ASA5510 to

Greetings-
I'm having trouble connecting an ASA5510 to a sonicwall. 
The VPN session says it comes up, on both sides, but I'm not getting any traffic to / from either site.
So its maybe an access-list or a NAT issue.
What do you think?
What are the next questions/information needed?
Thanks-
Mark

Hi,
Check the VPNs packet counters and determine at what point traffic is not flowing correctly.
If the L2L VPN is up from some test that probably meant that one of the sites is configured correctly and sends traffic to the VPN but the other site might have incomplete configuration related to Access Rules or NAT configurations.
On an ASA you can use the following command to show the counters
show crypto ipsec sa peer
I have no idea about the Sonicwall as I dont use them.
- Jouni

Similar Messages

  • ASA5510 VPN not working after upgrade from 8.2 to 8.3

    Hi,
    I have recently upgraded a customer ASA5510 to version 8.3.
    After upgrade web access etc is working fine however VPN is down.
    The config looks very different after the upgrade plus what looks to be duplicate entries.
    I suspect its an access list issue but I'm not sure.
    If anyone has any ideas based on the config below it would be greatly appreciated as I'm at a loss....?!
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password NvZgxFP5WhDo0hQl encrypted
    passwd FNeDAwBbhVaOtVAu encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 217.75.8.203 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    management-only
    boot system disk0:/asa832-k8.bin
    ftp mode passive
    clock timezone GMT/IST 0
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup Inside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network obj-192.168.1.2-04
    host 192.168.1.2
    object network obj-192.168.1.7-04
    host 192.168.1.7
    object network obj-192.168.1.0-02
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.0-02
    subnet 192.168.2.0 255.255.255.0
    object network obj-10.1.2.0-02
    subnet 10.1.2.0 255.255.255.0
    object network obj-192.168.1.224-02
    subnet 192.168.1.224 255.255.255.240
    object network obj-192.168.1.9-02
    host 192.168.1.9
    object network obj-192.168.1.2-05
    host 192.168.1.2
    object network obj-192.168.1.103-02
    host 192.168.1.103
    object network obj-192.168.1.7-05
    host 192.168.1.7
    object network NETWORK_OBJ_10.1.2.0_24
    subnet 10.1.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group network obj-192.168.1.2-02
    object-group network obj-192.168.1.7-02
    object-group network obj-192.168.1.0-01
    object-group network obj-192.168.2.0-01
    object-group network obj-10.1.2.0-01
    object-group network obj-192.168.1.224-01
    object-group network obj-192.168.1.9-01
    object-group network obj-192.168.1.2-03
    object-group network obj-192.168.1.103-01
    object-group network obj-192.168.1.7-03
    object-group network obj-192.168.1.2
    object-group network obj-192.168.1.7
    object-group network obj-192.168.1.0
    object-group network obj-192.168.2.0
    object-group network obj-10.1.2.0
    object-group network obj-192.168.1.224
    object-group network obj-192.168.1.9
    object-group network obj-192.168.1.2-01
    object-group network obj-192.168.1.103
    object-group network obj-192.168.1.7-01
    object-group network obj_any
    object-group network obj-0.0.0.0
    object-group network obj_any-01
    object-group service MonitcomUDP udp
    port-object range 3924 3924
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip any 192.168.1.224 255.255.255.240
    access-list Outside_cryptomap_60 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_cryptomap_60 extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq smtp
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq pop3
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq 2000 inactive
    access-list Outside_access_in extended permit icmp any any
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in extended permit tcp any host 217.75.8.204 eq 1200
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in extended permit tcp host 87.232.117.66 host 217.75.8.205 eq 5900
    access-list Outside_access_in extended permit udp any host 217.75.8.205 eq 3924
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 220
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 230
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 240
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 250
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 260
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 1433
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in extended permit tcp any host 217.75.8.206 eq www
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq https
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq www
    access-list Outside_access_in extended permit udp any any eq 4500 inactive
    access-list Outside_access_in extended permit udp any any eq isakmp inactive
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Inside_access_in extended permit ip any any
    access-list Inside_access_in extended permit icmp any any
    access-list RemoteVPN_splitTunnelAcl standard permit any
    access-list Outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Outside_cryptomap_dyn_20 extended permit ip any 192.168.1.224 255.255.255.240
    pager lines 24
    logging enable
    logging asdm warnings
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool VPNPool 192.168.1.230-192.168.1.240 mask 255.255.255.0
    ip verify reverse-path interface Outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    icmp permit any Inside
    asdm location 192.168.1.208 255.255.255.252 Inside
    asdm location 192.168.1.103 255.255.255.255 Inside
    asdm location 192.168.1.6 255.255.255.255 Inside
    asdm location 192.168.1.7 255.255.255.255 Inside
    asdm location 192.168.1.9 255.255.255.255 Inside
    no asdm history enable
    arp timeout 14400
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-192.168.2.0-02 obj-192.168.2.0-02 unidirectional
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-10.1.2.0-02 obj-10.1.2.0-02 unidirectional
    nat (Inside,any) source static any any destination static obj-192.168.1.224-02 obj-192.168.1.224-02 unidirectional
    nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.1.2.0_24 NETWORK_OBJ_10.1.2.0_24
    object network obj-192.168.1.2-04
    nat (Outside,Inside) static 217.75.8.204
    object network obj-192.168.1.7-04
    nat (Outside,Inside) static 217.75.8.206
    object network obj-192.168.1.0-02
    nat (Inside,Outside) dynamic interface
    object network obj-192.168.1.9-02
    nat (Inside,Outside) static 217.75.8.201
    object network obj-192.168.1.2-05
    nat (Inside,Outside) static 217.75.8.204
    object network obj-192.168.1.103-02
    nat (Inside,Outside) static 217.75.8.205
    object network obj-192.168.1.7-05
    nat (Inside,Outside) static 217.75.8.206
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    route Outside 0.0.0.0 0.0.0.0 217.75.8.198 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server DellServerAAA protocol radius
    aaa-server DellServerAAA (Inside) host 192.168.1.4
    key test
    http server enable
    http 62.17.29.2 255.255.255.255 Outside
    http 82.141.224.155 255.255.255.255 Outside
    http 63.218.54.8 255.255.255.252 Outside
    http 213.79.44.213 255.255.255.255 Outside
    http 192.168.1.0 255.255.255.0 Inside
    http 10.1.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec df-bit clear-df Outside
    crypto ipsec df-bit clear-df Inside
    crypto dynamic-map Outside_dyn_map 20 match address Outside_cryptomap_dyn_20
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set peer 89.127.172.29
    crypto map Outside_map 1 set transform-set ESP-3DES-SHA
    crypto map Outside_map 60 match address Outside_cryptomap_60
    crypto map Outside_map 60 set peer 89.105.114.98
    crypto map Outside_map 60 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface Outside
    crypto isakmp identity key-id nattingreallymatters
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet 192.168.1.0 255.255.255.0 Inside
    telnet timeout 5
    ssh 82.141.224.155 255.255.255.255 Outside
    ssh 62.17.29.2 255.255.255.255 Outside
    ssh 213.79.44.213 255.255.255.255 Outside
    ssh 192.168.1.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy RemoteVPN internal
    group-policy RemoteVPN attributes
    wins-server value 192.168.1.31
    dns-server value 192.168.1.31
    default-domain value freefoam.ie
    username freefoam password JLYaVf7FqRM2LH0e encrypted
    username cork password qbK2Hqt1H5ttJzPD encrypted
    tunnel-group 193.114.70.130 type ipsec-l2l
    tunnel-group 193.114.70.130 ipsec-attributes
    pre-shared-key ******
    tunnel-group 89.127.172.29 type ipsec-l2l
    tunnel-group 89.127.172.29 ipsec-attributes
    pre-shared-key ******
    tunnel-group 89.105.114.98 type ipsec-l2l
    tunnel-group 89.105.114.98 ipsec-attributes
    pre-shared-key *****
    tunnel-group RemoteVPN type remote-access
    tunnel-group RemoteVPN general-attributes
    address-pool VPNPool
    authentication-server-group DellServerAAA
    default-group-policy RemoteVPN
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:0dc16fe893bd4bba6fdf6b7eed93e553

