CISCO ASA Commands - No Object Resolution

How can I dump the configuration on a Cisco ASA where it does not resolve defined objects in the configuration?
For example: show route produces an output with object name instead of network address

Hi,
If I understood you correctly then your problem is that instead of IP addresses you are seein names/text in the configurations?
If this is true then I think your problem is probably because of the "name" configurations
You can use the following command to view the current configurations
show run names
If you want to disable the name/IP pairing from showing on the configuration you can use the following command
no names
It should not remove any of the "name" configurations but rather disables them from being used/viewed in the configuration. You can re-enable it with  the command "names"
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni

Similar Messages

  • Can't save Cisco ASA configuration in GNS3 via write memory command

    Hi all,
    I’m having a problem to save Cisco ASA configuration in GNS3 via write memory command.
       ciscoasa(config)# wr mem
       Building configuration…
       Cryptochecksum: c066a7ab b5b9071e bb5ee1f6 2d93be53
       %Error copying system:/running-config (Not enough space on device)
       Error executing command
       [FAILED]
       ciscoasa(config)#
    Here are the details of the lab setup.
    PC DETAILS:
       Windows 7 Enterprise SP1 64bit
       GNS3 v0.8.6 all-in-one (installer for 32-bit and 64-bit which includes Dynamips, Qemu/Pemu, Putty, VPCS, WinPCAP and Wireshark)
    ASA DETAILS:
       13,279,888 asa802-k8.bin.unpacked.initrd
       1,095,856 asa802-k8.bin.unpacked.vmlinuz
    Please advise. Thanks in advance.
    http://firewallengineer.wordpress.com/2014/02/19/problem-cisco-asa-in-gns3-error-copying-systemrunning-config-not-enough-space-on-device/

    instead of this:
    To create a flash file
    cd "C:\Program Files\GNS3\qemu-2.1.0"
    qemu-img.exe create c:\FLASH 256M
    try this:
    To create a flash file
    cd "C:\Program Files\GNS3\qemu-2.1.0"
    qemu-img.exe create c:\User\usuario\GNS3\FLASH 256M
    Let me know if is helpfull.

  • Command to View LDAP Password on Cisco ASA 5520

    Hello
    I am migrating from a Cisco ASA 5520 (ASA version 8.4(6)5 to a Cisco ASA 5585. We have LDAP issues logging into to our vpn client software. I assume the LDAP password may be incorrectly entered on the new 5585. No service password- encryption or more running:config won't show the encrypted LDAP password. What is the command to view that?
    Thanks!
    Matt

    Thankyou Jennifer for the responds.
    Could you please help me on how to enable "memberOf" attribute on AD to be pushed to ASA for the OU matching.
    i have already set the "Remote Dialin" property of user account name "testvendor" in AD as "Allow Access" .It can be shown in the debug output as below.
    [454095] sAMAccountName: value = testvendor
    [454095] sAMAccountType: value = 805306368
    [454095] userPrincipalName: value = [email protected]
    [454095] objectCategory: value = CN=Person,CN=Schema,CN=Configuration,DC=abc,DC=local
    [454095] msNPAllowDialin: value = TRUE
    [454095] dSCorePropagationData: value = 20111026081253.0Z
    [454095] dSCorePropagationData: value = 20111026080938.0Z
    [454095] dSCorePropagationData: value = 16010101000417.0Z
    Is their any other settings that i need to do it on AD ?
    Kindly advice
    Regards
    Shiji

  • Cisco ASA disable command line interface (CLI) vor VPN Remote Access users

    Hi,
    I have local database for a couple of VPN Remote Access users on our Cisco ASA 5510 firewall. When adding users i asigned them the privilege leve 0. Is it possible to completly disable CLI for theses users as they will only be using VPN Remote Access and do not need to access the appliance cli.
    Thanks in advance.
    Kind Regards,
    Marco

    Hi,
    We will need to use the vpn-filter or the ssh command to block ssh from the vpn pool.
    Regards,
    Vivek

  • Interactive Commands in NetConfig for Cisco ASA

    Hi,
    Maybe anyone knows, does CiscoWorks LMS supports this feature for Cisco ASA or I'm doing something wrong? I've sent interactive command "copy tftp: flash: <R>ip_address<R>asa841-k8.bin<R><R>"  to my ASA using netconfig tool and recived error "Command(s) failed on the device Insufficient no. of interactive responses(or timeout) for command: copy tftp: flash: ." For Cisco Catalyst it works fine. I have a last version of CiscoWorks 4.0.1.

    No, SWIM doesn't support ASDM upgrades, but what you're doing here is a system software upgrade.  What you might try doing is to increase the telnet timeout for this device.  Unfortunately, that feature is hidden in LMS 4.0, but see this document on how to do that:
    https://supportforums.cisco.com/docs/DOC-15162
    The document talks about inventory collection, but the interface to adjust the telnet timeout is in the same location as the SNMP timeout.  You'll want to time the transfer to know how long to make the timeout.

  • Cisco ASA sla and track commands

    Cisco ASA 5520's running 8.2.5 and using sla and track commands
    Am I right in thinking that sla and track can be used for any pair of routes using diverse routes between 2 locations, these commands are NOT just restricted to being sued for a default route?
    Example: I have 2 MPLS carriers between the 2 sites, the networks advertised by the MPLS carriers would be idnetical
    e.g.Site A has
    route outside 172.16.0.0 255.255.0.0 2.2.2.2 1 track 1
    route outside 172.16.0.0 255.255.0.0 3.3.3.3 128
    There would of course be the track 1 rtr...command and some corresponding sla commands

    Matthew
    Am I right in thinking that sla and track can be used for any pair of routes
    As far as I know, yes, they don't need to be default routes, it's just that they usually are.
    I would have thought if both routes are pointing via the outside interface though the next hop IPs would be in the same subnet ?
    Jon

  • DNS Resolution in Cisco ASA 5525

    Hey all,
    I will begin by telling you what my end goal is, I am trying to block specific websites on our cisco ASA 5525 using FDQN. I know that this functionality for DNS resolution was not implemented until a specific version.
    Current Version: Cisco ASA 5525
    ASA Version: 8.6(1)
    I can ping external addresses from the ASA however I cannot ping hostnames like "ping google.ca" does not work.
    What I've done.
    dns domain-lookup inside
    dns domain-lookup outside
    name-server x.x.x.x (Primary internal dns server)
    name-server x.x.x.x (Secondary internal dns server)
    name-server 8.8.8.8 (Google external dns server)
    name-server 8.8.4.4 (Google external dns server)
    domain-name example.com
    With this config I can, however, ping hostnames of internal servers.
    This is an example of me pinging an external hostname.
    ciscoasa# ping google.ca
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 2607:f8b0:4009:803::101f, timeout is 2 seconds:
    No route to host 2607:f8b0:4009:803::101f
    Success rate is 0 percent (0/1)
    Any ideas?
    Thanks!

    officeasa# ping www.google.com
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 2607:f8b0:4009:802::1012, timeout is 2 seconds:
    No route to host 2607:f8b0:4009:802::1012
    Success rate is 0 percent (0/1)
    John, due to the sensitive nature displayed within show route output, is there any other information I can tell you, what exactly did you need to see from this information?
    (I know without certain information you cannot help but I need to ensure security on my end)
    Thanks for understanding.

  • Cisco ASA 5505 Site to Site VPN

    Hello All,
    First time posting to the forums. I've been working with Cisco ASA 5505 for a number of months and recently I purchased a 2nd ASA with the goal of setting up Site to Site VPN tunnel. It look so simple from the number of videos that I have watched on the internet. But when I have done it suprise suprise it didn't work for me ... I have deleted the tunnels a number of times and attempted to recreate them. I am using the VPN wizard in the ADM to create the tunnel. Both the asa are 5505 and have the same same firmware etc.
    I would appreciate any help that can be directed towards this issue please.  Slowly losing my mind
    Please see details below:
    Both ADM are 7.1
    IOS
    ASA 1
    aved
    ASA Version 9.0(1)
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address 92.51.193.158 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network CIX_Subnet
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network NETWORK_OBJ_84.39.233.50
    host 84.39.233.50
    object network NETWORK_OBJ_92.51.193.158
    host 92.51.193.158
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address
    [email protected]
    logging recipient-address
    [email protected]
    level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    http 192.168.40.0 255.255.255.0 wireless
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 84.39.233.50
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 192.168.10.0 255.255.255.0 inside
    ssh 192.168.40.0 255.255.255.0 wireless
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password uYePLcrFadO9pBZx encrypted
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1
    ASA 2
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address 84.39.233.50 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network Eiresoft
    host 146.66.160.70
    description DBA Contractor
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_3
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_7
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in remark Access for Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark This is allowing access from Eiresoft to the OLTP Failover server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 192.168.10.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 92.51.193.156 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 92.51.193.158
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 92.51.193.156 255.255.255.252 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
    : end

