Group by in Interface

Dear all,
how we can use group by in interface
thanks
Naseer

Hi Naseer,
How are you?
It doesn't require to specify GROUP BY in your interface, as ODI automatically applies GROUP BY for any SQL standard transformation. One thing you have to make it clear is that you have to run the column either in SOURCE or STAGING and your are not using any aggregate functions and you are not using any CASE/SYSDATE function in your mappings.
Thanks,
G

Similar Messages

  • How to use Start Task Group for Workflow Interface

    Hi all,
    anyone who can tell me how to use the Interface IFWFTSKGRP (Start Task Group for Workflow Interface)?
    As far as I understood the documentation it can be used to restrict the selection of workflows that can be started in the Generic Object Services. But the question is how to implement it.
    Best regards,
    Carsten
    Edited by: Carsten Drewes on Jun 10, 2009 10:30 AM

    Hi, Carsten,
    (probably it's a bit too late to post an answer after 3 years , but I'll post it in case someone else needs it)
    You should implement GetTaskGroup method.
    The code should return id of the task group (otype TG, mantained in PFTC) that holds the list of workflow definitions.
    Here is a sample implementation. It's taken from FORMABSENC business object. It belongs to SAP demo workflow "Notification of Absence". I suppose it should be present in most systems and you can see it in action.
    begin_method gettaskgroup changing container.
    DATA: taskgroup LIKE rhobjects-object.
    *- set task group
    taskgroup = 'TG70000023'.
      *- set result
    swc_set_element container result taskgroup.
    end_method.

  • IDSM-2 virtualization with the exception of VLAN groups on inline interface

    Please comment the feature that the IDSM-2 supports virtualization with the exception of VLAN groups on inline interface pairs.
    (http://www.cisco.com/en/US/docs/security/ips/6.0/configuration/guide/cli/cliAnEng.html)
    How can one configure VLAN groups on inline pairs? Please give an example by CLI.

    The IDSM-2 does support Inline Vlan Pairs as the previous responder described. You can have up to 250 inline vlan pairs on an interface.
    The IDSM-2 does NOT support Vlan Groups on an Inline Interface Pair.
    The Appliances do support Vlan Groups on an Inline Interface Pair because they can have a switch on one side, and another switch (or router, or firewall) on the other side. The 2 devices could then be Trunking multiple vlans through the Appliance.
    You cannot, however, do this with an IDSM-2.
    Vlan IDs are not modified when going through an Inline Interface Pair. Which means the same vlan must exist on both sides of the pair.
    The problem with the IDSM-2 is that for Inline Interface Pair to work each port must be an Access Port for a different vlan. So the Inline Interface Pair joins 2 different vlans. Since it cannot rewrite the vlan headers the packets Must enter the IDSM-2 WITHOUT vlan headers so they can be passed between the 2 different vlans. Since the packets won't have vlan header you can not make vlan groups.
    if you need to rewrite the vlan header (usually because you need more than 1 pair of vlans), then you use Inline Vlan Pairs on a single interface instead of Inline Intercface Pairs.

  • Cisco 877w -Configuration of subinterfaces and main interface within the same bridge group is not permitted