    Hi,
    Many thanks for your reply.
    Finally got access to implement your suggestions.
    Initially none of the VPN's were up.
    After making the change the two VPN's came up.
    However only data via the first VPN is possible.
    Accessing resources on the 10.1.2.0 network is still not possible.
    Attached is the latest config, any input is greatly appreciated;
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password NvZgxFP5WhDo0hQl encrypted
    passwd FNeDAwBbhVaOtVAu encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 217.75.8.203 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    management-only
    boot system disk0:/asa832-k8.bin
    ftp mode passive
    clock timezone GMT/IST 0
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup Inside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network obj-192.168.1.2-04
    host 192.168.1.2
    object network obj-192.168.1.7-04
    host 192.168.1.7
    object network obj-192.168.1.0-02
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.0-02
    subnet 192.168.2.0 255.255.255.0
    object network obj-10.1.2.0-02
    subnet 10.1.2.0 255.255.255.0
    object network obj-192.168.1.224-02
    subnet 192.168.1.224 255.255.255.240
    object network obj-192.168.1.9-02
    host 192.168.1.9
    object network obj-192.168.1.2-05
    host 192.168.1.2
    object network obj-192.168.1.103-02
    host 192.168.1.103
    object network obj-192.168.1.7-05
    host 192.168.1.7
    object network NETWORK_OBJ_10.1.2.0_24
    subnet 10.1.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group network obj-192.168.1.2-02
    object-group network obj-192.168.1.7-02
    object-group network obj-192.168.1.0-01
    object-group network obj-192.168.2.0-01
    object-group network obj-10.1.2.0-01
    object-group network obj-192.168.1.224-01
    object-group network obj-192.168.1.9-01
    object-group network obj-192.168.1.2-03
    object-group network obj-192.168.1.103-01
    object-group network obj-192.168.1.7-03
    object-group network obj-192.168.1.2
    object-group network obj-192.168.1.7
    object-group network obj-192.168.1.0
    object-group network obj-192.168.2.0
    object-group network obj-10.1.2.0
    object-group network obj-192.168.1.224
    object-group network obj-192.168.1.9
    object-group network obj-192.168.1.2-01
    object-group network obj-192.168.1.103
    object-group network obj-192.168.1.7-01
    object-group network obj_any
    object-group network obj-0.0.0.0
    object-group network obj_any-01
    object-group service MonitcomUDP udp
    port-object range 3924 3924
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip any 192.168.1.224 255.255.255.240
    access-list Outside_cryptomap_60 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_cryptomap_60 extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq smtp
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq pop3
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq 2000 inactive
    access-list Outside_access_in extended permit icmp any any
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in extended permit tcp any host 217.75.8.204 eq 1200
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in extended permit tcp host 87.232.117.66 host 217.75.8.205 eq 5900
    access-list Outside_access_in extended permit udp any host 217.75.8.205 eq 3924
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 220
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 230
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 240
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 250
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 260
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 1433
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in extended permit tcp any host 217.75.8.206 eq www
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq https
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq www
    access-list Outside_access_in extended permit udp any any eq 4500 inactive
    access-list Outside_access_in extended permit udp any any eq isakmp inactive
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Inside_access_in extended permit ip any any
    access-list Inside_access_in extended permit icmp any any
    access-list RemoteVPN_splitTunnelAcl standard permit any
    access-list Outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Outside_cryptomap_dyn_20 extended permit ip any 192.168.1.224 255.255.255.240
    access-list global_access extended permit ip any any
    access-list Outside_cryptomap_80_3 extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Split-tunnel standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm warnings
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool VPNPool 192.168.1.230-192.168.1.240 mask 255.255.255.0
    ip verify reverse-path interface Outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    icmp permit any Inside
    asdm image disk0:/asdm-647.bin
    asdm location 192.168.1.208 255.255.255.252 Inside
    asdm location 192.168.1.103 255.255.255.255 Inside
    asdm location 192.168.1.6 255.255.255.255 Inside
    asdm location 192.168.1.7 255.255.255.255 Inside
    asdm location 192.168.1.9 255.255.255.255 Inside
    no asdm history enable
    arp timeout 14400
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-192.168.2.0-02 obj-192.168.2.0-02
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-10.1.2.0-02 obj-10.1.2.0-02
    nat (Inside,any) source static any any destination static obj-192.168.1.224-02 obj-192.168.1.224-02 unidirectional
    nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.1.2.0_24 NETWORK_OBJ_10.1.2.0_24
    object network obj-192.168.1.2-04
    nat (Outside,Inside) static 217.75.8.204
    object network obj-192.168.1.7-04
    nat (Outside,Inside) static 217.75.8.206
    object network obj-192.168.1.0-02
    nat (Inside,Outside) dynamic interface
    object network obj-192.168.1.9-02
    nat (Inside,Outside) static 217.75.8.201
    object network obj-192.168.1.2-05
    nat (Inside,Outside) static 217.75.8.204
    object network obj-192.168.1.103-02
    nat (Inside,Outside) static 217.75.8.205
    object network obj-192.168.1.7-05
    nat (Inside,Outside) static 217.75.8.206
    nat (Inside,Outside) after-auto source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    access-group global_access global
    route Outside 0.0.0.0 0.0.0.0 217.75.8.198 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server DellServerAAA protocol radius
    aaa-server DellServerAAA (Inside) host 192.168.1.4
    key test
    http server enable
    http 62.17.29.2 255.255.255.255 Outside
    http 82.141.224.155 255.255.255.255 Outside
    http 63.218.54.8 255.255.255.252 Outside
    http 213.79.44.213 255.255.255.255 Outside
    http 192.168.1.0 255.255.255.0 Inside
    http 10.1.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec df-bit clear-df Outside
    crypto ipsec df-bit clear-df Inside
    crypto dynamic-map Outside_dyn_map 20 match address Outside_cryptomap_dyn_20
    crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set peer 89.127.172.29
    crypto map Outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-DES-SHA ESP-3DES-MD5 ESP-AES-256-MD5 ESP-3DES-SHA ESP-DES-MD5
    crypto map Outside_map 60 match address Outside_cryptomap_60
    crypto map Outside_map 60 set peer 89.105.114.98
    crypto map Outside_map 60 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface Outside
    crypto isakmp identity key-id nattingreallymatters
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash md5
    group 5
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet 192.168.1.0 255.255.255.0 Inside
    telnet timeout 5
    ssh 82.141.224.155 255.255.255.255 Outside
    ssh 62.17.29.2 255.255.255.255 Outside
    ssh 213.79.44.213 255.255.255.255 Outside
    ssh 192.168.1.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable Outside
    anyconnect-essentials
    svc image disk0:/anyconnect-dart-win-2.5.3055-k9.pkg 1
    svc image disk0:/anyconnect-macosx-powerpc-2.5.3055-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy RemoteVPN internal
    group-policy RemoteVPN attributes
    wins-server value 192.168.1.31
    dns-server value 192.168.1.31
    vpn-tunnel-protocol IPSec svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Split-tunnel
    default-domain value freefoam.ie
    username freefoam password JLYaVf7FqRM2LH0e encrypted
    username cisco password DfO7NBd5PZ1b0kZ1 encrypted privilege 15
    username cork password qbK2Hqt1H5ttJzPD encrypted
    tunnel-group 193.114.70.130 type ipsec-l2l
    tunnel-group 193.114.70.130 ipsec-attributes
    pre-shared-key ************
    tunnel-group 89.127.172.29 type ipsec-l2l
    tunnel-group 89.127.172.29 ipsec-attributes
    pre-shared-key ************
    tunnel-group 89.105.114.98 type ipsec-l2l
    tunnel-group 89.105.114.98 ipsec-attributes
    pre-shared-key ************
    tunnel-group RemoteVPN type remote-access
    tunnel-group RemoteVPN general-attributes
    address-pool VPNPool
    authentication-server-group DellServerAAA
    default-group-policy RemoteVPN
    tunnel-group RemoteVPN webvpn-attributes
    group-alias Anyconnect enable
    tunnel-group RemoteVPN ipsec-attributes
    pre-shared-key c0nnect10nParameter$
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:fae6b7bc25fcf39daffbcdc6b91c9d8e

