Include multiple sub-interfaces in Cisco ASA for VPN tunnel

I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces.
Say, In Cisco ASA 5550(in datacentre), I created multiple subinterfaces with VLAN ID as below:
Inside, int0/1 : 10.1.1.0/24
DMZ, int0/1.100: 10.1.100.0/24 (VLAN 100)
Production, int 0/1.101 : 10.1.101.0/24 (VLAN 101)
Management, int 0/1.102: 10.1.102.0/24 (VLAN 102)
And another Cisco ASA 5505 is only configured with 1 x inside interface Inside, int 0/1: 192.168.1.0/24
So far, I have only been able to provide outside access to one of the sub-interfaces as NAT rule on inside interface didn't work for VLANs. Hence had to issue Global NAT rule to be applied on Production subinterface so that production VLAN can have outside access. I have managed to establish VPN tunnel between two ASAs on Production sub-interface only, Source interface = Production subinterface
Additional settings:
Have ACL to allow all sub interfaces to access outsite ( lower security level)
NAT rules is configured on Production subinterface with Source NAT Type as Dynamic PAT; when this was configured with source interface as inside, PCs behind various VLAN coun't access internet. 
I want to establish a site-to-site VPN tunnel with multiple sub-interfaces of Cisco ASA 5550 to Cisco ASA 5505. Would you please suggest what I am missing in my configuration? I need to be able to access multiple VLANs of datacentre from remote site.

I am trying to create a VPN tunnel between two Cisco ASAs where one ASA has multiple sub-interfaces.
Say, In Cisco ASA 5550(in datacentre), I created multiple subinterfaces with VLAN ID as below:
Inside, int0/1 : 10.1.1.0/24
DMZ, int0/1.100: 10.1.100.0/24 (VLAN 100)
Production, int 0/1.101 : 10.1.101.0/24 (VLAN 101)
Management, int 0/1.102: 10.1.102.0/24 (VLAN 102)
And another Cisco ASA 5505 is only configured with 1 x inside interface Inside, int 0/1: 192.168.1.0/24
So far, I have only been able to provide outside access to one of the sub-interfaces as NAT rule on inside interface didn't work for VLANs. Hence had to issue Global NAT rule to be applied on Production subinterface so that production VLAN can have outside access. I have managed to establish VPN tunnel between two ASAs on Production sub-interface only, Source interface = Production subinterface
Additional settings:
Have ACL to allow all sub interfaces to access outsite ( lower security level)
NAT rules is configured on Production subinterface with Source NAT Type as Dynamic PAT; when this was configured with source interface as inside, PCs behind various VLAN coun't access internet. 
I want to establish a site-to-site VPN tunnel with multiple sub-interfaces of Cisco ASA 5550 to Cisco ASA 5505. Would you please suggest what I am missing in my configuration? I need to be able to access multiple VLANs of datacentre from remote site.

Similar Messages

  • High receive discards on Sub-Interfaces in Cisco ASA.

    Hello Everyone,
    Over the past few weeks Solarwinds is reporting high receive discards on two of our subinterfaces created on Cisco ASA. No errors are observed on other subinterfaces. I checked the trunk port interface on the switch for any errors but found none. These errors are visible only under subinterface. What could be the issue?
    Regards

    I have the same problem too.
    I have Cisco ASA 5515  with the next version:
    Cisco Adaptive Security Appliance Software Version 9.1(4)
    My interface configuration is the next:
    PortChannel5 made with    Interface GigabitEthernet 0/2 + Interface GigabitEthernet 0/3
    Subinterfaces in PortChannel5
    Nagios Graphs shows:
    - many input discards in virtual subinterfaces
    - many output discards in interface Gi0/2 and Gi0/3
    - PortChannel5 output discards is the sum of discards in interface Gi0/2 and Gi0/3
    if I run the snmpwalk command against the ASA the following results were obtained:
    Interface description
    [user@FIREWALL01 ~]$ snmpwalk -v 2c -c XXXXXXX 10.255.16.1 | grep ifDescr
    IF-MIB::ifDescr.2 = STRING: Adaptive Security Appliance 'asa_mgmt_plane' interface
    IF-MIB::ifDescr.3 = STRING: Adaptive Security Appliance 'Internet' interface
    IF-MIB::ifDescr.4 = STRING: Adaptive Security Appliance 'LAN_MPLS' interface
    IF-MIB::ifDescr.5 = STRING: Adaptive Security Appliance 'GigabitEthernet0/2' interface
    IF-MIB::ifDescr.6 = STRING: Adaptive Security Appliance 'GigabitEthernet0/3' interface
    IF-MIB::ifDescr.7 = STRING: Adaptive Security Appliance 'stateifha' interface
    IF-MIB::ifDescr.8 = STRING: Adaptive Security Appliance 'statelink' interface
    IF-MIB::ifDescr.9 = STRING: Adaptive Security Appliance 'Internal-Data0/1' interface
    IF-MIB::ifDescr.10 = STRING: Adaptive Security Appliance 'cplane' interface
    IF-MIB::ifDescr.11 = STRING: Adaptive Security Appliance 'mgmt_plane_int_tap' interface
    IF-MIB::ifDescr.12 = STRING: Adaptive Security Appliance 'management' interface
    IF-MIB::ifDescr.13 = STRING: Adaptive Security Appliance 'Virtual254' interface
    IF-MIB::ifDescr.14 = STRING: Adaptive Security Appliance 'Port-channel5' interface
    IF-MIB::ifDescr.15 = STRING: Adaptive Security Appliance 'VLAN_USGLB_OOB' interface
    IF-MIB::ifDescr.16 = STRING: Adaptive Security Appliance 'VLAN_USGLBHSTHYP_MGNT' interface
    IF-MIB::ifDescr.17 = STRING: Adaptive Security Appliance 'VLAN_USGLBVRM_OM' interface
    IF-MIB::ifDescr.18 = STRING: Adaptive Security Appliance 'VLAN_USGLBVRM_MGNTOM' interface
    IF-MIB::ifDescr.19 = STRING: Adaptive Security Appliance 'VLAN_USGLBVRM_MGNT' interface
    IF-MIB::ifDescr.20 = STRING: Adaptive Security Appliance 'VLAN_USGLBVRM_SRVF' interface
    IF-MIB::ifDescr.21 = STRING: Adaptive Security Appliance 'VLAN_USGLBVRM_SRVB' interface
    IF-MIB::ifDescr.22 = STRING: Adaptive Security Appliance 'VLAN_USGLB_DMZ' interface
    Input discards
    [user@FIREWALL01 ~]$ snmpwalk -v 2c -c xxxxxxxxxx 10.255.16.1 | grep ifInDiscards
    IF-MIB::ifInDiscards.2 = Counter32: 0
    IF-MIB::ifInDiscards.3 = Counter32: 0
    IF-MIB::ifInDiscards.4 = Counter32: 0
    IF-MIB::ifInDiscards.5 = Counter32: 0
    IF-MIB::ifInDiscards.6 = Counter32: 0
    IF-MIB::ifInDiscards.7 = Counter32: 0
    IF-MIB::ifInDiscards.8 = Counter32: 0
    IF-MIB::ifInDiscards.9 = Counter32: 0
    IF-MIB::ifInDiscards.10 = Counter32: 0
    IF-MIB::ifInDiscards.11 = Counter32: 0
    IF-MIB::ifInDiscards.12 = Counter32: 0
    IF-MIB::ifInDiscards.13 = Counter32: 0
    IF-MIB::ifInDiscards.14 = Counter32: 0
    IF-MIB::ifInDiscards.15 = Counter32: 12481926
    IF-MIB::ifInDiscards.16 = Counter32: 9927941
    IF-MIB::ifInDiscards.17 = Counter32: 134120211
    IF-MIB::ifInDiscards.18 = Counter32: 124695686
    IF-MIB::ifInDiscards.19 = Counter32: 27081148
    IF-MIB::ifInDiscards.20 = Counter32: 2941537222
    IF-MIB::ifInDiscards.21 = Counter32: 32714719
    IF-MIB::ifInDiscards.22 = Counter32: 4008856
    Output discards
    [user@FIREWALL01 ~]$ snmpwalk -v 2c -c xxxxxxxxxxxx 10.255.16.1 | grep ifOutDiscards
    IF-MIB::ifOutDiscards.2 = Counter32: 0
    IF-MIB::ifOutDiscards.3 = Counter32: 0
    IF-MIB::ifOutDiscards.4 = Counter32: 0
    IF-MIB::ifOutDiscards.5 = Counter32: 3635696
    IF-MIB::ifOutDiscards.6 = Counter32: 119099
    IF-MIB::ifOutDiscards.7 = Counter32: 0
    IF-MIB::ifOutDiscards.8 = Counter32: 0
    IF-MIB::ifOutDiscards.9 = Counter32: 0
    IF-MIB::ifOutDiscards.10 = Counter32: 0
    IF-MIB::ifOutDiscards.11 = Counter32: 0
    IF-MIB::ifOutDiscards.12 = Counter32: 0
    IF-MIB::ifOutDiscards.13 = Counter32: 0
    IF-MIB::ifOutDiscards.14 = Counter32: 3754795
    IF-MIB::ifOutDiscards.15 = Counter32: 0
    IF-MIB::ifOutDiscards.16 = Counter32: 0
    IF-MIB::ifOutDiscards.17 = Counter32: 0
    IF-MIB::ifOutDiscards.18 = Counter32: 0
    IF-MIB::ifOutDiscards.19 = Counter32: 0
    IF-MIB::ifOutDiscards.20 = Counter32: 0
    IF-MIB::ifOutDiscards.21 = Counter32: 0
    IF-MIB::ifOutDiscards.22 = Counter32: 0
    Output discards may be normals, but I don't understand input discards in virtual subinterfaces of PortChannel5
    By the other hand, show interface command in subinterfaces don't show error or discards packets
    FIREWALL01/pri/act#    sh interface VLAN_USGLBVRM_SRVB detail 
    Interface Port-channel5.1020 "VLAN_USGLBVRM_SRVB", is up, line protocol is up
      Hardware is EtherChannel/LACP, BW 2000 Mbps, DLY 10 usec
            VLAN identifier 1020
            Description: VLAN_USGLBVRM_SRVB
            MAC address 6073.5c69.0917, MTU 1500
            IP address 10.255.19.65, subnet mask 255.255.255.192
      Traffic Statistics for "VLAN_USGLBVRM_SRVB":
            42067433644 packets input, 45125599467459 bytes
            28153119062 packets output, 8866514693262 bytes
            32715765 packets dropped
      Control Point Interface States:
            Interface number is 21
            Interface config status is active
            Interface state is active
      Control Point Vlan1020 States:
            Interface vlan config status is active
            Interface vlan state is UP
    FIREWALL01/pri/act#    sh interface VLAN_USGLBVRM_SRVF detail 
    Interface Port-channel5.1019 "VLAN_USGLBVRM_SRVF", is up, line protocol is up
      Hardware is EtherChannel/LACP, BW 2000 Mbps, DLY 10 usec
            VLAN identifier 1019
            Description: VLAN_USGLBVRM_SRVF
            MAC address 6073.5c69.0917, MTU 1500
            IP address 10.255.19.1, subnet mask 255.255.255.192
      Traffic Statistics for "VLAN_USGLBVRM_SRVF":
            30475814698 packets input, 14615432248013 bytes
            27472348465 packets output, 20872697455933 bytes
            2941588838 packets dropped
      Control Point Interface States:
            Interface number is 20
            Interface config status is active
            Interface state is active
      Control Point Vlan1019 States:
            Interface vlan config status is active
            Interface vlan state is UP
    FIREWALL01/pri/act#
    Can anyone explain why so many input errors appear in the subinterfaces?
    Thanks in advance!

