Cisco ASA 9x - Syslog - VPN

Does anyone know which syslog events I should be alerting on to tell me when a site to site vpn goes down and when it comes online? Thank you.

Hi Mattesong , 
You can enable the following logs  for ipsec tunnels :
# logging class vpn ? 
configure mode commands/options:
  asdm      Set ASDM logging level
  buffered  Set buffer logging level
  console   Set console logging level
  history   Set SNMP logging level
  mail      Set mail logging level
  monitor   Set tty logging level
  trap      Set syslog server logging level
For IPSEC client the command is:
# logging class vpnc
Please rate helpful posts !
Hope it helps
-Randy - 

Similar Messages

  • Cisco ASA 5505 L2TP VPN cannot access internal network

    Hi,
    I'm trying to configure Cisco L2TP VPN to my office. After successful connection I cannot access to internal network.
    Can you jhelp me to find out the issue?
    I have Cisco ASA:
    inside network - 192.168.1.0
    VPN network - 192.168.168.0
    I have router 192.168.1.2 and I cannot ping or get access to this router.
    Here is my config:
    ASA Version 8.4(3)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 198.X.X.A 255.255.255.248
    ftp mode passive
    same-security-traffic permit intra-interface
    object network net-all
    subnet 0.0.0.0 0.0.0.0
    object network vpn_local
    subnet 192.168.168.0 255.255.255.0
    object network inside_nw
    subnet 192.168.1.0 255.255.255.0
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any log
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool sales_addresses 192.168.168.1-192.168.168.254
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic net-all interface
    nat (inside,outside) source static inside_nw inside_nw destination static vpn_local vpn_local
    nat (outside,inside) source static vpn_local vpn_local destination static inside_nw inside_nw route-lookup
    object network vpn_local
    nat (outside,outside) dynamic interface
    object network inside_nw
    nat (inside,outside) dynamic interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 198.X.X.B 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication enable console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set my-transform-set-ikev1 esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set my-transform-set-ikev1 mode transport
    crypto dynamic-map dyno 10 set ikev1 transform-set my-transform-set-ikev1
    crypto map vpn 20 ipsec-isakmp dynamic dyno
    crypto map vpn interface outside
    crypto isakmp nat-traversal 3600
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.5-192.168.1.132 inside
    dhcpd dns 75.75.75.75 76.76.76.76 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy sales_policy internal
    group-policy sales_policy attributes
    dns-server value 75.75.75.75 76.76.76.76
    vpn-tunnel-protocol l2tp-ipsec
    username ----------
    username ----------
    tunnel-group DefaultRAGroup general-attributes
    address-pool sales_addresses
    default-group-policy sales_policy
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:5d1fc9409c87ecdc1e06f06980de6c13
    : end
    Thanks for your help.

    You have to test it with "real" traffic to 192.168.1.2 and if you use ping, you have to add icmp-inspection:
    policy-map global_policy
      class inspection_default
        inspect icmp
    Don't stop after you've improved your network! Improve the world by lending money to the working poor:
    http://www.kiva.org/invitedby/karsteni

  • Cisco ASA 5505 SSL VPN

    Hi Everyone,
    In my study home lab, I wanted to configure a cisco ASA 5505 ( Base license) to allow SSL VPN. I follow carefully the configuration procedure as instructed on a short videos I downloaded on youtube.
    I configured my outside e0/0 with a valid static IP address, unfortunately the vpn connection is timeout on a remote ( different) internet connection. But if  I connect to my own internet line using a WIFI the VPN ( AnyConnect SSL VPN client ) connection is established.
    I need help to solve this mystery. Please find attached the ASA config: #show run
    I hope my explaination does make sense, if not accept my apology I am just new in cisco technology.
    Best regards,
    BEN

    If you can connect with your own internet line, then most probably it's not an issue with the ASA configuration.
    I would check how you are routing the ASA to the internet, and if there is any ACL that might be blocking inbound access to the ASA on the device in front of the ASA.

