IPSec Password discarded in 3.0

Ever since the 3.0 upgrade any IPSec VPN configuration created with a username and password seems to discard the password which is saved into the configuration at the first connection attempt i.e. I create a new VPN config, save it with a username and password and can see the dots in the configuration field reflecting the password entry, then I attempt to connect and I am prompted for my password, which when supplied does work OK, but if I open the VPN config it shows 'Ask Every Time'. Is anyone else seeing this?

The interface look like this:
procedure strong_password_check(
    p_username                    in  varchar2,
    p_password                    in  varchar2,
    p_old_password                in  varchar2,
    p_workspace_name              in  varchar2,
    p_use_strong_rules            in  boolean,
    p_min_length_err              out boolean,
    p_new_differs_by_err          out boolean,
    p_one_alpha_err               out boolean,
    p_one_numeric_err             out boolean,
    p_one_punctuation_err         out boolean,
    p_one_upper_err               out boolean,
    p_one_lower_err               out boolean,
    p_not_like_username_err       out boolean,
    p_not_like_workspace_name_err out boolean,
    p_not_like_words_err          out boolean)
    ;With a lot of out parameters.
Regards Pete

Similar Messages

  • ASA 5505 IPSEC VPN connected but can't access to LAN

    ASA : 8.2.5
    ASDM: 6.4.5
    LAN: 10.1.0.0/22
    VPN Pool: 172.16.10.0/24
    Hi, we purcahsed a new ASA 5505 and try to setup IPSEC VPN via ASDM; i just simply run the Wizards, setup vpnpool, split tunnelling,etc.
    I can connect to the ASA by using cisco VPN client and internet works fine on the local PC, but it cannot access to the LAN (can't ping. can't remote desktop). I tried the same thing on our Production ASA(those have both Remote VPN and Site-to-site VPN working), the new profile i created worked fine.
    Below is my configure, do I mis-configure anything?
    ASA Version 8.2(5)
    hostname asatest
    domain-name XXX.com
    enable password 8Fw1QFqthX2n4uD3 encrypted
    passwd g9NiG6oUPjkYrHNt encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.1.1.253 255.255.252.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address XXX.XXX.XXX.XXX 255.255.255.240
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name vff.com
    access-list vpntest_splitTunnelAcl standard permit 10.1.0.0 255.255.252.0
    access-list inside_nat0_outbound extended permit ip 10.1.0.0 255.255.252.0 172.16.10.0 255.255.255.0
    pager lines 24
    logging enable
    logging timestamp
    logging trap warnings
    logging asdm informational
    logging device-id hostname
    logging host inside 10.1.1.230
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 172.16.10.1-172.16.10.254 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (inside) host 10.1.1.108
    nt-auth-domain-controller 10.1.1.108
    http server enable
    http 10.1.0.0 255.255.252.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 10.1.0.0 255.255.252.0 inside
    ssh timeout 20
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy vpntest internal
    group-policy vpntest attributes
    wins-server value 10.1.1.108
    dns-server value 10.1.1.108
    vpn-tunnel-protocol IPSec l2tp-ipsec
    password-storage disable
    ip-comp disable
    re-xauth disable
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpntest_splitTunnelAcl
    default-domain value XXX.com
    split-tunnel-all-dns disable
    backup-servers keep-client-config
    address-pools value vpnpool
    username admin password WeiepwREwT66BhE9 encrypted privilege 15
    username user5 password yIWniWfceAUz1sUb encrypted privilege 5
    username user3 password umNHhJnO7McrLxNQ encrypted privilege 3
    tunnel-group vpntest type remote-access
    tunnel-group vpntest general-attributes
    address-pool vpnpool
    authentication-server-group AD
    authentication-server-group (inside) AD
    default-group-policy vpntest
    strip-realm
    tunnel-group vpntest ipsec-attributes
    pre-shared-key BEKey123456
    peer-id-validate nocheck
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege cmd level 3 mode exec command packet-tracer
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command vpnclient
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command dynamic-filter
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege clear level 3 mode exec command dynamic-filter
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:447bbbc60fc01e9f83b32b1e0304c6b4
    : end

    I change  a Machine's gateway to this ASA and capture again, now we can see some reply.
    All ohter PCs and switches gateway are point to another ASA, maybe that's the reason why i didn't work?
    what's the recommanded way to make our LAN to have two 2 gateways(for load balance or backup router, etc)?
    add two gateways to all PCs and swtichwes?
    1: 18:15:48.307875 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       2: 18:15:49.777685 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       3: 18:15:51.377147 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       4: 18:15:57.445777 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       5: 18:15:58.856324 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       6: 18:16:00.395090 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       7: 18:16:06.483464 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       8: 18:16:08.082805 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
       9: 18:16:09.542406 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 68
      10: 18:16:20.640424 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      11: 18:16:20.642193 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      12: 18:16:21.169607 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      13: 18:16:21.171210 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      14: 18:16:22.179556 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      15: 18:16:22.181142 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      16: 18:16:23.237673 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.230: icmp: echo request
      17: 18:16:23.239291 802.1Q vlan#1 P0 10.1.1.230 > 172.16.10.1: icmp: echo reply
      18: 18:16:27.676402 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 50
      19: 18:16:29.246935 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 50
      20: 18:16:30.676921 802.1Q vlan#1 P0 172.16.10.1.137 > 10.1.1.108.137:  udp 50
      21: 18:16:49.539660 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request
      22: 18:16:54.952602 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request
      23: 18:17:04.511463 802.1Q vlan#1 P0 172.16.10.1 > 10.1.1.233: icmp: echo request

  • IPSEC packets are not encrypted

    Hello (and Happy Thanksgiving to those in the USA),
    We recently swapped our ASA and re-applied the saved config to the new device. There is a site-to-site VPN that works and a remote client VPN that does not. We use some Cisco VPN clients and some Shrew Soft VPN clients.I've compared the config of the new ASA to that of the old ASA and I cannot find any differences (but the remote client VPN was working on the old ASA). The remote clients do connect and a tunnel is established but they are unable to pass traffic. Systems on the network where the ASA is located are able to access the internet.
    Output of sho crypto isakmp sa (ignore peer #1, that is the working site-to-site VPN)
       Active SA: 2
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA d
    Total IKE SA: 2
    1   IKE Peer: xx.168.155.98
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    2   IKE Peer: xx.211.206.48
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    Output of sho crypto ipsec sa (info regarding site-to-site VPN removed). Packets are decrypted but not encrypted.
        Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: publi
    c-ip
          local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
          remote ident (addr/mask/prot/port): (10.20.1.100/255.255.255.255/0/0)
          current_peer: xx.211.206.48, username: me
          dynamic allocated peer ip: 10.20.1.100
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 20, #pkts decrypt: 20, #pkts verify: 20
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: public-ip/4500, remote crypto endpt.: xx.211.206.48/4
    500
          path mtu 1500, ipsec overhead 82, media mtu 1500
          current outbound spi: 7E0BF9B9
          current inbound spi : 41B75CCD
        inbound esp sas:
          spi: 0x41B75CCD (1102535885)
             transform: esp-aes esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, }
             slot: 0, conn_id: 16384, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
             sa timing: remaining key lifetime (sec): 28776
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
          spi: 0xC06BF0DD (3228299485)
             transform: esp-aes esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, Rekeyed}
             slot: 0, conn_id: 16384, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
             sa timing: remaining key lifetime (sec): 28774
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x000003FF 0xFFF80001
        outbound esp sas:
          spi: 0x7E0BF9B9 (2114714041)
             transform: esp-aes esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, }
             slot: 0, conn_id: 16384, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
             sa timing: remaining key lifetime (sec): 28774
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
          spi: 0xCBF945AC (3422111148)
             transform: esp-aes esp-sha-hmac no compression
             in use settings ={RA, Tunnel,  NAT-T-Encaps, Rekeyed}
             slot: 0, conn_id: 16384, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
             sa timing: remaining key lifetime (sec): 28772
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
    Config from ASA
    : Saved
    : Written by me at 19:56:37.957 pst Tue Nov 26 2013
    ASA Version 8.2(4)
    hostname mfw01
    domain-name company.int
    enable password xxx encrypted
    passwd xxx encrypted
    names
    name xx.174.143.97 cox-gateway description cox-gateway
    name 172.16.10.0 iscsi-network description iscsi-network
    name 192.168.1.0 legacy-network description legacy-network
    name 10.20.50.0 management-network description management-network
    name 10.20.10.0 server-network description server-network
    name 10.20.20.0 user-network description user-network
    name 192.168.1.101 private-em-imap description private-em-imap
    name 10.20.10.2 private-exchange description private-exchange
    name 10.20.10.3 private-ftp description private-ftp
    name 192.168.1.202 private-ip-phones description private-ip-phones
    name 10.20.10.6 private-kaseya description private-kaseya
    name 192.168.1.2 private-mitel-3300 description private-mitel-3300
    name 10.20.10.1 private-pptp description private-pptp
    name 10.20.10.7 private-sharepoint description private-sharepoint
    name 10.20.10.4 private-tportal description private-tportal
    name 10.20.10.8 private-xarios description private-xarios
    name 192.168.1.215 private-xorcom description private-xorcom
    name xx.174.143.99 public-exchange description public-exchange
    name xx.174.143.100 public-ftp description public-ftp
    name xx.174.143.101 public-tportal description public-tportal
    name xx.174.143.102 public-sharepoint description public-sharepoint
    name xx.174.143.103 public-ip-phones description public-ip-phones
    name xx.174.143.104 public-mitel-3300 description public-mitel-3300
    name xx.174.143.105 public-xorcom description public-xorcom
    name xx.174.143.108 public-remote-support description public-remote-support
    name xx.174.143.109 public-xarios description public-xarios
    name xx.174.143.110 public-kaseya description public-kaseya
    name xx.174.143.111 public-pptp description public-pptp
    name 192.168.2.0 Irvine_LAN description Irvine_LAN
    name xx.174.143.98 public-ip
    name 10.20.10.14 private-RevProxy description private-RevProxy
    name xx.174.143.107 public-RevProxy description Public-RevProxy
    name 10.20.10.9 private-XenDesktop description private-XenDesktop
    name xx.174.143.115 public-XenDesktop description public-XenDesktop
    name 10.20.1.1 private-gateway description private-gateway
    name 192.168.1.96 private-remote-support description private-remote-support
    interface Ethernet0/0
    nameif public
    security-level 0
    ip address public-ip 255.255.255.224
    interface Ethernet0/1
    speed 100
    duplex full
    nameif private
    security-level 100
    ip address private-gateway 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.0.1 255.255.255.0
    management-only
    ftp mode passive
    clock timezone pst -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name mills.int
    object-group service ftp
    service-object tcp eq ftp
    service-object tcp eq ftp-data
    object-group service DM_INLINE_SERVICE_1
    group-object ftp
    service-object udp eq tftp
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq 40
    port-object eq ssh
    object-group service web-server
    service-object tcp eq www
    service-object tcp eq https
    object-group service DM_INLINE_SERVICE_2
    service-object tcp eq smtp
    group-object web-server
    object-group service DM_INLINE_SERVICE_3
    service-object tcp eq ssh
    group-object web-server
    object-group service kaseya
    service-object tcp eq 4242
    service-object tcp eq 5721
    service-object tcp eq 8080
    service-object udp eq 5721
    object-group service DM_INLINE_SERVICE_4
    group-object kaseya
    group-object web-server
    object-group service DM_INLINE_SERVICE_5
    service-object gre
    service-object tcp eq pptp
    object-group service VPN
    service-object gre
    service-object esp
    service-object ah
    service-object tcp eq pptp
    service-object udp eq 4500
    service-object udp eq isakmp
    object-group network MILLS_VPN_VLANS
    network-object 10.20.1.0 255.255.255.0
    network-object server-network 255.255.255.0
    network-object user-network 255.255.255.0
    network-object management-network 255.255.255.0
    network-object legacy-network 255.255.255.0
    object-group service InterTel5000
    service-object tcp range 3998 3999
    service-object tcp range 6800 6802
    service-object udp eq 20001
    service-object udp range 5004 5007
    service-object udp range 50098 50508
    service-object udp range 6604 7039
    service-object udp eq bootpc
    service-object udp eq tftp
    service-object tcp eq 4000
    service-object tcp eq 44000
    service-object tcp eq www
    service-object tcp eq https
    service-object tcp eq 5566
    service-object udp eq 5567
    service-object udp range 6004 6603
    service-object tcp eq 6880
    object-group service DM_INLINE_SERVICE_6
    service-object icmp
    service-object tcp eq 2001
    service-object tcp eq 2004
    service-object tcp eq 2005
    object-group service DM_INLINE_SERVICE_7
    service-object icmp
    group-object InterTel5000
    object-group service DM_INLINE_SERVICE_8
    service-object icmp
    service-object tcp eq https
    service-object tcp eq ssh
    object-group service RevProxy tcp
    description RevProxy
    port-object eq 5500
    object-group service XenDesktop tcp
    description Xen
    port-object eq 8080
    port-object eq 2514
    port-object eq 2598
    port-object eq 27000
    port-object eq 7279
    port-object eq 8000
    port-object eq citrix-ica
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_8 any host public-ip
    access-list public_access_in extended permit object-group VPN any host public-ip
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_7 any host public-ip-phones
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_1 any host public-ftp
    access-list public_access_in extended permit tcp any host public-xorcom object-group DM_INLINE_TCP_1
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_2 any host public-exchange
    access-list public_access_in extended permit tcp any host public-RevProxy object-group RevProxy
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_3 any host public-remote-support
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_6 any host public-xarios
    access-list public_access_in extended permit object-group web-server any host public-sharepoint
    access-list public_access_in extended permit object-group web-server any host public-tportal
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_4 any host public-kaseya
    access-list public_access_in extended permit object-group DM_INLINE_SERVICE_5 any host public-pptp
    access-list public_access_in extended permit ip any host public-XenDesktop
    access-list private_access_in extended permit icmp any any
    access-list private_access_in extended permit ip any any
    access-list VPN_Users_SplitTunnelAcl standard permit server-network 255.255.255.0
    access-list VPN_Users_SplitTunnelAcl standard permit user-network 255.255.255.0
    access-list VPN_Users_SplitTunnelAcl standard permit management-network 255.255.255.0
    access-list VPN_Users_SplitTunnelAcl standard permit 10.20.1.0 255.255.255.0
    access-list VPN_Users_SplitTunnelAcl standard permit legacy-network 255.255.255.0
    access-list private_nat0_outbound extended permit ip object-group MILLS_VPN_VLANS Irvine_LAN 255.255.255.0
    access-list private_nat0_outbound extended permit ip object-group MILLS_VPN_VLANS 10.20.1.96 255.255.255.240
    access-list private_nat0_outbound extended permit ip object-group MILLS_VPN_VLANS 10.90.2.0 255.255.255.0
    access-list public_1_cryptomap extended permit ip object-group MILLS_VPN_VLANS Irvine_LAN 255.255.255.0
    access-list public_2_cryptomap extended permit ip object-group MILLS_VPN_VLANS 10.90.2.0 255.255.255.0
    pager lines 24
    logging enable
    logging list Error-Events level warnings
    logging monitor warnings
    logging buffered warnings
    logging trap warnings
    logging asdm warnings
    logging mail warnings
    logging host private private-kaseya
    logging permit-hostdown
    logging class auth trap alerts
    mtu public 1500
    mtu private 1500
    mtu management 1500
    ip local pool VPN_Users 10.20.1.100-10.20.1.110 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (public) 101 interface
    nat (private) 0 access-list private_nat0_outbound
    nat (private) 101 0.0.0.0 0.0.0.0
    nat (management) 101 0.0.0.0 0.0.0.0
    static (private,public) public-ip-phones private-ip-phones netmask 255.255.255.255 dns
    static (private,public) public-ftp private-ftp netmask 255.255.255.255 dns
    static (private,public) public-xorcom private-xorcom netmask 255.255.255.255 dns