  • Routing issue ASA5510 and CCME

    Hello community. 
    I have issues with ccme voice vlan, it is invisible(i cant ping 192.168.2.1) from root ASA. 
    So i have 192.168.0.1 as data vlan (1) and 192.168.2.1 as voice vlan , voice vlan used on root switch and connected to ASA but voice vlan invisible from asa5510. 
    on ccme it looks like:
    interface GigabitEthernet0/2.1
     encapsulation dot1Q 1
     ip address 192.168.0.1 255.255.255.0
    interface GigabitEthernet0/2.2
     description Voice
     encapsulation dot1Q 2
     ip address 192.168.2.1 255.255.255.0
    everything else working  fine.

    There is not enough information here for us to be able to identify the problem. At minimum you need to post the relevant parts of the ASA config and to provide information about the connection between ccme and ASA. 
    HTH
    Rick

  • Help open port on ASA5510 (version 8.3)

    Hi all,
    I configured ASA to open port 21, 3389, 5900 (outside access in) but when i check port just success : 21 and 3389, Error: 5900
    If i configured with only one port 5900 or 3389, is't ok, i don't undesrtand what 's the problem?
    ASA5510>       
    ASA5510> ena           
    Password: ***********************                                
    ASA5510# show run                
    : Saved      
    ASA Version 8.3(1)                 
    hostname ASA5510               
    domain-name lohoi.local                      
    enable password *********************** encrypted                                         
    passwd *********************** encrypted                                
    names    
    interface Ethernet0/0                    
    description Connect_to_Modem                            
    nameif outside              
    security-level 0                
    ip address 10.0.0.2 255.255.255.0                                 
    interface Ethernet0/1                    
    description Connect_to_Router2911                                 
    nameif inside             
    security-level 100                  
    ip address 172.16.17.2 255.255.255.240                                      
    interface Ethernet0/2                    
    shutdown        
    no na   
    no security-level                 
    no ip address             
    interface Ethernet0/3                    
    shutdown        
    no nameif         
    no security-level                 
    no ip address             
    interface Management0/0                      
    description Management                      
    nameif management                 
    security-level 100                  
    ip address 192.168.1.1 255.255.255.0                                    
    ftp mode passive               
    clock timezone ICT 7                   
    dns server-group DefaultDNS                          
    domain-name lohoi.local                       
    object network obj-any                     
    subnet 0.0.0.0 0.0.0.0                      
    object network ftpserver                       
    host 192.168.88.90                  
    description FTP server                      
    object network Remote_Desktop                       
    host 192.168.100.29                   
    object network VNC                 
    host 192.168.100.4                  
    access-list 101 extended permit icmp any any                                           
    access-list 101 extended permit icmp any any echo-reply                                                      
    access-list 101 extended permit tcp any any                                          
    access-list outside_access_in extended permit tcp any object ftpserver eq ftp                                                                            
    access-list outside_in extended permit tcp any host 192.168.100.29                                                                 
    access-list outside_in extended permit tcp any host 192.168.100.4                                                                
    pager lines 24             
    mtu outside 1500               
    mtu inside 1500              
    mtu management 1500                  
    icmp unreachable rate-limit 1 burst                                
    asdm image disk0:/asdm-631.bin                             
    asdm history enable                  
    arp timeout 14400                
    object network obj-any                     
    nat (inside,outside) dynamic interface                                      
    object network ftpserver                       
    nat (inside,outside) static interface service tcp ftp ftp                                                         
    object network Remote_Desktop                            
    nat (inside,outside) static interface service tcp 3389 3389                                                           
    object network VNC                 
    nat (inside,outside) static interface service tcp 5900 5900                                                           
    access-group outside_in in interface outside                                           
    route outside 0.0.0.0 0.0.0.0 10.0.0.1 1                                       
    route inside 192.168.88.64 255.255.255.224 1                                          
    route inside 192.168.100.0 255.255.255.0 172.16.17.1 1                                                     
    timeout xlate 3:00:00                    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02                                                                
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00                                                                             
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00                                                                              
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute                                                           
    timeout tcp-proxy-reassembly 0:01:00                                   
    dynamic-access-policy-record DfltAccessPolicy                                            
    aaa authentication ssh console LOCAL                                   
    http server enable                 
    http 192.168.1.0 255.255.255.0 management                                        
    http authentication-certificate inside                                     
    http authentication-certificate management                                         
    no snmp-server location                      
    no snmp-server contact                     
    snmp-server enable traps snmp authentication linkup linkdown coldstart                                                                     
    crypto ipsec security-association lifetime seconds 28800                                                       
    crypto ipsec security-association lifetime kilobytes 4608000                                                           
    telnet timeout 5               
    ssh 192.168.100.0 255.255.255.0 inside                                     
    ssh timeout 5            
    console timeout 0                
    threat-detection basic-threat                            
    threat-detection statistics access-list                                      
    no threat-detection statistics tcp-intercept                                           
    webvpn     
    username admin password *********************** encrypted privilege 15                                                              
    class-map inspection_default                           
    match default-inspection-traffic                                
    policy-map type inspect dns preset_dns_map                                         
    parameters          
      message-length maximum client auto                                   
      message-length maximum 512                           
    policy-map global_policy                       
    class inspection_default                        
      inspect dns preset_dns_map                           
      inspect ftp            
      inspect h323 h225                  
      inspect h323 ras                 
      inspect rsh            
      inspect rtsp             
      inspect esmtp              
      inspect sqlnet               
      inspect skinny               
      inspect sunrpc               
      inspect xdmcp              
      inspect sip            
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD
    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:667cb3ec729681c78ccab9a57abd89df
    : end
    ASA5510#

