ASA VPN configuration question

I am trying to configure a VPN tunnel to a remote 3rd party site from an ASA. I have set up a new tunnel group
But it seems to be trying to use the DefaultRAGroup and then the Defaultl2lGroup one. What do I need to do to ensure it uses the new one I have set up ?

The name of the tunnel-group has to be the ip address of the remote gateway. With that, the ASA can match the IPsec packets to the correct tunnel-group.

Similar Messages

  • Yet Another ASA VPN Licensing Question :)

    I have a pretty good understanding of ASA VPN concepts, but not sure about this scenario.  Two questions regarding 5525 VPN SSL Anyconnect Premium Licensing.
    1.  Assuming we already own a ASA 5525-x with 750 Anyconnect Essentials and Mobile ( p/n ASA5525VPN-EM750K9 ) and want the ability for 200 Clientless (Anyconnect Premium) VPN connections, including mobile devices, what part number do I need?  
    2.  Assuming we do not yet own a ASA5525, but want the same 200 clientless VPN connections plus mobile device connectivity, what part number do I need?   I'm assuming this is correct  >>  ASA5525VPN-PM250K9
    Thanks!

    It's no problem - I sometimes look for an answer to a question myself and find my own 2 year old post explaining the answer. As long as I don't find my 2 week old answer, I'm OK with that. :)
    Anyhow, no there's not a SKU to upgrade Essentials to Premium. All the Premium upgrade SKUs are between Premium licensed user tiers (10-25, 25-50, 50-100 etc.).
    If you're a persuasive customer and make a strong case with your reseller they may be able to get a deal with Cisco outside the normal channels to get some relief as a customer satisfaction issue. That's very much a case by case thing though and not the normal fulfillment method.

  • ASA 5505 VPN configuration question

    I have a asa 5505 v7.2(3) asdm 5.2(3) th I am trying to get reconfigured after our cable company was bought out and they replaced the cable modem with a router. My asa now has a non routable "10" address on the outside instead of one of the 5 statics I have assigned to me. I have natted my servers, but I cannot get my vpn clients connected. I am not sure how to get one of my statics assigned to the asa to use for the VPN tunnel. Used to be I just tunneled to the static "outside" address with my Cisco VPN clients (remote pc's). I tried assigning one of my statics to the outside, but then I had no connectivity at all since there is a router now before me, where it was just a modem before. I am used to working on larger pix's with my own IP address range, and not used to dealing with DHCP assigned outside addresses, so I am sure it is something simple I am missing. Any help would be greatly appreciated, this is for a small charity animal shelter, that has been down since the cable company made their "transparent change" when the bought another one out.
    The ISP router has an interface with one of my static on the outside facing interface, and a 10 address on the interface directly connected to my ASA. The ISP router then assigns a 10 address to my outside interface on the ASA. I then have 192 addresses on my inside interfaces with statics for their servers. I am just not sure now how to connect my VPN clients since I do not have a routable outside address anymore. I have tried connecting to the static on the ISP hinking they might pass the packet, but they don't. I thought maybe a loopback could be assigned to the ASA, but could not see a way to do that. also the ethernet interfaces cannot have address assigned, only vlans, which there can only be two, and both are used (inside, outside) so I am out of ideas.
    Thanks for any help
    Thanks much

    Hi Kevin
    Your current design causes administrative overhead. You either need one-to-one mapping with outside int or a PAT which is forwarding UDP 4500 and TCP 10000 (may cause troubles in GRE)
    Ask your ISP to configure the router in bridged mode and let your outside interface have the public IPs instead 10.x.x.x
    Regards

  • Asa vpn ip question

    Hi all,
    I feel like this is a dumb question, but I can't seem to find the documentation fitting my scenario on cisco. I can setup VPN without any problems. My issue though is that, all the configuration examples rely on the outside interface IP as the "PEER IP" in L2L or target IP in RA. Is there any special configuration needed to use a public IP other that my outside interface?
    Example:
    outside interface (ASA) ip 1.1.1.1
    L2L vpn ip 1.1.1.2
    RA vpn ip 1.1.1.3
    Gateway ip 1.1.1.4
    I want to use 1.1.1.2 and 1.1.1.3 in my ASA configuration instead of using the outside interface, but im unsure as to where I define this parameter.....
    Any suggestions using this example?
    Tia,
    Fred

    Fred, you are right in stating all docs pertaining to l2l vpn points to outside interface as it is the most commonly setup scenario. I am not aware you could do what you are trying to do using a different IP as your vpn termination point instead of the actual IP address of the interface, if there is a was Im willing to learn it.
    You could however, not that I have tried it but will see if I could simulate this at some point in future would be to have three outside subinterfaces one sub for L2l 1.1.1.2 end termination point, one sub RA 1.1.1.3 and your outside physical with 1.1.1.1 . This is Just a thought , perhaps we could see some other comments.
    Rgds
    Jorge

  • Cisco ASA -VPN Ping Question

    Hey guys, I have a Cisco ASA 5505 8.4 I have a Remote Access VPN up and working...for the most part. When I VPN in I would like to be able to access our Mitel phone manager which is just a internal IP you put in the browser. Here is the issue when I am connected I can't ping the address of 10.0.0.250. But I can ping my other servers 10.0.0.2 and 10.0.0.3. Why can I ping some address but not others.
    Thanks
    Nick

    Hi,
    Are you saying that the ASA replaced the previous device that acted as the default gateway for the phone system? And also the IP address was changed and this was not taken into consideration on the phone systems network configurations?
    This would indicate that the problem is with the phone system having the old gateway IP address configured and it doesnt know where to forward the traffic that is coming from a different network (for which it would require the correct default gateway)
    If the internal network that can ping and access the phone system means the hosts that are on the same internal network with the phone system (10.0.0.x) then this is expected as the default gateway is not needed between the hosts in the same network as they communicate directly.
    So would be the problem now simply be with the default gateway IP set on the phone system.
    - Jouni

  • ASA vpn nat question

    i have an ASA 5520 ver 8.4 with the following config
    WAN
    207.211.25.34
    Production
    10.11.12.1 255.255.255.0
    Mgmt
    10.11.11.1 255.255.255.0
    i need to create a peer-2-peer VPN to a remote site ASP16 from both Prod and Mgmt
    what would my nat statement look like ?
    currently i have the following but can only ping from Mgmt not Prod  (ASP17 is an network object group that contain the Prod and Mgmt subnets )
    nat (Production,WAN) source static ASP17_VPN ASP17_VPN destination static ASP16 ASP16 no-proxy-arp route-lookup
    nat (Mgmt,WAN) source static ASP17_VPN ASP17_VPN destination static ASP8_Prod ASP8_Prod

    Hello Tejas,
    After reading your configuration I can see that the crypto-maps are applyed to the outside interface, and the Access-list for the interesting traffic has both networks (Managment and production) so you should be able to access the other network from this site.
    Can you do the following packet tracers to see the features the ICMP packet is hitting when the Request is sent.
    I will need the output of the following commands:
    1- Packet-tracer input Mgmt icmp 10.11.34.15 8 0 10.30.6.15
    2-Packet-tracer input Production icmp 10.11.35.15 8 0 10.30.6.15
    Please rate helpful posts,
    Julio!!