    static (private,public) public-exchange private-exchange netmask 255.255.255.255 dns
    static (private,public) public-RevProxy private-RevProxy netmask 255.255.255.255 dns
    static (private,public) public-remote-support private-remote-support netmask 255.255.255.255 dns
    static (private,public) public-xarios private-xarios netmask 255.255.255.255 dns
    static (private,public) public-sharepoint private-sharepoint netmask 255.255.255.255 dns
    static (private,public) public-tportal private-tportal netmask 255.255.255.255 dns
    static (private,public) public-kaseya private-kaseya netmask 255.255.255.255 dns
    static (private,public) public-pptp private-pptp netmask 255.255.255.255 dns
    static (private,public) public-XenDesktop private-XenDesktop netmask 255.255.255.255 dns
    access-group public_access_in in interface public
    access-group private_access_in in interface private
    route public 0.0.0.0 0.0.0.0 cox-gateway 1
    route private server-network 255.255.255.0 10.20.1.254 1
    route private user-network 255.255.255.0 10.20.1.254 1
    route private management-network 255.255.255.0 10.20.1.254 1
    route private iscsi-network 255.255.255.0 10.20.1.254 1
    route private legacy-network 255.255.255.0 10.20.1.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    ldap attribute-map admin-control
      map-name  comment Privilege-Level
    ldap attribute-map allow-dialin
      map-name  msNPAllowDialin IETF-Radius-Class
      map-value msNPAllowDialin FALSE NOACCESS
      map-value msNPAllowDialin TRUE IPSecUsers
    ldap attribute-map mills-vpn_users
      map-name  msNPAllowDialin IETF-Radius-Class
      map-value msNPAllowDialin FALSE NOACCESS
      map-value msNPAllowDialin True IPSecUsers
    ldap attribute-map network-admins
      map-name  memberOf IETF-Radius-Service-Type
      map-value memberOf FALSE NOACCESS
      map-value memberOf "Network Admins" 6
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server Mills protocol nt
    aaa-server Mills (private) host private-pptp
    nt-auth-domain-controller ms01.mills.int
    aaa-server Mills_NetAdmin protocol ldap
    aaa-server Mills_NetAdmin (private) host private-pptp
    server-port 389
    ldap-base-dn ou=San Diego,dc=mills,dc=int
    ldap-group-base-dn ou=San Diego,dc=mills,dc=int
    ldap-scope subtree
    ldap-naming-attribute cn
    ldap-login-password *
    ldap-login-dn cn=asa,ou=Service Accounts,ou=San Diego,dc=mills,dc=int
    server-type microsoft
    ldap-attribute-map mills-vpn_users
    aaa-server NetworkAdmins protocol ldap
    aaa-server NetworkAdmins (private) host private-pptp
    ldap-base-dn ou=San Diego,dc=mills,dc=int
    ldap-group-base-dn ou=San Diego,dc=mills,dc=int
    ldap-scope subtree
    ldap-naming-attribute cn
    ldap-login-password *
    ldap-login-dn cn=asa,ou=Service Accounts,ou=San Diego,dc=mills,dc=int
    server-type microsoft
    ldap-attribute-map network-admins
    aaa-server ADVPNUsers protocol ldap
    aaa-server ADVPNUsers (private) host private-pptp
    ldap-base-dn ou=San Diego,dc=mills,dc=int
    ldap-group-base-dn ou=San Diego,dc=mills,dc=int
    ldap-scope subtree
    ldap-naming-attribute cn
    ldap-login-password *
    ldap-login-dn cn=asa,ou=Service Accounts,ou=San Diego,dc=mills,dc=int
    server-type microsoft
    ldap-attribute-map mills-vpn_users
    aaa authentication enable console ADVPNUsers LOCAL
    aaa authentication http console ADVPNUsers LOCAL
    aaa authentication serial console ADVPNUsers LOCAL
    aaa authentication telnet console ADVPNUsers LOCAL
    aaa authentication ssh console ADVPNUsers LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 management
    http 0.0.0.0 0.0.0.0 public
    http 0.0.0.0 0.0.0.0 private
    snmp-server host private private-kaseya poll community ***** version 2c
    snmp-server location Mills - San Diego
    snmp-server contact Mills Assist
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt noproxyarp private
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map public_map 1 match address public_1_cryptomap
    crypto map public_map 1 set pfs
    crypto map public_map 1 set peer xx.168.155.98
    crypto map public_map 1 set transform-set ESP-3DES-MD5 ESP-AES-128-SHA
    crypto map public_map 1 set nat-t-disable
    crypto map public_map 1 set phase1-mode aggressive
    crypto map public_map 2 match address public_2_cryptomap
    crypto map public_map 2 set pfs group5
    crypto map public_map 2 set peer xx.181.134.141
    crypto map public_map 2 set transform-set ESP-AES-128-SHA
    crypto map public_map 2 set nat-t-disable
    crypto map public_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map public_map interface public
    crypto isakmp enable public
    crypto isakmp policy 1
    authentication pre-share
    encryption aes
    hash sha
    group 5
    lifetime 86400
    crypto isakmp policy 10
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash md5
    group 1
    lifetime 28800
    telnet 0.0.0.0 0.0.0.0 private
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 public
    ssh 0.0.0.0 0.0.0.0 private
    ssh 0.0.0.0 0.0.0.0 management
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.0.2-192.168.0.254 management
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp authenticate
    ntp server 216.129.110.22 source public
    ntp server 173.244.211.10 source public
    ntp server 24.124.0.251 source public prefer
    webvpn
    enable public
    svc enable
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
    vpn-simultaneous-logins 0
    vpn-tunnel-protocol svc
    group-policy IPSecUsers internal
    group-policy IPSecUsers attributes
    wins-server value 10.20.10.1
    dns-server value 10.20.10.1
    vpn-tunnel-protocol IPSec
    password-storage enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_Users_SplitTunnelAcl
    default-domain value mills.int
    address-pools value VPN_Users
    group-policy Irvine internal
    group-policy Irvine attributes
    vpn-tunnel-protocol IPSec
    username admin password Kra9/kXfLDwlSxis encrypted
    tunnel-group VPN_Users type remote-access
    tunnel-group VPN_Users general-attributes
    address-pool VPN_Users
    authentication-server-group Mills_NetAdmin
    default-group-policy IPSecUsers
    tunnel-group VPN_Users ipsec-attributes
    pre-shared-key *
    tunnel-group xx.189.99.114 type ipsec-l2l
    tunnel-group xx.189.99.114 general-attributes
    default-group-policy Irvine
    tunnel-group xx.189.99.114 ipsec-attributes
    pre-shared-key *
    tunnel-group xx.205.23.76 type ipsec-l2l
    tunnel-group xx.205.23.76 general-attributes
    default-group-policy Irvine
    tunnel-group xx.205.23.76 ipsec-attributes
    pre-shared-key *
    tunnel-group xx.168.155.98 type ipsec-l2l
    tunnel-group xx.168.155.98 general-attributes
    default-group-policy Irvine
    tunnel-group xx.168.155.98 ipsec-attributes
    pre-shared-key *
    class-map global-class
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global-policy
    class global-class
      inspect dns
      inspect esmtp
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect sip 
      inspect skinny 
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
    service-policy global-policy global
    privilege cmd level 3 mode exec command perfmon
    privilege cmd level 3 mode exec command ping
    privilege cmd level 3 mode exec command who
    privilege cmd level 3 mode exec command logging
    privilege cmd level 3 mode exec command failover
    privilege cmd level 3 mode exec command packet-tracer
    privilege show level 5 mode exec command import
    privilege show level 5 mode exec command running-config
    privilege show level 3 mode exec command reload
    privilege show level 3 mode exec command mode
    privilege show level 3 mode exec command firewall
    privilege show level 3 mode exec command asp
    privilege show level 3 mode exec command cpu
    privilege show level 3 mode exec command interface
    privilege show level 3 mode exec command clock
    privilege show level 3 mode exec command dns-hosts
    privilege show level 3 mode exec command access-list
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command vlan
    privilege show level 3 mode exec command ip
    privilege show level 3 mode exec command ipv6
    privilege show level 3 mode exec command failover
    privilege show level 3 mode exec command asdm
    privilege show level 3 mode exec command arp
    privilege show level 3 mode exec command route
    privilege show level 3 mode exec command ospf
    privilege show level 3 mode exec command aaa-server
    privilege show level 3 mode exec command aaa
    privilege show level 3 mode exec command eigrp
    privilege show level 3 mode exec command crypto
    privilege show level 3 mode exec command vpn-sessiondb
    privilege show level 3 mode exec command ssh
    privilege show level 3 mode exec command dhcpd
    privilege show level 3 mode exec command vpn
    privilege show level 3 mode exec command blocks
    privilege show level 3 mode exec command wccp
    privilege show level 3 mode exec command webvpn
    privilege show level 3 mode exec command module
    privilege show level 3 mode exec command uauth
    privilege show level 3 mode exec command compression
    privilege show level 3 mode configure command interface
    privilege show level 3 mode configure command clock
    privilege show level 3 mode configure command access-list
    privilege show level 3 mode configure command logging
    privilege show level 3 mode configure command ip
    privilege show level 3 mode configure command failover
    privilege show level 5 mode configure command asdm
    privilege show level 3 mode configure command arp
    privilege show level 3 mode configure command route
    privilege show level 3 mode configure command aaa-server
    privilege show level 3 mode configure command aaa
    privilege show level 3 mode configure command crypto
    privilege show level 3 mode configure command ssh
    privilege show level 3 mode configure command dhcpd
    privilege show level 5 mode configure command privilege
    privilege clear level 3 mode exec command dns-hosts
    privilege clear level 3 mode exec command logging
    privilege clear level 3 mode exec command arp
    privilege clear level 3 mode exec command aaa-server
    privilege clear level 3 mode exec command crypto
    privilege cmd level 3 mode configure command failover
    privilege clear level 3 mode configure command logging
    privilege clear level 3 mode configure command arp
    privilege clear level 3 mode configure command crypto
    privilege clear level 3 mode configure command aaa-server
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:5d5c963680401d150bee94b3c7c85f7a
    Maybe my eyes are glazing over from looking at this for too long. Does anything look wrong? Maybe I missed a command that would not show up in the config?