  • 2 ASA for VPN tunnel hub and Dual tunnel to both from cisco1800

    I am struggling with configuring Cisco1841 to have dual or back up tunnel to two seperate ASA's on our corporate network. There is alot of great doco on DMVPN with routers as hub but is DMVPN the best way to configure this router and the others to fallow. I have no issues creating single normal tunnel to either ASA when I try to get tunnel to each I have issues.
    Last attemtp of DMVPN config on 1841
    crypto keyring Test
    pre-shared-key address #.#.#.# key Test!
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp profile L2L
    description LAN-to-LAN for spoke router(s) connection
    keyring Test
    match identity address #.#.#.# 255.255.255.255
    crypto ipsec transform-set ESP-3DES esp-3des esp-md5-hmac
    crypto dynamic-map dynmap 10
    set security-association lifetime seconds 28800
    set transform-set ESP-3DES
    set pfs group2
    set isakmp-profile L2L
    match address VPN-ACCESS-LIST-100
    crypto map mymap 10 ipsec-isakmp dynamic dynmap

    I got both tunnels working but I would like to be able to control routing better. Is there a good way to have all routing go over a single tunnel in case of a failure. With the below config I can get all 10.160.0.0 and 10.40.0.0 routing over the one tunnel and 10.41.0.0 over the other tunnel but if I similate a tunnel outage I can't get traffic to go to other tunnel I have added a 10.0.0.0 to each access list then both tunnels don't work. I think I have to do the access-list differently. The only way I know how to add routing is if I do tunnel interfaces and I have only done that with router to router tunnels. Is there a way to do that on a Router to ASA configuration?
    crypto keyring VGC_PTC
    pre-shared-key address ##.##.##.15 key VGC@Test_1
    crypto keyring VGC_Tulsa
    pre-shared-key address ##.##.##.25 key VGC$Test_2
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    lifetime 28800
    crypto isakmp profile L2L_Dallas
    description LAN-To-LAN for PTC Connection
    keyring VGC_PTC
    match identity address ##.##.##.15 255.255.255.255
    crypto isakmp profile L2L_Tulsa
    description LAN-To-LAN for Tulsa Connection
    keyring VGC_Tulsa
    match identity address ##.##.##.25 255.255.255.255
    crypto ipsec transform-set ESP-3DES esp-3des esp-md5-hmac
    crypto dynamic-map dynmap 10
    set security-association lifetime seconds 28800
    set transform-set ESP-3DES
    set isakmp-profile L2L_Dallas
    match address VPN-ACCESS-LIST-100
    crypto dynamic-map dynmap 20
    set security-association lifetime seconds 28800
    set transform-set ESP-3DES
    set isakmp-profile L2L_Tulsa
    match address VPN-ACCESS-LIST-200
    crypto map mymap 10 ipsec-isakmp dynamic dynmap
    ip access-list extended VPN-ACCESS-LIST-100
    permit ip 10.207.126.0 0.0.0.255 10.160.0.0 0.0.255.255
    permit ip 10.207.126.0 0.0.0.255 10.40.0.0 0.0.255.255
    ip access-list extended VPN-ACCESS-LIST-200
    permit ip 10.207.126.0 0.0.0.255 10.41.0.0 0.0.255.255

  • Configuring Cisco ASA for site to site VPN ( Issue with setting up local network)

    OK, so our primary firewall is a checkpoint gateway. Behind that we have a cisco ASA for vpn users. I have a project at the moment where we need to connect to another company using site to site VPN through the cisco ASA, as the checkpoint gateway is unable to establish a permanent tunnel with the other companies Cisco ASA.
    What would be the best practise for setting up the local network on my side? Create the network on the ASA and then use a L2 vlan to connect to the Core switch? 
    Setup a L3 interface on the core switch and point it towards the checkpoint gateway which would then point to the ASA?
    When you have to select your local network through the site to site wizard do you have to put the inside network address of the ASA?
    Our network is setup like this: Access layer switch > Core 6500 Switch > Checkpoint-Firewall > Internet
    The ASA is connected to a checkpoint sub interface
    Any help would be beneficial as im new to cisco ASAs 
    Thanks
    Mark

    Mark
    If we understood more about your environment we might be able to give you better answers. My initial reaction was similar to the suggestion from Michael to use a L2 vlan. But as I think a bit more my attention is drawn to something that you mention in the original post. The ASA is there for VPN users. If the VPN users need to access your internal network then you probably already have something configured on the ASA that allows access to the internal network. Perhaps that same thing might provide access for your site to site VPN?
    HTH
    Rick

  • Can I rate-limit on the sub-interface in cisco asr 1013?

