ASA5505 RA VPN problem

Question

Hi!
I have my ASA configured for 2 site-to-site VPNs and one Remote Access VPN (L2TP).
It used to work fine before, but now it stopped working at all.
Phase 1 shows conf mismatch with DH group I think - log says configured unknown - expected group 2 or smth like this.
But this issue arose now when I tried to make the RAVPN work again.
The main issue when it was working was that despite the proper tunnel network list configuration I only had access to the tunnel and did not have access to the local internet when connected.
I am learning and configuring my asa from documentation found on the internet so I am no professional.
Any support would be very appreciated.
My config below:
: Saved
ASA Version 9.1(3)
hostname ciscoasa
domain-name BETONOWA.local
enable password XXX encrypted
passwd XXX encrypted
names
ip local pool VPN_RA_POOL 192.168.1.200-192.168.1.220 mask 255.255.255.0
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 dhcprelay server 192.168.1.10
interface Vlan2
 nameif outside
 security-level 0
 ip address B.B.B.B 255.255.255.0
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 192.168.1.10
 name-server 8.8.8.8
 name-server 8.8.4.4
 domain-name BETONOWA.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network BETONOWA-DC
 host 192.168.1.10
object network BETONOWA-SQL
 host 192.168.1.15
object network EXCH-MBX
 host 192.168.1.20
object network IIS_https
 host 192.168.1.30
object network RenBetPBX
 host 192.168.1.2
object network SQL
 host 192.168.1.11
object network XEROX
 host 192.168.1.3
object network RBSTORE
 host 192.168.1.6
object network IIS_smtp
 host 192.168.1.30
object network SQL_MateuszServer
 host 192.168.1.11
object network NETWORK_OBJ_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_192.168.1.192_27
 subnet 192.168.1.192 255.255.255.224
object network igolomska-network
 subnet 192.168.0.0 255.255.255.0
object network IIS
 host 192.168.1.30
object network DC
 host 192.168.1.10
object service RDP
 service tcp source eq 23456 destination eq 3389
object network VirtualPC-rdp
 host 192.168.1.40
object network mlhome-network
 subnet 192.168.2.0 255.255.255.0
object network CUE-network
 subnet 10.1.10.0 255.255.255.0
object network VOIP-network
 subnet 10.1.1.0 255.255.255.0
object network CUE
 host 10.1.10.2
object network PBXDATA-network
 subnet 192.168.10.0 255.255.255.0
object network VirtualPC
 host 192.168.1.40
object network KAM_PTZ
 host 192.168.1.81
 description Kamera PTZ
object network KAM_PTZ_http
 host 192.168.1.81
object network KAM_HALA_PRZOD
 host 192.168.1.72
object network KAM_HALA_PRZOD_http
 host 192.168.1.72
object network KAM_HALA_CNC
 host 192.168.1.74
object network KAM_HALA_CNC_http
 host 192.168.1.74
object network vCMA_https
 host 192.168.1.17
object network AUTOSAT
 host 192.168.1.15
 description AUTOSAT_TCP
object network kamwaga1
 host 192.168.1.83
object network kamwaga2
 host 192.168.1.84
object network kamarcen1
 host 192.168.1.76
object network kamarcen1http
 host 192.168.1.76
object network kamarcen2
 host 192.168.1.79
object network kamarcen2http
 host 192.168.1.79
object network kamwaga2http
 host 192.168.1.84
object network kamwagahttp
 host 192.168.1.83
object-group service DM_INLINE_TCP_1 tcp
 port-object eq www
 port-object eq https
 port-object eq 8080
 port-object eq 8081
 port-object eq 6881
 port-object eq ftp
object-group service DM_INLINE_TCP_2 tcp
 port-object eq www
 port-object eq https
object-group service DM_INLINE_SERVICE_1
 service-object icmp
 service-object tcp-udp destination eq domain
 service-object udp destination eq ntp
access-list outside_access_in extended permit tcp any object RBSTORE object-group DM_INLINE_TCP_1
access-list outside_access_in extended permit tcp any 192.168.1.0 255.255.255.0 object-group DM_INLINE_TCP_2 log disable
access-list outside_access_in extended permit tcp any host 192.168.1.30 eq smtp
access-list outside_access_in extended permit tcp any object VirtualPC eq 3389
access-list outside_access_in extended permit tcp any object SQL eq 13000
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object NETWORK_OBJ_192.168.1.0_24
access-list outside_access_in extended permit tcp any object KAM_PTZ eq www
access-list outside_access_in extended permit tcp any object KAM_HALA_PRZOD eq www
access-list outside_access_in extended permit tcp any object KAM_HALA_CNC eq www
access-list outside_access_in extended permit tcp any object BETONOWA-SQL eq 8112
access-list outside_access_in extended permit ip any object kamwaga2
access-list outside_access_in extended permit ip any object kamwaga1
access-list outside_access_in extended permit ip any object kamarcen1
access-list outside_access_in extended permit ip any object kamarcen2
access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 object igolomska-network
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
access-list outside_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 object igolomska-network
access-list outside_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 object mlhome-network
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 10.1.10.0 255.255.255.0
access-list NONAT extended permit ip 10.1.10.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 8000
logging console informational
logging monitor informational
logging buffered informational
logging history informational
logging asdm informational
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface outside
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-715-100.bin
no asdm history enable
arp timeout 14400
arp permit-nonconnected
nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.192_27 NETWORK_OBJ_192.168.1.192_27 no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static igolomska-network igolomska-network no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static mlhome-network mlhome-network no-proxy-arp route-lookup