    Thanks in advance to all who take a look.

    Marius,
    I connected via my VPN client at home and pinged a remote server, attempted to RDP by name and then attempted to RDP by IP address. All were unsuccessful. Here is the packet capture:
    72 packets captured
       1: 09:44:06.304671 10.20.1.100.137 > 10.20.10.1.137:  udp 68
       2: 09:44:06.304885 10.20.1.100.54543 > 10.20.10.1.53:  udp 34
       3: 09:44:07.198384 10.20.1.100.51650 > 10.20.10.1.53:  udp 32
       4: 09:44:07.300353 10.20.1.100.54543 > 10.20.10.1.53:  udp 34
       5: 09:44:07.786504 10.20.1.100.137 > 10.20.10.1.137:  udp 68
       6: 09:44:07.786671 10.20.1.100.137 > 10.20.10.1.137:  udp 68
       7: 09:44:07.786855 10.20.1.100.137 > 10.20.10.1.137:  udp 68
       8: 09:44:08.198399 10.20.1.100.51650 > 10.20.10.1.53:  udp 32
       9: 09:44:09.282608 10.20.1.100.61328 > 10.20.10.1.53:  udp 32
      10: 09:44:09.286667 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      11: 09:44:09.286926 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      12: 09:44:09.287201 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      13: 09:44:09.300491 10.20.1.100.54543 > 10.20.10.1.53:  udp 34
      14: 09:44:10.199193 10.20.1.100.51650 > 10.20.10.1.53:  udp 32
      15: 09:44:10.282150 10.20.1.100.61328 > 10.20.10.1.53:  udp 32
      16: 09:44:11.286865 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      17: 09:44:12.302993 10.20.1.100.61328 > 10.20.10.1.53:  udp 32
      18: 09:44:12.785054 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      19: 09:44:13.301101 10.20.1.100.54543 > 10.20.10.1.53:  udp 34
      20: 09:44:14.204029 10.20.1.100.51650 > 10.20.10.1.53:  udp 32
      21: 09:44:14.287323 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      22: 09:44:14.375331 10.20.1.100 > 10.20.10.1: icmp: echo request
      23: 09:44:16.581589 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      24: 09:44:18.083842 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      25: 09:44:18.199879 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      26: 09:44:19.224063 10.20.1.100 > 10.20.10.1: icmp: echo request
      27: 09:44:19.582367 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      28: 09:44:19.704019 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      29: 09:44:20.288193 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      30: 09:44:21.200307 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      31: 09:44:21.786321 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      32: 09:44:23.289535 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      33: 09:44:24.204777 10.20.1.100 > 10.20.10.1: icmp: echo request
      34: 09:44:29.219440 10.20.1.100 > 10.20.10.1: icmp: echo request
      35: 09:44:29.287460 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      36: 09:44:30.787617 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      37: 09:44:32.287887 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      38: 09:45:00.533816 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      39: 09:45:02.018019 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      40: 09:45:03.160239 10.20.1.100.52764 > 10.20.10.1.53:  udp 34
      41: 09:45:03.350354 10.20.1.100.53948 > 10.20.10.1.53:  udp 38
      42: 09:45:03.521960 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      43: 09:45:04.158408 10.20.1.100.52764 > 10.20.10.1.53:  udp 34
      44: 09:45:04.344342 10.20.1.100.53948 > 10.20.10.1.53:  udp 38
      45: 09:45:06.160681 10.20.1.100.52764 > 10.20.10.1.53:  udp 34
      46: 09:45:06.358593 10.20.1.100.53948 > 10.20.10.1.53:  udp 38
      47: 09:45:10.159125 10.20.1.100.52764 > 10.20.10.1.53:  udp 34
      48: 09:45:10.345227 10.20.1.100.53948 > 10.20.10.1.53:  udp 38
      49: 09:45:14.550478 10.20.1.100.59402 > 10.20.10.1.53:  udp 32
      50: 09:45:15.536166 10.20.1.100.59402 > 10.20.10.1.53:  udp 32
      51: 09:45:17.546144 10.20.1.100.59402 > 10.20.10.1.53:  udp 32
      52: 09:45:21.882812 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      53: 09:45:23.379222 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      54: 09:45:24.893386 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      55: 09:45:41.550035 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      56: 09:45:43.029875 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      57: 09:45:44.541979 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      58: 09:46:10.767782 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      59: 09:46:12.261934 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      60: 09:46:13.776250 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      61: 09:46:19.848970 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      62: 09:46:20.113183 10.20.1.100.49751 > 10.20.10.7.3389: S 3288428077:3288428077(0) win 8192
      63: 09:46:21.331251 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      64: 09:46:22.831423 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      65: 09:46:23.101511 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      66: 09:46:23.123254 10.20.1.100.49751 > 10.20.10.7.3389: S 3288428077:3288428077(0) win 8192
      67: 09:46:24.591705 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      68: 09:46:26.115976 10.20.1.100.137 > 10.20.10.1.137:  udp 50
      69: 09:46:28.834276 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      70: 09:46:29.125817 10.20.1.100.49751 > 10.20.10.7.3389: S 3288428077:3288428077(0) win 8192
      71: 09:46:30.342816 10.20.1.100.137 > 10.20.10.1.137:  udp 68
      72: 09:46:31.840746 10.20.1.100.137 > 10.20.10.1.137:  udp 68
    72 packets shown

  • Unable to Access Remote LAN over IPSec VPN

    I have a Cisco ASA 5540 setup with Remote Access VPN for users. Suddenly no one can access the remote LAN over VPN. Below is my config:
    ASA Version 7.0(8)
    hostname DC2ASA
    domain-name yorktel.com
    enable password d2XdVlFOzleWlH1j encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    dns-guard
    interface GigabitEthernet0/0
     description outside/savvis
     nameif outside
     security-level 0
     ip address 216.33.198.4 255.255.255.0 standby 216.33.198.5
    interface GigabitEthernet0/1
     description inside
     nameif inside
     security-level 100
     ip address 10.203.204.1 255.255.254.0 standby 10.203.204.2
    interface GigabitEthernet0/2
     nameif insidesan
     security-level 100
     ip address 10.203.206.1 255.255.254.0 standby 10.203.206.2
    interface GigabitEthernet0/3
     description LAN/STATE Failover Interface
    interface Management0/0
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0
     management-only
    ftp mode passive
    object-group service FileMaker tcp-udp
     port-object range 16000 16001
    access-list outside-in extended permit ip 65.123.204.0 255.255.254.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit ip 216.33.198.0 255.255.255.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit icmp 216.33.198.0 255.255.255.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit icmp any any
    access-list outside-in extended permit icmp any any echo
    access-list outside-in extended permit ip any host 216.33.198.22 inactive
    access-list outside-in extended permit tcp any host 216.33.198.19
    access-list outside-in extended permit udp any host 216.33.198.19
    access-list outside-in extended permit ip any host 216.33.198.19
    access-list outside-in extended permit tcp any host 216.33.198.10 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ftp inactive
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ftp-data inactive
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ssh inactive
    access-list outside-in extended permit tcp any host 216.33.198.19 eq www
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.19 eq https
    access-list outside-in extended permit tcp any host 216.33.198.19 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.19 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.19 eq smtp
    access-list outside-in extended permit tcp any host 216.33.198.19 eq pop3
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 587
    access-list outside-in extended permit tcp any host 216.33.198.16 eq www
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.16 eq https
    access-list outside-in extended permit tcp any host 216.33.198.16 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.16 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.38 eq www
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.38 eq https
    access-list outside-in extended permit tcp any host 216.33.198.38 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.38 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.25 eq www
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.25 eq https
    access-list outside-in extended permit tcp any host 216.33.198.25 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.25 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.22 eq www
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.22 eq https
    access-list outside-in extended permit tcp any host 216.33.198.22 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.22 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.17 eq www