    Hi,
    I am looking for the command of rate-limit on a sub-interface in cisco asr 1013.
    Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-ADVENTERPRISEK9-M), Version 15.2(2)S, RELEASE SOFTWARE (fc1)
    IOS XE Version: 03.06.00.S
    Please let me know if it is possible in cisco asr 1013. If yes then what are the commands.
    Zobair

    The ASR no longer supports the rate-limit command, but it does support the same functionality in a QoS policy.
    Please find a sample configuration -
    ASR1004(config)#policy-map test
    ASR1004(config-pmap)#class class-default
    ASR1004(config-pmap-c)#shape average 10000
    Applying for both ingress and egress : -
    ASR1004(config)#int gig1/1/0
    ASR1004(config-if)#service-policy output test   
    or
    ASR1004(config-if)#service-policy input test

  • Access Site to Site Networks behind Cisco ASA thru VPN Client

    I have configured remote access thru asa for vpn clients to our main network. I can ping the required networks from vpn client. Internally I can ping remote network thru our sonicwall site to site vpn. I however cannot ping the remote network from the vpn client. I've added the network in the configuration on the ASA that I am trying to connect to. Any ideas what I can do so I can connect to Site B thru my vpn client connecting to Site A?
    Thanks,
    Matt

    Hello, matt0000111111.
    Did you add a VPN clients network to the sit-to-site VPN settings and to the NAT list (if nat exist at the interfaces at site-to-site vpn)?

  • Cisco ASA 5505 VPN help for local lan access.

    Hi all,
    I am very new to Cisco systems. Recently I was tasked to enable local lan access for one of my server. The problem is this. I have this server with 2 interfaces. One interface to my FTP server(192.168.2.3) and the other to the Cisco ASA(192.168.1.1). Whenever I connect the server to Cisco Anyconnect VPN, I am unable to access the FTP server anymore.
    I googled and found out that the problem is because the metric level is 1 for Ciscoanyconnect network interface which causes all traffic to go through the Cisco VPN Interface. Another problem is I can't change the metric of the Cisco VPN Interface as whenever I reconnect to the VPN, the metric resets back to 1 again. I tried to follow some guides to configure split tunnel but my traffic is still going through the VPN connection.
    Anyone can tell me what I am missing here? Sorry I am very new to Cisco systems. Spent about 5 days troubleshooting and I feel I am getting it soon. Anyone can guide me what else I am supposed to do?
    What I did> Configuration>> Remote access VPN>> Network Client Access>> Group Policies>> Advanced>> Split Tunneling>> Uncheck Inherit and select "Exclude Network List below.>> Uncheck Network List and select Manage, Add 192.168.2.0/24 to permit.
    Really appreciate if anyone can tell me what else I can do to ensure my server has access the my FTP Server after connecting to the VPN.
    Thanks all!
    Wen Qi

    Hi,
    Try adding the following configuration
    policy-map global_policy
    class inspection_default
      inspect pptp
    And then try again.
    I'm not 100% would you need to perhaps allow GRE through the firewall even after that. (Protocol 47)
    - Jouni

  • Port Forwarding for Cisco ASA 5505 VPN

    This is the Network
    Linksys E2500 ---> Cisco ASA 5505 ---> Server
    I beleive I need to forward some ports to the asa to use the IPsec VPN I just setup. I had the SSL VPN working but only needed to forward 443 for that....I assume that IPsec tunnel is a specific port.
    Thank You

    For IPSec VPN, you need to port forward UDP/500 and UDP/4500, and remember to enable NAT-T on the ASA.
    Command to enable NAT-T on ASA:
    crypto isakmp nat-traversal 30