  • Cisco ASA 5505 as VPN client

    Hello all thanks for looking,
    I need to know how to setup my cisco asa 5505 as a vpn client to services like HMA or privateinternet and other paid VPN services. If someone else has already written a guide to this then that would be great. What I want to do is route all my secure traffice through the asa and have it go across the internet as encrypted VPN stuff and have my other stuff that does not need to be encrypted just go through to my other router. 
    Thanks in advance,

    If your remote end of the services in question support IPsec IKEv1 as the VPN type then, yes - the 5505 can be a client for that service. At that point it looks like a regular LAN-LAN VPN which is documented in many Cisco and 3rd party how-to documents.

  • Unable to ping device behind Cisco 3750 on the same inside VLAN via Cisco ASA 5505 Anyconnect VPN

    Hi Guys,
    I've been stuck with this for the last 2 days, and I thought to try and use Cisco's forum, I setup my home DC, and started having problems once I moved a Cisco 5505 behind a Cisco 1841 router (I wanted to eventually test DMVPN live on the internet,) I was no longer able to ping some devices, then as soon as I introduce a collapsed core/distribution switch, I'm also no longer able to ping the devices behind the Cisco 3750, I've attached a network diagram and the ASA running-config.
    Everything seem fine internally with the exception of an intermittent network connectivity with a Citrix NetScaler VPX running on a VMware ESXi.
    For some odd reason, I am able to ping the following, with no issues.
    Cisco 3750 SVI (192.168.1.3)
    CentOS web server (connected directly to the Cisco ASA 5505)
    I have checked and enable the following:
    Nat Exemption
    Sysopt connection permit-vpn
    ACL's
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    Added ICMP in the inspection policy
    Packet-capture - Only getting echo requests.
    Thanks in advance!

    Hi,
    I believe you have the problem with your no-nat configurations..... you to exempt NAT for the traffic from 172.16.10.0 (Anyconnect VPN pool) to 192.168.1.0/24 (Inside LAN) to make this work
    object network acvpnpool
    subnet <anyconnect VPN Subnet>
    object network insidelan
    subnet <inside lan subnet>
    nat (inside,outside) source static acvpnpool acvpnpool destination static insidelan insidelan
    Make sure that you are able to reach the GW/Inside ip adress of the firewall from LAN machine.... all routing in place properly..... Thanks!!!
    Regards
    Karthik

  • Cisco ASA 5505 Ipsec VPN and random connection dropping issues.