    access-list outside-in extended permit tcp any host 216.33.198.17 eq rtsp
    access-list outside-in extended permit udp any host 216.33.198.17 eq 5005
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.17 eq 1755
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.17 eq https
    access-list outside-in extended permit tcp any host 216.33.198.17 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.17 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 989
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 990
    access-list outside-in extended permit tcp any host 216.33.198.24 eq www
    access-list outside-in extended permit tcp any host 216.33.198.24 eq rtsp
    access-list outside-in extended permit udp any host 216.33.198.24 eq 5005
    access-list outside-in extended permit tcp any host 216.33.198.24 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.24 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.24
    access-list outside-in extended permit tcp any host 216.33.198.24 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.24 eq https
    access-list outside-in extended permit tcp 209.67.5.96 255.255.255.224 any inactive
    access-list outside-in extended permit udp 209.67.5.96 255.255.255.224 any inactive
    access-list outside-in extended permit udp any host 216.33.198.17 inactive
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 1433
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 1434
    access-list outside-in extended permit tcp any host 216.33.198.100 eq www
    access-list outside-in extended permit tcp any host 216.33.198.101 eq www
    access-list outside-in extended permit tcp any host 216.33.198.102 eq www
    access-list outside-in extended permit tcp any host 216.33.198.103 eq www
    access-list outside-in extended permit tcp any host 216.33.198.104 eq www
    access-list outside-in extended permit tcp any host 216.33.198.105 eq www
    access-list outside-in extended permit tcp any host 216.33.198.106 eq www
    access-list outside-in extended permit tcp any host 216.33.198.107 eq www
    access-list outside-in extended permit tcp any host 216.33.198.108 eq www
    access-list outside-in extended permit tcp any host 216.33.198.109 eq www
    access-list outside-in extended permit tcp any host 216.33.198.110 eq www
    access-list outside-in extended permit tcp any host 216.33.198.100 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.101 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.102 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.103 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.104 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.105 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.106 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.107 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.108 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.109 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.110 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.100 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.101 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.102 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.103 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.104 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.105 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.106 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.107 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.108 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.109 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.110 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.100 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.101 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.102 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.103 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.104 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.105 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.106 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.107 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.108 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.109 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.110 eq ftp-data
    access-list outside-in extended permit tcp host 12.71.134.4 any
    access-list outside-in extended permit udp host 12.71.134.4 any
    access-list outside-in remark Allow Mark to access remote desktop from home office.
    access-list outside-in extended permit tcp host 96.255.220.240 any
    access-list outside-in remark Allow Mark to access remote desktop from home office.
    access-list outside-in extended permit udp host 96.255.220.240 any
    access-list outside-in extended permit tcp host 67.81.54.83 any
    access-list outside-in remark Allow Chris to access remote desktop from home office.
    access-list outside-in extended permit tcp host 100.1.41.196 any
    access-list outside-in remark Allow Chris to access remote desktop from home office.
    access-list outside-in extended permit udp host 100.1.41.196 any
    access-list outside-in extended permit udp host 67.81.54.83 any
    access-list outside-in remark Allow Jim Johnstone to remote in from home office.
    access-list outside-in extended permit tcp host 96.225.44.46 any
    access-list outside-in remark Allow Jim Johnstone to remote in from home office.
    access-list outside-in extended permit udp host 96.225.44.46 any
    access-list outside-in extended permit tcp host 64.19.183.67 any
    access-list outside-in extended permit udp host 64.19.183.67 any
    access-list outside-in remark Allow Steve Fisher to remote in from home office.
    access-list outside-in extended permit tcp host 173.67.0.16 any
    access-list outside-in remark Allow Steve Fisher to remote in from home office.
    access-list outside-in extended permit udp host 173.67.0.16 any
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq 3389
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq ftp-data
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq ftp
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq www
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq https
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit udp any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit ip any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 3389 inactive
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq 3389
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq www
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq https
    access-list outside-in extended permit tcp any host 216.33.198.21 eq 8080
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq ftp
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 3306
    access-list outside-in extended permit udp any host 216.33.198.19 eq 3306
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq 3389
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq ftp
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq www
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 3389 inactive
    access-list outside-in extended permit tcp any host 216.33.198.17 inactive
    access-list outside-in extended permit ip any host 216.33.198.17 inactive
    access-list outside-in extended permit tcp any host 216.33.198.18 inactive
    access-list outside-in extended permit udp any host 216.33.198.17 eq 554
    access-list outside-in extended permit udp any host 216.33.198.24 eq 554
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit tcp host 64.241.196.50 any
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit udp host 64.241.196.50 any
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit ip host 64.241.196.50 any
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.26 eq www
    access-list outside-in extended permit tcp any host 216.33.198.26 eq https
    access-list outside-in extended permit tcp any host 216.33.198.27 eq https
    access-list outside-in extended permit tcp any host 216.33.198.27 eq www
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.27 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.27 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ftp inactive
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ssh inactive
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 81
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.28 eq www
    access-list outside-in extended permit tcp any host 216.33.198.28 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.29 eq www
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.29 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.30 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.31 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.20 object-group FileMaker
    access-list outside-in extended permit tcp any host 216.33.198.20 eq 5003
    access-list outside-in extended permit udp any host 216.33.198.20 eq 5003
    access-list outside-in extended permit tcp any host 216.33.198.33 eq www
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.33 eq https
    access-list outside-in extended permit tcp any host 216.33.198.33 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.33 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.34 eq www