  • Cisco ASA 5505 - IPsec Tunnel issue

    Issue with IPsec Child SA
    Hi,
    I have a site to site VPN tunnel setup with a Cisco ASA5505 and a Checkpoint Firewall. The version of software is 9.22. I am using IKEv2 for Phase 1 encryption. The following is my cisco asa configuration:
    hostname GARPR-COM1-WF01
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    interface Ethernet0/0
     description Failover Link
     switchport access vlan 950
    interface Ethernet0/1
     description Outside FW Link
     switchport access vlan 999
    interface Ethernet0/2
     description Inside FW Link
     switchport access vlan 998
    interface Ethernet0/3
     description Management Link
     switchport access vlan 6
    interface Ethernet0/4
     shutdown
    interface Ethernet0/5
     shutdown
    interface Ethernet0/6
     shutdown
    interface Ethernet0/7
     shutdown
    interface Vlan1
     no nameif
     no security-level
     no ip address
    interface Vlan6
     nameif management
     security-level 100
     ip address 10.65.1.20 255.255.255.240
    interface Vlan950
     description LAN Failover Interface
    interface Vlan998
     nameif inside
     security-level 100
     ip address 10.65.1.5 255.255.255.252
    interface Vlan999
     nameif outside
     security-level 0
     ip address ************* 255.255.255.248
    boot system disk0:/asa922-4-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
     domain-name ***************
    object network North_American_LAN
     subnet 10.73.0.0 255.255.0.0
     description North American LAN
    object network Queretaro_LAN
     subnet 10.74.0.0 255.255.0.0
     description Queretaro_LAN
    object network Tor_LAN
     subnet 10.75.0.0 255.255.0.0
     description Tor LAN
    object network Mor_LAN
     subnet 10.76.0.0 255.255.0.0
     description Mor LAN
    object network Tus_LAN
     subnet 10.79.128.0 255.255.128.0
     description North American LAN
    object network Mtl_LAN
     subnet 10.88.0.0 255.255.0.0
     description Mtl LAN
    object network Wic_LAN
     subnet 10.90.0.0 255.254.0.0
     description Wic LAN
    object network Wic_LAN_172
     subnet 172.18.0.0 255.255.0.0
     description Wic Servers/Legacy Client LAN
    object network Mtl_LAN_172
     subnet 172.19.0.0 255.255.0.0
     description Mtl Servers/Legacy Client LAN
    object network Tor_LAN_172
     subnet 172.20.0.0 255.255.0.0
     description Tor Servers/Legacy Client LAN
    object network Bridge_LAN_172
     subnet 172.23.0.0 255.255.0.0
     description Bridge Servers/Legacy Client LAN
    object network Mtl_WLAN
     subnet 10.114.0.0 255.255.0.0
     description Mtl Wireless LAN
    object network Bel_WLAN
     subnet 10.115.0.0 255.255.0.0
     description Bel Wireless LAN
    object network Wic_WLAN
     subnet 10.116.0.0 255.255.0.0
     description Wic Wireless LAN
    object network Mtl_Infrastructure_10
     subnet 10.96.0.0 255.255.0.0
     description Mtl Infrastructre LAN
    object network BA_Small_Site_Blocks
     subnet 10.68.0.0 255.255.0.0
     description BA Small Sites Blocks
    object network Bel_LAN
     subnet 10.92.0.0 255.255.0.0
     description Bel LAN 10 Network
    object network LAN_172
     subnet 172.25.0.0 255.255.0.0
     description  LAN 172 Network
    object network Gar_LAN
     subnet 10.65.1.0 255.255.255.0
     description Gar LAN
    object network garpr-com1-wf01.net.aero.bombardier.net
     host **************
     description Garching Firewall
    object-group network BA_Sites
     description Internal Networks
     network-object object BA_Small_Site_Blocks
     network-object object Bel_LAN
     network-object object Bel_LAN_172
     network-object object Bel_WLAN
     network-object object Bridge_LAN_172
     network-object object Mtl_Infrastructure_10
     network-object object Mtl_LAN
     network-object object Mtl_LAN_172
     network-object object Mtl_WLAN
     network-object object Mor_LAN
     network-object object North_American_LAN
     network-object object Queretaro_LAN
     network-object object Tor_LAN
     network-object object Tor_LAN_172
     network-object object Tus_LAN
     network-object object Wic_LAN
     network-object object Wic_LAN_172
     network-object object Wic_WLAN
    access-list 101 extended permit ip object garpr-com1-wf01.net.aero.bombardier.net object Bel_LAN_172
    access-list 101 extended permit ip object Garching_LAN object-group BA_Sites
    pager lines 24
    logging enable
    logging timestamp
    logging buffered warnings
    logging trap informational
    logging asdm informational
    logging host outside 172.25.5.102
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    failover
    failover lan unit primary
    failover lan interface Failover_Link Vlan950
    failover polltime interface msec 500 holdtime 5
    failover key *****
    failover interface ip Failover_Link 192.168.124.1 255.255.255.0 standby 192.168.124.2
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-731-101.bin
    asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static Gar_LAN Gar_LAN destination static BA_Sites BA_Sites no-proxy-arp route-lookup
    route outside 0.0.0.0 0.0.0.0 ************* 1
    route inside 10.65.1.0 255.255.255.255 10.65.1.6 1
    route inside 10.65.1.16 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.32 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.48 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.64 255.255.255.240 10.65.1.6 1
    route inside 10.65.1.128 255.255.255.128 10.65.1.6 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 10.65.1.0 255.255.255.0 inside
    http 172.25.5.0 255.255.255.0 inside
    http 10.65.1.21 255.255.255.255 management
    snmp-server host inside 172.25.49.0 community ***** udp-port 161
    snmp-server host outside 172.25.49.0 community *****
    snmp-server host inside 172.25.5.101 community ***** udp-port 161
    snmp-server host outside 172.25.5.101 community *****
    snmp-server host inside 172.25.81.88 poll community *****
    snmp-server host outside 172.25.81.88 poll community *****
    snmp-server location:
    snmp-server contact
    snmp-server community *****
    snmp-server enable traps syslog
    crypto ipsec ikev2 ipsec-proposal aes256
     protocol esp encryption aes-256
     protocol esp integrity sha-1
    crypto ipsec security-association lifetime seconds 3600
    crypto ipsec security-association pmtu-aging infinite
    crypto map GARCH 10 match address 101
    crypto map GARCH 10 set pfs group19
    crypto map GARCH 10 set peer *******************
    crypto map GARCH 10 set ikev2 ipsec-proposal aes256
    crypto map GARCH 10 set security-association lifetime seconds 3600
    crypto map GARCH interface outside
    crypto ca trustpool policy
    no crypto isakmp nat-traversal
    crypto ikev2 policy 10
     encryption aes-256
     integrity sha256
     group 19
     prf sha256
     lifetime seconds 86400
    crypto ikev2 enable outside
    telnet 10.65.1.6 255.255.255.255 inside
    telnet timeout 5
    ssh stricthostkeycheck
    ssh 172.25.5.0 255.255.255.0 inside
    ssh 172.19.9.49 255.255.255.255 inside
    ssh 172.25.5.0 255.255.255.0 outside
    ssh 172.19.9.49 255.255.255.255 outside
    ssh timeout 30
    ssh version 2
    ssh key-exchange group dh-group1-sha1
    console timeout 30
    management-access inside
    dhcprelay server 172.25.81.1 outside
    dhcprelay server 172.25.49.1 outside
    dhcprelay enable inside
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 172.19.109.41
    ntp server 172.19.109.42
    ntp server 172.19.9.49 source outside
    tunnel-group ********* type ipsec-l2l
    tunnel-group ********* ipsec-attributes
     ikev2 remote-authentication pre-shared-key *****
     ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:25ad9bf6db66a31e840ad96f49cd7e37
    : end
    I believe when a VPN tunnel is setup there should be one Child sa per subnet. The internal network of 10.65.1.0/24 should be setup with a child sa to the networks that were specified above depending on if there is traffic destined for them. What I am seeing is multiple child sa setup for the same subnet like the example below:
    GARPR-COM1-WF01# sh crypto ikev2 sa | i 172.19
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
              remote selector 172.19.0.0/0 - 172.19.255.255/65535
    where for destination network 10.92.0.0/16 there is only one child sa:
    GARPR-COM1-WF01# sh crypto ikev2 sa | i 10.92
              remote selector 10.92.0.0/0 - 10.92.255.255/6553
    Should this be the case or does anyone have any idea why there is multiple child sa setup for the same subnet?
    Thanks
    Jonathan

    Hi there,
    I had same issue with PIX 506E and it was not even a circuit issue and I got ride of it and problem got fixed with PIX515E
    I don't know, the device is too old to stay alive.
    thanks