nat (inside,inside) source dynamic NETWORK_OBJ_192.168.1.0_24 interface destination static CUE-network CUE-network
nat (inside,inside) source dynamic NETWORK_OBJ_192.168.1.0_24 interface destination static VOIP-network VOIP-network
nat (inside,outside) source static CUE-network CUE-network destination static NETWORK_OBJ_192.168.1.192_27 NETWORK_OBJ_192.168.1.192_27 no-proxy-arp route-lookup
nat (inside,outside) source static VOIP-network VOIP-network destination static NETWORK_OBJ_192.168.1.192_27 NETWORK_OBJ_192.168.1.192_27 no-proxy-arp route-lookup
object network obj_any
 nat (inside,outside) dynamic interface
object network IIS_https
 nat (inside,outside) static interface service tcp https https
object network RBSTORE
 nat (any,any) static B.B.B.C
object network IIS_smtp
 nat (any,outside) static interface service tcp smtp smtp
object network SQL_MateuszServer
 nat (any,outside) static interface service tcp 13000 13000
object network VirtualPC-rdp
 nat (inside,outside) static interface service tcp 3389 3389
object network KAM_PTZ_http
 nat (any,outside) static interface service tcp www 8011
object network KAM_HALA_PRZOD_http
 nat (any,outside) static interface service tcp www 8012
object network KAM_HALA_CNC_http
 nat (any,outside) static interface service tcp www 8013
object network vCMA_https
 nat (any,any) static B.B.B.B service tcp https https
object network AUTOSAT
 nat (any,outside) static interface service tcp 8112 8112
object network kamarcen1http
 nat (any,outside) static interface service tcp www 8016
object network kamarcen2http
 nat (any,outside) static interface service tcp www 8017
object network kamwaga2http
 nat (any,outside) static interface service tcp www 8015
object network kamwagahttp
 nat (any,outside) static interface service tcp www 8014
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 Z.Z.Z.Z 1
route inside 10.1.1.0 255.255.255.0 A.A.A.A 1
route inside 10.1.10.0 255.255.255.0 A.A.A.A 1
route inside 192.168.10.0 255.255.255.0 A.A.A.A 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server BETONOWA-DC protocol radius
aaa-server BETONOWA-DC (inside) host BETONOWA-DC
 key *****
 radius-common-pw *****
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
crypto map outside_map 1 match address outside_cryptomap_1
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 212.91.B.B
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
crypto map outside_map 1 set ikev2 pre-shared-key *****
crypto map outside_map 1 set security-association lifetime seconds 86400
crypto map outside_map 1 set security-association lifetime kilobytes unlimited
crypto map outside_map 2 match address outside_cryptomap_2
crypto map outside_map 2 set peer 84.10.A.A
crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 2 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 2 set ikev2 pre-shared-key *****
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpool policy
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 40
 authentication crack
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 50
 authentication rsa-sig
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 60
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 70
 authentication crack
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 80
 authentication rsa-sig
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 90
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 100
 authentication crack
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 110
 authentication rsa-sig
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 120
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside
threat-detection basic-threat
threat-detection scanning-threat shun duration 3600
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
dynamic-filter updater-client enable
dynamic-filter use-database
dynamic-filter enable interface outside
ntp server 192.168.1.10 source inside prefer
webvpn
 anyconnect-essentials
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
 dns-server value 192.168.1.10 8.8.8.8
 vpn-tunnel-protocol l2tp-ipsec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl
 default-domain value BETONOWA.local
group-policy GroupPolicy_212.91.Y.Y internal
group-policy GroupPolicy_212.91.Y.Y attributes
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 ikev2
group-policy GroupPolicy_84.10.X.X internal
group-policy GroupPolicy_84.10.X.X attributes
 vpn-tunnel-protocol ikev1 ikev2
username root password FYt1qT0x6RrulpSE encrypted
tunnel-group DefaultRAGroup general-attributes
 address-pool VPN_RA_POOL
 authentication-server-group BETONOWA-DC
 default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
 authentication ms-chap-v2
tunnel-group 212.91.Y.Y type ipsec-l2l
tunnel-group 212.91.Y.Y general-attributes
 default-group-policy GroupPolicy_212.91.Y.Y
tunnel-group 212.91.Y.Y ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 3
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
tunnel-group 84.10.X.X type ipsec-l2l
tunnel-group 84.10.X.X general-attributes
 default-group-policy GroupPolicy_84.10.X.X
tunnel-group 84.10.A.A ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect dns preset_dns_map dynamic-filter-snoop
  inspect icmp
policy-map type inspect esmtp tls-allow
 parameters
  no mask-banner
  allow-tls
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
hpm topN enable
Cryptochecksum:e67cf29f1b63c6d550ce9333fe3f30d5
: end
asdm image disk0:/asdm-715-100.bin
no asdm history enable

Answer 1

The solution was the following for one IP!
object network x.x.x.x                      (inside IP)
   host x.x.x.x                                  (inside IP)
   nat (inside,outside) static y.y.y.y     (remote IP)