcpd address 192.168.202.100-192.168.202.199 vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.202.1 interface vlan470-Kyrkjekontoret
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret
    dhcpd enable vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.20.1 interface vlan480-Telefoni
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni
    dhcpd address 192.168.10.80-192.168.10.90 Vlan490-QNapBackup
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup
    dhcpd option 3 ip 192.168.10.1 interface Vlan490-QNapBackup
    dhcpd address 192.168.30.100-192.168.30.199 Vlan500-HellandBadlands
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands
    dhcpd option 3 ip 192.168.30.1 interface Vlan500-HellandBadlands
    dhcpd enable Vlan500-HellandBadlands
    dhcpd address 192.168.40.100-192.168.40.150 Vlan510-IsTak
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak
    dhcpd option 3 ip 192.168.40.1 interface Vlan510-IsTak
    dhcpd enable Vlan510-IsTak
    dhcpd address 192.168.50.150-192.168.50.199 Vlan600-SafeQ
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ
    dhcpd enable Vlan600-SafeQ
    dhcpd address 192.168.4.100-192.168.4.150 Vlan462-Suldalsposten
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface Vlan462-Suldalsposten
    dhcpd option 3 ip 192.168.4.1 interface Vlan462-Suldalsposten
    dhcpd enable Vlan462-Suldalsposten
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    prompt hostname context
    Cryptochecksum:x
    : end
    Config site 1:
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    passwd x encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.77.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group Telenor
    ip address pppoe setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 15
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_access_in extended permit icmp any any echo-reply log disable
    access-list outside_1_cryptomap extended permit ip 192.168.77.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.77.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.77.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 79.160.252.226
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.77.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group Telenor request dialout pppoe
    vpdn group Telenor localname x
    vpdn group Telenor ppp authentication chap
    vpdn username x password x store-local
    dhcpd auto_config outside
    dhcpd address 192.168.77.100-192.168.77.130 inside
    dhcpd dns 192.168.77.1 interface inside
    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside
    dhcpd enable inside
    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface outside
    tunnel-group 79.160.252.226 type ipsec-l2l
    tunnel-group 79.160.252.226 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:x
    : end

    Hi,
    The addition of a new network to the existing L2L VPN should be a pretty simple process.
    Essentially you will have to add the network to the Crypto ACL present in the "crypto map" configurations. You will also have to configure the NAT0 configuration for it in the proper interfaces of the ASA. These configurations are all done on both ends of the L2L VPN connection.
    Looking at your above configurations it would seem that you will need the following configurations
    SITE 1
    We add the new network to both the crypto ACL and the NAT0 ACL
    access-list outside_1_cryptomap extended permit ip 192.168.77.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.77.0 255.255.255.0 192.168.20.0 255.255.255.0
    SITE 2
    We add the new network to the crypto ACL
    We create a new NAT0 configuration for the Vlan480 interface as it has no previous NAT0 configuration
    access-list outside_20_cryptomap_1 extended permit ip 192.168.20.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list VLAN480-NAT0 remark NAT0 for VPN
    access-list VLAN480-NAT0 permit ip 192.168.20.0 255.255.255.0 192.168.77.0 255.255.255.0
    nat (vlan480-Telefoni) 0 access-list VLAN480-NAT0
    These configurations should pretty much do the trick.
    Let me know if it worked
    - Jouni