    ASA5510# show run                
    : Saved      
    ASA Version 8.3(1)                 
    hostname ASA5510               
    domain-name lohoi.local                      
    enable password ****************** encrypted                                         
    passwd ****************** encrypted                                
    names    
    interface Ethernet0/0                    
    description Connect_to_Modem                            
    nameif outside              
    security-level 0                
    ip address 10.0.0.2 255.255.255.0                                 
    interface Ethernet0/1                    
    description Connect_to_Router2911                                 
    nameif inside             
    security-level 100                  
    ip address 172.16.17.2 255.255.255.240                                      
    interface Ethernet0/2                    
    shutdown        
    no nameif         
    no security-level                 
    no ip address             
    interface Ethernet0/3                    
    shutdown        
    no nameif         
    no security-level                 
    no ip address             
    interface Management0/0                      
    description Management                      
    nameif management                 
    security-level 100                  
    ip address 192.168.1.1 255.255.255.0                                    
    ftp mode passive               
    clock timezone ICT 7                   
    dns server-group DefaultDNS                          
    domain-name lohoi.local                       
    object network obj-any                     
    subnet 0.0.0.0 0.0.0.0                      
    object network ftpserver                       
    host 192.168.88.90                  
    description FTP server                      
    object network remote_desktop                            
    host 192.168.100.2                  
    object network remote_vnc                        
    host 192.168.100.4                  
    access-list 101 extended permit icmp any any                                           
    access-list 101 extended permit icmp any any echo-reply                                                      
    access-list 101 extended permit tcp any any                                          
    access-list outside_access_in extended permit tcp any object ftpserver eq ftp                                                                            
    access-list outside_access_in extended permit tcp any host 192.168.100.4 eq 5900                                                                               
    access-list outside_access_in extended permit tcp any host 192.168.100.2 eq 3389                                                                               
    pager lines 24             
    mtu outside 1500               
    mtu inside 1500              
    mtu management 1500                  
    icmp unreachable rate-limit 1 burst-size 1                                         
    asdm image disk0:/asd                  
    asdm history enable                  
    arp timeout 14400                
    object network obj-any                     
    nat (inside,outside) dynamic interface                                      
    object network ftpserver                       
    nat (inside,outside) static interface service tcp ftp ftp                                                         
    object network remote_desktop                            
    nat (inside,outside) static interface service tcp 3389 3389                                                           
    object network remote_vnc                        
    nat (inside,outside) static interface service tcp 5900 5900                                                           
    access-group outside_access_in in interface outside                                                  
    route outside 0.0.0.0 0.0.0.0 10.0.0.1 1                                       
    route inside 192.168.88.64 255.255.255.224 172.16.17.1 1                                                       
    route inside 192.168.100.0 255.255.255.0 172.16.17.1 1                                                     
    timeout xlate 3:00:00                    
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02                                                                
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00                                                                             
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00                                                                              
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute                                                           
    timeout tcp-proxy-reassembly 0:01:00                                   
    dynamic-access-policy-record DfltAccessPolicy                                            
    aaa authentication ssh console LOCAL                                   
    http server enable                 
    http 192.168.1.0 255.255.255.0 management                                        
    http authentication-certificate inside                                     
    http authentication-certificate management                                         
    no snmp-server location                      
    no snmp-server contact                     
    snmp-server enable traps snmp authentication linkup linkdown coldstart                                                                     
    crypto ipsec security-association lifetime seconds 28800                                                       
    crypto ipsec security-association lifetime kilobytes 4608000                                                           
    telnet timeout 5               
    ssh 192.168.100.0 255.255.255.0 inside                                     
    ssh timeout 5            
    console timeout 0                
    threat-detection basic-threat                            
    threat-detection statistics access-list                                      
    no threat-detection statistics tcp-intercept                                           
    webvpn     
    username admin password ****************** encrypted privilege 15                                                              
    class-map inspection_default                           
    match default-inspection-traffic                                
    policy-map type inspect dns preset_dns_map                                         
    parameters          
      message-length maximum client auto                                   
      message-length maximum 512                           
    policy-map global_policy                       
    class inspection_default                        
      inspect dns preset_dns_map                           
      inspect ftp            
      inspect h323 h225                  
      inspect h323 ras                 
      inspect rsh            
      inspect rtsp             
      inspect esmtp              
      inspect sqlnet               
      inspect skinny               
      inspect sunrpc               
      inspect xdmcp              
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD
    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4f061a213185354518601f754e41494c
    : end
    ASA5510#
    So i configured again, but i'm not to access to 5900 port

  • Need help in configuring Client to Site IPSec VPN with Hairpinning on Cisco ASA5510 8.2(1)