  • ASA VPN client question

    Hello.
    I have a question about a connection between an asa5505-sec-bun-k9 (that acts as Easy VPN client) and a EASY VPN server.
    The connection with the Easy VPN server is OK but I cannot more connect to internet and create VPN connections to my ASA5505 when I enable the feature.
    Is this a normal condition with Easy VPN Client enabled?

    u need to do split tunneling on ur vpn server and apply it to the vpn client config on the vpn server that encypt only traffic destined to the server side pravite network
    lets say the private network behind the vpn server is 192.168.1.0/24
    so make a standard ACL
    access-list split standard permit 192.168.1.0 255.255.255.0
    group-policy [ur grop policy name] attributes
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split
    then when u connect from the easy client only traffic to 192.168.1.0 will go through the tunnel other traffic will not be part of encrypted traffic
    good luck
    Rate if helpful

  • ASA VPN QUESTION

    Hi All
    The question is pretty simple. I can successfully connect  to my ASA 5505  firewall via cisco vpn client 64 bit , i can ping any ip  address on the LAN behind ASA but none of the LAN computers can see or  ping the IP Address which is assigned to my vpn client from the ASA VPN  Pool.
    The LAN behind ASA is 192.168.0.0 and the VPN Pool for the cisco vpn client is 192.168.30.0
    I would appreciate some help pls
    Here is the config:
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password J7NxNd4NtVydfOsB encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.0.11 EXCHANGE
    name x.x.x.x WAN
    name 192.168.30.0 VPN_POOL2
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address WAN 255.255.255.252
    interface Ethernet0/0
    switchport access vlan 2
    <--- More --->
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    boot system disk0:/asa724-k8.bin
    ftp mode passive
    clock timezone EEST 2
    clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    access-list nk-acl extended permit tcp any interface outside eq smtp
    access-list nk-acl extended permit tcp any interface outside eq https
    access-list customerVPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 VPN_POOL2 255.255.255.0
    access-list inside_access_in extended permit ip any any
    access-list VPN_NAT extended permit ip VPN_POOL2 255.255.255.0 192.168.0.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPN_POOL2 192.168.30.10-192.168.30.90 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (inside) 10 interface
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (outside) 10 access-list VPN_NAT outside
    static (inside,outside) tcp interface smtp EXCHANGE smtp netmask 255.255.255.255
    static (inside,outside) tcp interface https EXCHANGE https netmask 255.255.255.255
    access-group inside_access_in in interface inside
    access-group nk-acl in interface outside
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authorization command LOCAL
    http server enable
    http 192.168.0.0 255.255.255.0 inside
    snmp-server host inside 192.168.0.16 community public
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    telnet 192.168.0.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcp-client client-id interface outside
    dhcpd dns 217.27.32.196
    dhcpd address 192.168.0.100-192.168.0.200 inside
    dhcpd dns 192.168.0.10 interface inside
    dhcpd enable inside
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy customerVPN internal
    group-policy customerVPN attributes
    dns-server value 192.168.0.10
    vpn-tunnel-protocol IPSec
    password-storage enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value customerVPN_splitTunnelAcl
    default-domain value customer.local
    username xxx password 8SYsAcRU4s6DpQP1 encrypted privilege 0
    username xxx attributes
    vpn-group-policy TUNNEL1
    username xxx password C6M4Xy7t0VOLU3bS encrypted privilege 0
    username xxx attributes
    vpn-group-policy PAPAGROUP
    username xxx password RU2zcsRqQAwCkglQ encrypted privilege 0
    username xxx attributes
    vpn-group-policy customerVPN
    username xxx password zfP8z5lE6WK/sSjY encrypted privilege 15
    tunnel-group customerVPN type ipsec-ra
    tunnel-group customerVPN general-attributes
    address-pool VPN_POOL2
    default-group-policy customerVPN
    tunnel-group customerVPN ipsec-attributes
    pre-shared-key *
    tunnel-group-map default-group DefaultL2LGroup
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:a4dfbb82008f78756fe4c7d029871ec1
    : end
    ciscoasa#                           

    Well lots of new features have been hinted at for ASA 9.2 but I've not seen anything as far as an Engineering Commit or Customer Commit for that feature.
    Site-site VPN in multiple context mode was added in 9.0(1) and I have customers have been asking for the remote access features as well.
    I will remember to ask about that at Cisco Live next month.