  • Problem with ASA 5505

    Good morning,
    I'm having the following problem. I configured a ASA 5505 with VPN and a VPN Remote Access Site-to-site. Everything is working, but when I reload the ASA does not work anymore VPNs, Remote Access error 412 and the Site-to-site does not connect more to solve, I have to reset and reconfigure the ASA. This is happening dopo updating the ASA, I have version 842-k8 and asdm645-106.
    Does anyone have any idea what can be?
    Thank you.
    Running-config:
    : Saved
    : Written by master at 10:34:14.839 BRDT Mon Oct 10 2011
    ASA Version 8.4(2)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 2KFQnbNIdI.2KYOU encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 172.16.0.140 255.255.252.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group gvt
    ip address pppoe setroute
    boot system disk0:/asa842-k8.bin
    ftp mode passive
    clock timezone BRST -3
    clock summer-time BRDT recurring 2 Sun Oct 0:00 3 Sun Feb 0:00
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network NETWORK_OBJ_172.16.0.0_22
    subnet 172.16.0.0 255.255.252.0
    object network NETWORK_OBJ_172.16.0.128_26
    subnet 172.16.0.128 255.255.255.192
    object network NETWORK_OBJ_20.0.0.0_24
    subnet 20.0.0.0 255.255.255.0
    object network NETWORK_OBJ_172.16.11.0_24
    subnet 172.16.11.0 255.255.255.0
    object-group network obj_any
    access-list 1 standard permit 172.16.0.0 255.255.252.0
    access-list 1 standard permit 20.0.0.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 172.16.0.0 255.255.252.0 20.0.0.0 255.255.255.0
    access-list outside_cryptomap_1 extended permit ip 172.16.0.0 255.255.252.0 172.16.11.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool pool 172.16.0.150-172.16.0.160 mask 255.255.252.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-645-106.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static NETWORK_OBJ_172.16.0.0_22 NETWORK_OBJ_172.16.0.0_22 destination static NETWORK_OBJ_172.16.0.128_26 NETWORK_OBJ_172.16.0.128_26 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_172.16.0.0_22 NETWORK_OBJ_172.16.0.0_22 destination static NETWORK_OBJ_20.0.0.0_24 NETWORK_OBJ_20.0.0.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_172.16.0.0_22 NETWORK_OBJ_172.16.0.0_22 destination static NETWORK_OBJ_172.16.11.0_24 NETWORK_OBJ_172.16.11.0_24 no-proxy-arp route-lookup
    nat (inside,outside) after-auto source dynamic any interface
    route outside 172.16.11.0 255.255.255.0 187.16.33.131 10
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 172.16.0.0 255.255.252.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set peer 189.11.56.237
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 2 match address outside_cryptomap_1
    crypto map outside_map 2 set peer 187.16.33.131
    crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 2 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group gvt request dialout pppoe
    vpdn group gvt localname *******@turbonetpro
    vpdn group gvt ppp authentication pap
    vpdn username *******@turbonetpro password *****
    dhcpd auto_config outside
    dhcpd address 172.16.0.144-172.16.1.143 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy crv internal
    group-policy crv attributes
    dns-server value 172.16.0.253 8.8.8.8
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value 1
    default-domain value crvnatural.com.br
    group-policy GroupPolicy_189.11.56.237 internal
    group-policy GroupPolicy_189.11.56.237 attributes
    vpn-filter value 1
    vpn-tunnel-protocol ikev1 ikev2
    group-policy GroupPolicy_187.16.33.131 internal
    group-policy GroupPolicy_187.16.33.131 attributes
    vpn-filter value 1
    vpn-tunnel-protocol ikev1 ikev2
    username master password kWH7f2vqtjMEg2Yp encrypted
    tunnel-group crv type remote-access
    tunnel-group crv general-attributes
    default-group-policy crv
    dhcp-server 172.16.0.253
    tunnel-group crv ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 189.11.**.*** type ipsec-l2l
    tunnel-group 189.11.**.*** general-attributes
    default-group-policy GroupPolicy_189.11.**.***
    tunnel-group 189.11.**.*** ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key ****
    ikev2 local-authentication pre-shared-key *****
    tunnel-group 187.16.33.*** type ipsec-l2l
    tunnel-group 187.16.33.*** general-attributes
    default-group-policy GroupPolicy_187.16.33.***
    tunnel-group 187.16.33.*** ipsec-attributes
    ikev1 pre-shared-key ******
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:50ed6f55182534a2429d065a26e9b45c
    : end

    David,
    In order to understand why LDAP is not working run a "debug ldap 255" and then try to login or run a AAA test.
    Attach the output to find out the issue.
    Please check this out as well, to make sure that you have the correct settings:
    ASA 8.0: Configure LDAP Authentication for WebVPN Users
    HTH.
    Portu.