    Need urgent help in configuring Client to Site IPSec VPN with Hairpinning on Cisco ASA5510 - 8.2(1).
    The following is the Layout:
    There are two Leased Lines for Internet access - 1.1.1.1 & 2.2.2.2, the latter being the Standard Default route, the former one is for backup.
    I have been able to configure  Client to Site IPSec VPN
    1) With access from Outside to only the Internal Network (172.16.0.0/24) behind the asa
    2) With Split tunnel with simultaneous assess to internal LAN and Outside Internet.
    But I have not been able to make tradiotional Hairpinng model work in this scenario.
    I followed every possible sugestions made in this regard in many Discussion Topics but still no luck. Can someone please help me out here???
    Following is the Running-Conf with Normal Client to Site IPSec VPN configured with No internat Access:
    LIMITATION: Can't Boot into any other ios image for some unavoidable reason, must use 8.2(1)
    running-conf  --- Working  normal Client to Site VPN without internet access/split tunnel
    ASA Version 8.2(1)
    hostname ciscoasa
    domain-name cisco.campus.com
    enable password xxxxxxxxxxxxxx encrypted
    passwd xxxxxxxxxxxxxx encrypted
    names
    interface GigabitEthernet0/0
    nameif internet1-outside
    security-level 0
    ip address 1.1.1.1 255.255.255.240
    interface GigabitEthernet0/1
    nameif internet2-outside
    security-level 0
    ip address 2.2.2.2 255.255.255.224
    interface GigabitEthernet0/2
    nameif dmz-interface
    security-level 0
    ip address 10.0.1.1 255.255.255.0
    interface GigabitEthernet0/3
    nameif campus-lan
    security-level 0
    ip address 172.16.0.1 255.255.0.0
    interface Management0/0
    nameif CSC-MGMT
    security-level 100
    ip address 10.0.0.4 255.255.255.0
    boot system disk0:/asa821-k8.bin
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name cisco.campus.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network cmps-lan
    object-group network csc-ip
    object-group network www-inside
    object-group network www-outside
    object-group service tcp-80
    object-group service udp-53
    object-group service https
    object-group service pop3
    object-group service smtp
    object-group service tcp80
    object-group service http-s
    object-group service pop3-110
    object-group service smtp25
    object-group service udp53
    object-group service ssh
    object-group service tcp-port
    object-group service udp-port
    object-group service ftp
    object-group service ftp-data
    object-group network csc1-ip
    object-group service all-tcp-udp
    access-list INTERNET1-IN extended permit ip host 1.2.2.2 host 2.2.2.3
    access-list CSC-OUT extended permit ip host 10.0.0.5 any
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq www
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq https
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq ssh
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq ftp
    access-list CAMPUS-LAN extended permit udp 172.16.0.0 255.255.0.0 any eq domain
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq smtp
    access-list CAMPUS-LAN extended permit tcp 172.16.0.0 255.255.0.0 any eq pop3
    access-list CAMPUS-LAN extended permit ip any any
    access-list csc-acl remark scan web and mail traffic
    access-list csc-acl extended permit tcp any any eq smtp
    access-list csc-acl extended permit tcp any any eq pop3
    access-list csc-acl remark scan web and mail traffic
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq 993
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq imap4
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq 465
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq www
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq https
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq smtp
    access-list INTERNET2-IN extended permit tcp any host 1.1.1.2 eq pop3
    access-list INTERNET2-IN extended permit ip any host 1.1.1.2
    access-list nonat extended permit ip 172.16.0.0 255.255.0.0 172.16.0.0 255.255.0.0
    access-list DNS-inspect extended permit tcp any any eq domain
    access-list DNS-inspect extended permit udp any any eq domain
    access-list capin extended permit ip host 172.16.1.234 any
    access-list capin extended permit ip host 172.16.1.52 any
    access-list capin extended permit ip any host 172.16.1.52
    access-list capin extended permit ip host 172.16.0.82 host 172.16.0.61
    access-list capin extended permit ip host 172.16.0.61 host 172.16.0.82
    access-list capout extended permit ip host 2.2.2.2 any
    access-list capout extended permit ip any host 2.2.2.2
    access-list campus-lan_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 192.168.150.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    mtu internet1-outside 1500
    mtu internet2-outside 1500
    mtu dmz-interface 1500
    mtu campus-lan 1500
    mtu CSC-MGMT 1500
    ip local pool vpnpool1 192.168.150.2-192.168.150.250 mask 255.255.255.0
    ip verify reverse-path interface internet2-outside
    ip verify reverse-path interface dmz-interface
    ip verify reverse-path interface campus-lan
    ip verify reverse-path interface CSC-MGMT
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-621.bin
    no asdm history enable
    arp timeout 14400
    global (internet1-outside) 1 interface
    global (internet2-outside) 1 interface
    nat (campus-lan) 0 access-list campus-lan_nat0_outbound
    nat (campus-lan) 1 0.0.0.0 0.0.0.0
    nat (CSC-MGMT) 1 10.0.0.5 255.255.255.255
    static (CSC-MGMT,internet2-outside) 2.2.2.3 10.0.0.5 netmask 255.255.255.255
    access-group INTERNET2-IN in interface internet1-outside
    access-group INTERNET1-IN in interface internet2-outside
    access-group CAMPUS-LAN in interface campus-lan
    access-group CSC-OUT in interface CSC-MGMT
    route internet2-outside 0.0.0.0 0.0.0.0 2.2.2.5 1
    route internet1-outside 0.0.0.0 0.0.0.0 1.1.1.5 2
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    http server enable
    http 10.0.0.2 255.255.255.255 CSC-MGMT
    http 10.0.0.8 255.255.255.255 CSC-MGMT
    http 1.2.2.2 255.255.255.255 internet2-outside
    http 1.2.2.2 255.255.255.255 internet1-outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map internet2-outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map internet2-outside_map interface internet2-outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca xyzxyzxyzyxzxyzxyzxyzxxyzyxzyxzy
            a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as a67a897as
        a67a897as a67a897as a67a897as a67a897as a67a897as
      quit
    crypto isakmp enable internet2-outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes
    hash md5
    group 2
    lifetime 86400
    telnet 10.0.0.2 255.255.255.255 CSC-MGMT
    telnet 10.0.0.8 255.255.255.255 CSC-MGMT
    telnet timeout 5
    ssh 1.2.3.3 255.255.255.240 internet1-outside
    ssh 1.2.2.2 255.255.255.255 internet1-outside
    ssh 1.2.2.2 255.255.255.255 internet2-outside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy VPN_TG_1 internal
    group-policy VPN_TG_1 attributes
    vpn-tunnel-protocol IPSec
    username ssochelpdesk password xxxxxxxxxxxxxx encrypted privilege 15
    username administrator password xxxxxxxxxxxxxx encrypted privilege 15
    username vpnuser1 password xxxxxxxxxxxxxx encrypted privilege 0
    username vpnuser1 attributes
    vpn-group-policy VPN_TG_1
    tunnel-group VPN_TG_1 type remote-access
    tunnel-group VPN_TG_1 general-attributes
    address-pool vpnpool1
    default-group-policy VPN_TG_1
    tunnel-group VPN_TG_1 ipsec-attributes
    pre-shared-key *
    class-map cmap-DNS
    match access-list DNS-inspect
    class-map csc-class
    match access-list csc-acl
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class csc-class
      csc fail-open
    class cmap-DNS
      inspect dns preset_dns_map
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum: y0y0y0y0y0y0y0y0y0y0y0y0y0y
    : end
    Neither Adding dynamic NAT for 192.168.150.0/24 on outside interface works, nor does the sysopt connection permit-vpn works
    Please tell what needs to be done here, to hairpin all the traffic to internet comming from VPN Clients.
    That is I need clients conected via VPN tunnel, when connected to internet, should have their IP's NAT'ted  against the internet2-outside interface address 2.2.2.2, as it happens for the Campus Clients (172.16.0.0/16)
    I'm not much conversant with everything involved in here, therefore please be elaborative in your replies. Please let me know if you need any more information regarding this setup to answer my query.
    Thanks & Regards
    maxs

    Hi Jouni,
    Thanks again for your help, got it working. Actually the problem was ASA needed some time after configuring to work properly ( ?????? ). I configured and tested several times within a short period, during the day and was not working initially, GUI packet tracer was showing some problems (IPSEC Spoof detected) and also there was this left out dns. Its working fine now.
    But my problem is not solved fully here.
    Does hairpinning model allow access to the campus LAN behind ASA also?. Coz the setup is working now as i needed, and I can access Internet with the NAT'ed ip address (outside-interface). So far so good. But now I cannot access the Campus LAN behind the asa.
    Here the packet tracer output for the traffic:
    packet-tracer output
    asa# packet-tracer input internet2-outside tcp 192.168.150.1 56482 172.16.1.249 22
    Phase: 1
    Type: ACCESS-LIST
    Subtype:
    Result: ALLOW
    Config:
    Implicit Rule
    Additional Information:
    MAC Access list
    Phase: 2
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 3
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   172.16.0.0      255.255.0.0     campus-lan
    Phase: 4
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.150.1   255.255.255.255 internet2-outside
    Phase: 5
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group internnet1-in in interface internet2-outside
    access-list internnet1-in extended permit ip 192.168.150.0 255.255.255.0 any
    Additional Information:
    Phase: 6
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 7
    Type: CP-PUNT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 8
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 9
    Type: NAT-EXEMPT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 10
    Type: NAT
    Subtype:     
    Result: DROP
    Config:
    nat (internet2-outside) 1 192.168.150.0 255.255.255.0
      match ip internet2-outside 192.168.150.0 255.255.255.0 campus-lan any
        dynamic translation to pool 1 (No matching global)
        translate_hits = 14, untranslate_hits = 0
    Additional Information:
    Result:
    input-interface: internet2-outside
    input-status: up
    input-line-status: up
    output-interface: internet2-outside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    The problem here as you can see is the Rule for dynamic nat that I added to make hairpin work at first place
    dynamic nat
    asa(config)#nat (internet2-outside) 1 192.168.150.0 255.255.255.0
    Is it possible to access both
    1)LAN behind ASA
    2)INTERNET via HAIRPINNING  
    simultaneously via a single tunnel-group?
    If it can be done, how do I do it. What changes do I need to make here to get simultaneous access to my LAN also?
    Thanks & Regards
    Abhijit