  • Confused with this ASA - VPN config issue

    Hello. Can anyone help me here? I am new to the ASA config and commands. Everything works well, enough, on this ASA except the VPN. A client can connect but cannot access anything inside or outside. Here is the config. Can someone please take a look and tell me why VPN is not working? I don't want to set up split-tunneling, I would prefer everything to go through the firewall. Also, if you see something else wrong (or have a better implementation) then please let me know.
    ASA Version 8.4(2)
    hostname FIREWALL_NAME
    enable password Some_X's_here encrypted
    passwd Some_X's_here encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/0.22
    description Public Internet space via VLAN 22
    vlan 22
    nameif Public_Internet
    security-level 0
    ip address 1.3.3.7 255.255.255.248
    interface Ethernet0/1
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.42
    description Private LAN space via VLAN 42
    shutdown
    vlan 42
    nameif Private_CDATA
    security-level 100
    ip address 10.30.136.1 255.255.255.0
    interface Ethernet0/1.69
    description Private LAN space via VLAN 69
    vlan 69
    nameif Private_ODATA
    security-level 100
    ip address 10.30.133.1 255.255.255.0
    interface Ethernet0/1.95
    description Private LAN space via VLAN 95
    shutdown
    vlan 95
    nameif Private_OVOICE
    security-level 100
    ip address 192.168.102.254 255.255.255.0
    interface Ethernet0/1.96
    description Private LAN space via VLAN 96
    shutdown
    vlan 96
    nameif Private_CVOICE
    security-level 100
    ip address 192.168.91.254 255.255.255.0
    interface Ethernet0/1.3610
    description Private LAN subnet via VLAN 3610
    shutdown
    vlan 3610
    nameif Private_CeDATA
    security-level 100
    ip address 10.10.100.18 255.255.255.240
    interface Ethernet0/1.3611
    description Private LAN space via VLAN 3611
    shutdown
    vlan 3611
    nameif Private_CeVOICE
    security-level 100
    ip address 10.10.100.66 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    security-level 0
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.69.1 255.255.255.0
    management-only
    banner exec WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    banner exec
    banner exec                                    ,
    banner exec                                  .';
    banner exec                              .-'` .'
    banner exec                            ,`.-'-.`\
    banner exec                           ; /     '-'
    banner exec                           | \       ,-,
    banner exec                           \  '-.__   )_`'._                      \|/
    banner exec                            '.     ```      ``'--._[]--------------*
    banner exec                           .-' ,                   `'-.           /|\
    banner exec                            '-'`-._           ((   o   )
    banner exec                                   `'--....(`- ,__..--'
    banner exec                                            '-'`
    banner exec
    banner exec frickin' sharks with frickin' laser beams attached to their frickin' heads
    banner login WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    banner asdm WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network CD_3610-GW
    host 10.10.100.17
    description First hop to 3610
    object network CV_3611-GW
    host 10.10.100.65
    description First hop to 3611
    object network GW_22-EXT
    host 1.3.3.6
    description First hop to 22
    object service MS-RDC
    service tcp source range 1024 65535 destination eq 3389
    description Microsoft Remote Desktop Connection
    object network HDC-LAN
    subnet 192.168.200.0 255.255.255.0
    description DC LAN subnet
    object network HAM-LAN
    subnet 192.168.110.0 255.255.255.0
    description HAM LAN subnet
    object service MSN
    service tcp source range 1 65535 destination eq 1863
    description MSN Messenger
    object network BCCs
    host 2.1.8.1
    description BCCs server access
    object network ODLW-EXT
    host 7.1.1.5
    description OTTDl
    object network SWINDS-INT
    host 10.30.133.67
    description SWINDS server
    object network SWINDS(192.x.x.x)-INT
    host 192.168.100.67
    description SWINDS server
    object service YMSG
    service tcp source range 1 65535 destination eq 5050
    description Yahoo Messenger
    object service c.b.ca1
    service tcp source range 1 65535 destination eq citrix-ica
    description Connections to the bc portal.
    object service c.b.ca2
    service tcp source range 1 65535 destination eq 2598
    description Connections to the bc portal.
    object service HTTP-EXT(7001)
    service tcp source range 1 65535 destination eq 7001
    description HTTP Extended on port 7001.
    object service HTTP-EXT(8000-8001)
    service tcp source range 1 65535 destination range 8000 8001
    description HTTP Extended on ports 8000-8001.
    object service HTTP-EXT(8080-8081)
    service tcp source range 1 65535 destination range 8080 8081
    description HTTP Extended on ports 8080-8081.
    object service HTTP-EXT(8100)
    service tcp source range 1 65535 destination eq 8100
    description HTTP Extended on port 8100.
    object service HTTP-EXT(8200)
    service tcp source range 1 65535 destination eq 8200
    description HTTP Extended on port 8200.
    object service HTTP-EXT(8888)
    service tcp source range 1 65535 destination eq 8888
    description HTTP Extended on port 8888.
    object service HTTP-EXT(9080)
    service tcp source range 1 65535 destination eq 9080
    description HTTP Extended on port 9080.
    object service ntp
    service tcp source range 1 65535 destination eq 123
    description TCP NTP on port 123.
    object network Pl-EXT
    host 7.1.1.2
    description OPl box.
    object service Pl-Admin
    service tcp source range 1 65535 destination eq 8443
    description Pl Admin portal
    object network FW-EXT
    host 1.3.3.7
    description External/Public interface IP address of firewall.
    object network Rs-EXT
    host 7.1.1.8
    description Rs web portal External/Public IP.
    object network DWDM-EXT
    host 2.1.2.1
    description DWDM.
    object network HM_VPN-EXT
    host 6.2.9.7
    description HAM Man.
    object network SIM_MGMT
    host 2.1.1.1
    description SIM Man.
    object network TS_MGMT
    host 2.1.1.4
    description TS Man.
    object network TS_MGMT
    host 2.1.2.2
    description TS Man.
    object service VPN-TCP(1723)
    service tcp source range 1 65535 destination eq pptp
    description For PPTP control path.
    object service VPN-UDP(4500)
    service udp source range 1 65535 destination eq 4500
    description For L2TP(IKEv1) and IKEv2.
    object service VPN-TCP(443)
    service tcp source range 1 65535 destination eq https
    description For SSTP control and data path.
    object service VPN-UDP(500)
    service udp source range 1 65535 destination eq isakmp
    description For L2TP(IKEv1) and IKEv2.
    object network RCM
    host 6.1.8.2
    description RCM
    object network RCM_Y
    host 6.1.8.9
    description RCM Y
    object network r.r.r.c163
    host 2.1.2.63
    description RCV IP.
    object network r.r.r.c227
    host 2.1.2.27
    description RCV IP.
    object network v.t.c-EXT
    host 2.5.1.2
    description RTICR
    object service VPN-TCP(10000)
    service tcp source range 1 65535 destination eq 10000
    description For TCP VPN over port 1000.
    object service BGP-JY
    service tcp source range 1 65535 destination eq 21174
    description BPG
    object network KooL
    host 192.168.100.100
    description KooL
    object network FW_Test
    host 1.3.3.7
    description Testing other External IP
    object network AO_10-30-133-0-LAN
    range 10.30.133.0 10.30.133.229
    description OLS 10.30.133.0/24
    object network AC_10-30-136-0-LAN
    subnet 10.30.136.0 255.255.255.0
    description CLS 10.30.136.0/24
    object network NETWORK_OBJ_192.168.238.0_27
    subnet 192.168.238.0 255.255.255.224
    object-group network All_Private_Interfaces
    description All private interfaces
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    network-object 10.10.100.16 255.255.255.240
    network-object 10.10.100.64 255.255.255.252
    network-object 192.168.102.0 255.255.255.0
    network-object 192.168.91.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service cb.ca
    description All ports required for cb.ca connections.
    service-object object c.b.ca1
    service-object object c.b.ca2
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq https
    service-object udp destination eq snmp
    object-group service FTP
    description All FTP ports (20 + 21)
    service-object tcp destination eq ftp
    service-object tcp destination eq ftp-data
    object-group service HTTP-EXT
    description HTTP Extended port ranges.
    service-object object HTTP-EXT(7001)
    service-object object HTTP-EXT(8000-8001)
    service-object object HTTP-EXT(8080-8081)
    service-object object HTTP-EXT(8100)
    service-object object HTTP-EXT(8200)
    service-object object HTTP-EXT(8888)
    service-object object HTTP-EXT(9080)
    object-group service ICMP_Any
    description ICMP: Any Type, Any Code
    service-object icmp alternate-address
    service-object icmp conversion-error
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp information-reply
    service-object icmp information-request
    service-object icmp mask-reply
    service-object icmp mask-request
    service-object icmp mobile-redirect
    service-object icmp parameter-problem
    service-object icmp redirect
    service-object icmp router-advertisement
    service-object icmp router-solicitation
    service-object icmp source-quench
    service-object icmp time-exceeded
    service-object icmp timestamp-reply
    service-object icmp timestamp-request
    service-object icmp traceroute
    service-object icmp unreachable
    service-object icmp6 echo
    service-object icmp6 echo-reply
    service-object icmp6 membership-query
    service-object icmp6 membership-reduction
    service-object icmp6 membership-report
    service-object icmp6 neighbor-advertisement
    service-object icmp6 neighbor-redirect
    service-object icmp6 neighbor-solicitation
    service-object icmp6 packet-too-big
    service-object icmp6 parameter-problem
    service-object icmp6 router-advertisement
    service-object icmp6 router-renumbering
    service-object icmp6 router-solicitation
    service-object icmp6 time-exceeded
    service-object icmp6 unreachable
    service-object icmp
    object-group service NTP
    description TCP and UPD NTP protocol
    service-object object ntp
    service-object udp destination eq ntp
    object-group service DM_INLINE_SERVICE_3
    group-object FTP
    group-object HTTP-EXT
    group-object ICMP_Any
    group-object NTP
    service-object tcp-udp destination eq domain
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq ssh
    service-object ip