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.34 eq https
    access-list outside-in extended permit tcp any host 216.33.198.34 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.34 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.36 eq www
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.36 eq https
    access-list outside-in extended permit tcp any host 216.33.198.36 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.36 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.37 eq www
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.37 eq https
    access-list outside-in extended permit tcp any host 216.33.198.37 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.37 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.39 eq www
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.39 eq https
    access-list outside-in extended permit tcp any host 216.33.198.39 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.39 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.41 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.41 eq www
    access-list outside-in extended permit tcp any host 216.33.198.41 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.41 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.41 eq https
    access-list outside-in extended permit tcp any host 216.33.198.41 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.42 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.42 eq www
    access-list outside-in extended permit tcp any host 216.33.198.42 eq https
    access-list outside-in extended permit tcp any host 216.33.198.42 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.42 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.42 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.28
    access-list inside-out extended permit tcp any host 216.33.198.17 eq rtsp
    access-list inside-out extended permit udp any host 216.33.198.17 eq 5004
    access-list inside-out extended permit udp any host 216.33.198.17 eq 5005
    access-list inside-out extended permit tcp any host 216.33.198.17 eq 1755
    access-list inside-out extended permit udp any host 216.33.198.17 eq 1755
    access-list rtsp-acl extended deny tcp any host 216.33.198.17 eq rtsp
    access-list rtsp-acl extended permit tcp any any eq rtsp
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 10.203.204.0 255.255.255.192
    access-list inside_nat0_outbound extended permit ip any 10.203.204.48 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 10.203.204.0 255.255.255.192
    access-list inside_nat0_outbound extended permit ip host 10.203.204.19 10.203.204.32 255.255.255.224
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 192.168.250.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 192.168.252.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 10.203.204.144 255.255.255.240
    access-list inside_nat0_outbound extended permit ip host 216.33.198.33 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.19 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.17 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.24 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.20 any inactive
    access-list inside_nat0_outbound extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip any 10.203.204.48 255.255.255.248
    access-list inside_nat0_outbound extended permit ip any 216.33.198.56 255.255.255.248
    access-list dc2vpn_splitTunnelAcl standard permit 10.203.204.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit 192.168.252.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit any
    access-list outside_map standard permit any
    access-list Split_Tunnel_List standard permit 10.203.204.0 255.255.255.0
    access-list test_splitTunnelAcl standard permit any
    access-list outside_access_out extended permit tcp any host 12.71.134.75 inactive
    access-list outside_in extended permit tcp host 12.71.134.75 any eq smtp
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.130.31
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.102
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.103
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.104
    access-list outside_nat0_inbound extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_80 extended permit ip 10.203.204.0 255.255.255.0 192.168.250.0 255.255.255.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.33 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.19 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.17 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.24 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_100 extended permit ip 10.203.204.0 255.255.255.0 192.168.252.0 255.255.255.0
    access-list dc2vpntest_splitTunnelAcl standard permit 10.203.204.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    logging ftp-bufferwrap
    logging ftp-server 10.203.204.10 logs asa ****
    mtu outside 1500
    mtu inside 1500
    mtu insidesan 1500
    mtu management 1500
    ip local pool vpnpool 10.203.204.60-10.203.204.65 mask 255.255.255.0
    failover
    failover lan unit secondary
    failover lan interface failover GigabitEthernet0/3
    failover polltime unit msec 999 holdtime 3
    failover polltime interface 5
    failover link failover GigabitEthernet0/3
    failover interface ip failover 172.16.100.1 255.255.255.252 standby 172.16.100.2
    monitor-interface outside
    monitor-interface inside
    monitor-interface insidesan
    no monitor-interface management
    icmp permit 65.123.204.0 255.255.254.0 outside
    asdm image disk0:/asdm-508.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    nat (outside) 0 access-list outside_nat0_inbound outside
    nat (inside) 0 access-list inside_nat0_outbound
    static (inside,outside) 216.33.198.10 10.203.204.10 netmask 255.255.255.255
    static (inside,outside) 216.33.198.11 10.203.204.11 netmask 255.255.255.255
    static (inside,outside) 216.33.198.12 10.203.204.12 netmask 255.255.255.255
    static (inside,outside) 216.33.198.13 10.203.204.13 netmask 255.255.255.255
    static (inside,outside) 216.33.198.14 10.203.204.14 netmask 255.255.255.255
    static (inside,outside) 216.33.198.15 10.203.204.15 netmask 255.255.255.255
    static (inside,outside) 216.33.198.16 10.203.204.16 netmask 255.255.255.255
    static (inside,outside) 216.33.198.17 10.203.204.17 netmask 255.255.255.255
    static (inside,outside) 216.33.198.18 10.203.204.18 netmask 255.255.255.255
    static (inside,outside) 216.33.198.19 10.203.204.19 netmask 255.255.255.255
    static (inside,outside) 216.33.198.20 10.203.204.20 netmask 255.255.255.255
    static (inside,outside) 216.33.198.21 10.203.204.21 netmask 255.255.255.255
    static (inside,outside) 216.33.198.22 10.203.204.22 netmask 255.255.255.255
    static (inside,outside) 216.33.198.23 10.203.204.23 netmask 255.255.255.255
    static (inside,outside) 216.33.198.24 10.203.204.24 netmask 255.255.255.255
    static (inside,outside) 216.33.198.25 10.203.204.25 netmask 255.255.255.255
    static (inside,outside) 216.33.198.26 10.203.204.26 netmask 255.255.255.255
    static (inside,outside) 216.33.198.27 10.203.204.27 netmask 255.255.255.255
    static (inside,outside) 216.33.198.28 10.203.204.28 netmask 255.255.255.255
    static (inside,outside) 216.33.198.29 10.203.204.29 netmask 255.255.255.255
    static (inside,outside) 216.33.198.30 10.203.204.30 netmask 255.255.255.255
    static (inside,outside) 216.33.198.31 10.203.204.31 netmask 255.255.255.255
    static (inside,outside) 216.33.198.32 10.203.204.32 netmask 255.255.255.255
    static (inside,outside) 216.33.198.33 10.203.204.33 netmask 255.255.255.255
    static (inside,outside) 216.33.198.34 10.203.204.34 netmask 255.255.255.255
    static (inside,outside) 216.33.198.35 10.203.204.35 netmask 255.255.255.255
    static (inside,outside) 216.33.198.36 10.203.204.36 netmask 255.255.255.255
    static (inside,outside) 216.33.198.37 10.203.204.37 netmask 255.255.255.255
    static (inside,outside) 216.33.198.38 10.203.204.38 netmask 255.255.255.255
    static (inside,outside) 216.33.198.39 10.203.204.39 netmask 255.255.255.255
    static (inside,outside) 216.33.198.40 10.203.204.40 netmask 255.255.255.255
    static (inside,outside) 216.33.198.41 10.203.204.41 netmask 255.255.255.255
    static (inside,outside) 216.33.198.42 10.203.204.42 netmask 255.255.255.255
    static (inside,outside) 216.33.198.43 10.203.204.43 netmask 255.255.255.255
    static (inside,outside) 216.33.198.44 10.203.204.44 netmask 255.255.255.255
    static (inside,outside) 216.33.198.45 10.203.204.45 netmask 255.255.255.255
    static (inside,outside) 216.33.198.46 10.203.204.46 netmask 255.255.255.255
    static (inside,outside) 216.33.198.47 10.203.204.47 netmask 255.255.255.255
    static (inside,outside) 216.33.198.48 10.203.204.48 netmask 255.255.255.255
    static (inside,outside) 216.33.198.49 10.203.204.49 netmask 255.255.255.255
    static (inside,outside) 216.33.198.50 10.203.204.50 netmask 255.255.255.255
    static (inside,outside) 216.33.198.51 10.203.204.51 netmask 255.255.255.255
    static (inside,outside) 216.33.198.52 10.203.204.52 netmask 255.255.255.255
    static (inside,outside) 216.33.198.53 10.203.204.53 netmask 255.255.255.255
    static (inside,outside) 216.33.198.54 10.203.204.54 netmask 255.255.255.255