    Hi,
    I have another problem - after upgrade ios wirelles connection not work.
    After reload i have :
    Configuration of subinterfaces and main interface
    within the same bridge group is not permitted
    STP: Unable to get the port parameters.
    Please configure the bridge group on this interface first.
    Please configure the bridge group on this interface first.
    Please configure the bridge group on this interface first.
    SETUP: new interface NVI0 placed in "shutdown" state
    my old configuration work propertly in the old software, but after update i have notificatio.
    Old thread:
    https://supportforums.cisco.com/discussion/12379491/cisco-877w-no-wireless-connection
    my current sh run:
    version 12.4 
    no service pad 
    service tcp-keepalives-in 
    service tcp-keepalives-out 
    service timestamps debug datetime msec localtime 
    service timestamps log datetime msec localtime 
    service password-encryption 
    hostname cisco 
    boot-start-marker 
    boot system flash:c870-advipservicesk9-mz.124-24.T6.bin 
    boot-end-marker 
    logging message-counter syslog 
    logging buffered 4096 informational 
    enable secret 5 $1$eCNp$rWuBfZ/cexnwnkm7L447s. 
    aaa new-model 
    aaa session-id common 
    dot11 syslog 
    dot11 ssid ciscowifi 
     vlan 1 
     authentication open 
     authentication key-management wpa 
     guest-mode 
     wpa-psk ascii 7 050D031D26595D0617 
    dot11 wpa handshake timeout 500 
    ip source-route 
    no ip dhcp use vrf connected 
    ip dhcp excluded-address 192.168.56.1 
    ip dhcp pool CLIENT 
       import all 
       network 192.168.56.0 255.255.255.0 
       default-router 192.168.56.1 
       dns-server 8.8.8.8 194.204.159.1 194.204.152.34 
       lease 0 2 
    ip cef 
    no ip domain lookup 
    no ipv6 cef 
    multilink bundle-name authenticated 
    username marek password 7 00121A0908500A 
    archive 
     log config 
      hidekeys 
    ip tcp path-mtu-discovery 
    bridge irb 
    interface ATM0 
     description Polaczenie ADSL do ISP$ES_WAN$ 
     no ip address 
     no atm ilmi-keepalive 
     pvc 0/35 
      encapsulation aal5mux ppp dialer 
      dialer pool-member 1 
     hold-queue 224 in 
    interface FastEthernet0 
     description Edzia 
    interface FastEthernet1 
     description dom 
    interface FastEthernet2 
     description Dziadek 
    interface FastEthernet3 
    interface Dot11Radio0 
     no ip address 
     no ip redirects 
     ip local-proxy-arp 
     ip nat inside 
     ip virtual-reassembly 
     no dot11 extension aironet 
     encryption vlan 1 mode ciphers tkip 
     encryption mode ciphers aes-ccm tkip 
     broadcast-key change 3600 
     ssid ciscowifi 
     speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 
     station-role root 
     world-mode dot11d country AU indoor 
     no cdp enable 
     bridge-group 1 
     bridge-group 1 subscriber-loop-control 
     bridge-group 1 spanning-disabled 
     bridge-group 1 block-unknown-source 
     no bridge-group 1 source-learning 
     no bridge-group 1 unicast-flooding 
    interface Dot11Radio0.1 
     description ciscowifi 
     encapsulation dot1Q 1 native 
     no cdp enable 
    interface Vlan1 
     no ip address 
     bridge-group 1 
    interface Dialer0 
     description Interfejs dzwoniacy 
     ip address negotiated 
     ip nat outside 
     ip virtual-reassembly 
     encapsulation ppp 
     dialer pool 1 
     dialer-group 1 
     ppp chap hostname [email protected] 
     ppp chap password 7 xxxxxxxxxxxxxxxxxxxxxx 
    interface BVI1 
     description Polaczenie dla sieci LAN 
     ip address 192.168.56.1 255.255.255.0 
     ip nat inside 
     ip virtual-reassembly 
    no ip forward-protocol nd 
    ip route 0.0.0.0 0.0.0.0 Dialer0 
    no ip http server 
    no ip http secure-server 
    ip nat inside source list 100 interface Dialer0 overload 
    ip nat inside source static tcp 192.168.56.10 80 interface Dialer0 80 
    ip nat inside source static tcp 192.168.56.10 22 interface Dialer0 22 
    logging trap debugging 
    logging 192.168.56.10 
    access-list 100 permit ip 192.168.56.0 0.0.0.255 any 
    access-list 100 deny   ip any any 
    no cdp run 
    snmp-server community ciskacz RO 
    snmp-server chassis-id ciskacz 
    control-plane 
    bridge 1 protocol ieee 
    bridge 1 route ip 
    line con 0 
     no modem enable 
    line aux 0 
    line vty 0 4 
     exec-timeout 0 0 
     transport preferred ssh 
     transport input ssh 
    scheduler max-task-time 5000 
    end 
    please help - thanks!

    Hello Marek,
    I suppose you are not planning to do any kinds of advanced config using several VLANs and multiple SSIDs so let's just make your configuration simple and working.
    In short, you need to remove all references to VLAN 1 and to any subinterfaces possibly related to the VLAN 1. This means in particular (follow these steps in sequence):
    Remove the Dot11Radio0.1 subinterface entirely
    In the Dot11Radio0 section, remove the encryption vlan 1 mode ciphers tkip command
    In the dot11 ssid ciscowifi section, remove the vlan 1 command
    After performing these steps, make sure that the ssid ciscowifi and encryption mode commands are still present in the Dot11Radio0 configuration, and if not, reenter them.
    Best regards,
    Peter

  • Can single interface accomodates multiple bridge groups

    Hi,   
    I am working on building FW configuration to serve multiple tier environment. The FW is in Transparent Mode, Sw Ver 8.4 which supports Bridge-group.
    My question is, whether FW supports having mutilple Bridge-groups under single interface. If not, what are the alternatives.
    firewall transparent
    interface gi0/0
    nameif outside
    security-level 0
    bridge-group-1
    bridge-group-2
    interface gi0/1
    nameif WebServers
    security-level 50
    bridge-group-1
    interface e0/2
    nameif AppServers
    security-level 100
    bridge-group-2
    Thanks

    Hello,
    That is not possible, Each interface will need to be assigned to a specific bridge group..
    Alternative would be to use a dedicated pair of interfaces for each bridge group
    Regards,
    Julio

  • User Interface Localizer - Radio group bug

    When I click "Next" or "Next Untranslated" on the last item in a radio group, the User Interface Localizer crashes. I have CVI 9.1.1.
    I know the workaround but thought it worth reporting. 
    --Ian

    Thanks for reporting this. A bug report has been created (#302870).

  • Change Interface to Interface Group for WLAN

    Hi Guys,
    We have 2 WISMs here and one WLAN connected to interface "Int1" and they are working fine. For now, we want to expand the IP addresses of this SSID, so we created several VLANs as well as some interfaces in WLC and created a interface group to contain all the interfaces (includes to original "Int1"). When we tried to change the interface to the interface group under that SSID, we found that the clients lost the connection. We even tried to put only the "Int1" in the interface group. Is there any way to expand the IP addresses without network outage? Thanks!

    Check the following link for proper interface grouping.
    http://mrncciew.com/2013/02/27/configuring-dynamic-interfaces-on-wlc/
    NOte:re-create and re-test the Int group with few Interface in the group and then add more.