    object-group service DM_INLINE_SERVICE_4
    group-object NTP
    service-object tcp destination eq daytime
    object-group network SWINDS
    description Both Internal IP addresses (192 + 10)
    network-object object SWINDS-INT
    network-object object SWINDS(192.x.x.x)-INT
    object-group service IM_Types
    description All messenger type applications
    service-object object MSN
    service-object object YMSG
    service-object tcp-udp destination eq talk
    service-object tcp destination eq aol
    service-object tcp destination eq irc
    object-group service SNMP
    description Both poll and trap ports.
    service-object udp destination eq snmp
    service-object udp destination eq snmptrap
    object-group service DM_INLINE_SERVICE_2
    group-object FTP
    service-object object MS-RDC
    service-object object Pl-Admin
    group-object SNMP
    object-group network DM_INLINE_NETWORK_1
    network-object object FW-EXT
    network-object object Rs-EXT
    object-group network AMV
    description connections for legacy AM
    network-object object DWDM-EXT
    network-object object HAM_MGMT
    network-object object SIM_MGMT
    network-object object TS_MGMT
    network-object object TS_MGMT
    object-group service IKEv2_L2TP
    description IKEv2 and L2TP VPN configurations
    service-object esp
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    object-group service PPTP
    description PPTP VPN configuration
    service-object gre
    service-object object VPN-TCP(1723)
    object-group service SSTP
    description SSTP VPN configuration
    service-object object VPN-TCP(443)
    object-group network RvIPs
    description Rv IP addresses
    network-object object RCM
    network-object object RCM_Y
    network-object object r.r.r.c163
    network-object object r.r.r.c227
    network-object object v.t.c-EXT
    object-group service Rvs
    description Rv configuration.
    service-object object VPN-TCP(10000)
    service-object object VPN-UDP(500)
    object-group service DM_INLINE_SERVICE_5
    service-object object BGP-JY
    service-object tcp destination eq bgp
    object-group network Local_Private_Subnets
    description OandCl DATA
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    access-list Public/Internet_access_out remark Block all IM traffic out.
    access-list Public/Internet_access_out extended deny object-group IM_Types object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Access from SWINDS to DLM portal
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_1 object-group SWINDS object ODLW-EXT
    access-list Public/Internet_access_out remark Allow access to BMC portal
    access-list Public/Internet_access_out extended permit object-group cb.ca object-group Local_Private_Subnets object BCCs
    access-list Public/Internet_access_out remark Allow basic services out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_3 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow WhoIS traffic out.
    access-list Public/Internet_access_out extended permit tcp object-group Local_Private_Subnets any eq whois
    access-list Public/Internet_access_out remark Allow Network Time protocols out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_4 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow all IP based monitoring traffic to Pl.
    access-list Public/Internet_access_out extended permit ip object-group SWINDS object Pl-EXT
    access-list Public/Internet_access_out remark Allow Management traffic to Pl-JY.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_2 object-group Local_Private_Subnets object Pl-EXT
    access-list Public/Internet_access_out remark Allow FTP traffic to Grimlock and RS FTP.
    access-list Public/Internet_access_out extended permit object-group FTP object-group Local_Private_Subnets object-group DM_INLINE_NETWORK_1
    access-list Public/Internet_access_out remark Allow VPN traffic to AM-JY.
    access-list Public/Internet_access_out extended permit object-group IKEv2_L2TP object-group Local_Private_Subnets object-group AMV
    access-list Public/Internet_access_out remark Allow VPN traffic to RCm devices.
    access-list Public/Internet_access_out extended permit object-group Rvs object-group Local_Private_Subnets object-group RvIPs
    access-list Public/Internet_access_out remark Allow BPG traffic out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_5 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow Kool server out.
    access-list Public/Internet_access_out extended permit ip object KooL any
    pager lines 24
    logging enable
    logging history informational
    logging asdm informational
    logging mail notifications
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu Public_Internet 1500
    mtu Private_CDATA 1500
    mtu Private_ODATA 1500
    mtu Private_OVOICE 1500
    mtu Private_CVOICE 1500
    mtu Private_CeDATA 1500
    mtu Private_CeVOICE 1500
    mtu management 1500
    ip local pool AO-VPN_Pool 192.168.238.2-192.168.238.30 mask 255.255.255.224
    ip verify reverse-path interface Public_Internet
    ip verify reverse-path interface Private_CDATA
    ip verify reverse-path interface Private_ODATA
    ip verify reverse-path interface Private_OVOICE
    ip verify reverse-path interface Private_CVOICE
    ip verify reverse-path interface Private_CeDATA
    ip verify reverse-path interface Private_CeVOICE
    ip verify reverse-path interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any Public_Internet
    no asdm history enable
    arp timeout 14400
    nat (Private_ODATA,Public_Internet) source dynamic AO_10-30-133-0-LAN interface
    nat (Private_CDATA,Public_Internet) source dynamic AC_10-30-136-0-LAN interface
    nat (Private_ODATA,Public_Internet) source static any any destination static NETWORK_OBJ_192.168.238.0_27 NETWORK_OBJ_192.168.238.0_27 no-proxy-arp route-lookup
    access-group Public/Internet_access_out out interface Public_Internet
    route Public_Internet 0.0.0.0 0.0.0.0 1.3.3.6 1
    route Private_CeDATA 10.0.0.0 255.0.0.0 10.10.100.17 1
    route Private_CeDATA 10.1.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.3.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.5.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.11.106.74 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 10.30.128.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.130.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.131.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.132.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.134.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.135.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.67.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.224.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 4.1.1.19 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 1.1.1.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 1.1.1.13 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.24 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.27 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.17.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.64 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.66 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.110 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.251.57 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.56.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.57.152 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 192.168.3.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.9.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.20.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.21.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.30.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.40.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.41.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.50.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.60.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.61.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.70.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.101.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.110.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.200.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.251.177.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 2.1.2.7 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 2.1.2.74 255.255.255.255 10.10.100.17 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (Private_ODATA) host 10.30.133.21
    timeout 5
    nt-auth-domain-controller Cool_Transformer_Name
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.69.0 255.255.255.0 management
    snmp-server host Private_ODATA 10.30.133.67 poll community Some_*s_here version 2c
    snmp-server location OT
    snmp-server contact [email protected]
    snmp-server community Some_*s_here
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change fru-insert fru-remove
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps remote-access session-threshold-exceeded
    snmp-server enable traps connection-limit-reached
    snmp-server enable traps cpu threshold rising
    snmp-server enable traps ikev2 start stop
    snmp-server enable traps nat packet-discard
    sysopt noproxyarp Public_Internet
    sysopt noproxyarp Private_CDATA
    sysopt noproxyarp Private_ODATA
    sysopt noproxyarp Private_OVOICE
    sysopt noproxyarp Private_CVOICE
    sysopt noproxyarp Private_CeDATA
    sysopt noproxyarp Private_CeVOICE
    sysopt noproxyarp management
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Public_Internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Public_Internet_map interface Public_Internet
    crypto ikev1 enable Public_Internet
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh 10.30.133.0 255.255.255.0 Private_ODATA
    ssh 192.168.69.0 255.255.255.0 management
    ssh timeout 2
    ssh version 2
    console timeout 5
    dhcprelay server 10.30.133.13 Private_ODATA
    dhcprelay enable Private_CDATA
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.30.133.13 prefer
    ntp server 132.246.11.227
    ntp server 10.30.133.21
    webvpn
    group-policy AO-VPN_Tunnel internal
    group-policy AO-VPN_Tunnel attributes
    dns-server value 10.30.133.21 10.30.133.13
    vpn-tunnel-protocol ikev1
    default-domain value ao.local
    username helpme password Some_X's_here encrypted privilege 1
    username helpme attributes
    service-type nas-prompt
    tunnel-group AO-VPN_Tunnel type remote-access
    tunnel-group AO-VPN_Tunnel general-attributes
    address-pool AO-VPN_Pool
    authentication-server-group AD
    default-group-policy AO-VPN_Tunnel
    tunnel-group AO-VPN_Tunnel ipsec-attributes
    ikev1 pre-shared-key Some_*s_here
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    class class-default
      user-statistics accounting
    service-policy global_policy global
    smtp-server 192.168.200.25
    prompt hostname context
    no call-home reporting anonymous
    Thanks,
    Jeff.                  