  • Fairly new to cisco ASA 5505 - Can someone look through my config?

    Hi.
    Can some one tell me if I did the NAT part right? Both dynamic and static.
    To be able to reach one vlan from another I created a Nat between them, is this the right way to do it?
    I can still limit the access between the vlans based on the access list.
    I also getting slow throughput over the VPN tunnel. Is there something wrong with my config. I used the wizard to set it up. There is also a cisco asa5505 on the other end.
    If there is some thing else that seems wrong, please let me know.
    Any help would be greatfully appreciated!
    Config:
    : Saved
    ASA Version 7.2(2)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    names
    name 192.168.1.250 DomeneServer
    name 192.168.1.10 NotesServer
    name 192.168.1.90 OvServer
    name 192.168.1.97 TerminalServer
    name 192.168.1.98 w8-eyeshare
    name 192.168.50.10 w8-print
    name 192.168.1.94 w8-app
    name 192.168.1.89 FonnaFlyMedia
    interface Vlan1
    nameif Vlan1
    security-level 100
    ip address 192.168.200.100 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address 79.x.x.226 255.255.255.224
    ospf cost 10
    interface Vlan400
    nameif vlan400
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    ospf cost 10
    interface Vlan450
    nameif Vlan450
    security-level 100
    ip address 192.168.210.1 255.255.255.0
    ospf cost 10
    interface Vlan460
    nameif Vlan460-SuldalHotell
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    ospf cost 10
    interface Vlan461
    nameif Vlan461-SuldalHotellGjest
    security-level 100
    ip address 192.168.3.1 255.255.255.0
    ospf cost 10
    interface Vlan462
    nameif Vlan462-Suldalsposten
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    ospf cost 10
    interface Vlan470
    nameif vlan470-Kyrkjekontoret
    security-level 100
    ip address 192.168.202.1 255.255.255.0
    ospf cost 10
    interface Vlan480
    nameif vlan480-Telefoni
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    ospf cost 10
    interface Vlan490
    nameif Vlan490-QNapBackup
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    ospf cost 10
    interface Vlan500
    nameif Vlan500-HellandBadlands
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    ospf cost 10
    interface Vlan510
    nameif Vlan510-IsTak
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    ospf cost 10
    interface Vlan600
    nameif Vlan600-SafeQ
    security-level 100
    ip address 192.168.50.1 255.255.255.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 500
    switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610
    switchport mode trunk
    interface Ethernet0/3
    switchport access vlan 490
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd x encrypted
    ftp mode passive
    clock timezone WAT 1
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service Lotus_Notes_Utgaaande tcp
    description Frim Notes og ut til alle
    port-object eq domain
    port-object eq ftp
    port-object eq www
    port-object eq https
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq pptp
    port-object eq smtp
    object-group service Lotus_Notes_inn tcp
    description From alle og inn til Notes
    port-object eq www
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq smtp
    object-group service Reisebyraa tcp-udp
    port-object range 3702 3702
    port-object range 5500 5500
    port-object range 9876 9876
    object-group service Remote_Desktop tcp-udp
    description Tilgang til Remote Desktop
    port-object range 3389 3389
    object-group service Sand_Servicenter_50000 tcp-udp
    description Program tilgang til Sand Servicenter AS
    port-object range 50000 50000
    object-group service VNC_Remote_Admin tcp
    description Frå oss til alle
    port-object range 5900 5900
    object-group service Printer_Accept tcp-udp
    port-object range 9100 9100
    port-object eq echo
    object-group icmp-type Echo_Ping
    icmp-object echo
    icmp-object echo-reply
    object-group service Print tcp
    port-object range 9100 9100
    object-group service FTP_NADA tcp
    description Suldalsposten NADA tilgang