    Hi,
    Thanks for the help to date
    I now have the Site to Site working but there is one little issue I have. If I try to RD to a server through the tunnel it will not allow connection on the first attempt however if I ping that host and then attempt to RD it will allow the connection. It looks like the host is asleep until it receives traffic through the tunnel. Is this thje correct behaviour.
    See below the details:
    ASA1:
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address XX.XX.XX.XX 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    description Wireless network
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    service-object object SQL_Server
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address [email protected]
    logging recipient-address [email protected] level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (wireless,outside) source static Wireless Wireless destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Servers Servers destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer XX.XX.XX.XX
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map servers_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map servers_map interface servers
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable inside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    crypto ikev1 enable servers
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.10.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username niamh password MlFlIlEiy8vismE0 encrypted
    username niamh attributes
    service-type admin
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password yQeVtvLLKqapoUje encrypted privilege 0
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:83fa7ce1d93375645205f6e79b526381
    ASA2:
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address X.X.X.X 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock timezone GMT 0
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network LAN
    subnet 192.168.100.0 255.255.255.0
    object network REMOTE-LAN
    subnet 192.168.10.0 255.255.255.0
    object network TargetMC
    host 83.71.194.145
    description This is Target Location that will be accessing the Webserver
    object network Rackspace_OLTP
    host 162.13.34.56
    description This is the IP address of production OLTP
    object service DB
    service tcp destination eq 5022
    object network Topaz_Target_VM
    host 82.198.151.168
    description This is Topaz IP that will be accessing Targets VM
    object service DB_2
    service tcp destination eq 5023
    object network EireSoft_NEW_IP
    host 146.66.161.3
    description Eiresoft latest IP form ISP DHCP
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    service-object icmp echo
    service-object icmp echo-reply
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object tcp destination eq www
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_12
    service-object object MSQL
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    service-object object DB_2
    object-group service DM_INLINE_SERVICE_13
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_14
    service-object object MSQL
    service-object object RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_access_in remark Access rules from Traget to CIX for testing
    access-list outside_access_in extended permit tcp object TargetMC object TMC_Webserver eq www
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_12 object Rackspace_OLTP object OLTP_Failover
    access-list outside_access_in remark Topaz access to Target VM
    access-list outside_access_in extended permit tcp object Topaz_Target_VM object TMC_Webserver eq www
    access-list outside_access_in remark Opened up for Target for the weekend. Closing on Monday 20th
    access-list outside_access_in extended permit tcp any object TMC_Webserver eq www
    access-list outside_access_in remark Access for Eiresoft after their ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_13 object EireSoft_NEW_IP object Development_OLTP
    access-list outside_access_in remark Eiresoft Access after ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_14 object EireSoft_NEW_IP object OLTP_Failover
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 object-group Payback_Intrernal
    pager lines 24
    logging enable
    logging console debugging
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static Payback_Intrernal Payback_Intrernal no-proxy-arp route-lookup
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source dynamic LAN interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http X.X.X.X 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer X.X.X.X
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh X.X.X.X  255.255.255.240 outside
    ssh X.X.X.X 255.255.255.252 outside
    ssh 192.168.40.0 255.255.255.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:78a7b9ccec2fa048306092eb29a2b769

  • I need helping!!! configuring RDP access to my local server from a remote location on my Cisco ASA 5505 Firewall.

    I need helping configuring RDP access to my local server from a remote location on my Cisco ASA 5505 Firewall.
    I have attempted to configure rdp access but it does not seem to be working for me Could I please ask someone to help me modify my current configuration to allow this? Please do step by step as I could use all the help I could get.
    I need to allow the following IP addresses to have RDP access to my server:
    66.237.238.193-66.237.238.222
    69.195.249.177-69.195.249.190
    69.65.80.240-69.65.80.249
    My external WAN server info is - 99.89.69.333
    The internal IP address of my server is - 192.168.6.2
    The other server shows up as 99.89.69.334 but is working fine.
    I already added one server for Static route and RDP but when I try to put in same commands it doesnt allow me to for this new one. Please take a look at my configuration file and give me the commands i need in order to put this through. Also please tell me if there are any bad/conflicting entries.
    THE FOLLOWING IS MY CONFIGURATION FILE
    Also I have modified IP information so that its not the ACTUAL ip info for my server/network etc... lol for security reasons of course
    Also the bolded lines are the modifications I made but that arent working.
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password DowJbZ7jrm5Nkm5B encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.6.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 99.89.69.233 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object-group network EMRMC
    network-object 10.1.2.0 255.255.255.0
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.11.0 255.255.255.0
    network-object 172.16.0.0 255.255.0.0
    network-object 192.168.9.0 255.255.255.0
    object-group service RDP tcp
    description RDP
    port-object eq 3389
    object-group service GMED tcp
    description GMED
    port-object eq 3390
    object-group service MarsAccess tcp
    description MarsAccess
    port-object range pcanywhere-data 5632
    object-group service MarsFTP tcp
    description MarsFTP
    port-object range ftp-data ftp
    object-group service MarsSupportAppls tcp
    description MarsSupportAppls
    port-object eq 1972
    object-group service MarsUpdatePort tcp
    description MarsUpdatePort
    port-object eq 7835
    object-group service NM1503 tcp
    description NM1503
    port-object eq 1503
    object-group service NM1720 tcp
    description NM1720
    port-object eq h323
    object-group service NM1731 tcp
    description NM1731
    port-object eq 1731
    object-group service NM389 tcp
    description NM389
    port-object eq ldap
    object-group service NM522 tcp
    description NM522
    port-object eq 522
    object-group service SSL tcp
    description SSL
    port-object eq https
    object-group service rdp tcp
    port-object eq 3389
    access-list outside_1_cryptomap extended permit ip 192.168.6.0 255.255.255.0 object-group EMRMC
    access-list inside_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 192.168.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 object-group EMRMC
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 host 99.89.69.334 eq pcanywhere-data
    access-list outside_access_in extended permit udp 69.16.158.128 255.255.255.128 host 99.89.69.334 eq pcanywhere-status
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 host 99.89.69.334 object-group RDP
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 eq ftp
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 eq ldap
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 eq h323
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 eq telnet
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 eq www
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 host 99.89.69.334 object-group SSL
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 object-group NM522
    access-list outside_access_in extended permit tcp 69.16.158.128 255.255.255.128 192.168.6.0 255.255.255.0 object-group NM1731
    access-list outside_access_in extended permit tcp 173.197.144.48 255.255.255.248 host 99.89.69.334 object-group RDP
    access-list outside_access_in extended permit tcp any interface outside eq 3389
    access-list outside_access_in extended permit tcp host 66.237.238.194 host 99.89.69.333
    access-list outside_access_in extended permit tcp host 66.237.238.194 host 99.89.69.333 object-group rdp
    access-list outside_access_in extended permit tcp any host 99.89.69.333 object-group rdp
    access-list out_in extended permit tcp any host 192.168.6.2 eq 3389
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp 99.89.69.334 3389 192.168.6.1 3389 netmask 255.255.255.255
    static (inside,outside) tcp interface 3389 192.168.6.2 3389 netmask 255.255.255.255
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 99.89.69.338 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.6.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer 68.156.148.5
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 1
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    tunnel-group 68.156.148.5 type ipsec-l2l
    tunnel-group 68.156.148.5 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:f47dfb2cf91833f0366ff572eafefb1d
    : end
    ciscoasa(config-network)#

    Unclear what did not work.  In your original post you include said some commands were added but don't work:
    static (inside,outside) tcp interface 3389 192.168.6.2 3389 netmask 255.255.255.255
    and later you state you add another command that gets an error:
    static (inside,outside) tcp 99.89.69.333 3389 192.168.6.2 3389 netmask 255.255.255.255
    You also stated that 99.89.69.333 (actually 99.89.69.233, guessing from the rest of your config and other posts) is your WAN IP address.
    The first static statement matches Cisco's documentation, which states that a static statement must use the 'interface' directive when you are trying to do static PAT utilizing the IP address of the interface.  Since 99.89.69.333 is the assigned IP address of your WAN interface, that may explain why the second statement fails.
    Any reason why you are using static PAT (including the port number 3389) instead of just skipping that directive?  Static PAT usually makes sense when you need to change the TCP port number.  In your example, you are not changing the TCP port 3389.

  • Cisco ASA 5505 Configurations. Help... Beyond Frustrated

    Hello All,
    I'm fairly new to Cisco products and Network management in general. At my place of employment, I was hired as an IT Tech- Repair and Building computers, most aspects of Physical networking, and software refresh/upgrades as well as solving compatibility issues among a plethora of other things. I've configured APs, a couple Catalyst switches, a router or two, and that is about the breadth of my Cisco knowledge. I was kind of thrown into a project which is to update the current inventory of computers which all run Windows XP Professional. We are making a capital purchase of 20 Laptops and 40 Desktops all of which will run Windows 7. This means the outdated PIX they were using is now useless. I purchased a Cisco ASA 5505 (Version 8.2(1)) because it is compatible with Windows XP and Windows 7. I have spent several days and sleepless nights trying to figure out how to configure this thing. I was hoping to use SSL for the VPN. I did some basic configurations just to get started but like I said, I have no real experience with Adaptive Security Appliances and I am so frustrated right now. I tried using the Wizard to no avail. I did a write erase using CLI and tried to configure that way but I'm doing something wrong as far as I can tell. The configurations were mostly pulled from here, the Cisco Community, and a couple other web sites.
    I’m connecting the ASA 5505 to a cable modem (gateway 24.39.245.33) and to our Netvanta for VPN purposes. Here are the commands/what I have configured so far:
    hostname AMDASA
    domain-name asa.(mydomain).com
    enable password (encrypted)
    passwd (encrypted)
    interface Ethernet0/0
    description TWCoutside
    switchport access vlan 2
    no shutdown
    write mem
    exit
    interface Ethernet0/1
    description Port1inside
    switchport access vlan 1
    no shutdown
    write mem
    exit
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.0.250 255.255.255.0
    write mem
    exit
    interface Vlan2
    nameif outside
    security-level 0
    ip address 24.39.245.36 255.255.255.240
    write mem
    exit
    object-group icmp-type DefaultICMP
    description Default ICMP Types permitted
    icmp-object echo-reply
    icmp-object unreachable
    icmp-object time-exceeded
    write mem
    exit
    ftp mode passive
    write mem
    clock timezone EST -5
    clock summer-time EDT recurring
    write mem
    exit
    dns server-group DefaultDNS
    domain-name asa.adcmotors.com
    write mem
    exit
    access-list acl_outside extended permit icmp any any object-group DefaultICMP
    access-group acl_outside in interface outside
    access-list acl_inside extended permit icmp any any object-group DefaultICMP
    access-group acl_inside in interface inside
    write mem
    exit
    write mem
    That is the extent of the configurations I made via CLI. I don't know how to set the DNS lookup from a static port and I have no idea what else I'm supposed to do after the above configurations I have done. Is there a place to actually obtain ALL of the configurations needed to VPN in? Is there an easier way to make this thing work? I've seriously grown a patch of gray hair because of this device. Please help me if you can!!!!!!