  • ASA 5505 backup interface

    Hello,
    I have setup ASA 5505 with 2 ISP, named outside (primary)  and backup, the scenario is if outside down, then backup will take over, it works now.
    But it is not working when the primary connection cannot reach the gateway with the interface still up.
    Is it possible when the primary connection cannot reach the gateway then backup automatically take over?
    Thanks before..
    My configuration is:
    ASA Version 8.2(1)
    hostname cisco
    domain-name default_domain
    enable password ********* encrypted
    passwd ********* encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 172.10.10.10 255.255.255.0
    interface Vlan3
    no forward interface Vlan2
    nameif backup
    security-level 0
    ip address 172.20.10.10 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 1
    interface Ethernet0/1
    switchport access vlan 2
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default domain
    same-security-traffic permit intra-interface
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu backup 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (inside) 1 interface
    global (outside) 1 interface
    global (backup) 1 interface
    nat (inside) 1 192.168.1.0 255.255.255.0
    access-group inside_out in interface inside
    access-group outside_in in interface outside
    access-group backup_in in interface backup
    route outside 0.0.0.0 0.0.0.0 172.10.10.1 1
    route backup 0.0.0.0 0.0.0.0 172.20.10.1 254
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd lease 1048575
    dhcpd auto_config outside
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:24af050f332deab3e38eb578f8081d05
    : end

    Hi Amrin,
    you can configure SLA monitoring on ASA and that woudl work fine for you:
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806e880b.shtml
    Hope that helps.
    Thanks,
    Varun

  • Interface on asa.

    Hi ,
    I have connected a firewall inside interface to l3 switch.
    on l3 switch
    int gi0/1
    no switchport
    ip address 192.168.10.1 255.255.255.0
    no shut    
    on firewall
    int gi0/1
    nameif inside
    security level 100
    ip address 192.168.10.2 255.255.255.0
    If i ping to 192.168.10.2 from firewall thus it ping.
    As i know inside host can ping to inside interface.But not any opposite interface such as dmz etc.(need access-list)

    Hi Prashant,
    Here are two things involved.
    1. Ping to the far end interface.
    The ASA will not allow to ping the far end interface, for example is you are a host connected on the Inside network and ping the Inside interface the ASA will reply, but if you try to ping the DMZ interface from a host on the inside this will not answer and is expected.
    2. Permit traffic from lower to higer interfaces.
    All the traffic from higher interface level to lower interface level is permitted by default but is deny the other way around, from lower to higher.
    If you need to permit traffic from lower to higher you need to enter a access-list on the lower level interface to permit traffic to the higher security level (If you are on version 8.2 or earlier you might need to add a NAT rule)
    For example:
    Inside security level 100
    Outside security level 0
    Inside host 192.168.1.1
    access-list outside_access_in permit ip any host 192.168.1.1
    access-group outside_access_in in interface outside
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806745b8.shtml
    I hope these helps.
    Regards
    Godfrey