    static (inside,outside) 216.33.198.55 10.203.204.55 netmask 255.255.255.255
    static (inside,outside) 216.33.198.56 10.203.204.56 netmask 255.255.255.255
    static (inside,outside) 216.33.198.57 10.203.204.57 netmask 255.255.255.255
    static (inside,outside) 216.33.198.58 10.203.204.58 netmask 255.255.255.255
    static (inside,outside) 216.33.198.59 10.203.204.59 netmask 255.255.255.255
    static (inside,outside) 216.33.198.60 10.203.204.60 netmask 255.255.255.255
    static (inside,outside) 216.33.198.61 10.203.204.61 netmask 255.255.255.255
    static (inside,outside) 216.33.198.62 10.203.204.62 netmask 255.255.255.255
    static (inside,outside) 216.33.198.63 10.203.204.63 netmask 255.255.255.255
    static (inside,outside) 216.33.198.64 10.203.204.64 netmask 255.255.255.255
    static (inside,outside) 216.33.198.65 10.203.204.65 netmask 255.255.255.255
    static (inside,outside) 216.33.198.66 10.203.204.66 netmask 255.255.255.255
    static (inside,outside) 216.33.198.67 10.203.204.67 netmask 255.255.255.255
    static (inside,outside) 216.33.198.68 10.203.204.68 netmask 255.255.255.255
    static (inside,outside) 216.33.198.69 10.203.204.69 netmask 255.255.255.255
    static (inside,outside) 216.33.198.70 10.203.204.70 netmask 255.255.255.255
    static (inside,outside) 216.33.198.71 10.203.204.71 netmask 255.255.255.255
    static (inside,outside) 216.33.198.100 10.203.204.100 netmask 255.255.255.255
    static (inside,outside) 216.33.198.101 10.203.204.101 netmask 255.255.255.255
    static (inside,outside) 216.33.198.102 10.203.204.102 netmask 255.255.255.255
    static (inside,outside) 216.33.198.103 10.203.204.103 netmask 255.255.255.255
    static (inside,outside) 216.33.198.104 10.203.204.104 netmask 255.255.255.255
    static (inside,outside) 216.33.198.105 10.203.204.105 netmask 255.255.255.255
    static (inside,outside) 216.33.198.106 10.203.204.106 netmask 255.255.255.255
    static (inside,outside) 216.33.198.107 10.203.204.107 netmask 255.255.255.255
    static (inside,outside) 216.33.198.108 10.203.204.108 netmask 255.255.255.255
    static (inside,outside) 216.33.198.109 10.203.204.109 netmask 255.255.255.255
    static (inside,outside) 216.33.198.110 10.203.204.110 netmask 255.255.255.255
    static (inside,outside) 216.33.198.111 10.203.204.111 netmask 255.255.255.255
    static (inside,outside) 216.33.198.112 10.203.204.112 netmask 255.255.255.255
    static (inside,outside) 216.33.198.113 10.203.204.113 netmask 255.255.255.255
    static (inside,outside) 216.33.198.114 10.203.204.114 netmask 255.255.255.255
    static (inside,outside) 216.33.198.115 10.203.204.115 netmask 255.255.255.255
    static (inside,outside) 216.33.198.116 10.203.204.116 netmask 255.255.255.255
    static (inside,outside) 216.33.198.117 10.203.204.117 netmask 255.255.255.255
    static (inside,outside) 216.33.198.118 10.203.204.118 netmask 255.255.255.255
    static (inside,outside) 216.33.198.119 10.203.204.119 netmask 255.255.255.255
    static (inside,outside) 216.33.198.120 10.203.204.120 netmask 255.255.255.255
    static (inside,outside) 216.33.198.121 10.203.204.121 netmask 255.255.255.255
    static (inside,outside) 216.33.198.122 10.203.204.122 netmask 255.255.255.255
    static (inside,outside) 216.33.198.123 10.203.204.123 netmask 255.255.255.255
    static (inside,outside) 216.33.198.124 10.203.204.124 netmask 255.255.255.255
    static (inside,outside) 216.33.198.125 10.203.204.125 netmask 255.255.255.255
    static (inside,outside) 216.33.198.126 10.203.204.126 netmask 255.255.255.255
    static (inside,outside) 216.33.198.127 10.203.204.127 netmask 255.255.255.255
    static (inside,outside) 216.33.198.128 10.203.204.128 netmask 255.255.255.255
    static (inside,outside) 216.33.198.129 10.203.204.129 netmask 255.255.255.255
    static (inside,outside) 216.33.198.130 10.203.204.130 netmask 255.255.255.255
    static (inside,outside) 216.33.198.131 10.203.204.131 netmask 255.255.255.255
    static (inside,outside) 216.33.198.132 10.203.204.132 netmask 255.255.255.255
    static (inside,outside) 216.33.198.133 10.203.204.133 netmask 255.255.255.255
    static (inside,outside) 216.33.198.134 10.203.204.134 netmask 255.255.255.255
    static (inside,outside) 216.33.198.135 10.203.204.135 netmask 255.255.255.255
    static (inside,outside) 216.33.198.136 10.203.204.136 netmask 255.255.255.255
    static (inside,outside) 216.33.198.137 10.203.204.137 netmask 255.255.255.255
    static (inside,outside) 216.33.198.138 10.203.204.138 netmask 255.255.255.255
    static (inside,outside) 216.33.198.139 10.203.204.139 netmask 255.255.255.255
    static (inside,outside) 216.33.198.140 10.203.204.140 netmask 255.255.255.255
    static (inside,outside) 216.33.198.141 10.203.204.141 netmask 255.255.255.255
    static (inside,outside) 216.33.198.142 10.203.204.142 netmask 255.255.255.255
    static (inside,outside) 216.33.198.143 10.203.204.143 netmask 255.255.255.255
    static (inside,outside) 216.33.198.144 10.203.204.144 netmask 255.255.255.255
    static (inside,outside) 216.33.198.145 10.203.204.145 netmask 255.255.255.255
    static (inside,outside) 216.33.198.146 10.203.204.146 netmask 255.255.255.255
    static (inside,outside) 216.33.198.147 10.203.204.147 netmask 255.255.255.255
    static (inside,outside) 216.33.198.148 10.203.204.148 netmask 255.255.255.255
    static (inside,outside) 216.33.198.149 10.203.204.149 netmask 255.255.255.255
    static (inside,outside) 216.33.198.150 10.203.204.150 netmask 255.255.255.255
    static (inside,outside) 216.33.198.151 10.203.204.151 netmask 255.255.255.255
    static (inside,outside) 216.33.198.152 10.203.204.152 netmask 255.255.255.255
    static (inside,outside) 216.33.198.153 10.203.204.153 netmask 255.255.255.255
    static (inside,outside) 216.33.198.154 10.203.204.154 netmask 255.255.255.255
    static (inside,outside) 216.33.198.155 10.203.204.155 netmask 255.255.255.255
    static (inside,outside) 216.33.198.156 10.203.204.156 netmask 255.255.255.255
    static (inside,outside) 216.33.198.157 10.203.204.157 netmask 255.255.255.255
    static (inside,outside) 216.33.198.158 10.203.204.158 netmask 255.255.255.255
    static (inside,outside) 216.33.198.159 10.203.204.159 netmask 255.255.255.255
    static (inside,outside) 216.33.198.160 10.203.204.160 netmask 255.255.255.255
    static (inside,outside) 216.33.198.161 10.203.204.161 netmask 255.255.255.255
    static (inside,outside) 216.33.198.162 10.203.204.162 netmask 255.255.255.255
    static (inside,outside) 216.33.198.163 10.203.204.163 netmask 255.255.255.255
    static (inside,outside) 216.33.198.164 10.203.204.164 netmask 255.255.255.255
    static (inside,outside) 216.33.198.165 10.203.204.165 netmask 255.255.255.255
    static (inside,outside) 216.33.198.166 10.203.204.166 netmask 255.255.255.255
    static (inside,outside) 216.33.198.167 10.203.204.167 netmask 255.255.255.255
    static (inside,outside) 216.33.198.168 10.203.204.168 netmask 255.255.255.255
    static (inside,outside) 216.33.198.169 10.203.204.169 netmask 255.255.255.255
    static (inside,outside) 216.33.198.170 10.203.204.170 netmask 255.255.255.255
    static (inside,outside) 216.33.198.171 10.203.204.171 netmask 255.255.255.255
    static (inside,outside) 216.33.198.172 10.203.204.172 netmask 255.255.255.255
    static (inside,outside) 216.33.198.173 10.203.204.173 netmask 255.255.255.255
    static (inside,outside) 216.33.198.174 10.203.204.174 netmask 255.255.255.255
    static (inside,outside) 216.33.198.175 10.203.204.175 netmask 255.255.255.255
    static (inside,outside) 216.33.198.176 10.203.204.176 netmask 255.255.255.255
    static (inside,outside) 216.33.198.177 10.203.204.177 netmask 255.255.255.255
    static (inside,outside) 216.33.198.178 10.203.204.178 netmask 255.255.255.255
    static (inside,outside) 216.33.198.179 10.203.204.179 netmask 255.255.255.255
    static (inside,outside) 216.33.198.180 10.203.204.180 netmask 255.255.255.255
    static (inside,outside) 216.33.198.181 10.203.204.181 netmask 255.255.255.255
    static (inside,outside) 216.33.198.182 10.203.204.182 netmask 255.255.255.255
    static (inside,outside) 216.33.198.183 10.203.204.183 netmask 255.255.255.255
    static (inside,outside) 216.33.198.184 10.203.204.184 netmask 255.255.255.255
    static (inside,outside) 216.33.198.185 10.203.204.185 netmask 255.255.255.255
    static (inside,outside) 216.33.198.186 10.203.204.186 netmask 255.255.255.255
    static (inside,outside) 216.33.198.187 10.203.204.187 netmask 255.255.255.255
    static (inside,outside) 216.33.198.188 10.203.204.188 netmask 255.255.255.255
    static (inside,outside) 216.33.198.189 10.203.204.189 netmask 255.255.255.255
    static (inside,outside) 216.33.198.190 10.203.204.190 netmask 255.255.255.255
    static (inside,outside) 216.33.198.191 10.203.204.191 netmask 255.255.255.255
    static (inside,outside) 216.33.198.192 10.203.204.192 netmask 255.255.255.255
    static (inside,outside) 216.33.198.193 10.203.204.193 netmask 255.255.255.255
    static (inside,outside) 216.33.198.194 10.203.204.194 netmask 255.255.255.255
    static (inside,outside) 216.33.198.195 10.203.204.195 netmask 255.255.255.255
    static (inside,outside) 216.33.198.196 10.203.204.196 netmask 255.255.255.255