    I tried those commands but this started getting messy and so I looked at the current config and it was not the same as what I originally posted.  Looks like some changes were implemented but not saved so the config that I posted what slightly different.  Thank you for all your suggestions.  Here is the new config, confirmed as the current running and saved config.  Same situation as before though.  I can connect using the Cisco VPN client but can only ping myself and can't get out to the Internet or access anything internal.  If someone can take a look it would be greatly appreciated.  The main difference is the VPN pool has been set as a subset of the 10.30.133.0 network instead of using a separate subnet (VPN pool is 10.30.133.200 - 10.30.133.230).
    ASA Version 8.4(2)
    hostname FIREWALL_NAME
    enable password Some_X's_here encrypted
    passwd Some_X's_here encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/0.22
    description Public Internet space via VLAN 22
    vlan 22
    nameif Public_Internet
    security-level 0
    ip address 1.3.3.7 255.255.255.248
    interface Ethernet0/1
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.42
    description Private LAN space via VLAN 42
    shutdown
    vlan 42
    nameif Private_CDATA
    security-level 100
    ip address 10.30.136.1 255.255.255.0
    interface Ethernet0/1.69
    description Private LAN space via VLAN 69
    vlan 69
    nameif Private_ODATA
    security-level 100
    ip address 10.30.133.1 255.255.255.0
    interface Ethernet0/1.95
    description Private LAN space via VLAN 95
    shutdown
    vlan 95
    nameif Private_OVOICE
    security-level 100
    ip address 192.168.102.254 255.255.255.0
    interface Ethernet0/1.96
    description Private LAN space via VLAN 96
    shutdown
    vlan 96
    nameif Private_CVOICE
    security-level 100
    ip address 192.168.91.254 255.255.255.0
    interface Ethernet0/1.3610
    description Private LAN subnet via VLAN 3610
    shutdown
    vlan 3610
    nameif Private_CeDATA
    security-level 100
    ip address 10.10.100.18 255.255.255.240
    interface Ethernet0/1.3611
    description Private LAN space via VLAN 3611
    shutdown
    vlan 3611
    nameif Private_CeVOICE
    security-level 100
    ip address 10.10.100.66 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    security-level 0
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.69.1 255.255.255.0
    management-only
    banner exec WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    banner exec
    banner exec                                    ,
    banner exec                                  .';
    banner exec                              .-'` .'
    banner exec                            ,`.-'-.`\
    banner exec                           ; /     '-'
    banner exec                           | \       ,-,
    banner exec                           \  '-.__   )_`'._                      \|/
    banner exec                            '.     ```      ``'--._[]--------------*
    banner exec                           .-' ,                   `'-.           /|\
    banner exec                            '-'`-._           ((   o   )
    banner exec                                   `'--....(`- ,__..--'
    banner exec                                            '-'`
    banner exec
    banner exec frickin' sharks with frickin' laser beams attached to their frickin' heads
    banner login WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    banner asdm WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network CD_3610-GW
    host 10.10.100.17
    description First hop to 3610
    object network CV_3611-GW
    host 10.10.100.65
    description First hop to 3611
    object network GW_22-EXT
    host 1.3.3.6
    description First hop to 22
    object network Ts-LAN
    host 192.168.100.4
    description TS
    object service MS-RDC
    service tcp source range 1024 65535 destination eq 3389
    description Microsoft Remote Desktop Connection
    object network HDC-LAN
    subnet 192.168.200.0 255.255.255.0
    description DC LAN subnet
    object network HAM-LAN
    subnet 192.168.110.0 255.255.255.0
    description HAM LAN subnet
    object service MSN
    service tcp source range 1 65535 destination eq 1863
    description MSN Messenger
    object network BCCs
    host 2.1.8.1
    description BCCs server access
    object network ODLW-EXT
    host 7.1.1.5
    description OTTDl
    object network SWINDS-INT
    host 10.30.133.67
    description SWINDS server
    object network SWINDS(192.x.x.x)-INT
    host 192.168.100.67
    description SWINDS server
    object service YMSG
    service tcp source range 1 65535 destination eq 5050
    description Yahoo Messenger
    object service c.b.ca1
    service tcp source range 1 65535 destination eq citrix-ica
    description Connections to the bc portal.
    object service c.b.ca2
    service tcp source range 1 65535 destination eq 2598
    description Connections to the bc portal.
    object service HTTP-EXT(7001)
    service tcp source range 1 65535 destination eq 7001
    description HTTP Extended on port 7001.
    object service HTTP-EXT(8000-8001)
    service tcp source range 1 65535 destination range 8000 8001
    description HTTP Extended on ports 8000-8001.
    object service HTTP-EXT(8080-8081)
    service tcp source range 1 65535 destination range 8080 8081
    description HTTP Extended on ports 8080-8081.
    object service HTTP-EXT(8100)
    service tcp source range 1 65535 destination eq 8100
    description HTTP Extended on port 8100.
    object service HTTP-EXT(8200)
    service tcp source range 1 65535 destination eq 8200
    description HTTP Extended on port 8200.
    object service HTTP-EXT(8888)
    service tcp source range 1 65535 destination eq 8888
    description HTTP Extended on port 8888.
    object service HTTP-EXT(9080)
    service tcp source range 1 65535 destination eq 9080
    description HTTP Extended on port 9080.
    object service ntp
    service tcp source range 1 65535 destination eq 123
    description TCP NTP on port 123.
    object network Pl-EXT
    host 7.1.1.2
    description OPl box.
    object service Pl-Admin
    service tcp source range 1 65535 destination eq 8443
    description Pl Admin portal
    object network FW-EXT
    host 1.3.3.7
    description External/Public interface IP address of firewall.
    object network Rs-EXT
    host 7.1.1.8
    description Rs web portal External/Public IP.
    object network DWDM-EXT
    host 2.1.2.1
    description DWDM.
    object network HM_VPN-EXT
    host 6.2.9.7
    description HAM Man.
    object network SIM_MGMT
    host 2.1.1.1
    description SIM Man.
    object network TS_MGMT
    host 2.1.1.4
    description TS Man.
    object network TS_MGMT
    host 2.1.2.2
    description TS Man.
    object service VPN-TCP(1723)
    service tcp source range 1 65535 destination eq pptp
    description For PPTP control path.
    object service VPN-UDP(4500)
    service udp source range 1 65535 destination eq 4500
    description For L2TP(IKEv1) and IKEv2.
    object service VPN-TCP(443)
    service tcp source range 1 65535 destination eq https
    description For SSTP control and data path.
    object service VPN-UDP(500)
    service udp source range 1 65535 destination eq isakmp
    description For L2TP(IKEv1) and IKEv2.
    object network RCM
    host 6.1.8.2
    description RCM
    object network RCM_Y
    host 6.1.8.9
    description RCM Y
    object network r.r.r.c163
    host 2.1.2.63
    description RCV IP.