  • I can Ping FW inside interface but can not connect to remote resources

    dear all
    i configer my asa 5520 through ASDM to enable VPN Connection , i follow the cisco steps and it works fine and the anyconnect version 3.1 in Windows 8 - one day troubleshoot for this point only - can connect and have an IP address from the range , but i have something wrong in NAT may be because all guides talking about old ASDM ( NAT Exempt) but i am confeused to apply it on the new ASDM.
    i can ping the inside interface  from my labtop which using anyconnect , but i can not access anything else inside my network
    Please anyone has a solution , please describe it using ASDM , thanks for help
    This is my configuration
    interface GigabitEthernet0/1
    description
    nameif SRV_ZONE
    security-level 50
    ip address 192.168.1.1 255.255.255.0
    interface GigabitEthernet0/2
    description
    nameif TRUST_ZONE
    security-level 100
    ip address 172.17.200.1 255.255.255.0
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif MGMT
    security-level 0
    ip address 10.10.10.1 255.255.255.0
    dns server-group DefaultDNS
    domain-name xxx.xxx.xxx
    object network obj-192.168.1.11
    host 192.168.1.11
    object network obj-xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object service obj-tcp-source-eq-25
    service tcp source eq smtp
    object network obj-192.168.1.12
    host 192.168.1.12
    object network obj-xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object network obj-192.168.1.0
    subnet 192.168.1.0 255.255.255.0
    object service obj-tcp-eq-25
    service tcp destination eq smtp
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network obj-0.0.0.0
    host 0.0.0.0
    object network obj_any-01
    subnet 0.0.0.0 0.0.0.0
    object network obj-172.17.8.8
    host 172.17.8.8
    object network obj-172.17.0.0
    subnet 172.17.0.0 255.255.0.0
    object network obj_any-02
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-03
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-04
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-05
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-06
    subnet 0.0.0.0 0.0.0.0
    object network obj.172.17.8.115
    host 172.17.8.115
    object network obj.xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object service http
    service tcp source eq www destination eq www
    object network obj.xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object service https
    service tcp source eq https destination eq https
    object service newservice
    service tcp source eq pop3 destination eq pop3
    object network mail
    host 172.17.8.8
    description mail     
    object network 192.168.1.11
    host 192.168.1.11
    description smtp     
    object service smtpnew
    service tcp source eq 587 destination eq 587
    object network VPN_RANGE
    description VPN ACCESS RANGE  
    object network VPN_PoOL
    subnet 172.17.16.0 255.255.255.0
    description vpn
    object-group network DM_INLINE_NETWORK_1
    network-object host 192.168.1.11
    network-object host 192.168.1.12
    object-group network Eighth_Floor
    network-object 172.17.8.0 255.255.255.0
    object-group service WEB_SERVICES
    service-object tcp destination eq www
    object-group network ENT_SERVERS
    network-object host 192.168.1.11
    network-object host 192.168.1.1
    object-group network DM_INLINE_NETWORK_2
    network-object 172.17.200.0 255.255.255.0
    network-object 172.17.8.0 255.255.255.0
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq www
    port-object eq https
    port-object eq smtp
    object-group service web tcp
    port-object eq www
    port-object eq xxx
    port-object eq ftp
    port-object eq xxx
    port-object eq xxx
    object-group service xxx_Web_and_Email
    service-object object http
    service-object tcp destination eq pop3
    service-object tcp destination eq smtp
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    access-list DMZ_access_in extended permit ip 192.168.1.0 255.255.255.0 172.17.0.0 255.255.0.0
    access-list DMZ_access_in extended permit ip 192.168.1.0 255.255.255.0 any
    access-list justice_splitTunnelAcl standard permit 10.100.100.0 255.255.255.0
    access-list xxx-VPN_splitTunnelAcl remark vpn
    access-list xxx-VPN_splitTunnelAcl standard permit 172.17.16.0 255.255.255.0
    access-list xxx-VPN_splitTunnelAcl standard permit any
    access-list cap extended permit tcp any host xxx.xxx.xxx.xxx eq smtp log
    access-list cap1 extended permit tcp host 192.168.1.11 any eq smtp
    access-list SRV_ZONE_nat_outbound extended permit tcp 192.168.1.0 255.255.255.0 any eq smtp
    access-list SRV_ZONE_nat_outbound extended permit ip host 192.168.1.11 any
    access-list TRUST_ZONE_access_in extended permit ip host 172.17.88.108 any
    access-list TRUST_ZONE_access_in extended permit object-group DM_INLINE_PROTOCOL_2 10.10.3.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit object-group DM_INLINE_PROTOCOL_3 10.10.50.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit ip 172.17.8.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit ip 172.17.200.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit ip 172.17.0.0 255.255.0.0 host 192.168.1.12
    access-list TRUST_ZONE_cryptomap extended permit ip xxx.xxx.xxx.xxx 255.255.255.248 any
    access-list outside_access_in extended permit tcp any host 192.168.1.11 eq smtp
    access-list outside_access_in extended permit tcp any host 172.17.8.8 eq www
    access-list outside_access_in extended permit tcp any host 192.168.1.12 object-group web
    access-list outside_access_in extended permit tcp any host 172.17.8.8 eq pop3
    access-list outside_access_in extended permit ip 172.17.16.0 255.255.255.0 any inactive
    access-list vpn remark vpn
    access-list vpn standard permit 172.17.16.0 255.255.255.0
    pager lines 24
    logging enable
    logging trap informational
    logging asdm informational
    logging host TRUST_ZONE 172.17.8.100
    mtu INT_ZONE 1500