    port-object eq ftp
    port-object eq ftp-data
    object-group service Telefonsentral tcp
    description Hoftun
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    port-object eq telnet
    object-group service Printer_inn_800 tcp
    description Fra 800  nettet og inn til 400 port 7777
    port-object range 7777 7777
    object-group service Suldalsposten tcp
    description Sending av mail vha Mac Mail programmet - åpner smtp
    port-object eq pop3
    port-object eq smtp
    object-group service http2 tcp
    port-object range 81 81
    object-group service DMZ_FTP_PASSIVE tcp-udp
    port-object range 55536 56559
    object-group service DMZ_FTP tcp-udp
    port-object range 20 21
    object-group service DMZ_HTTPS tcp-udp
    port-object range 443 443
    object-group service DMZ_HTTP tcp-udp
    port-object range 8080 8080
    object-group service DNS_Query tcp
    port-object range domain domain
    object-group service DUETT_SQL_PORT tcp-udp
    description For kobling mellom andre nett og duett server
    port-object range 54659 54659
    access-list outside_access_in extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list vlan400_access_in extended deny ip any host 149.20.56.34
    access-list vlan400_access_in extended deny ip any host 149.20.56.32
    access-list vlan400_access_in extended permit ip any any
    access-list Vlan450_access_in extended deny ip any host 149.20.56.34
    access-list Vlan450_access_in extended deny ip any host 149.20.56.32
    access-list Vlan450_access_in extended permit ip any any
    access-list Vlan460_access_in extended deny ip any host 149.20.56.34
    access-list Vlan460_access_in extended deny ip any host 149.20.56.32
    access-list Vlan460_access_in extended permit ip any any
    access-list vlan400_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande
    access-list vlan400_access_out extended permit tcp any host DomeneServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host TerminalServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host OvServer object-group http2
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_inn
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-eyeshare object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-app object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host FonnaFlyMedia range 8400 8600
    access-list vlan400_access_out extended permit udp any host FonnaFlyMedia range 9000 9001
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host DomeneServer
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host w8-app object-group DUETT_SQL_PORT
    access-list Vlan500_access_in extended deny ip any host 149.20.56.34
    access-list Vlan500_access_in extended deny ip any host 149.20.56.32
    access-list Vlan500_access_in extended permit ip any any
    access-list vlan470_access_in extended deny ip any host 149.20.56.34
    access-list vlan470_access_in extended deny ip any host 149.20.56.32
    access-list vlan470_access_in extended permit ip any any
    access-list Vlan490_access_in extended deny ip any host 149.20.56.34
    access-list Vlan490_access_in extended deny ip any host 149.20.56.32
    access-list Vlan490_access_in extended permit ip any any
    access-list Vlan450_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan1_access_out extended permit ip any any
    access-list Vlan1_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan1_access_out extended deny ip any any
    access-list Vlan1_access_out extended permit icmp any any echo-reply
    access-list Vlan460_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTPS
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTP
    access-list Vlan500_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit tcp any host 192.168.202.10 object-group Remote_Desktop
    access-list Vlan510_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan480_access_out extended permit ip any any
    access-list Vlan510_access_in extended permit ip any any
    access-list Vlan600_access_in extended permit ip any any
    access-list Vlan600_access_out extended permit icmp any any