    Hi our desperate friend .
    First I would suggest to use the Cisco VPN client instead of SSL VPN (AnyConnect). The configuration is a bit simpler and for the SSL VPN you would need to install the client on the ASA and purchase additional license if you plan to have more than 2 clients. The VPN Client usually comes with the ASA. If you dont have it or dont have access to download it from cisco.com go to the person from which you purchased your ASA and ask him how to get it.
    That said, I also think that your ASA lacks of some basic configuration as of now.  If you are planning to use this in replacement for your current PIX. You would need to configure a default route and some basic NAT:
    route outside 0.0.0.0 0.0.0.0 24.39.245.33
    global (outside) 1 interface
    nat (inside) 1 192.168.0.0  255.255.255.0
    Now regarding the VPN Client configuration you would need to something like this:
    Create an isakmp policy:
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha    
    group 2
    lifetime 86400
    Create a couple of ACLs that we will use later:
    access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list split_tun standard permit 192.168.0.0 255.255.255.0
    Create a Pool for the VPN Clients to use:
    ip local pool TestPool 192.168.100.1-192.168.100.20 mask 255.255.255.0
    Create a Group Policy:
    group-policy TEST internal
    group-policy TEST attributes
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split_tun
    Create a group:
    tunnel-group TEST type ipsec-ra
    tunnel-group TEST general-attributes
    address-pool TestPool
    authentication-server-group ABTVPN
    default-group-policy TEST
    tunnel-group TEST ipsec-attributes
    pre-shared-key cisco123
    Create crypto map and do a NAT 0:
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map Outside_dyn_map 10 set transform-set ESP-3DES-SHA
    crypto map Outside_map 10 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface outside
    nat (inside) 0 access-l nonat
    Finally create a user that you will use to connect:
    username test password test123
    Then you would need to configure your VPN Client to connect with the ASA.
    Here is a config Example of VPN clients to the ASA. It uses an external server for the authentication but just skip those parts. For the initial config you might want to keep the authentication local.
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806de37e.shtml
    I hope this helps. Feel free to ask if you have any questions. Also it would very usefull if you could upload the current config (show run) of the ASA in case you need to ask something else.
    Have fun.
    Raga

  • Azure Site to Site VPN with Cisco ASA 5505

    I have got Cisco ASA 5505 device (version 9.0(2)). And i cannot connect S2S with azure (azure network alway in "connecting" state). In my cisco log:
    IP = 104.40.182.93, Keep-alives configured on but peer does not support keep-alives (type = None)
    Group = 104.40.182.93, IP = 104.40.182.93, QM FSM error (P2 struct &0xcaaa2a38, mess id 0x1)!
    Group = 104.40.182.93, IP = 104.40.182.93, Removing peer from correlator table failed, no match!
    Group = 104.40.182.93, IP = 104.40.182.93,Overriding Initiator's IPSec rekeying duration from 102400000 to 4608000 Kbs
    Group = 104.40.182.93, IP = 104.40.182.93, PHASE 1 COMPLETED
    I have done all cisco s2s congiguration over standard wizard cos seems your script for 8.x version of asa only?
    (Does azure support 9.x version of asa?)
    How can i fix it?

    Hi,
    As of now, we do not have any scripts for Cisco ASA 9x series.
    Thank you for your interest in Windows Azure. The Dynamic routing is not supported for the Cisco ASA family of devices.
    Unfortunately, a dynamic routing VPN gateway is required for Multi-Site VPN, VNet to VNet, and Point-to-Site.
    However, you should be able to setup a site-to-site VPN with Cisco ASA 5505 series security appliance as
    demonstrated in this blog:
    Step-By-Step: Create a Site-to-Site VPN between your network and Azure
    http://blogs.technet.com/b/canitpro/archive/2013/10/09/step-by-step-create-a-site-to-site-vpn-between-your-network-and-azure.aspx
    You can refer to this article for Cisco ASA templates for Static routing:
    http://msdn.microsoft.com/en-us/library/azure/dn133793.aspx
    Did you download the VPN configuration file from the dashboard and copy the content of the configuration
    file to the Command Line Interface of the Cisco ASDM application? It seems that there is no specified IP address in the access list part and maybe that is why the states message appeared.
    According to the
    Cisco ASA template, it should be similar to this:
    access-list <RP_AccessList>
    extended permit ip object-group
    <RP_OnPremiseNetwork> object-group <RP_AzureNetwork>
    nat (inside,outside) source static <RP_OnPremiseNetwork>
    <RP_OnPremiseNetwork> destination static <RP_AzureNetwork>
    <RP_AzureNetwork>
    Based on my experience, to establish
    IPSEC tunnel, you need to allow the ESP protocol and UDP Port 500. Please make sure that the
    VPN device cannot be located behind a NAT. Besides, since Cisco ASA templates are not
    compatible for dynamic routing, please make sure that you chose the static routing.
    Since you configure the VPN device yourself, it's important that you would be familiar with the device and its configuration settings.
    Hope this helps you.
    Girish Prajwal

  • L2TP on Cisco ASA 5505, just doesn't work??!

    This is pretty urgent, client expects me to have this up by lunch today
    So, there is this Cisco ASA 5505 ver 8.4.
    Most things work but now I want to setup a vpn connection...
    I have done this 2 ways, first by using the "VPN Wizard" in ASDM and then 5 hours later removing everything and configuring from cli.
    And it just doesn't work, client (WinXP & Win7) gets "error 792" and sometimes "error 789" (both indicating problem with phase 1, I'm pretty sure of that)
    Googling on those gives a few suggestions none works.
    All I get in the log on Cisco is the "Error processing payload: Payload ID: 1"
    Googling on that only comes up with a few pages telling me this message is caused by an error. (Yeah, I could never have guessed...)
    For the cli config, I followed this tutorial carefully (3 times actually...)
    http://www.cisco.com/en/US/docs/secu...html#wp1117464
    I'm using PSK for IPSec, entered same on Cisco and client - checked several times, this is not a password/PSK issue.
    Ports opened on Cisco: 500, 1701, 4500
    (For a try I opened all ports, no change.)
    And here's the "show run":
    Code:
    ASA Version 8.4(2)
    hostname ciscoasa
    enable password <string> encrypted
    passwd <string> encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.5.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address #.#.#.# 255.255.255.252
    interface Vlan7
    description VLAN till kontor
    no forward interface Vlan2
    nameif kontor
    security-level 100
    ip address 172.16.5.1 255.255.255.0
    ftp mode passive
    clock timezone GMT 0
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Webserver
    host 192.168.5.2
    object network Webserver443
    host 192.168.5.2
    object network rdp
    host 192.168.5.2
    object network vpnserver
    host 192.168.5.2
    object service vpn-service-group
    object network VPN
    host 192.168.5.2
    object-group service Webports tcp-udp
    description Portar för webbserver
    port-object eq 443
    port-object eq www
    object-group service DM_INLINE_TCP_1 tcp
    group-object Webports
    port-object eq www
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service VPNports tcp-udp
    port-object eq 1701
    port-object eq 4500
    port-object eq 500
    object-group service RDP tcp-udp
    port-object eq 3389
    object-group service vpn-services tcp-udp
    port-object eq 1701
    port-object eq 500
    access-list outside_access_in extended permit tcp any object Webserver eq www
    access-list outside_access_in_1 extended permit tcp any object Webserver object-group DM_INLINE_TCP_1
    access-list outside_access_in_1 remark Ãppnar för vpn
    access-list outside_access_in_1 extended permit object-group TCPUDP any any object-group VPNports
    access-list outside_access_in_1 extended permit object-group TCPUDP any any object-group RDP
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu kontor 1500
    ip local pool vpn1 10.10.10.10-10.10.10.50 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    object network obj_any
    nat (inside,outside) dynamic interface
    object network Webserver
    nat (inside,outside) static interface service tcp www www
    object network Webserver443
    nat (inside,outside) static interface service tcp https https
    object network rdp
    nat (inside,outside) static interface service tcp 3389 3389
    access-group outside_access_in_1 in interface outside
    route outside 0.0.0.0 0.0.0.0 79.142.243.33 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authorization command LOCAL
    aaa authorization exec LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec ikev2 ipsec-proposal 3DES-SHA
    protocol esp encryption aes-256 aes-192 aes 3des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal 3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=ciscoasa
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    .... (sorry, not giving you the cert...)
    crypto ikev2 policy 1
    encryption 3des
    integrity sha
    group 2 1
    prf sha
    lifetime seconds 86400
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 1
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 1
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 1
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 1
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh scopy enable
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 10
    console timeout 0
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    l2tp tunnel hello 100
    dhcpd dns 8.8.8.8
    dhcpd auto_config outside
    dhcpd address 192.168.5.11-192.168.5.36 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    address-pools value vpn1
    group-policy DfltGrpPolicy attributes
    dns-server value 79.142.240.10
    vpn-tunnel-protocol l2tp-ipsec
    address-pools value vpn1
    username test password <string> nt-encrypted
    username someoneelse password <string> nt-encrypted privilege 15
    username someoneelse attributes
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    service-type admin
    username someone password <string> nt-encrypted privilege 0
    tunnel-group DefaultRAGroup general-attributes
    authorization-server-group LOCAL
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    tunnel-group vpn1 type remote-access
    tunnel-group vpn1 ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege cmd level 3 mode exec command packet-tracer
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command vpnclient
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command dynamic-filter
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege clear level 3 mode exec command dynamic-filter
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:dd92aa6707dc63e8ed7dad47cfecdd47
    : end
    In Pingvino Veritas!