    mtu SRV_ZONE 1500
    mtu TRUST_ZONE 1500
    mtu MGMT 1500
    ip local pool VPN_POOL 172.17.16.100-172.17.16.254 mask 255.255.255.0
    ip verify reverse-path interface INT_ZONE
    ip verify reverse-path interface SRV_ZONE
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any SRV_ZONE
    icmp permit any TRUST_ZONE
    asdm image disk0:/asdm-635.bin
    no asdm history enable
    arp timeout 14400
    nat (SRV_ZONE,INT_ZONE) source static obj-192.168.1.11 obj-xxx.xxx.xxx.xxx service any obj-tcp-source-eq-25
    nat (SRV_ZONE,INT_ZONE) source static obj-192.168.1.12 obj-xxx.xxx.xxx.xxx
    nat (SRV_ZONE,INT_ZONE) source dynamic obj-192.168.1.0 interface service obj-tcp-eq-25 obj-tcp-eq-25
    nat (INT_ZONE,SRV_ZONE) source static any any destination static 192.168.1.11 obj-172.17.8.8 service obj-tcp-source-eq-25 obj-tcp-source-eq-25
    nat (TRUST_ZONE,INT_ZONE) source static VPN_PoOL VPN_PoOL destination static VPN_PoOL VPN_PoOL
    object network obj_any
    nat (SRV_ZONE,INT_ZONE) dynamic obj-0.0.0.0
    object network obj_any-01
    nat (SRV_ZONE,MGMT) dynamic obj-0.0.0.0
    object network obj-172.17.8.8
    nat (TRUST_ZONE,INT_ZONE) static xxx.xxx.xxx.xxx service tcp www www
    object network obj-172.17.0.0
    nat (TRUST_ZONE,SRV_ZONE) static 172.17.0.0
    object network obj_any-02
    nat (TRUST_ZONE,INT_ZONE) dynamic interface
    object network obj_any-03
    nat (TRUST_ZONE,SRV_ZONE) dynamic interface
    object network obj_any-04
    nat (TRUST_ZONE,INT_ZONE) dynamic obj-0.0.0.0
    object network obj_any-05
    nat (TRUST_ZONE,SRV_ZONE) dynamic obj-0.0.0.0
    object network obj_any-06
    nat (TRUST_ZONE,MGMT) dynamic obj-0.0.0.0
    object network obj.172.17.8.115
    nat (TRUST_ZONE,INT_ZONE) static obj.xxx.xxx.xxx.xxx service tcp www www
    object network mail
    nat (TRUST_ZONE,INT_ZONE) static obj-xxx.xxx.xxx.xxx service tcp pop3 pop3
    nat (TRUST_ZONE,INT_ZONE) after-auto source static obj-172.17.8.8 obj-xxx.xxx.xxx.xxx service https https
    access-group outside_access_in in interface INT_ZONE
    access-group DMZ_access_in in interface SRV_ZONE
    access-group TRUST_ZONE_access_in in interface TRUST_ZONE
    route INT_ZONE 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    route TRUST_ZONE 10.10.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 10.11.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 10.12.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 10.13.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 172.17.0.0 255.255.0.0 172.17.200.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 172.17.8.0 255.255.255.0 TRUST_ZONE
    http 172.17.8.155 255.255.255.255 TRUST_ZONE
    http 172.17.8.45 255.255.255.255 TRUST_ZONE
    http 10.10.10.2 255.255.255.255 MGMT
    http 192.168.1.12 255.255.255.255 SRV_ZONE
    http 0.0.0.0 0.0.0.0 INT_ZONE
    http 172.17.200.0 255.255.255.0 TRUST_ZONE
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map pol 1 match address TRUST_ZONE_cryptomap
    crypto dynamic-map pol 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map INT_ZONE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map TRUST_ZONE_map0 1 ipsec-isakmp dynamic pol
    crypto map TRUST_ZONE_map0 interface TRUST_ZONE
    crypto map INT_ZONE_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map INT_ZONE_map0 interface INT_ZONE
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn SEC-xxx-FW1
    subject-name CN=SEC-xxx-FW1
    no client-types
    proxy-ldc-issuer
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment self
    subject-name CN=SEC-xxx-FW1
    keypair sslvpnkeypair
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 31
        57f4e52e 6b851966 77515d62 c209a0df 1c32ce94 bb90cbce 497cfd04 6745ea85
        efb75f85 2ae1ad35 344d94ab 915e01ab d3292626 ac697a52 b4ed6632 d3ed2332 ae
      quit
    crypto ca certificate chain ASDM_TrustPoint1
    certificate e6054352
        c64f3661 30f14c3d 06b5f039 9f14560d 3b154fd1 42782268 7531689e 8e547d91
        85e88415 e326f653 74733a6c a3f5c935 f7e83f56 f6
      quit
    crypto isakmp enable INT_ZONE
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 INT_ZONE
    ssh 172.17.8.0 255.255.255.0 TRUST_ZONE
    ssh 10.10.10.2 255.255.255.255 MGMT
    ssh timeout 5
    console timeout 0
    management-access TRUST_ZONE
    vpn load-balancing
    interface lbpublic INT_ZONE
    interface lbprivate INT_ZONE
    priority-queue INT_ZONE
      tx-ring-limit 256
    threat-detection basic-threat
    threat-detection scanning-threat
    threat-detection statistics host number-of-rate 3
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint1 INT_ZONE
    webvpn
    enable INT_ZONE
    svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy xxx-VPN internal
    group-policy xxx-VPN attributes
    dns-server value xx.xx.xx.xx xx.xx.xx.xx
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value xxx-VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol webvpn
    group-policy GPNEW internal
    group-policy GPNEW attributes
    dns-server value 172.17.8.41
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    default-domain value xxx.xxx.xxx
    address-pools value VPN_POOL
    username VPNAM password xxx encrypted
    username VPNAM attributes
    service-type remote-access
    vpn-group-policy xxx-VPN
    tunnel-group xxx-VPN type remote-access
    tunnel-group xxx-VPN general-attributes
    dhcp-server 172.17.8.41
    tunnel-group xxx-VPN ipsec-attributes
    pre-shared-key *****
    tunnel-group pol type ipsec-l2l
    tunnel-group pol ipsec-attributes
    pre-shared-key *****
    trust-point ASDM_TrustPoint0
    tunnel-group SSLClientProfile type remote-access
    tunnel-group SSLClientProfile general-attributes
    address-pool VPN_POOL
    default-group-policy GPNEW
    tunnel-group SSLClientProfile webvpn-attributes
    group-alias SSLVPNClient enable
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect ip-options
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:78a941e3f509dec8f3570c60061eedaa
    : end