    access-list Vlan600_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan600_access_out extended permit tcp 192.168.1.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.202.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.210.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_in_1 extended permit ip any any
    access-list Vlan461_access_in extended permit ip any any
    access-list Vlan461_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list Vlan462-Suldalsposten_access_in extended permit ip any any
    access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_in_1 extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu Vlan1 1500
    mtu outside 1500
    mtu vlan400 1500
    mtu Vlan450 1500
    mtu Vlan460-SuldalHotell 1500
    mtu Vlan461-SuldalHotellGjest 1500
    mtu vlan470-Kyrkjekontoret 1500
    mtu vlan480-Telefoni 1500
    mtu Vlan490-QNapBackup 1500
    mtu Vlan500-HellandBadlands 1500
    mtu Vlan510-IsTak 1500
    mtu Vlan600-SafeQ 1500
    mtu Vlan462-Suldalsposten 1500
    no failover
    monitor-interface Vlan1
    monitor-interface outside
    monitor-interface vlan400
    monitor-interface Vlan450
    monitor-interface Vlan460-SuldalHotell
    monitor-interface Vlan461-SuldalHotellGjest
    monitor-interface vlan470-Kyrkjekontoret
    monitor-interface vlan480-Telefoni
    monitor-interface Vlan490-QNapBackup
    monitor-interface Vlan500-HellandBadlands
    monitor-interface Vlan510-IsTak
    monitor-interface Vlan600-SafeQ
    monitor-interface Vlan462-Suldalsposten
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (vlan400) 0 access-list vlan400_nat0_outbound
    nat (vlan400) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan450) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0
    nat (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0
    nat (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0
    nat (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0
    nat (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0
    nat (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0
    nat (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0
    static (vlan400,outside) 79.x.x.x DomeneServer netmask 255.255.255.255
    static (vlan470-Kyrkjekontoret,outside) 79.x.x.x 192.168.202.10 netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.x NotesServer netmask 255.255.255.255 dns
    static (vlan400,outside) 79.x.x.231 TerminalServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.234 OvServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.232 w8-eyeshare netmask 255.255.255.255
    static (Vlan490-QNapBackup,outside) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns
    static (Vlan600-SafeQ,outside) 79.x.x.235 w8-print netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.236 w8-app netmask 255.255.255.255
    static (Vlan450,vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (Vlan500-HellandBadlands,vlan400) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
    static (vlan400,Vlan500-HellandBadlands) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan450) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,outside) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255
    static (Vlan462-Suldalsposten,vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0
    static (vlan400,Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan450,Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (vlan470-Kyrkjekontoret,Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0
    access-group Vlan1_access_out out interface Vlan1
    access-group outside_access_in in interface outside
    access-group outside_access_out out interface outside
    access-group vlan400_access_in in interface vlan400
    access-group vlan400_access_out out interface vlan400
    access-group Vlan450_access_in in interface Vlan450
    access-group Vlan450_access_out out interface Vlan450
    access-group Vlan460_access_in in interface Vlan460-SuldalHotell
    access-group Vlan460_access_out out interface Vlan460-SuldalHotell
    access-group Vlan461_access_in in interface Vlan461-SuldalHotellGjest
    access-group Vlan461_access_out out interface Vlan461-SuldalHotellGjest
    access-group vlan470_access_in in interface vlan470-Kyrkjekontoret