    I lmost got it working now, new problem is that the connection is immediately ended.
    Logs shows that client is authenticated and assigned an ip.
    From the logs, all happens during one second:
    IPAA: Client assigned ip-address from local pool
    IPAA: Local pool request succeeded for tunnel-group
    IPAA: Freeing local pool address
    L2TP Tunnel created, tunnel_id is 24
    L2TP Tunnel deleted, tunnel_id =24
    IPSEC: An outbound remote access SA has been deleted
    IPSEC: An inbound remote access SA has been deleted
    Session is being torn down. Reason: L2TP initiated
    Teardown UDP connection

  • S2S between Cisco ASA 5505 and Sonicwall TZ-170 but not able to ping across

    Hi,
    I am helping out a friend of mine with his Site-to-Site VPN between his companies Cisco ASA another company's SonicWall TZ-170.  I have checked the screenshots proivded by the other end and tried to match with ours.  The Tunnel shows but we are not able to Ping resources on the other end.  The other side insists that the problem is on our end but I am not sure where the issue resides.  Please take a look at our config and let me know if there is anything that I have missed.  I am pretty sure I didn't but extra eyes may be of need here.
    Our LAN is 10.200.x.x /16 and theirs is 192.168.9.0 /24
    ASA Version 8.2(2)
    terminal width 300
    hostname company-asa
    domain-name Company.com
    no names
    name 10.1.0.0 sacramento-network
    name 10.3.0.0 irvine-network
    name 10.2.0.0 portland-network
    name x.x.x.x MailLive
    name 192.168.9.0 revit-vpn-remote-subnet
    dns-guard
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.128
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.200.200.1 255.255.0.0
    interface Ethernet0/2
    nameif dmz
    security-level 50
    ip address 172.22.22.1 255.255.255.0
    interface Ethernet0/3
    description Internal Wireless
    shutdown
    nameif Wireless
    security-level 100
    ip address 10.201.201.1 255.255.255.0
    interface Management0/0
    shutdown
    nameif management
    security-level 100
    no ip address
    management-only
    boot system disk0:/asa822-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name company.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network local_net_group
    network-object 10.1.0.0 255.255.0.0
    network-object 10.2.0.0 255.255.0.0
    network-object 10.200.0.0 255.255.0.0
    network-object 10.3.0.0 255.255.0.0
    network-object 10.4.0.0 255.255.0.0
    network-object 10.5.0.0 255.255.0.0
    network-object 10.6.0.0 255.255.0.0
    network-object 10.7.0.0 255.255.0.0
    network-object 192.168.200.0 255.255.255.0
    object-group network NACIO123
    network-object 1.1.1.1 255.255.255.224
    object-group service MAIL_HTTPS_BORDERWARE tcp
    port-object eq smtp
    port-object eq https
    port-object eq 10101
    object-group service SYSLOG_SNMP_NETFLOW udp
    port-object eq syslog
    port-object eq snmp
    port-object eq 2055
    object-group service HTTP_HTTPS tcp
    port-object eq www
    port-object eq https
    object-group network OUTSIDECO_SERVERS
    network-object host x.x.x.34
    network-object host x.x.x.201
    network-object host x.x.x.63
    object-group network NO-LOG
    network-object host 10.200.200.13
    network-object host 10.200.200.25
    network-object host 10.200.200.32
    object-group service iPhoneSync-Services-TCP tcp
    port-object eq 993
    port-object eq 990
    port-object eq 998
    port-object eq 5678
    port-object eq 5721
    port-object eq 26675
    object-group service termserv tcp
    description terminal services
    port-object eq 3389
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DTI tcp
    description DCS CONTROL PROTOCOL
    port-object eq 3333
    object-group service H.245 tcp
    description h.245 signaling
    port-object range 1024 4999
    object-group service RAS udp
    port-object eq 1719
    port-object range 1718 1720
    object-group service XML tcp
    port-object range 3336 3341
    object-group service mpi tcp
    port-object eq 2010
    object-group service mvp_control tcp
    port-object eq 2946
    object-group service rpc tcp-udp
    port-object eq 1809
    object-group service tcp8080 tcp
    port-object eq 8080
    object-group service tcp8011 tcp
    port-object eq 8011
    object-group service rtp_rtcp_udp udp
    port-object range 1024 65535
    object-group service ecs_xml tcp-udp
    port-object eq 3271
    object-group service rtp20000 udp
    description 10000-65535
    port-object range 20000 25000
    port-object range 10000 65535
    object-group service tcp5222 tcp
    port-object range 5222 5269
    object-group service tcp7070 tcp
    port-object eq 7070
    object-group network videoco
    network-object host x.x.x.144
    network-object host x.x.x.145
    object-group service video tcp
    port-object range 1718 h323
    object-group service XML2 tcp-udp
    port-object range 3336 3345
    object-group service tcp_tls tcp
    port-object eq 5061
    object-group service Autodesk tcp
    port-object eq 2080
    port-object range 27000 27009
    access-list outside_policy remark ====== Begin Mail From Postini Network ======
    access-list outside_policy extended permit tcp x.x.x.x 255.255.240.0 host x.x.x.x eq smtp
    access-list outside_policy extended permit tcp x.x.x.x 255.255.255.240 host x.x.x.x eq smtp
    access-list outside_policy extended permit tcp x.x.x.0 255.255.240.0 host x.x.x.x eq smtp
    access-list outside_policy remark ****** End Mail From Postini Network ******
    access-list outside_policy remark ====== Begin Inbound Web Mail Access ======
    access-list outside_policy extended permit tcp any host x.x.x.x object-group HTTP_HTTPS
    access-list outside_policy remark ****** End Inbound Web Mail Access ******
    access-list outside_policy remark ====== Begin iPhone Sync Rules to Mail Server ======
    access-list outside_policy extended permit tcp any host x.x.x.x object-group iPhoneSync-Services-TCP
    access-list outside_policy remark ****** End iPhone Sync Rules to Mail Server ******
    access-list outside_policy remark ====== Begin MARS Monitoring ======
    access-list outside_policy extended permit udp x.x.x.x 255.255.255.128 host x.x.x.x object-group SYSLOG_SNMP_NETFLOW
    access-list outside_policy extended permit icmp x.x.x.x 255.255.255.128 host x.x.x.x
    access-list outside_policy remark ****** End MARS Monitoring ******
    access-list outside_policy extended permit tcp object-group NACIO123 host x.x.x.141 eq ssh
    access-list outside_policy extended permit tcp any host x.x.x.x eq www
    access-list outside_policy extended permit tcp any host x.x.x.x eq https
    access-list outside_policy extended permit tcp any host x.x.x.x eq h323
    access-list outside_policy extended permit tcp any host x.x.x.x range 60000 60001
    access-list outside_policy extended permit udp any host x.x.x.x range 60000 60007
    access-list outside_policy remark radvision 5110   port 80 both
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco eq www
    access-list outside_policy remark radvision
    access-list outside_policy extended permit tcp any object-group videoco object-group termserv
    access-list outside_policy remark radvision 5110  port21 out
    access-list outside_policy extended permit tcp any object-group videoco eq ftp
    access-list outside_policy remark rad5110   port22 both
    access-list outside_policy extended permit tcp any object-group videoco eq ssh
    access-list outside_policy remark rad 5110  port161 udp both
    access-list outside_policy extended permit udp any object-group videoco eq snmp
    access-list outside_policy remark rad5110 port443 both
    access-list outside_policy extended permit tcp any object-group videoco eq https
    access-list outside_policy remark rad5110 port 1024-4999  both
    access-list outside_policy extended permit tcp any object-group videoco object-group H.245
    access-list outside_policy remark rad5110 port 1719 udp both
    access-list outside_policy extended permit udp any object-group videoco object-group RAS
    access-list outside_policy remark rad5110 port 1720 both
    access-list outside_policy extended permit tcp any any eq h323
    access-list outside_policy remark RAD 5110 port 3333 tcp both
    access-list outside_policy extended permit tcp any object-group videoco object-group DTI
    access-list outside_policy remark rad5110 port 3336-3341 both
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco object-group XML2
    access-list outside_policy remark port 5060 tcp/udp
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco eq sip
    access-list outside_policy remark rad 5110port 1809 rpc both
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco object-group rpc
    access-list outside_policy remark rad 5110 port 2010 both
    access-list outside_policy extended permit tcp any object-group videoco object-group mpi
    access-list outside_policy remark rad 5110 port 2946 both
    access-list outside_policy extended permit tcp any object-group videoco object-group mvp_control
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp8080
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp8011
    access-list outside_policy remark 1024-65535
    access-list outside_policy extended permit udp any object-group videoco object-group rtp_rtcp_udp
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco object-group ecs_xml
    access-list outside_policy extended permit udp any object-group videoco object-group rtp20000
    access-list outside_policy extended permit tcp any object-group videoco eq telnet
    access-list outside_policy remark port 53 dns
    access-list outside_policy extended permit object-group TCPUDP any object-group videoco eq domain
    access-list outside_policy remark 7070
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp7070
    access-list outside_policy remark 5222-5269 tcp
    access-list outside_policy extended permit tcp any object-group videoco range 5222 5269
    access-list outside_policy extended permit tcp any object-group videoco object-group video
    access-list outside_policy extended permit tcp any object-group videoco object-group tcp_tls
    access-list outside_policy remark ====== Begin Autodesk Activation access ======
    access-list outside_policy extended permit tcp any any object-group Autodesk
    access-list outside_policy remark ****** End Autodesk Activation access ******
    access-list outside_policy extended permit tcp x.x.x.x 255.255.255.248 host x.x.x.x eq smtp
    access-list outside_policy remark ****** End Autodesk Activation access ******
    access-list inside_policy extended deny tcp host 10.200.200.25 10.1.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.3.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.2.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.4.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny tcp host 10.200.200.25 10.5.0.0 255.255.0.0 eq 2967 log disable
    access-list inside_policy extended deny udp object-group NO-LOG any eq 2967 log disable
    access-list inside_policy extended deny tcp object-group NO-LOG any eq 2967 log disable
    access-list inside_policy remark ====== Begin Outbound Mail Server Rules ======
    access-list inside_policy extended permit udp host 10.200.200.222 any eq 5679
    access-list inside_policy extended permit tcp host 10.200.200.222 any eq smtp
    access-list inside_policy remark ****** End Outbound Mail Server Rules ******
    access-list inside_policy extended permit ip object-group local_net_group any
    access-list inside_policy extended permit icmp object-group local_net_group any
    access-list OUTSIDECO_VPN extended permit ip host x.x.x.x object-group OUTSIDECO_SERVERS
    access-list company-split-tunnel standard permit 10.1.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.2.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.3.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.4.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.200.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.5.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.6.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 10.7.0.0 255.255.0.0
    access-list company-split-tunnel standard permit 172.22.22.0 255.255.255.0
    access-list company-split-tunnel remark Video
    access-list company-split-tunnel standard permit 192.168.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.1.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.2.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.3.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.200.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.4.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.5.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.6.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 10.7.0.0 255.255.0.0
    access-list SSL_SPLIT standard permit 172.22.22.0 255.255.255.0
    access-list SSL_SPLIT remark Video
    access-list SSL_SPLIT standard permit 192.168.0.0 255.255.0.0
    access-list NONAT_SSL extended permit ip object-group local_net_group 172.20.20.0 255.255.255.0
    access-list NONAT_SSL extended permit ip 10.200.0.0 255.255.0.0 192.168.9.0 255.255.255.0
    access-list tom extended permit tcp host x.x.x.x any eq smtp
    access-list tom extended permit tcp host 10.200.200.222 any eq smtp
    access-list tom extended permit tcp any host x.x.x.x
    access-list aaron extended permit tcp any any eq 2967
    access-list capauth extended permit ip host 10.200.200.1 host 10.200.200.220
    access-list capauth extended permit ip host 10.200.200.220 host 10.200.200.1
    access-list DMZ extended permit icmp any any
    access-list dmz_access_in extended permit tcp any eq 51024 any eq 3336
    access-list dmz_access_in extended permit icmp any any
    access-list dmz_access_in extended permit tcp any any eq ftp
    access-list dmz_access_in extended permit tcp any any eq https
    access-list dmz_access_in remark rad5110 port 162 out
    access-list dmz_access_in extended permit udp any any eq snmptrap
    access-list dmz_access_in remark port 23 out
    access-list dmz_access_in extended permit tcp any any eq telnet
    access-list dmz_access_in remark port 53 dns out
    access-list dmz_access_in extended permit object-group TCPUDP any any eq domain
    access-list dmz_access_in extended permit object-group TCPUDP any any eq www
    access-list dmz_access_in extended permit tcp any any eq h323
    access-list dmz_access_in extended permit tcp any any object-group XML
    access-list dmz_access_in extended permit udp any any object-group RAS
    access-list dmz_access_in extended permit tcp any any range 1718 h323
    access-list dmz_access_in extended permit tcp any any object-group H.245
    access-list dmz_access_in extended permit object-group TCPUDP any any eq sip
    access-list dmz_access_in extended permit udp any any object-group rtp_rtcp_udp
    access-list dmz_access_in extended permit object-group TCPUDP any any object-group XML2
    access-list dmz_access_in extended permit ip object-group local_net_group any
    access-list dmz_access_in remark port 5061
    access-list dmz_access_in extended permit tcp any any object-group tcp_tls
    access-list outside_cryptomap extended permit ip 10.200.0.0 255.255.0.0 192.168.9.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffered warnings
    logging trap informational
    logging history informational
    logging asdm warnings
    logging host outside x.x.x.x
    mtu outside 1500
    mtu inside 1500
    mtu dmz 1500
    mtu Wireless 1500
    mtu management 1500
    ip local pool SSL_VPN_POOL 172.20.20.1-172.20.20.75 mask 255.255.255.0
    ip verify reverse-path interface outside
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-631.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT_SSL
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) x.x.x.12 10.200.200.15 netmask 255.255.255.255
    static (inside,outside) x.x.x.15 10.5.0.11 netmask 255.255.255.255
    static (inside,outside) x.x.x.13 10.200.200.240 netmask 255.255.255.255
    static (inside,outside) x.x.x.16 10.200.200.222 netmask 255.255.255.255
    static (inside,outside) x.x.x.14 10.200.200.155 netmask 255.255.255.255
    static (inside,dmz) 10.200.200.0 10.200.200.0 netmask 255.255.255.0
    static (inside,dmz) 10.4.0.0 10.4.0.0 netmask 255.255.0.0
    static (dmz,outside) x.x.x.18 172.22.22.15 netmask 255.255.255.255
    static (dmz,outside) x.x.x.19 172.22.22.16 netmask 255.255.255.255
    static (inside,dmz) 10.3.0.0 10.3.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.2.0.0 10.2.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.1.0.0 10.1.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.6.0.0 10.6.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.7.0.0 10.7.0.0 netmask 255.255.0.0
    static (inside,dmz) 10.5.0.0 10.5.0.0 netmask 255.255.0.0
    access-group outside_policy in interface outside
    access-group inside_policy in interface inside
    access-group dmz_access_in in interface dmz
    route outside 0.0.0.0 0.0.0.0 x.x.x.12 1
    route inside 10.1.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.2.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.3.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.4.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.5.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.6.0.0 255.255.0.0 10.200.200.254 1
    route inside 10.7.0.0 255.255.0.0 10.200.200.150 1
    route inside x.x.x.0 255.255.255.0 10.200.200.2 1
    route inside x.x.x.0 255.255.255.0 10.200.200.2 1
    route inside 192.168.1.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.2.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.3.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.4.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.5.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.6.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.7.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.200.0 255.255.255.0 10.200.200.254 1
    route inside 192.168.201.0 255.255.255.0 10.200.200.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 2:00:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server COMPANY-NT-AUTH protocol nt
    aaa-server COMPANY-NT-AUTH (inside) host 10.200.200.220
    nt-auth-domain-controller DC
    aaa authentication ssh console LOCAL
    aaa authorization command LOCAL
    http server enable
    http 10.200.200.0 255.255.255.0 inside
    http 10.200.0.0 255.255.0.0 inside
    http 10.3.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set AES256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set asa2transform esp-3des esp-sha-hmac
    crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set transform-set 3DES-SHA
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto map OUTSIDE_MAP 5 match address outside_cryptomap
    crypto map OUTSIDE_MAP 5 set pfs
    crypto map OUTSIDE_MAP 5 set peer x.x.x.53
    crypto map OUTSIDE_MAP 5 set transform-set 3DES-SHA
    crypto map OUTSIDE_MAP 5 set security-association lifetime seconds 28800
    crypto map OUTSIDE_MAP 10 match address OUTSIDECO_VPN
    crypto map OUTSIDE_MAP 10 set peer x.x.x.25
    crypto map OUTSIDE_MAP 10 set transform-set AES256-SHA
    crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800
    crypto map OUTSIDE_MAP 10 set security-association lifetime kilobytes 4608000
    crypto map OUTSIDE_MAP 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map OUTSIDE_MAP interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 28800
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 20
    console timeout 0
    dhcpd dns 10.200.200.220 10.200.200.225
    dhcpd wins 10.200.200.220 10.200.200.225
    dhcpd lease 18000
    dhcpd domain company.com
    dhcpd dns 10.200.200.220 10.200.200.225 interface Wireless
    dhcpd wins 10.200.200.220 10.200.200.225 interface Wireless
    dhcpd lease 18000 interface Wireless
    dhcpd domain company.com interface Wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 192.5.41.40 source outside prefer
    ssl trust-point vpn.company.com outside
    webvpn
    enable outside
    anyconnect-essentials
    svc image disk0:/anyconnect-win-2.5.0217-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.5.2017-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy SSL_Client_Policy internal
    group-policy SSL_Client_Policy attributes
    wins-server value 10.200.200.220
    dns-server value 10.200.200.220
    vpn-tunnel-protocol IPSec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SSL_SPLIT
    default-domain value company.com
    webvpn
      sso-server none
      auto-signon allow uri * auth-type all
    group-policy no-split-test internal
    group-policy no-split-test attributes
    banner value Welcome to company and Associates
    banner value Welcome to company and Associates
    dns-server value 10.200.200.220
    vpn-tunnel-protocol IPSec
    ipsec-udp enable
    split-tunnel-policy tunnelall
    default-domain value company.com
    group-policy DfltGrpPolicy attributes
    dns-server value 10.200.200.220
    default-domain value company.com
    group-policy company internal
    group-policy company attributes
    banner value Welcome to company and Associates
    banner value Welcome to company and Associates
    dns-server value 10.200.200.220
    vpn-tunnel-protocol IPSec
    ipsec-udp enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SSL_SPLIT
    default-domain value company.com
    username ciscoadmin password xxxxxxxxxxx encrypted privilege 15
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool SSL_VPN_POOL
    authentication-server-group COMPANY-NT-AUTH
    default-group-policy SSL_Client_Policy
    tunnel-group DefaultWEBVPNGroup webvpn-attributes
    group-alias company_SSL_VPN enable
    tunnel-group company_group type remote-access
    tunnel-group company_group general-attributes
    address-pool SSL_VPN_POOL
    authentication-server-group COMPANY-NT-AUTH LOCAL
    default-group-policy company
    tunnel-group company_group ipsec-attributes
    pre-shared-key *****
    tunnel-group x.x.x.53 type ipsec-l2l
    tunnel-group x.x.x.53 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect tftp
      inspect esmtp
      inspect ftp
      inspect icmp
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect skinny
      inspect sqlnet
      inspect sunrpc
      inspect xdmcp
      inspect mgcp
      inspect h323 h225
      inspect h323 ras
      inspect sip
    service-policy global_policy global
    privilege cmd level 5 mode exec command ping
    privilege cmd level 6 mode exec command write
    privilege show level 5 mode exec command running-config
    privilege show level 5 mode exec command version
    privilege show level 5 mode exec command conn
    privilege show level 5 mode exec command memory
    privilege show level 5 mode exec command cpu
    privilege show level 5 mode exec command xlate
    privilege show level 5 mode exec command traffic
    privilege show level 5 mode exec command interface
    privilege show level 5 mode exec command clock
    privilege show level 5 mode exec command ip
    privilege show level 5 mode exec command failover
    privilege show level 5 mode exec command arp
    privilege show level 5 mode exec command route
    privilege show level 5 mode exec command blocks
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:a0689b4c837c79a51e7a0cfed591dec9
    : end
    COMPANY-asa#