    Hello,
    We are currently having issues with a ASA 5505 Ipsec VPN. It was configured about 7-8 months ago and has been running very well..up until the last few weeks.  For some reason, the VPN tends to randomly disconnect any user clients connected a lot.  Furthermore, sometimes it actually connects; however does not put us on the local network for some reason and unable to browse file server.  We have tried rebooting the ASA a few times and our ISP Time Warner informed us there are no signs of packet loss but still unable to pinpoint the problem.  Sometimes users close out of VPN client completely, reopen several times and then it works.  However it's never really consistent enough and hasn't been the last few weeks.  No configuration changes have been made to ASA at all.  Furthermore, the Cisco Ipsec VPN client version is: 5.0.70
    Directly below is our current running config (modded for public).  Any help or ideas would be greatly appreciated.  Otherwise, if everything looks good...then I will defer back to our ISP Time Warner:
    : Saved
    ASA Version 8.4(2)
    hostname domainasa
    domain-name adomain.local
    enable password cTfsR84pqF5Xohw. encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 205.101.1.240 255.255.255.248
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 192.168.2.60
    domain-name adomain.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network SBS_2011
    host 192.168.2.60
    object network NETWORK_OBJ_192.168.2.0_24
    subnet 192.168.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.5.192_
    27
    subnet 192.168.5.192 255.255.255.224
    object network Https_Access
    host 192.168.2.90
    description Spam Hero
    object-group network DM_INLINE_NETWORK_1
    network-object object SPAM1
    network-object object SPAM2
    network-object object SPAM3
    network-object object SPAM4
    network-object object SPAM5
    network-object object SPAM6
    network-object object SPAM7
    network-object object SPAM8
    object-group service RDP tcp
    description Microsoft RDP
    port-object eq 3389
    access-list outside_access_in extended permit tcp object-group DM_INLINE_NETWORK_1 object SBS_2011 eq smtp
    access-list outside_access_in extended permit tcp any object SBS_2011 eq https
    access-list outside_access_in extended permit icmp any interface outside
    access-list outside_access_in remark External RDP Access
    access-list outside_access_in extended permit tcp any object SBS_2011 object-group RDP
    access-list domain_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool test 192.168.10.1-192.168.10.5 mask 255.255.255.0
    ip local pool VPN_Users 192.168.5.194-192.168.5.22
    0 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24
    NETWORK_OBJ_192.168.2.0_24
    destination static NETWORK_OBJ_192.168.5.192_
    27 NETWORK_OBJ_192.168.5.192_
    27 no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    object network SBS_2011
    nat (inside,outside) static interface service tcp smtp smtp
    object network Https_Access
    nat (inside,outside) static interface service tcp https https
    nat (inside,outside) after-auto source dynamic any interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 205.101.1.239 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-reco
    rd DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.2.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.2.160-192.168.2.19
    9 inside
    dhcpd dns 192.168.2.60 24.29.99.36 interface inside
    dhcpd wins 192.168.2.60 24.29.99.36 interface inside
    dhcpd domain adomain interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy domain internal
    group-policy domain attributes
    wins-server value 192.168.2.60
    dns-server value 192.168.2.60
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value adomain.local
    username ben password zWCAaitV3CB.GA87 encrypted privilege 0
    username ben attributes
    vpn-group-policy domain
    username sdomain password FATqd4I1ZoqyQ/MN encrypted
    username sdomain attributes
    vpn-group-policy domain
    username adomain password V5.hvhZU4S8NwGg/ encrypted
    username adomain attributes
    vpn-group-policy domain
    service-type admin
    username jdomain password uODal3Mlensb8d.t encrypted privilege 0
    username jdomain attributes
    vpn-group-policy domain
    service-type admin
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool VPN_Users
    default-group-policy domain
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:e2466a5b754
    eebcdb0cef
    f051bef91d
    9
    : end
    no asdm history enable
    Thanks again

    Hello Belnet,
    What do the logs show from the ASA.
    Can you post them ??
    Any other question..Sure..Just remember to rate all of the community answers.
    Julio

  • CIsco ASA 5505 and VPN licenses

    Hi,
    Cisco ASA 5505 comes with 10 VPN licenses in a standard configuration.
    How those licenses are counted? Will I need a license per one IPSec SA?
    If I have two site connected with LAN-to-LAN VPN with 10 subnets at one site, how many licenses will be taken? 10 - one per IPSec SA or just 1 - one per point-to-point VPN?
    Thank you.
    Regards,
    Alex

    Alex,
    In an ASA 5505, it should say something like this...when you do sh ver.
    VPN Peers : 25
    It means that you can have so many peers connecting to the ASA. Its not per IPSec SA.
    Its a per tunnel license.
    Rate this, if it helps!
    Gilbert

  • Trying to use DS 6.2 w/ Cisco ASA 5540 for VPN Auth

    Hello all,
    I'm trying to connect our Cisco ASA 5540 with LDAP authentication to our DSEE 6.2 directory. The authentication is failing and this line in the debug output from the firewall is really getting to me: "No results returned for iPlanet global password policy".
    Their authentication process is two-steps.. It binds with a service account, searches on the "naming attribute" (in our case uid), grabs the DN of the user, and unbinds. With step 2, it binds to the directory with the DN it found when searching, and the password the user supplied. If the second bind is successful, then the firewall lets them on the VPN.
    When the firewall binds with the service account, it successfully finds the user's DN and disconnects, so I know my ACI is working correctly there. It just seems to fail when trying to re-bind with the user's DN...
    We opened a TAC case with Cisco, and this is their response:
    The DN configured on the security appliance to access a Sun directory server must be able to access the default password policy on that server. We recommend using the directory administrator, or a user with directory administrator privileges, as the DN. Alternatively, you can place an ACI on the default password policy.
    I refuse to let a poorly written application or appliance bind as cn=Directory Administrator!
    I tried putting an ACI on the default password policy located at cn=Password Policy,cn=config , but that doesn't seem to make any difference to the ASA.. My best guess is that it's looking somewhere else for the password policy... did it used to be located elsewhere in iPlanet? Has anyone made this work before with a Cisco ASA?