    access-group vlan470_access_out out interface vlan470-Kyrkjekontoret
    access-group vlan480_access_out out interface vlan480-Telefoni
    access-group Vlan490_access_in in interface Vlan490-QNapBackup
    access-group Vlan490_access_out out interface Vlan490-QNapBackup
    access-group Vlan500_access_in in interface Vlan500-HellandBadlands
    access-group Vlan500_access_out out interface Vlan500-HellandBadlands
    access-group Vlan510_access_in in interface Vlan510-IsTak
    access-group Vlan510_access_out out interface Vlan510-IsTak
    access-group Vlan600_access_in_1 in interface Vlan600-SafeQ
    access-group Vlan600_access_out out interface Vlan600-SafeQ
    access-group Vlan462-Suldalsposten_access_in_1 in interface Vlan462-Suldalsposten
    access-group Vlan462-Suldalsposten_access_out_1 out interface Vlan462-Suldalsposten
    route outside 0.0.0.0 0.0.0.0 79.x.x.225 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    username x password x encrypted privilege 15
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.210.0 255.255.255.0 Vlan450
    http 192.168.200.0 255.255.255.0 Vlan1
    http 192.168.1.0 255.255.255.0 vlan400
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 20 match address outside_20_cryptomap_1
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer 62.92.159.137
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp enable vlan400
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group 62.92.159.137 type ipsec-l2l
    tunnel-group 62.92.159.137 ipsec-attributes
    pre-shared-key *
    telnet 192.168.200.0 255.255.255.0 Vlan1
    telnet 192.168.1.0 255.255.255.0 vlan400
    telnet timeout 5
    ssh 171.68.225.216 255.255.255.255 outside
    ssh timeout 5
    console timeout 0
    dhcpd update dns both
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface outside
    dhcpd address 192.168.1.100-192.168.1.225 vlan400
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface vlan400
    dhcpd option 3 ip 192.168.1.1 interface vlan400
    dhcpd enable vlan400
    dhcpd address 192.168.210.100-192.168.210.200 Vlan450
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450
    dhcpd option 3 ip 192.168.210.1 interface Vlan450
    dhcpd enable Vlan450
    dhcpd address 192.168.2.100-192.168.2.150 Vlan460-SuldalHotell
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell
    dhcpd option 3 ip 192.168.2.1 interface Vlan460-SuldalHotell
    dhcpd enable Vlan460-SuldalHotell
    dhcpd address 192.168.3.100-192.168.3.200 Vlan461-SuldalHotellGjest
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest
    dhcpd option 3 ip 192.168.3.1 interface Vlan461-SuldalHotellGjest
    dhcpd enable Vlan461-SuldalHotellGjest
    dhcpd address 192.168.202.100-192.168.202.199 vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.202.1 interface vlan470-Kyrkjekontoret
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret
    dhcpd enable vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.20.1 interface vlan480-Telefoni
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni
    dhcpd address 192.168.10.80-192.168.10.90 Vlan490-QNapBackup
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup
    dhcpd option 3 ip 192.168.10.1 interface Vlan490-QNapBackup
    dhcpd address 192.168.30.100-192.168.30.199 Vlan500-HellandBadlands
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands
    dhcpd option 3 ip 192.168.30.1 interface Vlan500-HellandBadlands
    dhcpd enable Vlan500-HellandBadlands
    dhcpd address 192.168.40.100-192.168.40.150 Vlan510-IsTak
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak
    dhcpd option 3 ip 192.168.40.1 interface Vlan510-IsTak
    dhcpd enable Vlan510-IsTak
    dhcpd address 192.168.50.150-192.168.50.199 Vlan600-SafeQ
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ
    dhcpd enable Vlan600-SafeQ
    dhcpd address 192.168.4.100-192.168.4.150 Vlan462-Suldalsposten
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface Vlan462-Suldalsposten
    dhcpd option 3 ip 192.168.4.1 interface Vlan462-Suldalsposten
    dhcpd enable Vlan462-Suldalsposten
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    prompt hostname context
    Cryptochecksum:x
    : end