  • Cisco ASA 5505 VPN Anyconnect no address assignment

    I have a problem with ip assigment via anyconnect. I always get the message no assigned address via anyconnect. I assigned to my profile for vpn a address pool, but it's still not working. Here is my config:
    hostname firewall
    domain-name ITTRIPP.local
    enable password 8K8UeTZ9KV5Lvofo encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    ip local pool 192.168.178.0 192.168.178.151-192.168.178.171 mask 255.255.255.255
    ip local pool net-10 10.0.0.1-10.0.0.10 mask 255.255.255.0
    ip local pool SSL-POOL 172.16.1.1-172.16.1.254 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
     switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     description Private Interface
     nameif inside
     security-level 100
     ip address 192.168.178.10 255.255.255.0
     ospf cost 10
    interface Vlan2
     description Public Interface
     nameif outside
     security-level 0
     ip address 192.168.177.2 255.255.255.0
     ospf cost 10
    interface Vlan3
     description DMZ-Interface
     nameif dmz
     security-level 0
     ip address 10.10.10.2 255.255.255.0
    boot system disk0:/asa914-k8.bin
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup dmz
    dns server-group DefaultDNS
     name-server 192.168.178.3
     name-server 192.168.177.1
     domain-name ITTRIPP.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network 192.168.178.x
     subnet 192.168.178.0 255.255.255.0
    object network NETWORK_OBJ_192.168.178.0_26
     subnet 192.168.178.0 255.255.255.192
    object service teamviewer
     service tcp source eq 5938
    object service smtp_tls
     service tcp source eq 587
    object service all_tcp
     service tcp source range 1 65535
    object service udp_all
     service udp source range 1 65535
    object network NETWORK_OBJ_192.168.178.128_26
     subnet 192.168.178.128 255.255.255.192
    object network NETWORK_OBJ_10.0.0.0_28
     subnet 10.0.0.0 255.255.255.240
    object-group service Internet-udp udp
     description UDP Standard Internet Services
     port-object eq domain
     port-object eq ntp
     port-object eq isakmp
     port-object eq 4500
    object-group service Internet-tcp tcp
     description TCP Standard Internet Services
     port-object eq www
     port-object eq https
     port-object eq smtp
     port-object eq 465
     port-object eq pop3
     port-object eq 995
     port-object eq ftp
     port-object eq ftp-data
     port-object eq domain
     port-object eq ssh
     port-object eq telnet
    object-group user DM_INLINE_USER_1
     user LOCAL\admin
     user LOCAL\lukas
     user LOCAL\sarah
    object-group service DM_INLINE_TCP_1 tcp
     port-object eq ftp
     port-object eq ftp-data
     port-object eq ssh
    object-group service 192.168.178.network tcp
     port-object eq 5000
     port-object eq 5001
    object-group service DM_INLINE_SERVICE_1
     service-object object smtp_tls
     service-object tcp destination eq imap4
     service-object object teamviewer
    object-group service DM_INLINE_SERVICE_2
     service-object object all_tcp
     service-object object udp_all
    object-group service DM_INLINE_SERVICE_3
     service-object object all_tcp
     service-object object smtp_tls
     service-object object teamviewer
     service-object object udp_all
     service-object tcp destination eq imap4
    object-group service vpn udp
     port-object eq 1701
     port-object eq 4500
     port-object eq isakmp
    object-group service openvpn udp
     port-object eq 1194
    access-list NAT-ACLs extended permit ip 192.168.178.0 255.255.255.0 any
    access-list inside-in remark -=[Access Lists For Outgoing Packets from Inside in                                                                                                                    terface]=-
    access-list inside-in extended permit udp 192.168.178.0 255.255.255.0 any object                                                                                                                    -group Internet-udp
    access-list inside-in extended permit tcp 192.168.178.0 255.255.255.0 any object                                                                                                                    -group Internet-tcp
    access-list inside-in extended permit icmp 192.168.178.0 255.255.255.0 any
    access-list inside-in extended permit udp 192.168.178.0 255.255.255.0 any eq sip                                                                                                                    
    access-list inside-in extended permit object-group DM_INLINE_SERVICE_1 192.168.1                                                                                                                    78.0 255.255.255.0 any
    access-list inside-in extended permit object-group DM_INLINE_SERVICE_2 192.168.1                                                                                                                    78.0 255.255.255.0 any
    access-list outside-in remark -=[Access Lists For Incoming Packets on OUTSIDE in                                                                                                                    terface]=-
    access-list outside-in extended permit icmp any 192.168.178.0 255.255.255.0 echo                                                                                                                    -reply
    access-list outside-in extended permit tcp object-group-user DM_INLINE_USER_1 an                                                                                                                    y host 192.168.178.95 object-group DM_INLINE_TCP_1
    access-list outside-in extended permit tcp any host 192.168.178.95 object-group                                                                                                                     192.168.178.network
    access-list outside-in extended permit tcp any 192.168.178.0 255.255.255.0 eq si                                                                                                                    p
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.                                                                                                                    251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Nam                                                                                                                    e Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.                                                                                                                    252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbi                                                                                                                    os-ns
    access-list dmz_access_in remark -=[Access Lists For Outgoing Packets from DMZ i                                                                                                                    nterface]=-
    access-list dmz_access_in extended permit object-group DM_INLINE_SERVICE_3 10.10                                                                                                                    .10.0 255.255.255.0 any
    access-list dmz_access_in extended permit icmp 10.10.10.0 255.255.255.0 any
    access-list dmz_access_in extended permit tcp 10.10.10.0 255.255.255.0 any objec                                                                                                                    t-group Internet-tcp
    access-list dmz_access_in extended permit udp 10.10.10.0 255.255.255.0 any objec                                                                                                                    t-group Internet-udp
    pager lines 24
    logging enable
    logging buffer-size 30000
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.16                                                                                                                    8.178.0_26 NETWORK_OBJ_192.168.178.0_26 no-proxy-arp route-lookup
    nat (dmz,outside) source static any any destination static NETWORK_OBJ_192.168.1                                                                                                                    78.0_26 NETWORK_OBJ_192.168.178.0_26 no-proxy-arp route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.16                                                                                                                    8.178.128_26 NETWORK_OBJ_192.168.178.128_26 no-proxy-arp route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_10.0.0                                                                                                                    .0_28 NETWORK_OBJ_10.0.0.0_28 no-proxy-arp route-lookup
    object network 192.168.178.x
     nat (inside,outside) dynamic interface
    nat (dmz,outside) after-auto source dynamic 192.168.178.x interface
    access-group inside-in in interface inside
    access-group outside-in in interface outside
    access-group dmz_access_in in interface dmz
    route outside 0.0.0.0 0.0.0.0 192.168.177.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ITTRIPP protocol ldap
    aaa-server ITTRIPP (inside) host 192.168.178.3
     ldap-base-dn CN=Users,DC=ITTRIPP,DC=local
     ldap-scope subtree
     ldap-naming-attribute sAMAccountName
     ldap-login-password *****
     ldap-login-dn CN=Administrator,DC=ITTRIPP,DC=local
     server-type microsoft
    user-identity default-domain LOCAL
    eou allow none
    aaa authentication telnet console LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    aaa local authentication attempts max-fail 5
    http server enable
    http 192.168.178.0 255.255.255.0 inside
    http redirect outside 80
    http redirect inside 80