    Hi Sian,
    Yes on their end the PFS is enabled for DH Group 2.
    Here is the information that you requested:
    company-asa# sh crypto isakmp sa
       Active SA: 3
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 3
    1   IKE Peer: x.x.x.87
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    2   IKE Peer: x.x.x.53
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    3   IKE Peer: x.x.x.25
        Type    : user            Role    : initiator
        Rekey   : no              State   : MM_WAIT_MSG4
    company-asa# sh crypto ipsec sa
    interface: outside
        Crypto map tag: OUTSIDE_MAP, seq num: 5, local addr: x.x.x.13
          access-list outside_cryptomap extended permit ip 10.200.0.0 255.255.0.0 192.168.9.0 255.255.255.0
          local ident (addr/mask/prot/port): (10.200.0.0/255.255.0.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.9.0/255.255.255.0/0/0)
          current_peer: x.x.x.53
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 10744, #pkts decrypt: 10744, #pkts verify: 10744
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: x.x.x.13, remote crypto endpt.: x.x.x.53
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: 500EC8BF
          current inbound spi : 8DAE3436
        inbound esp sas:
          spi: 0x8DAE3436 (2377004086)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 32768, crypto-map: OUTSIDE_MAP
             sa timing: remaining key lifetime (kB/sec): (3914946/24388)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0x500EC8BF (1343146175)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 32768, crypto-map: OUTSIDE_MAP
             sa timing: remaining key lifetime (kB/sec): (3915000/24388)
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
        Crypto map tag: outside_dyn_map, seq num: 20, local addr: x.x.x.13
          local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
          remote ident (addr/mask/prot/port): (172.20.20.8/255.255.255.255/0/0)
          current_peer: x.x.x.87, username: ewebb
          dynamic allocated peer ip: 172.20.20.8
          #pkts encaps: 16434, #pkts encrypt: 16464, #pkts digest: 16464
          #pkts decaps: 19889, #pkts decrypt: 19889, #pkts verify: 19889
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 16434, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 30, #pre-frag failures: 0, #fragments created: 60
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 60
          #send errors: 0, #recv errors: 0
          local crypto endpt.: x.x.x.13/4500, remote crypto endpt.: x.x.x.87/2252
          path mtu 1500, ipsec overhead 66, media mtu 1500
          current outbound spi: 2D712C9F
          current inbound spi : 0EDB79C8
        inbound esp sas:
          spi: 0x0EDB79C8 (249264584)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, }
             slot: 0, conn_id: 65536, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 18262
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0x2D712C9F (762391711)
             transform: esp-3des esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, }
             slot: 0, conn_id: 65536, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 18261
             IV size: 8 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001