    I was just wondering if this is the way to do the "connection" between vlans.. or should it be routed?
    The traffic between the vlan is working as intended. There are not much traffice only some RDP connection and some printing jobs.
    But i'm getting some of these errors: (not alle like this, but portmap translation creation failed)
    305006    192.168.10.200 portmap translation creation failed for udp src Vlan460-SuldalHotell:192.168.2.112/59133 dst Vlan490-QNapBackup:192.168.10.200/161
    I did the sh interface commends:
    Result of the command: "sh interface"
    Interface Vlan1 "Vlan1", is down, line protocol is down
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.200.100, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan1":
        0 packets input, 0 bytes
        0 packets output, 0 bytes
        0 packets dropped
          1 minute input rate 0 pkts/sec,  0 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  0 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan2 "outside", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 79.x.x.226, subnet mask 255.255.255.224
      Traffic Statistics for "outside":
        1780706730 packets input, 1221625431570 bytes
        1878320718 packets output, 1743030863134 bytes
        5742216 packets dropped
          1 minute input rate 558 pkts/sec,  217568 bytes/sec
          1 minute output rate 803 pkts/sec,  879715 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 621 pkts/sec,  482284 bytes/sec
          5 minute output rate 599 pkts/sec,  428957 bytes/sec
          5 minute drop rate, 1 pkts/sec
    Interface Vlan400 "vlan400", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.1.1, subnet mask 255.255.255.0
      Traffic Statistics for "vlan400":
        1093422654 packets input, 1191121436317 bytes
        784209789 packets output, 374041914789 bytes
        11465163 packets dropped
          1 minute input rate 751 pkts/sec,  870445 bytes/sec
          1 minute output rate 462 pkts/sec,  116541 bytes/sec
          1 minute drop rate, 11 pkts/sec
          5 minute input rate 474 pkts/sec,  415304 bytes/sec
          5 minute output rate 379 pkts/sec,  197861 bytes/sec
          5 minute drop rate, 7 pkts/sec
    Interface Vlan450 "Vlan450", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.210.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan450":
        139711812 packets input, 27519985266 bytes
        202793062 packets output, 233679075458 bytes
        12523100 packets dropped
          1 minute input rate 68 pkts/sec,  9050 bytes/sec
          1 minute output rate 83 pkts/sec,  88025 bytes/sec
          1 minute drop rate, 6 pkts/sec
          5 minute input rate 145 pkts/sec,  15068 bytes/sec
          5 minute output rate 241 pkts/sec,  287093 bytes/sec
          5 minute drop rate, 6 pkts/sec
    Interface Vlan460 "Vlan460-SuldalHotell", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.2.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan460-SuldalHotell":
        177971988 packets input, 161663208458 bytes
        193137004 packets output, 137418896469 bytes
        4003957 packets dropped
          1 minute input rate 13 pkts/sec,  2295 bytes/sec
          1 minute output rate 14 pkts/sec,  15317 bytes/sec
          1 minute drop rate, 2 pkts/sec
          5 minute input rate 4 pkts/sec,  794 bytes/sec
          5 minute output rate 1 pkts/sec,  477 bytes/sec
          5 minute drop rate, 2 pkts/sec
    Interface Vlan461 "Vlan461-SuldalHotellGjest", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.3.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan461-SuldalHotellGjest":
        332909692 packets input, 351853184942 bytes
        312038518 packets output, 156669956740 bytes
        583171 packets dropped
          1 minute input rate 0 pkts/sec,  6 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  6 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan462 "Vlan462-Suldalsposten", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.4.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan462-Suldalsposten":
        33905 packets input, 14303320 bytes
        28285 packets output, 27536357 bytes
        10199 packets dropped
          1 minute input rate 0 pkts/sec,  6 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  6 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan470 "vlan470-Kyrkjekontoret", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.202.1, subnet mask 255.255.255.0
      Traffic Statistics for "vlan470-Kyrkjekontoret":
        12176257 packets input, 4305665570 bytes
        10618750 packets output, 5982598969 bytes
        974796 packets dropped
          1 minute input rate 2 pkts/sec,  770 bytes/sec
          1 minute output rate 1 pkts/sec,  861 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 2 pkts/sec,  708 bytes/sec
          5 minute output rate 1 pkts/sec,  980 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan480 "vlan480-Telefoni", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.20.1, subnet mask 255.255.255.0
      Traffic Statistics for "vlan480-Telefoni":
        246638 packets input, 43543149 bytes
        10 packets output, 536 bytes
        226674 packets dropped
          1 minute input rate 0 pkts/sec,  126 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  56 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan490 "Vlan490-QNapBackup", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.10.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan490-QNapBackup":