    My network admin and I ended up solving this problem by sheer dumb luck. In the ASA config, you tell it what kind of LDAP server it's connecting to. In one set of docs, it had the available options as microsoft, sun, or generic. In another set of docs, we found that openldap was also an acceptable option.
    I'm guessing the ASA is thinking the "sun" option is connecting to the old Netscape Directory Server. Changing the "server type" to openldap made it work immediately. It also does not look like it's trying to look at the LDAP server's password policy now either.

  • Cisco asa 5585 syslog options for ips?

    We have CISCO ASA 5585 with a separate module for IPS, I want to know what are the options for configuring syslog? Its nearly impossible to find ; and there are some forums on the internet which says that cisco ips stores logs in native / proprietary format and cannot be exported.
    Please elaborate
    Thanks.

    Some sensor-related events generate syslog messages. Those will be forwarded according to the parent ASA syslog settings.
    Detailed IPS events (signature triggers actions etc.) are stored locally and must be retrieved using the SDEE protocol (tcp-based). That requires use of a management system like Cisco Security Manager (CSM), IPS Manager Express (IME) etc. There is a good document here that explains SDEE in more detail.

  • Cisco ASA 5505 - 1st VPN works, 2nd VPN can't get traffic across

    This is my first Cisco configuration ever so go easy on me.  A lot of the commands that I used here I don't really understand.  I got them from Googling configs.  I have the need for more than one VPN on this thing, and I've been fighting with this thing for hours today without any luck.
    The first VPN I setup, labeled vpn1 here works perfectly.  I connect via the public IP on the DSL and I can get traffic to my 192.168.1.0/24 network without any problems.
    I pretty much duplicated the configuration for the 2nd VPN, just replacing my 192.168.1.0/24 subnet w/ the network connected to a third interface on the ASA (10.4.0.0 255.255.240.0).  I successfully make connection to this VPN, but I cannot get traffic to traverse the VPN.  I'm using the address 10.4.0.1 to test pings.  The ASA itself can ping 10.4.0.1 as that interface of the ASA has 10.4.13.10 255.255.240.0, which is the same subnet (range is 10.4.0.0 - 10.4.15.255).
    Here is my config (edited for names and passwords)
    ciscoasa# show run
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password ********** encrypted
    passwd ********** encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group ISP_DSL
    ip address pppoe setroute
    interface Vlan3
    no forward interface Vlan1
    nameif private
    security-level 100
    ip address 10.4.13.10 255.255.240.0
    ftp mode passive
    access-list 100 extended permit icmp any any
    access-list nonat remark ACL for Nat Bypass
    access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list nonat extended permit ip 10.4.0.0 255.255.240.0 192.168.3.0 255.255.255.0
    access-list vpn_SplitTunnel remark ACL for VPN Split Tunnel
    access-list vpn_SplitTunnel standard permit 192.168.1.0 255.255.255.0
    access-list vpn_SplitTunnel standard permit 10.4.0.0 255.255.240.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1492
    mtu private 1500
    ip local pool vpn1pool 192.168.2.100-192.168.2.110
    ip local pool vpn2pool 192.168.3.100-192.168.3.110
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (private) 0 access-list nonat
    access-group 100 in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set strong-des esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map dynmap 30 set transform-set strong-des
    crypto map vpn1 65535 ipsec-isakmp dynamic dynmap
    crypto map vpn1 interface outside
    crypto map vpn2 65535 ipsec-isakmp dynamic dynmap
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 11
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 10
    console timeout 0
    vpdn group ISP_DSL request dialout pppoe
    vpdn group ISP_DSL localname [email protected]
    vpdn group ISP_DSL ppp authentication chap
    vpdn username [email protected] password **********
    dhcp-client update dns
    dhcpd auto_config outside
    dhcpd address 192.168.1.100-192.168.1.200 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy vpn2 internal
    group-policy vpn2 attributes
    vpn-idle-timeout 120
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_SplitTunnel
    group-policy vpn1 internal
    group-policy vpn1 attributes
    vpn-idle-timeout 120
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_SplitTunnel
    username cssadmin password ********** encrypted
    username vpn2user password ********** encrypted
    username vpn1user password ********** encrypted
    tunnel-group vpn1-VPN type remote-access
    tunnel-group vpn1-VPN general-attributes
    address-pool vpn1pool
    default-group-policy vpn1
    tunnel-group vpn1-VPN ipsec-attributes
    pre-shared-key **********
    tunnel-group vpn2-VPN type remote-access
    tunnel-group vpn2-VPN general-attributes
    address-pool vpn2pool
    default-group-policy vpn2
    tunnel-group vpn2-VPN ipsec-attributes
    pre-shared-key *****
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:f5137c68c4b4a832c9dff8db808004ae
    : end
    Theories:  after fighting with it for a while and having another guy in my office look at it, we decided that the problem is probably that even though the pings are probably reaching 10.4.0.1, they have no route back to my VPN subnet 192.168.3.0/24.  I contacted the admins of the 10.4.0.0 network and asked if they could add a route to 192.168.3.0/24 via 10.4.13.10, but he said there is no router of default gateway on the network to even configure.
    So, what do I do?  Maybe NAT the VPN traffic?  If that is the correct answer, what lines would I put/change in the config to NAT that traffic.
    I'm assuming the reason the 1st VPN works is because the ASA is the default gateway for the inside 192.168.1.0/24 network.
    Thanks in advance for any insight you can provide.