  • %ASA-7-710005: TCP request discarded error in Client to Site VPN in CISCO ASA 5510

    Hi Friends,
    I'm trying to built client to site VPN in CISCO ASA 5510 8.4(4) and getting below error while connecting cisco VPN client software. Also, I'm getting below log in ASA. Please help me to reslove.
    Error in CISCO VPN Client Software:
    Secure VPN Connection Terminated locally by the client.
    Reason : 414 : Failed to establish a TCP connection.
    Error in CISCO ASA 5510
    %ASA-7-710005: TCP request discarded from <Public IP> /49276 to outside:<Outside Interface IP of my ASA> /10000
    ASA Configuration:
    XYZ# sh run
    : Saved
    ASA Version 8.4(4)
    hostname XYZ
    domain-name XYZ
    enable password 3uLkVc9JwRA1/OXb level 3 encrypted
    enable password R/x90UjisGVJVlh2 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    nameif outside_rim
    security-level 0
    ip address 1.1.1.1 255.255.255.252
    interface Ethernet0/1
    duplex full
    nameif XYZ_DMZ
    security-level 50
    ip address 172.1.1.1 255.255.255.248
    interface Ethernet0/2
    speed 100
    duplex full
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.252
    interface Ethernet0/3
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 3.3.3.3 255.255.255.224
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa844-k8.bin
    ftp mode passive
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    domain-name XYZ
    object network obj-172.17.10.3
    host 172.17.10.3
    object network obj-10.1.134.0
    subnet 10.1.134.0 255.255.255.0
    object network obj-208.75.237.0
    subnet 208.75.237.0 255.255.255.0
    object network obj-10.7.0.0
    subnet 10.7.0.0 255.255.0.0
    object network obj-172.17.2.0
    subnet 172.17.2.0 255.255.255.0
    object network obj-172.17.3.0
    subnet 172.17.3.0 255.255.255.0
    object network obj-172.19.2.0
    subnet 172.19.2.0 255.255.255.0
    object network obj-172.19.3.0
    subnet 172.19.3.0 255.255.255.0
    object network obj-172.19.7.0
    subnet 172.19.7.0 255.255.255.0
    object network obj-10.1.0.0
    subnet 10.1.0.0 255.255.0.0
    object network obj-10.2.0.0
    subnet 10.2.0.0 255.255.0.0
    object network obj-10.3.0.0
    subnet 10.3.0.0 255.255.0.0
    object network obj-10.4.0.0
    subnet 10.4.0.0 255.255.0.0
    object network obj-10.6.0.0
    subnet 10.6.0.0 255.255.0.0
    object network obj-10.9.0.0
    subnet 10.9.0.0 255.255.0.0
    object network obj-10.11.0.0
    subnet 10.11.0.0 255.255.0.0
    object network obj-10.12.0.0
    subnet 10.12.0.0 255.255.0.0
    object network obj-172.19.1.0
    subnet 172.19.1.0 255.255.255.0
    object network obj-172.21.2.0
    subnet 172.21.2.0 255.255.255.0
    object network obj-172.16.2.0
    subnet 172.16.2.0 255.255.255.0
    object network obj-10.19.130.201
    host 10.19.130.201
    object network obj-172.30.2.0
    subnet 172.30.2.0 255.255.255.0
    object network obj-172.30.3.0
    subnet 172.30.3.0 255.255.255.0
    object network obj-172.30.7.0
    subnet 172.30.7.0 255.255.255.0
    object network obj-10.10.1.0
    subnet 10.10.1.0 255.255.255.0
    object network obj-10.19.130.0
    subnet 10.19.130.0 255.255.255.0
    object network obj-XXXXXXXX
    host XXXXXXXX
    object network obj-145.248.194.0
    subnet 145.248.194.0 255.255.255.0
    object network obj-10.1.134.100
    host 10.1.134.100
    object network obj-10.9.124.100
    host 10.9.124.100
    object network obj-10.1.134.101
    host 10.1.134.101
    object network obj-10.9.124.101
    host 10.9.124.101
    object network obj-10.1.134.102
    host 10.1.134.102
    object network obj-10.9.124.102
    host 10.9.124.102
    object network obj-115.111.99.133
    host 115.111.99.133
    object network obj-10.8.108.0
    subnet 10.8.108.0 255.255.255.0
    object network obj-115.111.99.129
    host 115.111.99.129
    object network obj-195.254.159.133
    host 195.254.159.133
    object network obj-195.254.158.136
    host 195.254.158.136
    object network obj-209.164.192.0
    subnet 209.164.192.0 255.255.224.0
    object network obj-209.164.208.19
    host 209.164.208.19
    object network obj-209.164.192.126
    host 209.164.192.126
    object network obj-10.8.100.128
    subnet 10.8.100.128 255.255.255.128
    object network obj-115.111.99.130
    host 115.111.99.130
    object network obj-10.10.0.0
    subnet 10.10.0.0 255.255.0.0
    object network obj-115.111.99.132
    host 115.111.99.132
    object network obj-10.10.1.45
    host 10.10.1.45
    object network obj-10.99.132.0
    subnet 10.99.132.0 255.255.255.0
    object-group network Serversubnet
    network-object 10.10.1.0 255.255.255.0
    network-object 10.10.5.0 255.255.255.192
    object-group network XYZ_destinations
    network-object 10.1.0.0 255.255.0.0
    network-object 10.2.0.0 255.255.0.0
    network-object 10.3.0.0 255.255.0.0
    network-object 10.4.0.0 255.255.0.0
    network-object 10.6.0.0 255.255.0.0
    network-object 10.7.0.0 255.255.0.0
    network-object 10.11.0.0 255.255.0.0
    network-object 10.12.0.0 255.255.0.0
    network-object 172.19.1.0 255.255.255.0
    network-object 172.19.2.0 255.255.255.0
    network-object 172.19.3.0 255.255.255.0
    network-object 172.19.7.0 255.255.255.0
    network-object 172.17.2.0 255.255.255.0
    network-object 172.17.3.0 255.255.255.0
    network-object 172.16.2.0 255.255.255.0
    network-object 172.16.3.0 255.255.255.0
    network-object host 10.50.2.206
    object-group network XYZ_us_admin
    network-object 10.3.1.245 255.255.255.255
    network-object 10.5.33.7 255.255.255.255
    network-object 10.211.5.7 255.255.255.255
    network-object 10.3.33.7 255.255.255.255
    network-object 10.211.3.7 255.255.255.255
    object-group network XYZ_blr_networkdevices
    network-object 10.200.10.0 255.255.255.0
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host 172.16.2.21
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host 172.16.2.22
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host XXXXXXXX
    access-list XYZ_PAT extended permit ip 10.19.130.0 255.255.255.0 any
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 195.254.159.133
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 195.254.158.136
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 any
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 209.164.192.0 255.255.224.0
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 209.164.208.19
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 209.164.192.126
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.7.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.17.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.17.3.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.3.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.7.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.1.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.3.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.4.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.6.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.9.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.11.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.12.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.1.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.21.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.2.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.3.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.7.0 255.255.255.0
    access-list nonat extended permit ip object-group Serversubnet object-group XYZ_destinations
    access-list nonat extended permit ip 10.10.1.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list nonat extended permit ip 10.19.130.0 255.255.255.0 host XXXXXXXX
    access-list nonat extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list Guest_PAT extended permit ip 10.8.108.0 255.255.255.0 any
    access-list Cacib extended permit ip 10.8.100.128 255.255.255.128 145.248.194.0 255.255.255.0
    access-list Cacib_PAT extended permit ip 10.8.100.128 255.255.255.128 any
    access-list New_Edge extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.7.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.7.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 172.17.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.17.3.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.3.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.7.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.2.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.3.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.4.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.6.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.9.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.11.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.12.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.1.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.21.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.17.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.17.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.7.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.1.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.3.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.4.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.6.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.9.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.11.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.12.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.1.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.21.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.16.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.2.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.3.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.7.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.7.0 255.255.255.0
    access-list XYZ_global extended permit ip object-group Serversubnet object-group XYZ_destinations
    access-list XYZ_global extended permit ip object-group XYZ_destinations object-group Serversubnet
    access-list ML_VPN extended permit ip host 115.111.99.129 209.164.192.0 255.255.224.0
    access-list ML_VPN extended permit ip host 115.111.99.129 host 209.164.208.19
    access-list ML_VPN extended permit ip host 115.111.99.129 host 209.164.192.126
    access-list Da_VPN extended permit ip host 10.9.124.100 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.101 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.102 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.100 10.125.81.0 255.255.255.0
    access-list Da_VPN extended permit ip host 10.9.124.101 10.125.81.0 255.255.255.0
    access-list Da_VPN extended permit ip host 10.9.124.102 10.125.81.0 255.255.255.0
    access-list Sr_PAT extended permit ip 10.10.0.0 255.255.0.0 any
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 host 10.125.86.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 host 10.125.86.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 host 10.125.86.46
    access-list XYZ_reliance extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list coextended permit ip host 2.2.2.2 host XXXXXXXX
    access-list coextended permit ip host XXXXXXXXhost 2.2.2.2
    access-list ci extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list ci extended permit ip 208.75.237.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list acl-outside extended permit ip host 57.66.81.159 host 172.17.10.3
    access-list acl-outside extended permit ip host 80.169.223.179 host 172.17.10.3
    access-list acl-outside extended permit ip any host 172.17.10.3
    access-list acl-outside extended permit tcp any host 10.10.1.45 eq https
    access-list acl-outside extended permit tcp any any eq 10000
    access-list acl-outside extended deny ip any any log
    pager lines 10
    logging enable
    logging buffered debugging
    mtu outside_rim 1500
    mtu XYZ_DMZ 1500
    mtu outside 1500
    mtu inside 1500
    ip local pool XYZ_c2s_vpn_pool 172.30.10.51-172.30.10.254
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-208.75.237.0 obj-208.75.237.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.7.0.0 obj-10.7.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.17.2.0 obj-172.17.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.17.3.0 obj-172.17.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.2.0 obj-172.19.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.3.0 obj-172.19.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.7.0 obj-172.19.7.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.2.0.0 obj-10.2.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.3.0.0 obj-10.3.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.4.0.0 obj-10.4.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.6.0.0 obj-10.6.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.9.0.0 obj-10.9.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.11.0.0 obj-10.11.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.12.0.0 obj-10.12.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.1.0 obj-172.19.1.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.21.2.0 obj-172.21.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.16.2.0 obj-172.16.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.2.0 obj-172.30.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.3.0 obj-172.30.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.7.0 obj-172.30.7.0 no-proxy-arp route-lookup
    nat (inside,any) source static Serversubnet Serversubnet destination static XYZ_destinations XYZ_destinations no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-10.2.0.0 obj-10.2.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.0 obj-10.19.130.0 destination static obj-XXXXXXXX obj-XXXXXXXX no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.0 obj-10.19.130.0 destination static obj-145.248.194.0 obj-145.248.194.0 no-proxy-arp route-lookup
    nat (inside,outside) source static obj-10.1.134.100 obj-10.9.124.100
    nat (inside,outside) source static obj-10.1.134.101 obj-10.9.124.101
    nat (inside,outside) source static obj-10.1.134.102 obj-10.9.124.102
    nat (inside,outside) source dynamic obj-10.8.108.0 interface
    nat (inside,outside) source dynamic obj-10.19.130.0 obj-115.111.99.129
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-195.254.159.133 obj-195.254.159.133
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-195.254.158.136 obj-195.254.158.136
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.192.0 obj-209.164.192.0
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.208.19 obj-209.164.208.19
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.192.126 obj-209.164.192.126
    nat (inside,outside) source dynamic obj-10.8.100.128 obj-115.111.99.130
    nat (inside,outside) source dynamic obj-10.10.0.0 obj-115.111.99.132
    nat (inside,outside) source static obj-10.10.1.45 obj-115.111.99.133
    nat (inside,outside) source dynamic obj-10.99.132.0 obj-115.111.99.129
    object network obj-172.17.10.3
    nat (XYZ_DMZ,outside) static 115.111.99.134
    access-group acl-outside in interface outside
    route outside 0.0.0.0 0.0.0.0 115.111.23.129 1
    route outside 0.0.0.0 0.0.0.0 115.254.127.130 10
    route inside 10.10.0.0 255.255.0.0 10.8.100.1 1
    route inside 10.10.1.0 255.255.255.0 10.8.100.1 1
    route inside 10.10.5.0 255.255.255.192 10.8.100.1 1
    route inside 10.8.100.128 255.255.255.128 10.8.100.1 1
    route inside 10.8.108.0 255.255.255.0 10.8.100.1 1
    route inside 10.19.130.0 255.255.255.0 10.8.100.1 1
    route inside 10.99.4.0 255.255.255.0 10.99.130.254 1
    route inside 10.99.132.0 255.255.255.0 10.8.100.1 1
    route inside 10.1.134.0 255.255.255.0 10.8.100.1 1
    route outside 208.75.237.0 255.255.255.0 115.111.23.129 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication telnet console LOCAL
    aaa authorization command LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set vpn2 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn6 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set vpn5 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn7 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set vpn4 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn1 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn_reliance esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set c2s_vpn esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 86400
    crypto dynamic-map dyn1 1 set ikev1 transform-set c2s_vpn
    crypto dynamic-map dyn1 1 set reverse-route
    crypto map vpn 1 match address XYZ
    crypto map vpn 1 set peer XYZ Peer IP
    crypto map vpn 1 set ikev1 transform-set vpn1
    crypto map vpn 1 set security-association lifetime seconds 3600
    crypto map vpn 1 set security-association lifetime kilobytes 4608000
    crypto map vpn 2 match address NE
    crypto map vpn 2 set peer NE_Peer IP
    crypto map vpn 2 set ikev1 transform-set vpn2
    crypto map vpn 2 set security-association lifetime seconds 3600
    crypto map vpn 2 set security-association lifetime kilobytes 4608000
    crypto map vpn 4 match address ML_VPN
    crypto map vpn 4 set pfs
    crypto map vpn 4 set peer ML_Peer IP
    crypto map vpn 4 set ikev1 transform-set vpn4
    crypto map vpn 4 set security-association lifetime seconds 3600
    crypto map vpn 4 set security-association lifetime kilobytes 4608000
    crypto map vpn 5 match address XYZ_global
    crypto map vpn 5 set peer XYZ_globa_Peer IP
    crypto map vpn 5 set ikev1 transform-set vpn5
    crypto map vpn 5 set security-association lifetime seconds 3600
    crypto map vpn 5 set security-association lifetime kilobytes 4608000
    crypto map vpn 6 match address Da_VPN
    crypto map vpn 6 set peer Da_VPN_Peer IP
    crypto map vpn 6 set ikev1 transform-set vpn6
    crypto map vpn 6 set security-association lifetime seconds 3600
    crypto map vpn 6 set security-association lifetime kilobytes 4608000
    crypto map vpn 7 match address Da_Pd_VPN
    crypto map vpn 7 set peer Da_Pd_VPN_Peer IP
    crypto map vpn 7 set ikev1 transform-set vpn6
    crypto map vpn 7 set security-association lifetime seconds 3600
    crypto map vpn 7 set security-association lifetime kilobytes 4608000
    crypto map vpn interface outside
    crypto map vpn_reliance 1 match address XYZ_rim
    crypto map vpn_reliance 1 set peer XYZ_rim_Peer IP
    crypto map vpn_reliance 1 set ikev1 transform-set vpn_reliance
    crypto map vpn_reliance 1 set security-association lifetime seconds 3600
    crypto map vpn_reliance 1 set security-association lifetime kilobytes 4608000
    crypto map vpn_reliance interface outside_rim
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto isakmp identity address
    no crypto isakmp nat-traversal
    crypto ikev1 enable outside_rim
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28800
    crypto ikev1 policy 2
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    crypto ikev1 policy 4
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28000
    crypto ikev1 policy 5
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 10.8.100.0 255.255.255.224 inside
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    no threat-detection basic-threat
    no threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy XYZ_c2s_vpn internal
    username testadmin password oFJjANE3QKoA206w encrypted
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXXtype ipsec-l2l
    tunnel-group XXXXXXXXipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XYZ_c2s_vpn type remote-access
    tunnel-group XYZ_c2s_vpn general-attributes
    address-pool XYZ_c2s_vpn_pool
    tunnel-group XYZ_c2s_vpn ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect icmp
      inspect ip-options
    service-policy global_policy global
    privilege show level 3 mode exec command running-config
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command crypto
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:caa7476cd348ed89b95d37d4e3c9e1d8
    : end
    XYZ#