  • Problems to reach ASA5510 via IE on Windows Vista

    Dear all,
    since some days we have a ASA5510, we connected it on a Windows Vista Laptop via ethernet cable (using at the back of the router the mgtm slot) and connect it on the network slot on the laptop.
    Laptop is getting IP addresses automatically.
    Now we tried to reach the router in the Internet Explorer using: http://192.168.1.1, but we could not reach this site.
    When I try to ping the router via cmd and typing ping 192.168.1.1 I get answers.
    For us it is very important to change the IP address of the router, as he will be used in a network with 10.xxx.xxx.xx addresses.
    I have no idea, what I did wrong here
    Would be nice, if someone has an idea.
    Just to let you know, I'm not that Network specialist, all I know comes from learning by doing. So sorry in advance for any stupid question I may have.
    Thanks for your patience.

    Great, this worked!
    I have now changed the IP address into one of the address ranges I need and waiting now that the step of communicating the new configuration to the rotuer will be finished.
    Let's cross the fingers, that it will work successfully.
    Edit 1 11:07 - Is it normal that it take that long to send the new IP address configuration to the Router?      
    Edit 2 14:54 - It is now accessable on the new IP range. Now having another issue for which I will create a new discussion.      
    Message was edited by: Simone Schultz

  • ASA5510-SEC with CSC-SSM and Plus lic

    I have setup the ASA5510-SEC with the CSC-SSM and it is working great.  What I need is to be able to provide, for the client, reports of how much time particular users spend on the Internet, where they go on the Internet etc.  Do I need more product to do this reporting?  Would also like to have email reports
    Thanks,

    I would recommend posting in netpro for this.  This community doesn't work with the ASA series.
    www.cisco.com/go/netpro

  • ASA5510 , how can i create natpolicy for two DSL connections

    How can tell me how to configure our ASA to nat our to internetconnections, at the moment the first work fine,
    ISP1                        NAT
                            ASA5510      LAN
    ISP2                         NAT
    Regards

    Looks like you are trying to loadbalance the outbound traffic, if that's the case i would say true Load balancing is not possible on ASA, however below are the possible workaround options.
      1st  Option
    You can configure Dual ISP setup on the firewall which will provide redundancy among ISP, means if 1st ISP goes down the ASA will start routing traffic from the secondary ISP, below is the link for configuring the same.
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
    2nd Option
    Lets take an example
    ASA----- ISP1 (1.1.1.2)
       |---------ISP2 (2.2.2.2)
    We  can force the traffic for the destination ports to be routed through secondary ISP, keeping both the ISP passing traffic at the same time.
    Following are the commands which will achieve it-
    route ISP1 0 0 1.1.1.2 //Default route pointing to ISP1
    route ISP2 0 0 2.2.2.2 2 //Default route with Metric 2 via ISP2
    static (ISP2,inside) tcp 0.0.0.0 80 0.0.0.0 80
    static (ISP2,inside) tcp 0.0.0.0 443 0.0.0.0 443
    sysopt noproxyarp inside
    nat (inside) 1 0 0
    global (ISP1) 1 interface
    global (ISP2) 1 interface
    Thats it !! Now all the traffic destined to any address on port 80/443 will be forcibly put on ISP2 interface and routed from there.
    Note: This stuff requires that we KNOW what the destination ports are, if there is some traffic which uses dynamic ports, like voice traffic we will have to route it via ISP1 and cannot make it route via ISP2.
    3Rd  Option
    ASA is not a  Load-balancer and if you want to do load balancing between ISPs  we cannot *truly* achieve this, but we may configure ASA in such a manner that traffic for some destination IP address is routed via ISP1 and some is routed via ISP2. Following would be configuration commands in this scenario-
    nat (inside) 1 0 0
    global (ISP1) 1 interface
    global (ISP2) 1 interface
    route ISP1 128.0.0.0 128.0.0.0 1.1.1.2
    route ISP2 0.0.0.0 128.0.0.0 2.2.2.2
    The first creates a default route that routes addresses with the first bit of 1 to 1.1.1.2 of ISP1.
    The second creates a default route that routes addresses with the first bit of 0 to 2.2.2.2 of ISP2.
    Note: This will do traffic routing based on *Destination* IP addresses and NOT based on traffic load. As I mentioned, ASA is NOT a LB.
    Please mark this as answered if your query is resolved.
    Faisal

  • How to validate SSL cert on ASA5510, before changing DNS?

    I have recently installed an SSL certificate from a third party CA (GoDaddy) into an ASA5510 that I will be using as a VPN appliance for AnyConnect clients.
    The ASA is going to replace our VPN server, which currently has the vpn.domain.com FDQN assigned to its IP address in public DNS.  
    Is there a way for me to properly valiadate that the SSL cert will work without any issues (i.e. no invalid error messages popping up on users' AnyConnect clients) from the Internet, before I cut over public DNS to point to the public facing interface on the ASA5510 which is where vpn.company.com will ultimately be pointing to?

    Put vpn.domain.com in your local PC hosts file with the new IP. Then try Anyconnect.

  • ASA5510 sla monitor does not fail back

    I've been down this path before and never got a resolution to this issue.
    ASA5510 Security Plus
    Primary ISP conn is Comcast cable
    Secondary ISP conn is fract T1
    I duplicated the SLA code from http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
    When I pull the conn from primary ISP the default route to the secondary comes up
    When I reconnect the primary the default route to the secondary does not go away.
    I must either reload the ASA or remove/readd the two default outside routes.
    Anyone have this same experience and could lend a hand?
    Are there any commands I might have in my config that break SLA?
    If so I would have hoped either the Configuration Guide or Command Reference for 8.2 would say so, but I don't see any mentioned.
    I'm working remotely with my customer so I can't play with this except on off-hours.
    ASA running 8.2(2) so as to use AnyConnect Essentials.
    Thx,
    Phil