    Hello Belnet,
    What do the logs show from the ASA.
    Can you post them ??
    Any other question..Sure..Just remember to rate all of the community answers.
    Julio

  • Cisco ASA 5505 L2L VPN Tunnel with one Dynamic IP

    Hi Rizwan,
    Thanks for your response.  I updated the configuration per your response below... It still doesn't work.  please see my new config files below.  Please help.  Thanks in advance for your help....
    Hi Pinesh,
    Please make follow changes on host: officeasa
    remove this line below highlighted.
    crypto dynamic-map L2LMap 1 match address Crypto_L2L
    It is only because group1 is weak, so please change it to group2
    crypto dynamic-map L2LMap 1 set pfs group1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117
    Please make follow changes on host: homeasa
    It is only because group1 is weak, so please change it to group2
    crypto map L2Lmap 1 set pfs group1
    route outside 10.10.5.0 255.255.255.0 xxx.xxx.xxx.xxx default gateway on homeasa.
    Hope that helps, if not please open a new thread.
    Thanks
    Rizwan Rafeek
    New config files..
    Site-A:   (Office):
    Hostname: asaoffice
    Inside: 10.10.5.0/254
    Outside e0/0: Static IP 96.xxx.xxx.118/30
    Site-B:   (Home):
    Hostname: asahome
    Inside: 10.10.6.0/254
    Outside e0/0: Dynamic IP (DG: 66.xxx.xxx.1)
    SIte-A:
    officeasa(config)# sh config
    : Saved
    : Written by enable_15 at 15:34:23.899 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname officeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address 96.xxx.xxx.118 255.255.255.252
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.5.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 192.168.100.0 255.2
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255.255.2
    access-list ormtST standard permit 10.10.5.0 255.255.255.0
    access-list OCrypto_L2L extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool ormtIPP 192.168.100.100-192.168.100.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 96.xxx.xxx.117 1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.5.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set OSite2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map OL2LMap 1 set pfs
    crypto dynamic-map OL2LMap 1 set transform-set OSite2Site
    crypto dynamic-map OL2LMap 1 set reverse-route
    crypto map out_L2lMap 65535 ipsec-isakmp dynamic OL2LMap
    crypto map out_L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.5.101-10.10.5.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy ormtGP internal
    group-policy ormtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value ormtST
    address-pools value ormtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type remote-access
    tunnel-group ormtProfile type remote-access
    tunnel-group ormtProfile general-attributes
    default-group-policy ormtGP
    tunnel-group ormtProfile webvpn-attributes
    group-alias OFFICE enable
    tunnel-group defaultL2LGroup type ipsec-l2l
    tunnel-group defaultL2LGroup ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:46d5c2e1ac91d73293f2fb1a0045180c
    officeasa(config)#
    Site-B:
    Home ASA Configuration:
    homeasa# sh config
    : Saved
    : Written by enable_15 at 15:48:42.479 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname homeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.6.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 192.168.101.0 255.255.255.0