        137317833 packets input, 6066713912 bytes
        223933623 packets output, 263191563744 bytes
        531738 packets dropped
          1 minute input rate 0 pkts/sec,  135 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  68 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan500 "Vlan500-HellandBadlands", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.30.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan500-HellandBadlands":
        30816778 packets input, 4887486069 bytes
        42403099 packets output, 47831750415 bytes
        948717 packets dropped
          1 minute input rate 3 pkts/sec,  707 bytes/sec
          1 minute output rate 3 pkts/sec,  3459 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  23 bytes/sec
          5 minute output rate 0 pkts/sec,  31 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan510 "Vlan510-IsTak", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.40.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan510-IsTak":
        1253148 packets input, 245364736 bytes
        1225385 packets output, 525528101 bytes
        161567 packets dropped
          1 minute input rate 0 pkts/sec,  6 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  6 bytes/sec
          5 minute output rate 0 pkts/sec,  0 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Vlan600 "Vlan600-SafeQ", is up, line protocol is up
      Hardware is EtherSVI
        MAC address 001d.453a.ea0e, MTU 1500
        IP address 192.168.50.1, subnet mask 255.255.255.0
      Traffic Statistics for "Vlan600-SafeQ":
        1875377 packets input, 1267279709 bytes
        1056139 packets output, 290728055 bytes
        521943 packets dropped
          1 minute input rate 0 pkts/sec,  165 bytes/sec
          1 minute output rate 0 pkts/sec,  0 bytes/sec
          1 minute drop rate, 0 pkts/sec
          5 minute input rate 0 pkts/sec,  178 bytes/sec
          5 minute output rate 0 pkts/sec,  9 bytes/sec
          5 minute drop rate, 0 pkts/sec
    Interface Ethernet0/0 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
        Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
        Available but not configured via nameif
        MAC address 001d.453a.ea06, MTU not set
        IP address unassigned
        1782670655 packets input, 1256666911856 bytes, 0 no buffer
        Received 95709 broadcasts, 0 runts, 0 giants
        1978 input errors, 1978 CRC, 0 frame, 0 overrun, 1978 ignored, 0 abort
        0 L2 decode drops
        17179928790 switch ingress policy drops
        1878320261 packets output, 1778955488577 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        0 rate limit drops
        0 switch egress policy drops
    Interface Ethernet0/2 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
        Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
        Available but not configured via nameif
        MAC address 001d.453a.ea08, MTU not set
        IP address unassigned
        1790819459 packets input, 1783854920873 bytes, 0 no buffer
        Received 27571913 broadcasts, 0 runts, 0 giants
        614 input errors, 614 CRC, 0 frame, 0 overrun, 614 ignored, 0 abort
        0 L2 decode drops
        19768 switch ingress policy drops
        1547507675 packets output, 991527977853 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        0 rate limit drops
        0 switch egress policy drops
    Interface Ethernet0/3 "", is up, line protocol is up
      Hardware is 88E6095, BW 100 Mbps
        Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
        Available but not configured via nameif
        MAC address 001d.453a.ea09, MTU not set
        IP address unassigned
        137318166 packets input, 9176625008 bytes, 0 no buffer
        Received 290030 broadcasts, 0 runts, 0 giants
        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
        0 L2 decode drops
        335 switch ingress policy drops
        223933623 packets output, 267222625073 bytes, 0 underruns
        0 output errors, 0 collisions, 0 interface resets
        0 babbles, 0 late collisions, 0 deferred
        0 lost carrier, 0 no carrier
        0 rate limit drops
        0 switch egress policy drops

Maybe you are looking for

  • I can't upgrade my current iPhoto 9.3.2 to 9.5 with my OS X Mavericks

    I have upgraded my MacBoon Pro with Mevericks but I can't seem to access to my iPhoto 9.3.2 I was informed that I need to upgrade to 9.5 which I tried but failed. And I've been consistently, using my Apple ID to log in all places (iTunes, Apple Suppr

  • Nokia N8 email line break problem

    So, I've only found one other post on here about this problem, with no solution. The problem being that when you reply to an email in a hotmail inbox on the N8. Any line breaks (created by pressing return) are ignored and the whole email is sent as o

  • Tabstrip in module pool

    how would use tabstrip in module pool

  • Updating older fcp x files

    Hi, I have an older FCPX file which needs updating to a new library and I have tried to follow other suggestions but am having no luck. My .fcpproject file and .fcpevent file are in their respective folders called Final Cut Projects and Final Cut Eve

  • Captivate Dreamweaver Tutorial

    I am developing a series of educational websites designed to support the needs of staff and students. The subject site I'm currently working on is Media Studies and it contains a unit on Web Design &amp; Web Conventions along with New Technologies. I