    thanks god
    i solve the problem
    the problem is in NAT
    i creat an object with the ip address host from VPN pool and name it vpn
    then i do the nat from inside to that host as the following picture...
    trust zone is the inside zone
    vpn is the outside vpn host...
    thanks and hope it helps anyone else...

  • How do I block pings from the outside to the ASA 5505 outside interface?

    I was asked to block pings from the internet to the outside interface of our ASA-5505 firewall.  I found a post that said to enter "icmp deny any outside", however that does not do it.
    I created an ACL to try and do the trick, also to no avail:
    access-list outside_in extended permit icmp any any echo-reply
    access-list outside_in in interface outside
    access-group outside_in in interface outside
    Anyone have a clue what I'm doing wrong?  I'm not the firewall guy as you can tell.  :/
    Thanks in advance...
    Block / Deny ICMP Echo (Ping) on Cisco ASA Outside Interface
    Most networks that you protect with a Cisco ASA device, will probably want to deny ICMP (maybe not all ICMP types, but a lot of network admins will want to block ICMP Echo, etc.) on the outside interface. This will make the network harder to find through external enumeration, but not impossible.
    ASA5505(config)#icmp deny any outside
    You will deny ICMP on the outside interface, but if you include ICMP as a protocol in the default global policy map, you can ping from the inside to any host on the outside, and it will be permitted back through the ASA, as it knows about the previous ICMP “connection

    You are allowing echo-reply, thus it will reply to a ping
    try this ACL:
    icmp deny any echo-reply outside
    From: 
    https://supportforums.cisco.com/thread/223769
    Eric

  • Why i cant access asa 8.4 thruogh asdm from outside interface ???

    hi all ,
    plz help e why i cant access asa asdm from outside interface
    my puclic ip on outisde is :
    x.x.55.34
    i changed  portf of asdm to 65000 because i have portforward  ,
    i tried to connect to my ip thriuogh asdm bu :
    x.x.55.34
    x.x.55.34:65000
    but no luck ,
    it succed if i try to connect locally
    here is my sh run command :
    ====================================================
    ASA5505#
    ASA5505# sh run
    : Saved
    ASA Version 8.4(2)
    hostname ASA5505
    enable password qsddsEGCCSH encrypted
    passwd 2KFsdsdbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 2
    interface Vlan1
    nameif ins
    security-level 100
    ip address 10.66.12.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 50
    ip address x.x.55.34 255.255.255.248
    boot system disk0:/asa842-k8.bin
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network obj-0.0.0.0
    host 0.0.0.0
    object network localsubnet
    subnet 10.66.12.0 255.255.255.0
    description localsubnet
    object network HTTP-Host
    host 10.66.12.249
    description web server
    object network HTTPS-HOST
    host 10.66.12.249
    description Https
    object network RDP-Host
    host 10.66.12.122
    description RDP host
    object network citrix-host
    host 10.66.12.249
    description citrix
    object service rdp
    service tcp destination eq 3389
    object service https
    service tcp destination eq https
    object service citrix
    service tcp destination eq 2598
    object service http
    service tcp destination eq www
    object network RDP1
    host 10.66.12.249
    object network HTTPS-Host
    host 10.66.12.249
    object network CITRIX-Host
    host 10.66.12.249
    object-group network RDP-REDIRECT
    object-group network HTTP-REDIRECT
    object-group network HTTPS-REDIRECT
    object-group network CITRIX-ICA-HDX-REDIRECTION
    object-group network CITRIX-ICA-SESSION-RELIABILITY-REDIRECTION
    object-group service CITRIX-ICA-HDX
    object-group service CITRIX-SR
    object-group service RDP
    object-group network MY-insideNET
    network-object 10.66.12.0 255.255.255.0
    access-list outside_in extended permit tcp any host 10.66.12.249 eq www
    access-list outside_in extended permit tcp any host 10.66.12.249 eq https
    access-list outside_in extended permit tcp any host 10.66.12.249 eq 2598
    access-list outside_in extended permit tcp any host 10.66.12.122 eq 3389
    access-list outside_in extended permit tcp any host 10.66.12.249 eq citrix-ica
    access-list outside_in extended permit tcp any host x.x.55.34 eq 65000
    access-list outside_in extended permit tcp any host x.x.55.34 eq https
    access-list outside_in extended permit ip any any
    pager lines 24
    mtu ins 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-645.bin
    no asdm history enable
    arp timeout 14400
    object network localsubnet
    nat (ins,outside) dynamic interface
    object network HTTP-Host
    nat (ins,outside) static interface service tcp www www
    object network RDP-Host
    nat (ins,outside) static interface service tcp 3389 3389
    object network HTTPS-Host
    nat (ins,outside) static interface service tcp https https
    object network CITRIX-Host
    nat (ins,outside) static interface service tcp citrix-ica citrix-ica
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 62.109.55.33 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable 65000
    http 10.66.12.0 255.255.255.0 ins
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
        308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
        0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
        30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
        13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
        0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
        20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
        65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
        65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
        30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
        30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
        496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
        74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
        68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
        3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
        63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
        0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
        a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
        9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
        7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
        15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
        63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
        18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
        4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
        81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
        db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
        ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
        45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
        2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
        1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
        03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
        69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
        02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
        6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
        c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
        69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
        1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
        551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
        1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
        2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
        4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
        b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
        6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
        481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
        b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
        5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
        6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
        6c2527b9 deb78458 c61f381e a4c4cb66
      quit
    telnet 0.0.0.0 0.0.0.0 outside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access outside
    dhcpd address 10.66.12.160-10.66.12.180 ins
    dhcpd dns 212.112.166.22 212.112.166.18 interface ins
    dhcpd enable ins
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username test password P4ttSdddd3SV8TYp encrypted privilege 15
    username ADMIN password 5dddd3ThngqY encrypted privilege 15
    username drvirus password p03BtCddddryePSDf encrypted privilege 15
    username cisco password edssdsdOAQcNEL encrypted privilege 15
    prompt hostname context
    call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD
    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
    : end

    For access over VPN you need:
    management-access inside
    and don't forget:
    ssh inside
    http inside
    I'm guessing you forgot to grant ASDM (http/https) access to the IP addresses used by the VPN?  Can you SSH?  If not, that is your problem to solve first.