    object network r.r.r.c227
    host 2.1.2.27
    description RCV IP.
    object network v.t.c-EXT
    host 2.5.1.2
    description RTICR
    object service VPN-TCP(10000)
    service tcp source range 1 65535 destination eq 10000
    description For TCP VPN over port 1000.
    object service BGP-JY
    service tcp source range 1 65535 destination eq 21174
    description BPG
    object network KooL
    host 192.168.100.100
    description KooL
    object network FW_Test
    host 1.3.3.7
    description Testing other External IP
    object network AO_10-30-133-0-LAN
    subnet 10.30.133.0 255.255.255.0
    description OLS 10.30.133.0/24
    object network AC_10-30-136-0-LAN
    subnet 10.30.136.0 255.255.255.0
    description CLS 10.30.136.0/24
    object-group network All_Private_Interfaces
    description All private interfaces
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    network-object 10.10.100.16 255.255.255.240
    network-object 10.10.100.64 255.255.255.252
    network-object 192.168.102.0 255.255.255.0
    network-object 192.168.91.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service cb.ca
    description All ports required for cb.ca connections.
    service-object object c.b.ca1
    service-object object c.b.ca2
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq https
    service-object udp destination eq snmp
    object-group service FTP
    description All FTP ports (20 + 21)
    service-object tcp destination eq ftp
    service-object tcp destination eq ftp-data
    object-group service HTTP-EXT
    description HTTP Extended port ranges.
    service-object object HTTP-EXT(7001)
    service-object object HTTP-EXT(8000-8001)
    service-object object HTTP-EXT(8080-8081)
    service-object object HTTP-EXT(8100)
    service-object object HTTP-EXT(8200)
    service-object object HTTP-EXT(8888)
    service-object object HTTP-EXT(9080)
    object-group service ICMP_Any
    description ICMP: Any Type, Any Code
    service-object icmp alternate-address
    service-object icmp conversion-error
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp information-reply
    service-object icmp information-request
    service-object icmp mask-reply
    service-object icmp mask-request
    service-object icmp mobile-redirect
    service-object icmp parameter-problem
    service-object icmp redirect
    service-object icmp router-advertisement
    service-object icmp router-solicitation
    service-object icmp source-quench
    service-object icmp time-exceeded
    service-object icmp timestamp-reply
    service-object icmp timestamp-request
    service-object icmp traceroute
    service-object icmp unreachable
    service-object icmp6 echo
    service-object icmp6 echo-reply
    service-object icmp6 membership-query
    service-object icmp6 membership-reduction
    service-object icmp6 membership-report
    service-object icmp6 neighbor-advertisement
    service-object icmp6 neighbor-redirect
    service-object icmp6 neighbor-solicitation
    service-object icmp6 packet-too-big
    service-object icmp6 parameter-problem
    service-object icmp6 router-advertisement
    service-object icmp6 router-renumbering
    service-object icmp6 router-solicitation
    service-object icmp6 time-exceeded
    service-object icmp6 unreachable
    service-object icmp
    object-group service NTP
    description TCP and UPD NTP protocol
    service-object object ntp
    service-object udp destination eq ntp
    object-group service DM_INLINE_SERVICE_3
    group-object FTP
    group-object HTTP-EXT
    group-object ICMP_Any
    group-object NTP
    service-object tcp-udp destination eq domain
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq ssh
    service-object ip
    object-group service DM_INLINE_SERVICE_4
    group-object NTP
    service-object tcp destination eq daytime
    object-group network SWINDS
    description Both Internal IP addresses (192 + 10)
    network-object object SWINDS-INT
    network-object object SWINDS(192.x.x.x)-INT
    object-group service IM_Types
    description All messenger type applications
    service-object object MSN
    service-object object YMSG
    service-object tcp-udp destination eq talk
    service-object tcp destination eq aol
    service-object tcp destination eq irc
    object-group service SNMP
    description Both poll and trap ports.
    service-object udp destination eq snmp
    service-object udp destination eq snmptrap
    object-group service DM_INLINE_SERVICE_2
    group-object FTP
    service-object object MS-RDC
    service-object object Pl-Admin
    group-object SNMP
    object-group network DM_INLINE_NETWORK_1
    network-object object FW-EXT
    network-object object Rs-EXT
    object-group network AMV
    description connections for legacy AM
    network-object object DWDM-EXT
    network-object object HAM_MGMT
    network-object object SIM_MGMT
    network-object object TS_MGMT
    network-object object TS_MGMT
    object-group service IKEv2_L2TP
    description IKEv2 and L2TP VPN configurations
    service-object esp
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    object-group service PPTP
    description PPTP VPN configuration
    service-object gre
    service-object object VPN-TCP(1723)
    object-group service SSTP
    description SSTP VPN configuration
    service-object object VPN-TCP(443)
    object-group network RvIPs
    description Rv IP addresses
    network-object object RCM
    network-object object RCM_Y
    network-object object r.r.r.c163
    network-object object r.r.r.c227
    network-object object v.t.c-EXT
    object-group service Rvs
    description Rv configuration.
    service-object object VPN-TCP(10000)
    service-object object VPN-UDP(500)
    object-group service DM_INLINE_SERVICE_5
    service-object object BGP-JY
    service-object tcp destination eq bgp
    object-group network Local_Private_Subnets
    description OandCl DATA
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    object-group service IPSec
    description IPSec traffic
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    access-list Public/Internet_access_out remark Block all IM traffic out.
    access-list Public/Internet_access_out extended deny object-group IM_Types object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Access from SWINDS to DLM portal
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_1 object-group SWINDS object ODLW-EXT
    access-list Public/Internet_access_out remark Allow access to BMC portal
    access-list Public/Internet_access_out extended permit object-group cb.ca object-group Local_Private_Subnets object BCCs
    access-list Public/Internet_access_out remark Allow basic services out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_3 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow WhoIS traffic out.
    access-list Public/Internet_access_out extended permit tcp object-group Local_Private_Subnets any eq whois
    access-list Public/Internet_access_out remark Allow Network Time protocols out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_4 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow all IP based monitoring traffic to Pl.
    access-list Public/Internet_access_out extended permit ip object-group SWINDS object Pl-EXT
    access-list Public/Internet_access_out remark Allow Management traffic to Pl-JY.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_2 object-group Local_Private_Subnets object Pl-EXT
    access-list Public/Internet_access_out remark Allow FTP traffic to Grimlock and RS FTP.