    Thanks Javier.
    But i have revised the VPN confuration. Below are the latest configs. with this latest configs. I'm getting username & password screen while connecting cisco vpn client software. once we entered the login credential. it shows "security communication channel" then it goes to "not connected" state. Can you help me to fix this.
    access-list ACL-RA-SPLIT standard permit host 10.10.1.3
    access-list ACL-RA-SPLIT standard permit host 10.10.1.13
    access-list ACL-RA-SPLIT standard permit host 10.91.130.201
    access-list nonat line 1 extended permit ip host 10.10.1.3 172.30.10.0 255.255.255.0
    access-list nonat line 2 extended permit ip host 10.10.1.13 172.30.10.0 255.255.255.0
    access-list nonat line 3 extended permit ip host 10.91.130.201 172.30.10.0 255.255.255.0
    ip local pool CO-C2S-VPOOL 172.30.10.51-172.30.10.254 mask 255.255.255.0
    group-policy CO-C2S internal
    group-policy CO-C2S attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list vlauel ACL-RA-SPLIT
    dns-server value 10.10.1.3
    tunnel-group TUN-RA-SPLIT type remote-access
    tunnel-group TUN-RA-SPLIT general-attributes
    default-group-policy CO-C2S
    address-pool CO-C2S-VPOOL
    tunnel-group TUN-RA-SPLIT ipsec-attributes
    pre-shared-key sekretk3y
    username ra-user1 password passw0rd1 priv 1
    group-policy CO-C2S internal
    group-policy CO-C2S attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list vlauel ACL-RA-SPLIT
    dns-server value 10.10.1.3
    tunnel-group TUN-RA-SPLIT type remote-access
    tunnel-group TUN-RA-SPLIT general-attributes
    default-group-policy CO-C2S
    address-pool CO-C2S-VPOOL
    tunnel-group TUN-RA-SPLIT ipsec-attributes
    pre-shared-key *********
    username ******* password ******** priv 1
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set 3DES
    crypto map Outside_Map 500 ipsec-isakmp dynamic dynmap
    crypto isakmp identify address
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encr 3des
    hash sha
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set 3DES
    crypto map Outside_Map 500 ipsec-isakmp dynamic dynmap
    crypto map vpn interface outside
    crypto isakmp identify address
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encr 3des
    hash sha
    group 1
    lifetime 3600

  • FTP Port ERROR Forwarding in Cisco ASA 8.2(5), Very Intersting.