  • Remote Access VPN (ipsec) can ping LAN interface of firewall but not clients on the company network.

    The VPN will connect.
    I can ping and connect to the ASA 5510 on it's LAN interface.
    My problem is that I cannot ping or access anything on the LAN past the firewall. What am I doing wrong?
    Here is my config.
    Result of the command: "show config"
    : Saved
    : Written by enable_15 at 22:55:02.299 UTC Tue Jan 10 2012
    ASA Version 8.2(5)
    hostname ********
    enable password UbBnTPKwu27ohfYB encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address x.x.x.x x.x.x.x
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.0.4.1 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network BC
    network-object 10.0.3.0 255.255.255.0
    network-object 10.0.4.0 255.255.255.0
    access-list outside_access_in extended permit tcp any any eq ssh
    access-list outside_access_in extended permit tcp any any eq 50000
    access-list outside_access_in extended permit tcp any any eq 3390
    access-list outside_access_in extended permit tcp any any eq 8066
    access-list outside_access_in extended permit tcp any any eq 22225
    access-list outside_access_in extended permit tcp any any eq 1600
    access-list outside_access_in extended permit tcp any any eq 37260
    access-list outside_access_in extended permit tcp any any eq 37261
    access-list outside_access_in extended permit tcp any any eq 37262
    access-list outside_access_in extended permit tcp any any eq 37263
    access-list outside_access_in extended permit tcp any any eq 37264
    access-list outside_access_in extended permit tcp any any eq 1435
    access-list outside_access_in extended permit tcp any any eq 250
    access-list outside_access_in extended permit tcp any any eq citrix-ica
    access-list outside_access_in extended permit tcp any any eq 8080
    access-list outside_access_in extended permit tcp any any eq www
    access-list outside_access_in extended permit tcp any any eq 85
    access-list outside_access_in extended permit tcp any any eq 8069
    access-list outside_access_in extended permit tcp any any eq 3389
    access-list outside_access_in extended permit tcp any any eq 23032
    access-list outside_access_in extended permit tcp any any eq 32023
    access-list outside_access_in extended permit tcp any any eq 3399
    access-list outside_access_in extended permit udp any any eq 250
    access-list outside_access_in extended permit udp any any eq 5008
    access-list outside_access_in extended permit icmp any any
    access-list splittunn-ppso extended permit ip 10.0.4.0 255.255.255.0 10.10.10.0 255.255.255.0
    access-list splittunn-ppso extended permit ip 10.0.3.0 255.255.255.0 10.10.10.0 255.255.255.0
    access-list nonat extended permit ip 10.0.4.0 255.255.255.0 10.10.10.0 255.255.255.0
    access-list nonat extended permit ip 10.0.3.0 255.255.255.0 10.10.10.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn-pool 10.10.10.1-10.10.10.254 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 101 interface
    nat (inside) 0 access-list nonat
    nat (inside) 101 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 50000 10.0.4.58 50000 netmask 255.255.255.255
    static (inside,outside) tcp interface ssh 10.0.4.7 ssh netmask 255.255.255.255
    static (inside,outside) tcp interface 3390 10.0.3.249 3390 netmask 255.255.255.255
    static (inside,outside) tcp interface 8066 10.0.3.249 8066 netmask 255.255.255.255
    static (inside,outside) tcp interface 22225 10.0.4.58 22225 netmask 255.255.255.255
    static (inside,outside) tcp interface 1600 10.0.4.58 1600 netmask 255.255.255.255
    static (inside,outside) tcp interface 37260 10.0.4.58 37260 netmask 255.255.255.255
    static (inside,outside) tcp interface 37261 10.0.4.58 37261 netmask 255.255.255.255
    static (inside,outside) tcp interface 37262 10.0.4.58 37262 netmask 255.255.255.255
    static (inside,outside) tcp interface 37263 10.0.4.58 37263 netmask 255.255.255.255
    static (inside,outside) tcp interface 37264 10.0.4.58 37264 netmask 255.255.255.255
    static (inside,outside) tcp interface 1433 10.0.4.240 1433 netmask 255.255.255.255
    static (inside,outside) udp interface 5008 10.0.4.240 5008 netmask 255.255.255.255
    static (inside,outside) udp interface 249 10.0.4.240 249 netmask 255.255.255.255
    static (inside,outside) tcp interface 250 10.0.4.240 250 netmask 255.255.255.255
    static (inside,outside) tcp interface www 10.0.4.15 www netmask 255.255.255.255
    static (inside,outside) tcp interface citrix-ica 10.0.4.15 citrix-ica netmask 255.255.255.255
    static (inside,outside) tcp interface 8080 10.0.4.15 8080 netmask 255.255.255.255
    static (inside,outside) tcp interface 85 10.0.4.15 85 netmask 255.255.255.255
    static (inside,outside) tcp interface 8069 10.0.4.236 8069 netmask 255.255.255.255
    static (inside,outside) tcp interface 3399 10.0.4.236 3389 netmask 255.255.255.255
    static (inside,outside) tcp interface 23032 10.0.4.244 23032 netmask 255.255.255.255
    static (inside,outside) tcp interface 32023 10.0.4.244 32023 netmask 255.255.255.255
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    route inside 10.0.3.0 255.255.255.0 10.0.4.205 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 management
    http x.x.x.x x.x.x.x outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
        308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
        0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
        30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
        13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
        0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
        20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
        65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
        65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
        30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
        30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
        496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
        74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
        68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
        3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
        63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
        0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
        a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
        9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
        7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
        15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
        63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
        18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
        4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
        81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
        db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
        ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
        45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
        2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
        1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
        03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
        69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
        02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
        6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
        c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
        69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
        1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
        551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
        1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
        2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
        4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
        b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
        6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
        481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
        b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
        5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
        6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
        6c2527b9 deb78458 c61f381e a4c4cb66
      quit
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet x.x.x.x 255.255.255.255 outside
    telnet 0.0.0.0 0.0.0.0 inside
    telnet 0.0.0.0 0.0.0.0 management
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 management
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    group-policy ppso internal
    group-policy ppso attributes
    dns-server value 10.0.4.241 10.0.4.14
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value splittunn-ppso
    default-domain value ppso.local
    split-dns value ppso.local
    address-pools value vpn-pool
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    address-pool vpn-pool
    default-group-policy VPN
    tunnel-group VPN ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:88a9b69fc3d718c3badfa99db2c7ce4f