    http redirect dmz 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-A                                                                                                                    ES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-A                                                                                                                    ES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES2                                                                                                                    56 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map dmz_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map dmz_map interface dmz
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
     enrollment self
     subject-name CN=firewall
     crl configure
    crypto ca trustpoint ASDM_TrustPoint1
     enrollment self
     fqdn l1u.dyndns.org
     email [email protected]
     subject-name CN=l1u.dyndns.org,OU=VPN Services,O=ITTRIPP,C=DE,St=NRW,L=PLBG,EA=                                                                                                                    [email protected]
     serial-number
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
     certificate 6a871953
        308201cf 30820138 a0030201 0202046a 87195330 0d06092a 864886f7 0d010105
        0500302c 3111300f 06035504 03130866 69726577 616c6c31 17301506 092a8648
        86f70d01 09021608 66697265 77616c6c 301e170d 31343033 30373039 31303034
        5a170d32 34303330 34303931 3030345a 302c3111 300f0603 55040313 08666972
        6577616c 6c311730 1506092a 864886f7 0d010902 16086669 72657761 6c6c3081
        9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100c0 8f17fa6c
        2f227dd9 9d2856e1 b1f8193b 13c61cfe 2d6cbf94 62373535 71db9ac7 5f4ad79f
        7594cfef 1360d88d ad3c69c1 6e617071 c6629bfa 3c77c2d2 a59b1ce1 39ae7a44
        3f8c852d f51d03c1 d9924f7c 24747bbb bf79af9a 68365ed8 7f56e58c a37c7036
        4db983e0 414d1b5e a8a2226f 7c76f50d d14ca714 252f7fbb d4a23d02 03010001
        300d0609 2a864886 f70d0101 05050003 81810019 0d0bbce4 31d9342c 3965eb56
        4dde42e0 5ea57cbb a79b3542 4897521a 8a6859c6 daf5e356 9526346d f13fb344
        260f3fc8 fca6143e 25b08f3d d6780448 3e0fdf6a c1fe5379 1b9227b1 cee01a20
        aa252698 6b29954e ea8bb250 4310ff96 f6c6f0dc 6c7c6021 3c72c756 f7b2e6a1
        1416d222 0e11ca4a 0f0b840a 49489303 b76632
      quit
    crypto ca certificate chain ASDM_TrustPoint1
     certificate 580c1e53
        308202ff 30820268 a0030201 02020458 0c1e5330 0d06092a 864886f7 0d010105
        05003081 c3312230 2006092a 864886f7 0d010901 16136d61 696c406c 31752e64
        796e646e 732e6f72 67310d30 0b060355 04071304 504c4247 310c300a 06035504
        0813034e 5257310b 30090603 55040613 02444531 10300e06 0355040a 13074954
        54524950 50311530 13060355 040b130c 56504e20 53657276 69636573 31173015
        06035504 03130e6c 31752e64 796e646e 732e6f72 67313130 12060355 0405130b
        4a4d5831 3533345a 30575430 1b06092a 864886f7 0d010902 160e6c31 752e6479
        6e646e73 2e6f7267 301e170d 31343033 31353036 35303535 5a170d32 34303331
        32303635 3035355a 3081c331 22302006 092a8648 86f70d01 09011613 6d61696c
        406c3175 2e64796e 646e732e 6f726731 0d300b06 03550407 1304504c 4247310c
        300a0603 55040813 034e5257 310b3009 06035504 06130244 45311030 0e060355
        040a1307 49545452 49505031 15301306 0355040b 130c5650 4e205365 72766963
        65733117 30150603 55040313 0e6c3175 2e64796e 646e732e 6f726731 31301206
        03550405 130b4a4d 58313533 345a3057 54301b06 092a8648 86f70d01 0902160e
        6c31752e 64796e64 6e732e6f 72673081 9f300d06 092a8648 86f70d01 01010500
        03818d00 30818902 818100c0 8f17fa6c 2f227dd9 9d2856e1 b1f8193b 13c61cfe
        2d6cbf94 62373535 71db9ac7 5f4ad79f 7594cfef 1360d88d ad3c69c1 6e617071
        c6629bfa 3c77c2d2 a59b1ce1 39ae7a44 3f8c852d f51d03c1 d9924f7c 24747bbb
        bf79af9a 68365ed8 7f56e58c a37c7036 4db983e0 414d1b5e a8a2226f 7c76f50d
        d14ca714 252f7fbb d4a23d02 03010001 300d0609 2a864886 f70d0101 05050003
        81810087 8aca9c2b 40c9a326 4951c666 44c311b6 5f3914d5 69fcbe0a 13985b51
        336e3c1b ae29c922 c6c1c29d 161fd855 984b6148 c6cbd50f ff3dde66 a71473c4
        ea949f87 b4aca243 8151acd8 a4a426d1 7a434fbd 1a14bd90 0abe5736 4cd0f21b
        d194b3d6 9ae45fab 2436ccbf d59d6ba9 509580a0 ad8f4131 39e6ccf1 1b7a125d
        d50e4e
      quit
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable inside client-services port 443
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable dmz client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint1
    crypto ikev1 enable outside
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 65535
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet 192.168.178.0 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.178.0 255.255.255.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    no vpn-addr-assign aaa
    no vpn-addr-assign local
    no ipv6-vpn-addr-assign aaa
    dhcp-client update dns server both
    dhcpd update dns both
    dhcpd address 192.168.178.100-192.168.178.150 inside
    dhcpd dns 192.168.178.3 192.168.177.1 interface inside
    dhcpd wins 192.168.178.3 interface inside
    dhcpd domain ITTRIPP.local interface inside
    dhcpd update dns both interface inside
    dhcpd option 3 ip 192.168.178.10 interface inside
    dhcpd option 4 ip 192.168.178.3 interface inside
    dhcpd option 6 ip 192.168.178.3 192.168.177.1 interface inside
    dhcpd option 66 ip 192.168.178.95 interface inside
    dhcpd enable inside
    dhcpd address 192.168.177.100-192.168.177.150 outside
    dhcpd dns 192.168.178.3 192.168.177.1 interface outside
    dhcpd wins 192.168.178.3 interface outside
    dhcpd domain ITTRIPP.local interface outside
    dhcpd update dns both interface outside
    dhcpd option 3 ip 192.168.177.2 interface outside
    dhcpd option 4 ip 192.168.178.3 interface outside
    dhcpd option 6 ip 192.168.178.3 interface outside
    dhcpd enable outside
    dhcpd address 10.10.10.100-10.10.10.150 dmz
    dhcpd dns 192.168.178.3 192.168.177.1 interface dmz
    dhcpd wins 192.168.178.3 interface dmz
    dhcpd domain ITTRIPP.local interface dmz
    dhcpd update dns both interface dmz
    dhcpd option 3 ip 10.10.10.2 interface dmz
    dhcpd option 4 ip 192.168.178.3 interface dmz
    dhcpd option 6 ip 192.168.178.3 interface dmz
    dhcpd enable dmz
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 averag                                                                                                                    e-rate 200
    tftp-server inside 192.168.178.105 /volume1/data/tftp
    ssl encryption 3des-sha1
    ssl trust-point ASDM_TrustPoint0
    ssl trust-point ASDM_TrustPoint1 outside
    ssl trust-point ASDM_TrustPoint1 dmz
    ssl trust-point ASDM_TrustPoint0 dmz vpnlb-ip
    ssl trust-point ASDM_TrustPoint1 inside
    ssl trust-point ASDM_TrustPoint0 inside vpnlb-ip
    ssl trust-point ASDM_TrustPoint0 outside vpnlb-ip
    webvpn
     enable inside
     enable outside
     enable dmz
     file-encoding 192.168.178.105 big5
     csd image disk0:/csd_3.5.2008-k9.pkg
     anyconnect image disk0:/anyconnect-linux-3.1.03103-k9.pkg 1
     anyconnect image disk0:/anyconnect-macosx-i386-3.1.03103-k9.pkg 2
     anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 3
     anyconnect profiles SSL-Profile_client_profile disk0:/SSL-Profile_client_profil                                                                                                                    e.xml
     anyconnect enable
     tunnel-group-list enable
     mus password *****
    group-policy DfltGrpPolicy attributes
     wins-server value 192.168.178.3
     dns-server value 192.168.178.3 192.168.177.1
     dhcp-network-scope 192.168.178.0
     vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
     default-domain value ITTRIPP.local
     split-dns value ITTRIPP.local
     webvpn
      anyconnect firewall-rule client-interface public value outside-in
      anyconnect firewall-rule client-interface private value inside-in
    group-policy GroupPolicy_SSL-Profile internal
    group-policy GroupPolicy_SSL-Profile attributes
     wins-server value 192.168.178.3
     dns-server value 192.168.178.3 192.168.177.1
     vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
     default-domain value ITTRIPP.local
     webvpn
      anyconnect profiles value SSL-Profile_client_profile type user
    username sarah password PRgJuqNTubRwqXtd encrypted
    username admin password QkbxX5Qv0P59Hhrx encrypted privilege 15
    username lukas password KGLLoTxH9mCvWzVI encrypted
    tunnel-group DefaultWEBVPNGroup general-attributes
     address-pool SSL-POOL
     secondary-authentication-server-group LOCAL
     authorization-server-group LOCAL
    tunnel-group DefaultWEBVPNGroup ipsec-attributes
     ikev1 trust-point ASDM_TrustPoint0
     ikev1 radius-sdi-xauth
    tunnel-group SSL-Profile type remote-access
    tunnel-group SSL-Profile general-attributes
     address-pool SSL-POOL
     default-group-policy GroupPolicy_SSL-Profile
    tunnel-group SSL-Profile webvpn-attributes
     group-alias SSL-Profile enable
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
     class class-default
      user-statistics accounting
    service-policy global_policy global
    mount FTP type ftp
     server 192.168.178.105
     path /volume1/data/install/microsoft/Cisco
     username lukas
     password ********
     mode passive
     status enable
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD                                                                                                                    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:998674b777e5fd1d3a131d93704ea0e1
    Any idea why it's not working?