    Hi,
    I  have the following configuration on a Cisco ASA 8.2(5), all the traffic  to the port 5000 go to an IP Camera and www 80 it's forward throught static NAT to a Web Server without problem,  I have the same Configuration for a FTP SERVER Windows and FTP Server Linux and doesn't make the foward to an internal IP address.  Attach is  the configuration I would like to know what is causing the problems.
    The  FTP Server Are running locally without any problems, when I try to  reach it for the Outside interface then i  can't, this is in the only  port i can't forward.
    I really appreciate your help.
    Thanks
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password dAWCvYvyr2FRISo5 encrypted
    passwd dAWCvYvyr2FRISo5 encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.2 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    ftp mode passive
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 8.8.4.4
    name-server 8.8.8.8
    name-server 196.3.81.132
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service TEST2 tcp
    port-object eq www
    port-object eq https
    access-list 101 extended permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list 101 extended permit icmp any interface outside echo-reply
    access-list 101 extended permit udp any any eq 5000
    access-list 101 extended permit udp any any eq ntp
    access-list 101 extended permit udp any 192.168.1.0 255.255.255.0 eq tftp
    access-list 102 extended permit icmp any interface outside echo-reply
    access-list 102 extended permit icmp any interface outside
    access-list 102 extended permit ip any host 192.168.1.5
    access-list 102 extended permit tcp any host 192.168.1.5 eq 5000
    access-list 102 extended permit tcp any interface outside eq 5000
    access-list 102 extended permit tcp any host 192.168.1.5 eq https
    access-list 102 extended permit tcp any any eq 5000
    access-list 102 extended permit ip any host 192.168.1.8
    access-list 102 extended permit tcp any any eq telnet
    access-list 102 extended permit tcp any interface outside object-group TEST2
    access-list 102 extended permit ip any 192.168.1.0 255.255.255.0
    access-list 102 extended permit tcp any interface outside eq www
    access-list 102 extended permit tcp any interface outside eq ftp
    access-list 102 extended permit tcp any interface outside eq ftp-data
    access-list 102 extended permit tcp any any eq ftp
    access-list 103 extended permit udp any 192.168.1.0 255.255.255.0 eq tftp
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.1.0 255.255.255.0
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 5000 192.168.1.5 5000 netmask 255.255.255.255
    static (inside,outside) tcp interface www 192.168.1.15 www netmask 255.255.255.255
    static (inside,outside) tcp interface ftp 192.168.1.15 ftp netmask 255.255.255.255
    static (inside,outside) tcp interface ftp-data 192.168.1.15 ftp-data netmask 255.255.255.255
    access-group 102 in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 225.255.255.0 inside
    telnet timeout 30
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.10-192.168.1.41 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cabelen password tJPt4MkXkeex6ITZ encrypted
    class-map ftp-class
    match access-list 102
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect dns preset_dns_map
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:3465bc9d04198e9df80787c0c039db27
    : end
    ciscoasa#

    This is the results of the log it didn't not find the public ip address which im making FTP connection.
    ciscoasa#  sh logg | i 147.197.115.171
    ciscoasa#  sh logg
    Syslog logging: enabled
        Facility: 20
        Timestamp logging: disabled
        Standby logging: disabled
        Debug-trace logging: disabled
        Console logging: disabled
        Monitor logging: disabled
        Buffer logging: level debugging, 88 messages logged
        Trap logging: disabled
        History logging: disabled
        Device ID: disabled
        Mail logging: disabled
        ASDM logging: level informational, 68 messages logged
    connection 125407 for outside:111.221.74.28/443 to inside:192.168.1.24/24483 duration 0:02:01 bytes
    44
    %ASA-7-609002: Teardown local-host outside:111.221.74.28 duration 0:02:01
    %ASA-7-710005: UDP request discarded from 192.168.1.24/138 to inside:192.168.1.255/138
    %ASA-6-302016: Teardown UDP connection 125402 for outside:177.0.186.239/57036 to inside:192.168.1.24
    /24483 duration 0:02:02 bytes 220
    %ASA-7-609002: Teardown local-host outside:177.0.186.239 duration 0:02:02
    %ASA-6-302016: Teardown UDP connection 125408 for outside:89.240.135.18/47096 to inside:192.168.1.24
    /24483 duration 0:02:01 bytes 44
    %ASA-7-609002: Teardown local-host outside:89.240.135.18 duration 0:02:01
    %ASA-6-302016: Teardown UDP connection 125409 for outside:111.221.77.145/40037 to inside:192.168.1.2
    4/24483 duration 0:02:01 bytes 486
    %ASA-7-609002: Teardown local-host outside:111.221.77.145 duration 0:02:01
    %ASA-6-302016: Teardown UDP connection 125410 for outside:64.4.23.148/40014 to inside:192.168.1.24/2
    4483 duration 0:02:01 bytes 178
    %ASA-7-609002: Teardown local-host outside:64.4.23.148 duration 0:02:01
    %ASA-6-305012: Teardown dynamic UDP translation from inside:192.168.1.24/24483 to outside:69.86.151.
    109/54119 duration 0:03:00
    %ide:216.146.39.70/80 to inside:192.168.1.5/3628 duration 0:00:00 bytes 303 TCP FINs
    %ASA-7-609002: Teardown local-host outside:216.146.39.70 duration 0:00:00
    nable_15' executed the 'configure terminal' command.
    %ASA-6-302015: Built inbound UDP connection 125412 for inside:192.168.1.20/68 (192.168.1.20/68) to i
    dentity:192.168.1.2/67 (192.168.1.2/67)
    %ASA-6-604103: DHCP daemon interface inside:  address granted 0128.987b.d28e.e7 (192.168.1.20)
    %ASA-6-302016: Teardown UDP connection 125411 for inside:192.168.1.27/68 to identity:192.168.1.2/67
    duration 0:02:01 bytes 623
    %ASA-5-111008: User 'enable_15' executed the 'no access-list 102 extended permit ip any 192.168.1.0
    255.255.255.0' command.
    %ASA-6-302010: 20 in use, 234 most used
    %ASA-5-111008: User 'enable_15' executed the 'no access-list 102 extended permit ip any host 192.168
    .1.8' command.
    %ASA-5-111005: 192.168.1.24 end configuration: OK
    %ASA-6-302016: Teardown UDP connection 125412 for inside:192.168.1.20/68 to identity:192.168.1.2/67
    duration 0:02:01 bytes 641
    %ASA-7-609001: Built local-host outside:209.128.96.248
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.20/57764 to outside:69.86.151.109
    /50424
    %ASA-6-302013: Built outbound TCP connection 125413 for outside:209.128.96.248/80 (209.128.96.248/80
    ) to inside:192.168.1.20/57764 (69.86.151.109/50424)
    %ASA-7-111009: User 'enable_15' executed cmd: show running-config
    %ASA-7-111009: User 'enable_15' executed cmd: show logging
    %ASA-7-609001: Built local-host outside:174.35.22.69
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.24/51106 to outside:69.86.151.109
    /53818
    %ASA-6-302013: Built outbound TCP connection 125414 for outside:174.35.22.69/80 (174.35.22.69/80) to
    inside:192.168.1.24/51106 (69.86.151.109/53818)
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.24/51107 to outside:69.86.151.109
    /12433
    %ASA-6-302013: Built outbound TCP connection 125415 for outside:174.35.22.69/80 (174.35.22.69/80) to
    inside:192.168.1.24/51107 (69.86.151.109/12433)
    %ASA-7-609001: Built local-host outside:8.8.8.8
    %ASA-6-305011: Built dynamic UDP translation from inside:192.168.1.24/51214 to outside:69.86.151.109
    /42103
    %ASA-6-302015: Built outbound UDP connection 125416 for outside:8.8.8.8/53 (8.8.8.8/53) to inside:19
    2.168.1.24/51214 (69.86.151.109/42103)
    %ASA-6-302016: Teardown UDP connection 125416 for outside:8.8.8.8/53 to inside:192.168.1.24/51214 du
    ration 0:00:00 bytes 176
    %ASA-7-609002: Teardown local-host outside:8.8.8.8 duration 0:00:00
    %ASA-6-302014: Teardown TCP connection 125414 for outside:174.35.22.69/80 to inside:192.168.1.24/511
    06 duration 0:00:06 bytes 2075 TCP FINs
    %ASA-6-302014: Teardown TCP connection 125415 for outside:174.35.22.69/80 to inside:192.168.1.24/511
    07 duration 0:00:06 bytes 3016 TCP FINs
    %ASA-7-609002: Teardown local-host outside:174.35.22.69 duration 0:00:06
    ciscoasa#

Maybe you are looking for

  • "sequence 'JDR_DOCUMENT_ID_S' is corrupt"  using JPXImporter

    used JPX Import to load components with the following command : java oracle.jrad.tools.xml.importer.JPXImporter $JAVA_TOP/cggv/oracle/apps/per/selfservice/appraisals/server/MgrAppraisalsInProgressVOEx.jpx -username apps -password $mp_apps -dbconnecti

  • My internet is slowing down - sometimes the whole computer does too......

    Hi, Is any one able to give me some advice with this? My iMac is now about 18 months old. Over the past 4-6 months it has gradually got slower. I have noticed this mainly on the internet. Some days it takes about 3-4 minutes to load one page or can't

  • Will Apple replace my charger for free?

    Got my macbook in august of last year. The charger just recently stopped working about three days ago (I haven't done anything to it. The part that actually plugs into the computer is fine, I believe theres something wrong with the wiring inside of i

  • ORA-13050 unable to construct spatial object - Error

    Hi friends!, I to realize the follow query: SELECT A.MI_PRINX, B.DESCRIP FROM PEVEDISC A, PEVEGEO B WHERE SDO_GEOM.RELATE(A.GEOLOC,'ANYINTERACT',B.GEOLOC,0.005) = 'TRUE' AND SDO_GEOM.RELATE(A.GEOLOC,'TOUCH',B.GEOLOC,0.005) = 'FALSE' AND ROWNUM <= 10

  • Bridge Email Folders Don't Match Email Folder Structure on my Torch 9850

    Hi, Wondering if anyone else has run into this. Shortly after getting a new BB and the PB and using them, I re-arranged my folders in lotus notes to make it easier to sort through them on the BB and PB. After rearranging, the folder structure updated