    Yeah, I figured out where my problem was.
    My IP Local Pool range was the problem.
    I was using 10.10.10.0 which conflicted with a point-to-point connection where the serial interfaces were numbered and using 10.10.10.1 and 10.10.10.2.
    Traffic would leave the firewall, hit the intended host, go back through my core router, then off to the other network.
    I changed my ip local pool to a different range (192.168.100.0) and my problem was solved.

  • Permit traffic from Inside to Outside, but not Inside to medium security interface

    Can someone just clarify the following. Assume ASA with interfaces as :
    inside (100)   (private ip range 1)
    guest (50)       (private ip range 2)  
    outside (0)      (internet)
    Example requirement is host on inside has http access to host on outside, but it shouldn’t have http access to host on guest – or any future created interfaces (with security between 1-99).
    What’s the best practice way to achieve this?

    Hi,
    The "security-level" alone is ok when you have a very simple setup.
    I would suggest creating ACLs for each interface and use them to control the traffic rather than using the "security-level" alone for that.
    If you want to control traffic from "inside" to any other interfaces (and its networks) I would suggest the following
    Create and "object-group" containing all of the other network
    Create an ACL for the "inside" interface
    First block all traffic to other networks using the "object-group" created
    After this allow all rest of the traffic
    In the case where you need to allow some traffic to the other networks, insert the rule at the top of the ACL before the rule that blocks all traffic to other networks
    For example a situation where you have interfaces and networks
    WAN
    LAN-1 = 10.10.10.0/24
    LAN-2 = 10.10.20.0/24
    DMZ = 192.168.10.0/24
    GUEST = 192.168.100.0/24
    You could block all traffic from "LAN-1" to any network other than those behind the "WAN" interface with the following configuration.
    object-group network BLOCKED-NETWORKS
    network-object 10.10.20.0 255.255.255.0
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.100.0 255.255.255.0
    access-list LAN-1-IN remark Block Traffic to Other Local Networks
    access-list LAN-1-IN deny ip any object-group BLOCKED-NETWORKS
    access-list LAN-1-IN remark Allow All Other Traffic
    access-list LAN-1-IN permit ip 10.10.10.0 255.255.255.0 any
    This should work if your only need is to control the traffic of the interface "LAN-1". If you want to control each interfaces connections to the others then you could do minor additions
    Have all your local networks configured under the "object-group"This way you can use the same "object-group" for each interface ACL
    object-group network BLOCKED-NETWORKS
    network-object 10.10.10.0 255.255.255.0
    network-object 10.10.20.0 255.255.255.0
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.100.0 255.255.255.0
    access-list LAN-1-IN remark Block Traffic to Other Local Networks
    access-list LAN-1-IN deny ip any object-group BLOCKED-NETWORKS
    access-list LAN-1-IN remark Allow All Other Traffic
    access-list LAN-1-IN permit ip 10.10.10.0 255.255.255.0 any
    access-list LAN-2-IN remark Block Traffic to Other Local Networks
    access-list LAN-2-IN deny ip any object-group BLOCKED-NETWORKS
    access-list LAN-2-IN remark Allow All Other Traffic
    access-list LAN-2-IN permit ip 10.10.20.0 255.255.255.0 any
    access-list DMZ-IN remark Block Traffic to Other Local Networks
    access-list DMZ-IN deny ip any object-group BLOCKED-NETWORKS
    access-list DMZ-IN remark Allow All Other Traffic
    access-list DMZ-IN permit ip 192.168.10.0 255.255.255.0 any
    access-list GUEST-IN remark Block Traffic to Other Local Networks
    access-list GUEST-IN deny ip any object-group BLOCKED-NETWORKS
    access-list GUEST-IN remark Allow All Other Traffic
    access-list GUEST-IN permit ip 192.168.100.0 255.255.255.0 any
    Then you could basically use the same type ACLs in each interface. (Though still separate ACLs for each interface) And as I said if you need to open something between local networks then insert the correct "permit" tule at the top of the ACL.
    Hope this helps
    - Jouni

  • Connect to VPN but can't ping past inside interface

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

Maybe you are looking for