    access-list Public/Internet_access_out extended permit object-group FTP object-group Local_Private_Subnets object-group DM_INLINE_NETWORK_1
    access-list Public/Internet_access_out remark Allow VPN traffic to AM-JY.
    access-list Public/Internet_access_out extended permit object-group IKEv2_L2TP object-group Local_Private_Subnets object-group AMV
    access-list Public/Internet_access_out remark Allow VPN traffic to RCm devices.
    access-list Public/Internet_access_out extended permit object-group Rvs object-group Local_Private_Subnets object-group RvIPs
    access-list Public/Internet_access_out remark Allow BPG traffic out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_5 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow Kool server out.
    access-list Public/Internet_access_out extended permit ip object KooL any
    pager lines 24
    logging enable
    logging history informational
    logging asdm informational
    logging mail notifications
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu Public_Internet 1500
    mtu Private_CDATA 1500
    mtu Private_ODATA 1500
    mtu Private_OVOICE 1500
    mtu Private_CVOICE 1500
    mtu Private_CeDATA 1500
    mtu Private_CeVOICE 1500
    mtu management 1500
    ip local pool AO-VPN_Pool 192.168.238.2-192.168.238.30 mask 255.255.255.224
    ip verify reverse-path interface Public_Internet
    ip verify reverse-path interface Private_CDATA
    ip verify reverse-path interface Private_ODATA
    ip verify reverse-path interface Private_OVOICE
    ip verify reverse-path interface Private_CVOICE
    ip verify reverse-path interface Private_CeDATA
    ip verify reverse-path interface Private_CeVOICE
    ip verify reverse-path interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any Public_Internet
    no asdm history enable
    arp timeout 14400
    nat (Private_ODATA,Public_Internet) source dynamic AO_10-30-133-0-LAN interface
    nat (Private_CDATA,Public_Internet) source dynamic AC_10-30-136-0-LAN interface
    nat (Private_ODATA,Public_Internet) source static any any destination static NETWORK_OBJ_192.168.238.0_27 NETWORK_OBJ_192.168.238.0_27 no-proxy-arp route-lookup
    access-group Public/Internet_access_out out interface Public_Internet
    route Public_Internet 0.0.0.0 0.0.0.0 1.3.3.6 1
    route Private_CeDATA 10.0.0.0 255.0.0.0 10.10.100.17 1
    route Private_CeDATA 10.1.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.3.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.5.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.11.106.74 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 10.30.128.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.130.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.131.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.132.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.134.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.135.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.67.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.224.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 4.1.1.19 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 1.1.1.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 1.1.1.13 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.24 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.27 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.29 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.17.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.64 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.66 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.110 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.251.57 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.56.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.57.152 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 192.168.3.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.9.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.20.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.21.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.30.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.40.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.41.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.50.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.60.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.61.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.70.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.101.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.110.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.200.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.251.177.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 2.1.2.7 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 2.1.2.74 255.255.255.255 10.10.100.17 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (Private_ODATA) host 10.30.133.21
    timeout 5
    nt-auth-domain-controller Cool_Transformer_Name
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.69.0 255.255.255.0 management
    snmp-server host Private_ODATA 10.30.133.67 poll community Some_*s_here version 2c
    snmp-server location OT
    snmp-server contact [email protected]
    snmp-server community Some_*s_here
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change fru-insert fru-remove
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps remote-access session-threshold-exceeded
    snmp-server enable traps connection-limit-reached
    snmp-server enable traps cpu threshold rising
    snmp-server enable traps ikev2 start stop
    snmp-server enable traps nat packet-discard
    sysopt noproxyarp Public_Internet
    sysopt noproxyarp Private_CDATA
    sysopt noproxyarp Private_ODATA
    sysopt noproxyarp Private_OVOICE
    sysopt noproxyarp Private_CVOICE
    sysopt noproxyarp Private_CeDATA
    sysopt noproxyarp Private_CeVOICE
    sysopt noproxyarp management
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Public_Internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Public_Internet_map interface Public_Internet
    crypto ikev1 enable Public_Internet
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh 10.30.133.0 255.255.255.0 Private_ODATA
    ssh 192.168.69.0 255.255.255.0 management
    ssh timeout 2
    ssh version 2
    console timeout 5
    dhcprelay server 10.30.133.13 Private_ODATA
    dhcprelay enable Private_CDATA
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.30.133.13 prefer
    ntp server 132.246.11.227
    ntp server 10.30.133.21
    webvpn
    group-policy AO-VPN_Tunnel internal
    group-policy AO-VPN_Tunnel attributes
    dns-server value 10.30.133.21 10.30.133.13
    vpn-tunnel-protocol ikev1
    default-domain value ao.local
    username helpme password Some_X's_here encrypted privilege 1
    username helpme attributes
    service-type nas-prompt
    tunnel-group AO-VPN_Tunnel type remote-access
    tunnel-group AO-VPN_Tunnel general-attributes
    address-pool AO-VPN_Pool
    authentication-server-group AD
    default-group-policy AO-VPN_Tunnel
    tunnel-group AO-VPN_Tunnel ipsec-attributes
    ikev1 pre-shared-key Some_*s_here
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny 
    inspect sunrpc
    inspect xdmcp
    inspect sip 
    inspect netbios
    inspect tftp
    inspect ip-options
    class class-default
    user-statistics accounting
    service-policy global_policy global
    smtp-server 192.168.200.25
    prompt hostname context
    no call-home reporting anonymous
    Thanks in advance,
    Jeff.