    You've got a lot going on there but I'd focus on the line "no vpn-addr-assign local". Per the command reference that tells the ASA NOT to use the  local pool.
    By the way, DHCP on the outside interface looks very counter-intutive, as does enabling VPN on all interfaces over every protocol.

  • Cisco ASA Anconnect VPN Deployment

    Hi,
    I have an enquiry regarding the deployment for ASA that need to support more than 10000 clients. I understand that multiple ASA would be required for it however I was wondering what may be the typical design for it? Should the multiple ASA be setup as vpn cluster/load balancing/etc...?
    It would be appreciated if there are any design document for it. The present setup is a pair of ASA active/standby was wondering on how to combine the total connection if I require 15000 vpn connections; example 2 pairs of active/standby with vpn clustering/load balancing/etc...?
    Thanks.

    You are right, the vpn-loadbalancing is the technologie you should deploy for that. With that you can combine multiple devices to a load-sharing cluster. These devices can be different, for example two 5555 with two 5545 which would give you atotal of 15000 VPN-connections.
    Of course you should plan for device-failure. So you could deploy 4*5555 and also if one ASA is lost you still have 15000 connections (well, at least based on the data-sheet; I wouldn't push the amount of connections to the limit).
    For redundancy you could also deploy these devices also as FO-systems. 3*2*5555 would also give you redundancy.
    This is all under the assumption that the users connect to the same office where the ASAs have a L2-connection to each other which is needed for VPN-loadbalancing. If the users connect through different locations, then these ASAs can't use VPN-loadbalancing unless you have a L2 connection between the loacations.
    If you have multiple locations you should also think about the shared-license server which could save a lot of money if your users don't always use the same gateway.
    And the last point: configure as much as possible for your AAA with a central RADIUS-server to reduce the probability of misconfiguration on multiple ASAs.
    Sent from Cisco Technical Support iPad App

  • CISCO ASA 5505 Split Tunnel DNS with Site to Site VPN

    I have a working configuration for Site to Site VPN between our head office and a private AWS VPC instance.
    The tunnel is active and I can ping the IP address of the remote network and connect to the remote machines using the IP address, but we need to use the FQDN and not the IP.  We have a DNS server set up in AWS for any DNS queries for the remote domain name.
    My question is whether or not the ASA 5505 supports a DNS split tunnel for Site to Site VPN and how it can be configured.
    I can not find where I can interogate the DNS query to be redirected to the VPN tunnel when our domain name is used in a DNS query.  Thus, any pings I try with the FQDN of our servers in AWS are failing as they are going to the default DNS, which is the internet.
    Can any one point me in the right direction on how to configure this DNS rewrite so that we can access our AWS private cloud using FQDN from our AWS domain rather than an IP address?

    Jose, your fix to problem 1 allows all access from the outside, assuming you applied the extended list to the outside interface.  Try to be more restrictive than an '...ip any any' rule for outside_in connections.  For instance, this is what I have for incoming VOIP (access list and nat rules):
    access list rule:
    access-list outside_access_in extended permit udp any object server range 9000 9049 log errors
    nat rule:
    nat (inside,outside) source static server interface service voip-range voip-range
    - 'server' is a network object *
    - 'voip-range' is a service group range
    I'd assume you can do something similar here in combination with my earlier comment:
    access-list incoming extended permit tcp any any eq 5900
    Can you explain your forwarding methodology a little more?  I'm by no means an expert on forwarding, but the way I read what you're trying to do is that you have an inbound VNC request coming in on 5900 and you want the firewall to figure out which host the request should go to.  Or is it vice-versa, the inbound VNC request can be on port 6001-6004 ?

  • Cisco ASA 5505 VPN connection issue ("Unable to add route")

    I'm trying to get IPSec VPN working onto a new Cisco ASA5505. Pretty standard configuration.
    Setup:
    * Cisco VPN client on Windows 7 (v5.0.07.0290 x64 on Laptop1 and v5.0.07.0440 x64 on Laptop2)
    * PPPoE/NAT and internal DHCP on the ASA were configured with the Startup Wizard in ASDM
    NATting is working fine - internal PCs get an IP address in the 192.168.2.0/24 range and can all access the Internet.
    I wanted to be able to connect from anywhere to the ASA in order to reach one of the internal servers. Should be pretty basic.
    First I tried with the built-in ASDM IPSec Wizard, instructions found here.
    VPN clients can connect to the ASA, are connected (until they're manually disconnected), but cannot reach the internal network nor the Internet. Note VPN client can connect fine to a different VPN site (not administered by myself).
    Client logs show following error messages:
    1 15:53:09.363 02/11/12 Sev=Warning/3     IKE/0xA300005F
    Firewall, Cisco Intrusion Prevention Security Agent, is not running, the client will not send firewall information to concentrator.
    2 15:53:13.593 02/11/12 Sev=Warning/2     CVPND/0xE3400013
    AddRoute failed to add a route with metric of 0: code 160
    Destination     192.168.1.255
    Netmask     255.255.255.255
    Gateway     172.16.1.1
    Interface     172.16.1.101
    3 15:53:13.593 02/11/12 Sev=Warning/2     CM/0xA3100024
    Unable to add route. Network: c0a801ff, Netmask: ffffffff, Interface: ac100165, Gateway: ac100101.
    4 15:54:30.425 02/11/12 Sev=Warning/2     CVPND/0xA3400015
    Error with call to IpHlpApi.DLL: CheckUpVASettings: Found IPADDR entry addr=172.16.1.101, error 0
    5 15:54:31.433 02/11/12 Sev=Warning/2     CVPND/0xA3400015
    Error with call to IpHlpApi.DLL: CheckUpVASettings: Found IPADDR entry addr=172.16.1.101, error 0
    6 15:54:32.445 02/11/12 Sev=Warning/2     CVPND/0xA3400015
    Error with call to IpHlpApi.DLL: CleanUpVASettings: Was able to delete all VA settings after all, error 0
    7 20:50:45.355 02/11/12 Sev=Warning/3     IKE/0xA300005F
    Firewall, Cisco Intrusion Prevention Security Agent, is not running, the client will not send firewall information to concentrator.
    8 20:50:50.262 02/11/12 Sev=Warning/2     CVPND/0xE3400013
    AddRoute failed to add a route with metric of 0: code 160
    Destination     192.168.1.255
    Netmask     255.255.255.255
    Gateway     172.16.1.1
    Interface     172.16.1.100
    9 20:50:50.262 02/11/12 Sev=Warning/2     CM/0xA3100024
    Unable to add route. Network: c0a801ff, Netmask: ffffffff, Interface: ac100164, Gateway: ac100101.
    I've already tried the suggestions from this link, although the problem is different there (as the user can still access the internet, even without split tunneling, which I cannot).
    A show run shows the following output (note in the below I have tried a different VPN network: 192.168.3.0/24 instead of 172.16.1.0/24 seen in the Client log)
    Result of the command: "sh run"
    : Saved
    ASA Version 8.2(5)
    hostname AsaDWD
    enable password kLu0SYBETXUJHVHX encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group DW-VPDN
    ip address pppoe setroute
    ftp mode passive
    access-list inside_nat0_outbound extended permit ip any 192.168.3.0 255.255.255.240
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool DWD-VPN-Pool 192.168.3.5-192.168.3.15 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group DW-VPDN request dialout pppoe
    vpdn group DW-VPDN localname fa******@SKYNET
    vpdn group DW-VPDN ppp authentication pap
    vpdn username fa******@SKYNET password *****
    dhcpd auto_config outside
    dhcpd address 192.168.2.5-192.168.2.36 inside
    dhcpd domain DOMAIN interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DWD internal
    group-policy DWD attributes
    vpn-tunnel-protocol IPSec
    username test password ******* encrypted privilege 0
    username test attributes
    vpn-group-policy DWD
    tunnel-group DWD type remote-access
    tunnel-group DWD general-attributes
    address-pool DWD-VPN-Pool
    default-group-policy DWD
    tunnel-group DWD ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:3e6c9478a1ee04ab2e1e1cabbeddc7f4
    : end
    I've installed everything using the CLI as well (after a factory reset). This however yielded exactl the same issue.
    Following commands have been entered:
    ip local pool vpnpool 172.16.1.100-172.16.1.199 mask 255.255.255.0
    username *** password ****
    isakmp policy 1 authentication pre-share
    isakmp policy 1 encryption 3des
    isakmp policy 1 hash sha
    isakmp policy 1 group 2
    isakmp policy 1 lifetime 43200
    isakmp enable outside
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 10 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 10 set reverse-route
    crypto dynamic-map outside_dyn_map 10 set security-association lifetime seconds 288000
    crypto map outside_map 10 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp nat-traversal
    sysopt connection permit-ipsec
    sysopt connection permit-vpn
    group-policy dwdvpn internal
    group-policy dwdvpn attributes
    vpn-tunnel-protocol IPSec
    default-domain value DWD
    tunnel-group dwdvpn type ipsec-ra
    tunnel-group dwdvpn ipsec-attributes
    pre-shared-key ****
    tunnel-group dwdvpn general-attributes
    authentication-server-group LOCAL
    default-group-policy dwdvpn
    Unfortunately I'm getting the same "AddRoute failed to add a route with metric of 0: code 160" error message.
    I'm very confused as this should be a pretty standard setup. I tried to follow the instructions on the Cisco site to the letter...
    The only "differences" in my setup are an internal network of 192.168.2.0 (with ASA IP address 192.168.2.254) and PPPoE with DHCP instead of no PPPoE at all.
    Does anyone know what's going on?