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    access-list hrmtST standard permit 10.10.6.0 255.255.255.0
    access-list Crypto_L2L extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool hrmtIPP 192.168.101.100-192.168.101.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 10.10.5.0 255.255.255.0 66.xxx.xxx.1 1   (IP address of the Dynamic IP from ISP)
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.6.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set Site2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map L2Lmap 1 match address Crypto_L2L
    crypto map L2Lmap 1 set peer 96.xxx.xxx.118
    crypto map L2Lmap 1 set transform-set Site2Site
    crypto map L2LMap 1 set pfs
    crypto map L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.6.101-10.10.6.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy hrmtGP internal
    group-policy hrmtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value hrmtST
    address-pools value hrmtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type admin
    tunnel-group hrmtProfile type remote-access
    tunnel-group hrmtProfile general-attributes
    default-group-policy hrmtGP
    tunnel-group hrmtProfile webvpn-attributes
    group-alias hrmtCGA enable
    tunnel-group 96.xxx.xxx.118 type ipsec-l2l
    tunnel-group 96.xxx.xxx.118 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:d16a0d49f275612dff7e404f49bcc499
    homeasa#

    Thanks Rizwan,
    Still no luck.  I can't even ping the otherside (office)..  I am not sure if i'm running the debug rightway.   Here are my results...
    homeasa(config)# ping inside 10.10.5.254............. (Office CIsco ASA5505 IP on local side.  I also tried pinging the server on other side (office) whic is @10.10.5.10 and got the same result)
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.5.254, timeout is 2 seconds:
    Success rate is 0
    homeasa(config)# debug crypto isakmp 7
    homeasa(config)# debug crypto ipsec 7
    homeasa(config)# sho crypto isakmp 7
                                       ^
    ERROR: % Invalid input detected at '^' marker.
    homeasa(config)# sho crypto isakmp
    There are no isakmp sas
    Global IKE Statistics
    Active Tunnels: 0
    Previous Tunnels: 0
    In Octets: 0
    In Packets: 0
    In Drop Packets: 0
    In Notifys: 0
    In P2 Exchanges: 0
    In P2 Exchange Invalids: 0
    In P2 Exchange Rejects: 0
    In P2 Sa Delete Requests: 0
    Out Octets: 0
    Out Packets: 0
    Out Drop Packets: 0
    Out Notifys: 0
    Out P2 Exchanges: 0
    Out P2 Exchange Invalids: 0
    Out P2 Exchange Rejects: 0
    Out P2 Sa Delete Requests: 0
    Initiator Tunnels: 0
    Initiator Fails: 0
    Responder Fails: 0
    System Capacity Fails: 0
    Auth Fails: 0
    Decrypt Fails: 0
    Hash Valid Fails: 0
    No Sa Fails: 0
    Global IPSec over TCP Statistics
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Inbound packets: 0
    Inbound dropped packets: 0
    Outbound packets: 0
    Outbound dropped packets: 0
    RST packets: 0
    Recevied ACK heart-beat packets: 0
    Bad headers: 0
    Bad trailers: 0
    Timer failures: 0
    Checksum errors: 0
    Internal errors: 0
    hjnavasa(config)# sh crypto ipsec sa peer 96.xxx.xxx.118
    There are no ipsec sas
    homeasa(config)#

  • What is the Cisco ASA 5520's VPN ustility like?