  • WRVS4400N - Multiple Dynamic VPN Configurations?

    Hello,
    I am wondering if anyone knows whether or not the WRVS4400N supports more than one dynamic VPN configuration?
    I am trying to get the WRVS4400N to let more than one TheGreenBow client to connect to it.....
    Thank you,
    A Read

    Yes, you can configure multiple dynamic-to-static l2l on ASA. But for multiple connections using ezvpn will be much easier. Following links may help you
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

  • Cisco sr520 VPN configuration and deployment

    Hope one of the cisco genius' can help me out. I have a small business with one sr520 edge router. The network is up and running fine but I need to allow remote users to connect back to a vpn at the office in order to access user winxp Pcs using RDP remotedesktop.
    I have searched the web and cisco forums and see there are quite a few vpn configurations but I found no clear setup guide for accomplishing what I understood to be pretty simple. "allow 5 outside users to connect back to the office and work as if they were sitting in the office"
    Question:
    1. What client software is needed on the remote client pc to connect back back to the sr520 vpn? Can I use the windows pptp vpn client or the built-in Mac client?
    2. My router shows three items labeled vpn. VPN remote, VPN Server and SSL VPN...i have tweaked each of these screens but still not been able to connect an outside client. Is there a setup guide to explain the features of this router and how to use it.
    3. after poking around the Cisco site for a vpn client i am wondering why do I need a support contract to use a feature of a router I just bought? Does Firmware and client software cost extra?
    Thanks for any assistance you can offer...
    Kevin Hall
    Houston Tx

    Hi,
    Some users have reported that IPSecuritas works well with the Cisco Small Business routers.
    http://www.lobotomo.com/products/IPSecuritas/
    For the RV180 I would try to adapt the SA500 tutorial to make it work:
    http://www.cisco.com/en/US/docs/security/multi_function_security/multi_function_security_appliance/sa_500/technote/note/SA500_mac_appnote.pdf
    Please note that this client is not supported by Cisco. If you have questions or issues, please post here on the forum.
    - Marty

  • ASA 5505 configured for WebVPN connecting to Citrix Web Interface

    ASA 5505 configured for WebVPN connecting to Citrix Web Interface.
    i have a ASA 5505 that I am attempting to configure for WebVPN with passthrough into Web Interface .  The user authenticates into WebVPN OK and gets the option to click on the Citrix Link (which is i add bookmark  citrix server http:// 172.30.40.5.) i enter the citrix and then for example  i want to open to outlook it can not open. (when i want to open some application no application is open)).there is no alarm at asa. how i solve this issue?
    thanks.

    Teymur,
    Can you confim that after disabling the ssl/tls on the Citrix server (secure connectivity) that you are getting exactly the same error.  It is possible that it is generating a different error.
    The bug where we have see the existing error was CSCtf06303 but that has been fixed in 8.4.1.  Can you confirm the exact version of code you are running on the ASA.
    If you have confirmed the above two notes it may be adventageous to open a TAC case as we may need to do some live additional troubleshooting.
    Thanks
    -Jay

  • SAP-JEE, SAP_BUILDT, and SAP_JTECHS and Dev Configuration questions

    Hi experts,
    I am configuring NWDI for our environment and have a few questions that I'm trying to get my arms around.  
    I've read we need to check-in SAP-JEE, SAP_BUILDT, and SAP_JTECHS as required components, but I'm confused on the whole check-in vs. import thing.
    I placed the 3 files in the correct OS directory and checked them in via the check-in tab on CMS.   Next, the files show up in the import queue for the DEV tab.  My questions are what do I do next?
    1.  Do I import them into DEV?  If so, what is this actually doing?  Is it importing into the actual runtime system (i.e. DEV checkbox and parameters as defined in the landscape configurator for this track)? Or is just importing the file into the DEV buildspace of NWDI system?
    2.  Same question goes for the Consolidation tab.    Do I import them in here as well? 
    3.  Do I need to import them into the QA and Prod systems too?  Or do I remove them from the queue?
    Development Configuration questions ***
    4. When I download the development configuration, I can select DEV or CON workspace.  What is the difference?  Does DEV point to the sandbox (or central development) runtime system and CONS points to the configuration runtime system as defined in the landscape configurator?  Or is this the DEV an CON workspace/buildspace of the NWDI sytem.
    5.  Does the selection here dictate the starting point for the development?  What is an example scenarios when I would choose DEV vs. CON?
    6.  I have heard about the concept of a maintenance track and a development track.  What is the difference and how do they differ from a setup perspective?   When would a Developer pick one over the over? 
    Thanks for any advice
    -Dave

    Hi David,
    "Check-In" makes SCA known to CMS, "import" will import the content of the SCAs into CBS/DTR.
    1. Yes. For these three SCAs specifically (they only contain buildarchives, no sources, no deployarchives) the build archives are imported into the dev buildspace on CBS. If the SCAs contain deployarchives and you have a runtime system configured for the dev system then those deployarchives should get deployed onto the runtime system.
    2. Have you seen /people/marion.schlotte/blog/2006/03/30/best-practices-for-nwdi-track-design-for-ongoing-development ? Sooner or later you will want to.
    3. Should be answered indirectly.
    4. Dev/Cons correspond to the Dev/Consolidation system in CMS. For each developed SC you have 2 systems with 2 workspaces in DTR for each (inactive/active)
    5. You should use dev. I would only use cons for corrections if they can't be done in dev and transported. Note that you will get conflicts in DTR if you do parallel changes in dev and cons.
    6. See link in No.2 ?
    Regards,
    Marc

  • Advanced ASA PAT configuration...

    I have a unique requirement for my ASA PAT configuration...
    By default a Cisco router running IOS will utilize the SAME port when creating a dynamic PAT. i.e. the inside hosts request, generates a dynamic PAT, where the requests source port, is the port which is translated to the inside host from the outside interface.
    The ASA ignores the inside hosts source port, and maps the PAT using its own random port above 1024.
    I would like to over-ride this default behavior and instruct the ASA to use the same port for PAT that was the inside host's initiated source port.
    TIA for any help,
    Travis

    The document present in the url below will of great help to you in defining the port number manually:
    http://www.cisco.com/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htpt4pat.html#wp1049437

  • How does one delete VPN configurations in the settings list not used any more?

    How does one delete VPN configurations in the settings list not used any more?

    Sorted found profiles and delete from there

Maybe you are looking for