    Yes, I have tried from a different laptop - same results. Using that laptop I can connect to a different IPSec site without issues.
    Please find my renewed config below:
    DWD-ASA(config)# sh run: Saved:ASA Version 8.2(5) !hostname DWD-ASAenable password ******* encryptedpasswd ****** encryptednames!interface Ethernet0/0 switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!interface Vlan1 nameif inside security-level 100 ip address 192.168.2.254 255.255.255.0 !interface Vlan2 nameif outside security-level 0 pppoe client vpdn group DWD ip address pppoe setroute !ftp mode passiveaccess-list inside_nat0_outbound extended permit ip any 192.168.50.0 255.255.255.224 pager lines 24logging asdm informationalmtu inside 1500mtu outside 1500ip local pool vpnpool 192.168.50.10-192.168.50.20 mask 255.255.255.0icmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400global (outside) 1 interfacenat (inside) 0 access-list inside_nat0_outboundnat (inside) 1 0.0.0.0 0.0.0.0timeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolutetimeout tcp-proxy-reassembly 0:01:00timeout floating-conn 0:00:00dynamic-access-policy-record DfltAccessPolicyhttp server enablehttp 192.168.2.0 255.255.255.0 insidehttp 0.0.0.0 0.0.0.0 outsideno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartcrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec security-association lifetime seconds 28800crypto ipsec security-association lifetime kilobytes 4608000crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAPcrypto map outside_map interface outsidecrypto isakmp enable outsidecrypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400telnet timeout 5ssh 0.0.0.0 0.0.0.0 outsidessh timeout 5console timeout 0vpdn group DWD request dialout pppoevpdn group DWD localname *****@SKYNETvpdn group DWD ppp authentication papvpdn username *****@SKYNET password ***** dhcpd auto_config outside!dhcpd address 192.168.2.10-192.168.2.40 insidedhcpd enable inside!threat-detection basic-threatthreat-detection statistics access-listno threat-detection statistics tcp-interceptwebvpn enable outside svc enablegroup-policy DfltGrpPolicy attributes vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpngroup-policy dwdipsec internalgroup-policy dwdipsec attributes vpn-tunnel-protocol IPSec default-domain value DWDDOMusername user1 password ***** encrypted privilege 0username user1 attributes vpn-group-policy dwdipsectunnel-group dwdipsec type remote-accesstunnel-group dwdipsec general-attributes address-pool vpnpool default-group-policy dwdipsectunnel-group dwdipsec ipsec-attributes pre-shared-key *****tunnel-group dwdssl type remote-accesstunnel-group dwdssl general-attributes address-pool vpnpool!class-map inspection_default match default-inspection-traffic!!policy-map type inspect dns preset_dns_map parameters  message-length maximum client auto  message-length maximum 512policy-map global_policy class inspection_default  inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options !service-policy global_policy globalprompt hostname context no call-home reporting anonymousCryptochecksum:f5c8dd644aa2a27374a923671da1c834: endDWD-ASA(config)#

  • Cisco ASA 5505 VPN Routing/Networking Question

    I have a very basic question about Cisco ASA 5505 IPsec Site to Site VPNs.  I want to install a Cisco ASA 5505 at a Data Center, in a LAN subnet that utilizes publicly routable IP addresses.  I would like to install a second Cisco ASA 5505 in a remote branch office as its peer. 
    Regardless of whether I use publicly routable IPs at the branch office in the "inside" network or non-routable IPs, how would the devices and servers at the Data Center know to route IP packets destined for the branch office back through the Cisco ASA instead of through the default gateway at the Data Center?  I can see accomplishing this if every single device at the Data Center is configured with routing table entries, but that isn't feasible.  It also isn't feasible to use the Cisco ASA 5505 as the default gateway for all of the devices as the Data Center, allowing it to decide where the traffic should go.
    What am I missing?  Is the solution to try to map branch office IPs to IP addresses within the Data Center's LAN subnet so that all of the traffic is on the same subnet?

    You can do it in several different ways.
    One way is to tell the server that if it has traffic to network x then it needs to go to the ASA all other traffic is to head for the default gateway.
    In windows this is done via the route command
    do not forget to make it "persistent" otherwise the route will disapear when your reboot the server.
    in unix/linux
    It is also the route command
    Or you can tell your "default gateway" to route that network to the ASA
    Good luck
    HTH

  • Cisco ASA 5505 VPN problem

    I've got a new 5505, and I've run through two wizards: one to start up, one to add client VPN. As a result, I can now connect from a client, the client gets the right info (ip adress, dns, gateway), but it cannot connect to any of the servers on the 'inside' network. The config is here:
    http://www.dubbele.com/asaconfig.txt.
    I've tried a lot of different things, but I cannot seem to get what's going wrong. Any clues would be very welcome!

    John,
    I strongly suggest to always use different ip-scheme for each of vpn RA tunnels and that they not be the same any of the asa inside interfaces.
    interface Vlan1
    ip address 192.168.6.25 255.255.255.0
    ip local pool vpnhaarlem 192.168.6.150-192.168.6.175 mask 255.255.255.0
    for vpnhaarlem do the following.
    use a unique private IP scheme for it as you have done with rotterdam , as an example lets use 10.20.20.0/24
    remove
    no ip local pool vpnhaarlem 192.168.6.150-192.168.6.175 mask 255.255.255.0
    add
    ip local pool vpnhaarlem 10.20.20.1-10.20.20.254 mask 255.255.255.0
    This first line acl is ok but persoannly I suggest to be more granular allowing specific RA tunnel group networks and not just permit ip any, again example for 10.20.20.0/24 network .
    stick with one no NAT acl for RA tunnels like inside_nat0_outbound remove the 1 and 2 otherwise you will have to create more
    nat (inside) access-list statements for RA networks.
    remove
    no access-list inside_nat0_outbound_1 extended permit ip any 192.168.6.0 255.255.255.0
    no access-list inside_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 192.168.6.0 255.255.255.0
    add
    access-list inside_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 10.20.20.0 255.255.255.0
    for the rotterdam tunnel group it is fine with unique IP scheme , I would apply my suggestion above
    no access-list inside_nat0_outbound_2 extended permit ip 192.168.6.0 255.255.255.0 192.168.6.128 255.255.255.192
    access-list inside_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 192.168.5.0 255.255.255.0
    re-adjust the no-nat acl statement bellow
    no nat (inside) 0 access-list inside_nat0_outbound_2
    nat (inside) 0 access-list inside_nat0_outbound
    Let us know how it works out
    Rgds
    Jorge

Maybe you are looking for

  • Ethernet connectability completely frozen-out by frozen SES-mode; WTR54GS

    On a reset i accidentilly hit the SES button, now on my ethernet connection, the "Secure Easy Setup" button is frozen white. i've browsed th web, found other people have encountered same problem. i've spent probably 100 hours, trying many fixes, incl

  • Error when deploying new version of application on ALBPM 6.0.4

    I keep getting this error on our dev box when trying to deploy a new version of the application: <May 21, 2010 12:25:41 PM CDT> <Warning> <RMI> <BEA-080003> <RuntimeException thrown by rmi server: javax.management.remote.rmi.RMIConnectionImpl.invoke(

  • XSLT mapping query

    Hi All I have done a XSLT mapping to map a flat file structure to a hierarchical structure. But my 3rd level node is getting repeated for 2nd level node. Please find the details below Source Structure - flat file Header - 1 Record - 1....unbound Fore

  • Is there any query i can use to monitor Users tried to log on to data base

    is there any way to know the users tried to log on to data base is this possible if user entered user name and wrong password 4 times for example is there a table or something let me know that for example HR tried 4 times to log into data base

  • Final Cut Studio audio on Timeline

    Why does the audio timeline gather small bunches of audio digits...up and down everytime I make an audio change on the mixer?