    Pls. read and try the workaround.
    CSCtc16148    SLA monitor fails to fail back when ip verify reverse is applied
    Symptom:
    Route Tracking may fail to fail back to the primary link/route when restored.
    Conditions:
    SLA monitor must configured along with ip verify reverse path on the tracked interface.
    Workaround:
    1. Remove ip verify reverse path off of the tracked interface
    or
    2. add a static route to the SLA target out the primary tracked interface.
    [Wrap text]  [Edit this enclosure]
    Release-note: Added 09/23/2009 20:28:24 by kusankar
    [Unwrap text]  [Edit this enclosure]
    Release-note: Added 09/23/2009 20:28:24 by kusankar
    [Uwrap text]  [Edit this enclosure]
    fixed-in-broadview-8.3.1.1_interim-by-cl104097: Added 03/23/2010 11:54:08 by perforce
    fixed-in-broadview-8.3.1.1_interim-by-cl104097: Added 03/23/2010 11:54:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-broadview-8.3.1.1_interim-by-cl104097&ext=&type=FILE
    fixed-in-broadview-8.3.1.1_interim-by-cl104097: Added 03/23/2010 11:54:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-broadview-8.3.1.1_interim-by-cl104097: Added 03/23/2010 11:54:08 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-broadview-8.3.1.1_interim-by-cl104097: Added 03/23/2010 11:54:08 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-broadview-8.3.1_fcs_throttle-by-cl103850: Added 03/22/2010 15:48:05 by perforce
    fixed-in-broadview-8.3.1_fcs_throttle-by-cl103850: Added 03/22/2010 15:48:05 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-broadview-8.3.1_fcs_throttle-by-cl103850&ext=&type=FILE
    fixed-in-broadview-8.3.1_fcs_throttle-by-cl103850: Added 03/22/2010 15:48:05 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-broadview-8.3.1_fcs_throttle-by-cl103850: Added 03/22/2010 15:48:05 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-broadview-8.3.1_fcs_throttle-by-cl103850: Added 03/22/2010 15:48:05 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-broadview-bennu-by-cl101314: Added 02/18/2010 19:06:08 by perforce
    fixed-in-broadview-bennu-by-cl101314: Added 02/18/2010 19:06:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-broadview-bennu-by-cl101314&ext=&type=FILE
    fixed-in-broadview-bennu-by-cl101314: Added 02/18/2010 19:06:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-broadview-bennu-by-cl101314: Added 02/18/2010 19:06:08 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-broadview-bennu-by-cl101314: Added 02/18/2010 19:06:08 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-broadview-idfw-by-cl101317: Added 02/18/2010 19:09:07 by perforce
    fixed-in-broadview-idfw-by-cl101317: Added 02/18/2010 19:09:07 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-broadview-idfw-by-cl101317&ext=&type=FILE
    fixed-in-broadview-idfw-by-cl101317: Added 02/18/2010 19:09:07 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-broadview-idfw-by-cl101317: Added 02/18/2010 19:09:07 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-broadview-idfw-by-cl101317: Added 02/18/2010 19:09:07 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-broadview-logging-ng-by-cl101311: Added 02/18/2010 19:03:08 by perforce
    fixed-in-broadview-logging-ng-by-cl101311: Added 02/18/2010 19:03:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-broadview-logging-ng-by-cl101311&ext=&type=FILE
    fixed-in-broadview-logging-ng-by-cl101311: Added 02/18/2010 19:03:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-broadview-logging-ng-by-cl101311: Added 02/18/2010 19:03:08 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-broadview-logging-ng-by-cl101311: Added 02/18/2010 19:03:08 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-broadview-main-by-cl101300: Added 02/18/2010 18:27:07 by perforce
    fixed-in-broadview-main-by-cl101300: Added 02/18/2010 18:27:07 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-broadview-main-by-cl101300&ext=&type=FILE
    fixed-in-broadview-main-by-cl101300: Added 02/18/2010 18:27:07 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-broadview-main-by-cl101300: Added 02/18/2010 18:27:07 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-broadview-main-by-cl101300: Added 02/18/2010 18:27:07 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-sedona-64bit-by-cl101362: Added 02/19/2010 04:52:24 by perforce
    fixed-in-sedona-64bit-by-cl101362: Added 02/19/2010 04:52:24 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-sedona-64bit-by-cl101362&ext=&type=FILE
    fixed-in-sedona-64bit-by-cl101362: Added 02/19/2010 04:52:24 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-sedona-64bit-by-cl101362: Added 02/19/2010 04:52:24 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-sedona-64bit-by-cl101362: Added 02/19/2010 04:52:24 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-sedona-bv64-by-cl101426: Added 02/19/2010 11:42:41 by perforce
    fixed-in-sedona-bv64-by-cl101426: Added 02/19/2010 11:42:41 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-sedona-bv64-by-cl101426&ext=&type=FILE
    fixed-in-sedona-bv64-by-cl101426: Added 02/19/2010 11:42:41 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-sedona-bv64-by-cl101426: Added 02/19/2010 11:42:41 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-sedona-bv64-by-cl101426: Added 02/19/2010 11:42:41 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-sedona-main-by-cl101297: Added 02/18/2010 18:24:15 by perforce
    fixed-in-sedona-main-by-cl101297: Added 02/18/2010 18:24:15 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-sedona-main-by-cl101297&ext=&type=FILE
    fixed-in-sedona-main-by-cl101297: Added 02/18/2010 18:24:15 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-sedona-main-by-cl101297: Added 02/18/2010 18:24:15 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-sedona-main-by-cl101297: Added 02/18/2010 18:24:15 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-titan-8.2.2_fcs_throttle-by-cl101307: Added 02/18/2010 18:57:08 by perforce
    fixed-in-titan-8.2.2_fcs_throttle-by-cl101307: Added 02/18/2010 18:57:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-titan-8.2.2_fcs_throttle-by-cl101307&ext=&type=FILE
    fixed-in-titan-8.2.2_fcs_throttle-by-cl101307: Added 02/18/2010 18:57:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-titan-8.2.2_fcs_throttle-by-cl101307: Added 02/18/2010 18:57:08 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-titan-8.2.2_fcs_throttle-by-cl101307: Added 02/18/2010 18:57:08 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-titan-bennu-by-cl101294: Added 02/18/2010 18:24:08 by perforce
    fixed-in-titan-bennu-by-cl101294: Added 02/18/2010 18:24:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-titan-bennu-by-cl101294&ext=&type=FILE
    fixed-in-titan-bennu-by-cl101294: Added 02/18/2010 18:24:08 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-titan-bennu-by-cl101294: Added 02/18/2010 18:24:08 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-titan-bennu-by-cl101294: Added 02/18/2010 18:24:08 by perforce
    [Uwrap text]  [Edit this enclosure]
    fixed-in-titan-main-by-cl101282: Added 02/18/2010 16:48:04 by perforce
    fixed-in-titan-main-by-cl101282: Added 02/18/2010 16:48:04 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=fixed-in-titan-main-by-cl101282&ext=&type=FILE
    fixed-in-titan-main-by-cl101282: Added 02/18/2010 16:48:04 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    fixed-in-titan-main-by-cl101282: Added 02/18/2010 16:48:04 by perforce
    [Wrap Text]  [Edit this enclosure]
    fixed-in-titan-main-by-cl101282: Added 02/18/2010 16:48:04 by perforce
    [Uwrap text]  [Edit this enclosure]
    sla-mon-sh-tech: Added 09/23/2009 20:43:52 by kusankar
    sla-mon-sh-tech: Added 09/23/2009 20:43:52 by kusankarCan not view this .log file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=sla-mon-sh-tech&ext=log&type=FILE
    sla-mon-sh-tech: Added 09/23/2009 20:43:52 by kusankarCan not view this .log file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    sla-mon-sh-tech: Added 09/23/2009 20:43:52 by kusankar
    [Wrap Text]  [Edit this enclosure]
    sla-mon-sh-tech: Added 09/23/2009 20:43:52 by kusankar
    [Uwrap text]  [Edit this enclosure]
    static-analysis-titan-main: Added 02/18/2010 16:48:07 by perforce
    static-analysis-titan-main: Added 02/18/2010 16:48:07 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://cdetsweb-prd.cisco.com/apps/dumpcr_att?identifier=CSCtc16148&title=static-analysis-titan-main&ext=&type=FILE
    static-analysis-titan-main: Added 02/18/2010 16:48:07 by perforceCan not view this . file attachment inline, please click on the following link to view the attachment.
    http://
    [UnWrap text]  [Edit this enclosure]
    static-analysis-titan-main: Added 02/18/2010 16:48:07 by perforce
    [Wrap Text]  [Edit this enclosure]
    static-analysis-titan-main: Added 02/18/2010 16:48:07 by perforce
    -KS