    Hi, I have a Cisco 3015 VPN concentrator, the Web admin tool is really good. We are getting a 2 Cisco 5520 soon in failover mode and I wondered if I should move my site-to-sites to the ASA 5520 and if so how good it the tool for the ASA VPN's as I not seen it yet?

    The VPN capabilities of the ASA are very similar to that of the concentrators. Much of the management interface will have the same look and feel on both appliances. Migrating your L2L VPNs is a matter of preference and will depend on your topology. For me, I prefer to terminate my L2L VPNs into a DMZ and use the ASA to permit/deny traffic into my LAN.

  • Cisco ASA 5520 SSL VPN Web Login Customization For RSA Login

    I have a Cisco 5520 that I have RSA radius with hardware token up and working witrhout issue. The RSA radius authentication works fine.
    My problem is that I want the login page of the WebVPN portal to display two fields for the user RSA passcode. An RSA passcode is the PIN and the current toke code together.
    I want one field to accept the PIN from the passcode and the other field to accept the TOKEN CODE from the RSA token.
    Currently the login page has in this order:
    USERNAME:
    PASSCODE:
    My end state would be:
    USERNAME:
    PIN:
    TOKENCODE:
    I know this has been done with the native Cisco IPSEC client but I cannot find a way to do this with the WebVPN login page. I have been thru the Customization page and can't seem to get this to work correctly.
    Thanks.

    Hello friend!
    Please allow me to resurect this old post. Did you have the solution?
    Regards!

  • Cisco ASA 5540 Syslog logging everything

    Hello. I am trying to log every connection (Build, deny, etc)
    But for some reason I don't see them sh log
    Any ideas?
    asa1# show run log
    logging enable
    logging timestamp
    logging emblem
    logging asdm-buffer-size 512
    logging console debugging
    logging monitor debugging
    logging buffered debugging
    logging trap debugging
    logging asdm debugging
    logging from-address ***********
    logging recipient-address ************* level errors
    logging recipient-address ********** level errors
    logging queue 0
    logging host LOG 192.168.168.2 format emblem
    logging debug-trace
    logging permit-hostdown

    Rahul; I fix the problem. I had every logging output enabled (logging console debugging,logging monitor debugging,logging buffered debugging) and the ASA was loosing the abilitity to log. I disable them and now everyhing is logged.
    Thanks

  • Cisco ASA 5510 site to site VPN only

    Hi,
    Need some expert help. I will be deploying the CISCO ASA 5510 in VPN site to site scenario only. One interface will be for the WAN and the other LAN interface is connected to another firewall appliance. The main purpose of the ASA is for branch site VPN connection only. My default gateway is pointing to the Internet router on my WAN inteface. Should NAT be enabled on my WAN inteface? The only expected traffic to go thru my ASA is VPN traffic to the other site. I have already defined static routes and have gone thru the wizard for site to site VPN and added my local and remote networks. Also how do I approach my access policies, the default deny any any is in place. Should I allow anything on it? The firewall connected to my LAN interface is expected to do the filtering, like I said the ASA's purpose is just to do VPN site to site. Thanks all

    Thanks Jon. That is what I want to clarify as well, running the VPN site to site wizard, will automatically create the 'cryptomap' access rules, will the existing deny all rule apply to the VPN traffic? I think there was an option that VPN traffic will bypass access rules.
    So having NAT enabled for anything that goes out on My WAN inteface would not matter at all, even if the VPN traffic will go out of that interface right? Hope I don't sound confusing.
    As per your second question, I know it sounds weird and is not good network design, but customer just renewed maintenance contract for the other firewall box that is why he does not want to get rid of it yet. Although ISA can perform the function as well. Thanks.

Maybe you are looking for