  • SMARTnet 8x5xNBD part number for ASA5510-SEC-BUN-K9

    Dears,
    I am trying to find the part number for the Cisco SMARTnet Maintenance 8x5xNBD for the Cisco   ASA5510-SEC-BUN-K9.
    I browse cisco website, tried dynamic config tool, forums etc but no luck.
    1: Please let me know the part number for it.
    2: Which tool can be used to find smartnet or other Maintenance details/partnumbers
    3: Is there any specific tool other then Dynamic Config to generate BOM
    BR,
    ABDUL MAJID KHAN

    Yes there is. You can use Cisco Commerce Workspace which is a classical tool from Cisco. Cisco Commerce workspace provides one integrated commerce experience that allows cisco partners to register deals, configure and price products, software and related services, and submit orders from a single Workspace.

  • Using ASA5510 AIP-SSM in IDS mode

    Hi,
    I' ve a Cisco ASA5510 with  AIP-SSM and I wold like to use it like a one-armed IDS for connect them to a span port of a switch in my network,
    without the traffic passing through the Firewall.
    I've try to configure it and connect the interface inside (fast0/1) to the span port, I create the policy for permit  all the traffic to the  Sensor but it doesn't work, no packet recived on sensor.
    somebody can help me?
    thanks

    Unfortunately you can't use the AIP-SSM in an ASA with a spanning switch like you could with the 4200 series appliances.
    The reason is that the ASA was built to be a firewall, and no matter how much of that functionality you turn off, it still needs to see TCP and UDP conversations flowing thru the ASA in order to pass that traffic to the AIP-SSM sensor (I tired very hard to see if I could get around this limitation, but you can't).
    The best you can hope to do is put the ASA in-line (I know this reduces reliability) and turn off as much of the firewall configs you can. Then you can promisciously monitor the traffic passing thru teh ASA with teh AIP-SSM.
    It's not ideal, but it's the cheapest IPS sensor in Cisco's line up right now.
    - Bob

  • ASA5510 Clientless VPN SSO RDWEB OWA CIFS

    Hi!
    I´m trying to use single sign on in clientless vpn portal. I have my bookmarks in place (rdweb/web servers and cifs share). I would like to just enter user/pass just one time (at the portal loginpage of asa5510). I use radius for my auth (radius auth running on a win2008r2 with nap policy). 
    I have seen on other posts that i should put &csco_sso=1parameter after the url string in bookmark settings but that doesnt work. I also tried the post settings CSCO_WEBVPN_USERNAME & CSCO_WEBVPN_PASSWORD
    Do i need to specify single signon server in Group policy i use for clientless vpn? In that case what should i specify?
    Servername: Just any name or the fqdn?
    Authentication type: I dont have any siteminder solution in place so my options are SAML POST
    Settings
    Assertion URL: ?
    Issuer: ?
    Cert:
    Do i need to set up a ADFS 2.0 role on my network to use SSO server feature at the asa5510?
    Regards,
    Fredrik

    A couple of updates:
    3. I added our nbns server to the Cisco config, and now clicking the Browse entire network button shows me the domain.  However, when I click on the domain, it says "Failed to retrieve servers".  A had a support tech look at this, and he said the config all looks fine, and he found a few other instances of this for other users.  He's investigating and will get back to me.
    4. This looks like it's possible through content-rewrite rules (http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/vpn_clientless_ssl.html#wp2389515)  
    "By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the ASA. The ASA therefore lets you create rewrite rules that let users browse certain sites and applications without going through the ASA. This is similar to split-tunneling in an IPSec VPN connection."
    Whether this will work in combination with SSO is the question, but I'll play around and see what I find.  :-)

  • ASA5510 - Accessing Anyconnect via other local Interface

    Hello - I hope someone can help.
    I have a scenario where there is an ASA5510 configured as follows:
    Interface0 = Outside
    Interface1 = LAN
    Interface2 = DMZ
    Interface3 = unused
    Running ASA version 8.2[1]
    All network operations are fine, as are the IPSEC tunnels to other branch offices, and the incoming SSL VPN accessed via the IP address assigned to the external adapter.
    My problem is that I have a device on the DMZ that needs to access the AnyConnect service hosted on the external adapter so that it can access LAN resources.  When I try accessing it, I see the following errors appearing in the debug log:
    3
    Dec 03 2012
    12:10:50
    710003
    [DMZ client address]
    51031
    [AnyConnect ExternalAddress]
    443
    TCP access denied by ACL from [DMZ client address]/51031 to DMZ:[AnyConnect ExternalAddress]/443
    If you look closely, it suggests an ACL issue from the DMZ client to the external AnyConnect IP address BUT it suggests the Anyconnect IP address is on the DMZ interface.
    Has anyone seen this before? 
    Thanks in advance for any help.

    In this scenario, you will have to enable Anyconnect on the DMZ interface for letting DMZ users to establish an Anyconnect tunnel and allow access of LAN resources since from DMZ or any other LAN interface you cannot directly VPN on External interface.
    For reference, check https://supportforums.cisco.com/message/3801168#3801168 as similar discussion has happened in it as well.
    Regards,
    Anuj

  • Alternative to PBR on ASA5510

    We have an ASA5510 with a backup ISP connection protecting our corporate network.  I also have a mail server and I would like to route SMTP traffic over the backup network.  I realize that the ASA5510 does not support PBR, but I also know that I can use static NAT rules as a workaround to direct specific types of traffic over a particular interface (e.g. "static (outside,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0" and "static (backup,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0").
    My question is, is it possible to use something similar to force a particular host to use a specific interface? I have tried to make this work on my own without success.  Is it even possible?

    Hi Jonathan,
    If i understand correctly, you require that a particular host, use the backup ISP instead of the main one, while going out to the internet.
    I don't think this would be possible, since the internal flow goes like this:
    X: address in local LAN
    Y: some address on the internet
    Outside: Interface connected to main internet
    Backup: Interface connected to backup internet
    static (inside,Backup) X  OR nat (inside) and global(Backup) has been configured on ASA
    Packet with source X and destination Y reaches inside interface of ASA
    ASA does a route lookup for Y and sees that the main ISP default route has the least metric
    Thus it decides that egress interface should be Outside.
    So now, when looking for a NAT entry, it looks for a static(inside,Outside) or a matching global(Outside) and not for the static (inside,backup) or global (Backup) which we configured for it.
    Thus its not possible to do a source based routing using static NAT. Destination based yes (as described in the smtp/www example in your post). Unfortunately not source based.
    Hope this helps.
    -Shrikant
    P.S.: Please mark the question as resolved if it has been answered. Do rate helpful posts. Thanks

Maybe you are looking for