    static (inside,outside) 216.33.198.197 10.203.204.197 netmask 255.255.255.255
    static (inside,outside) 216.33.198.198 10.203.204.198 netmask 255.255.255.255
    static (inside,outside) 216.33.198.199 10.203.204.199 netmask 255.255.255.255
    static (inside,outside) 216.33.198.200 10.203.204.200 netmask 255.255.255.255
    access-group outside-in in interface outside
    route outside 0.0.0.0 0.0.0.0 216.33.198.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
    timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy test internal
    group-policy test attributes
     dns-server value 10.203.204.14 10.203.204.15
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value test_splitTunnelAcl
     default-domain value yorkmedia.local
     webvpn
    group-policy tunneltest internal
    group-policy tunneltest attributes
     dns-server value 10.203.204.14 4.2.2.2
     default-domain value yorkmedia.local
     webvpn
    group-policy testpol internal
    group-policy testpol attributes
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelall
     split-tunnel-network-list value dc2vpn_splitTunnelAcl
     webvpn
    group-policy aes internal
    group-policy aes attributes
     dns-server value 10.203.204.14 10.203.204.15
     vpn-tunnel-protocol IPSec
     group-lock value aestest
     webvpn
    group-policy grouptest internal
    group-policy grouptest attributes
     dns-server value 10.203.204.14 4.2.2.2
     default-domain value yorkmedia.local
     webvpn
    group-policy dc2vpntest internal
    group-policy dc2vpntest attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dc2vpntest_splitTunnelAcl
     webvpn
    group-policy dc2vpn internal
    group-policy dc2vpn attributes
     dns-server value 10.203.204.14 10.203.204.15
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dc2vpn_splitTunnelAcl
     webvpn
    group-policy BMSTV internal
    group-policy BMSTV attributes
     wins-server none
     dns-server none
     dhcp-network-scope none
     vpn-access-hours none
     vpn-simultaneous-logins 3
     vpn-idle-timeout none
     vpn-session-timeout none
     vpn-filter none
     vpn-tunnel-protocol IPSec
     password-storage disable
     ip-comp disable
     re-xauth disable
     group-lock none
     pfs disable
     ipsec-udp disable
     ipsec-udp-port 10000
     split-tunnel-policy tunnelall
     split-tunnel-network-list none
     default-domain none
     split-dns none
     secure-unit-authentication disable
     user-authentication disable
     user-authentication-idle-timeout none
     ip-phone-bypass disable
     leap-bypass disable
     nem disable
     backup-servers keep-client-config
     client-firewall none
     client-access-rule none
     webvpn
    username mmaxey password zSSKHLc.gx8szpy2 encrypted privilege 15
    username mmaxey attributes
     vpn-group-policy dc2vpn
     webvpn
    username jjohnstone password qElIg/rYW4OoTIEP encrypted privilege 15
    username jjohnstone attributes
     vpn-group-policy dc2vpntest
     webvpn
    username sragona password ZgCBom/StrITlFdU encrypted
    username sragona attributes
     vpn-group-policy dc2vpn
     webvpn
    username admin password 5zvQXQPrcnyHyGKm encrypted
    username seng password PP8UcINDKi7BSsj2 encrypted
    username seng attributes
     vpn-group-policy dc2vpn
     webvpn
    username chauser password I3OIxCe8FBONQlhK encrypted
    username chauser attributes
     vpn-group-policy dc2vpn
     webvpn
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 65.123.204.0 255.255.254.0 outside
    http 0.0.0.0 0.0.0.0 outside
    http 10.203.204.0 255.255.254.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set pfs group7
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-AES-256-SHA
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto map outside_map 60 match address outside_cryptomap_60
    crypto map outside_map 60 set peer 165.89.240.1
    crypto map outside_map 60 set transform-set ESP-3DES-SHA
    crypto map outside_map 60 set security-association lifetime seconds 28800
    crypto map outside_map 60 set security-association lifetime kilobytes 4608000
    crypto map outside_map 80 match address outside_cryptomap_80
    crypto map outside_map 80 set pfs
    crypto map outside_map 80 set peer 64.19.183.67
    crypto map outside_map 80 set transform-set ESP-3DES-SHA
    crypto map outside_map 80 set security-association lifetime seconds 28800
    crypto map outside_map 80 set security-association lifetime kilobytes 4608000
    crypto map outside_map 100 match address outside_cryptomap_100
    crypto map outside_map 100 set pfs
    crypto map outside_map 100 set peer 64.241.196.50
    crypto map outside_map 100 set transform-set ESP-3DES-SHA
    crypto map outside_map 100 set security-association lifetime seconds 28800
    crypto map outside_map 100 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption aes-256
    isakmp policy 30 hash sha
    isakmp policy 30 group 5
    isakmp policy 30 lifetime 86400
    isakmp policy 50 authentication pre-share
    isakmp policy 50 encryption aes-256
    isakmp policy 50 hash sha
    isakmp policy 50 group 7
    isakmp policy 50 lifetime 86400
    isakmp nat-traversal  20
    isakmp ipsec-over-tcp port 10000
    tunnel-group DefaultRAGroup ipsec-attributes
     pre-shared-key *
    tunnel-group dc2vpn type ipsec-ra
    tunnel-group dc2vpn general-attributes
     address-pool vpnpool
     default-group-policy dc2vpn
    tunnel-group dc2vpn ipsec-attributes
     pre-shared-key *
    tunnel-group test type ipsec-ra
    tunnel-group test general-attributes
     default-group-policy test
    tunnel-group test ipsec-attributes
     pre-shared-key *
    tunnel-group 165.89.240.1 type ipsec-l2l
    tunnel-group 165.89.240.1 general-attributes
     default-group-policy BMSTV
    tunnel-group 165.89.240.1 ipsec-attributes
     pre-shared-key *
     isakmp keepalive threshold 3600 retry 2
    tunnel-group 64.19.183.67 type ipsec-l2l
    tunnel-group 64.19.183.67 ipsec-attributes
     pre-shared-key *
    tunnel-group 64.241.196.50 type ipsec-l2l
    tunnel-group 64.241.196.50 ipsec-attributes
     pre-shared-key *
     isakmp keepalive disable
    tunnel-group dc2vpntest type ipsec-ra
    tunnel-group dc2vpntest general-attributes
     default-group-policy dc2vpntest
    tunnel-group dc2vpntest ipsec-attributes
     pre-shared-key *
    tunnel-group aestest type ipsec-ra
    tunnel-group aestest general-attributes
     address-pool vpnpool
     default-group-policy aes
    tunnel-group aestest ipsec-attributes
     pre-shared-key *
    tunnel-group TunnelGroup1 type ipsec-ra
    tunnel-group TunnelGroup1 general-attributes
     address-pool vpnpool
    telnet 10.203.204.10 255.255.255.255 inside
    telnet timeout 5
    ssh 65.123.204.0 255.255.254.0 outside
    ssh 10.203.204.0 255.255.254.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd lease 3600
    dhcpd ping_timeout 50
    class-map rtsp-traffic
     match access-list rtsp-acl
    class-map inspection_default
     match default-inspection-traffic
    policy-map global_policy
     class inspection_default
      inspect dns maximum-length 512
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
     class rtsp-traffic
      inspect rtsp
    service-policy global_policy global
    tftp-server inside 10.203.204.10 dc2asa01/config
    Cryptochecksum:6d74d3994ea6764893c420f477568aac
    : end

    You have three site-site VPNs and a remote access VPN setup. so the statement "Suddenly no one can access the remote LAN over VPN. " is a bit ambiguous in that context.
    From which source to what destination is not working for you?

  • ASA VPN QUESTION

    Hi All
    The question is pretty simple. I can successfully connect  to my ASA 5505  firewall via cisco vpn client 64 bit , i can ping any ip  address on the LAN behind ASA but none of the LAN computers can see or  ping the IP Address which is assigned to my vpn client from the ASA VPN  Pool.
    The LAN behind ASA is 192.168.0.0 and the VPN Pool for the cisco vpn client is 192.168.30.0
    I would appreciate some help pls
    Here is the config:
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password J7NxNd4NtVydfOsB encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.0.11 EXCHANGE
    name x.x.x.x WAN
    name 192.168.30.0 VPN_POOL2
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address WAN 255.255.255.252
    interface Ethernet0/0
    switchport access vlan 2
    <--- More --->
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    boot system disk0:/asa724-k8.bin
    ftp mode passive
    clock timezone EEST 2
    clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    access-list nk-acl extended permit tcp any interface outside eq smtp
    access-list nk-acl extended permit tcp any interface outside eq https
    access-list customerVPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 VPN_POOL2 255.255.255.0
    access-list inside_access_in extended permit ip any any
    access-list VPN_NAT extended permit ip VPN_POOL2 255.255.255.0 192.168.0.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPN_POOL2 192.168.30.10-192.168.30.90 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (inside) 10 interface
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (outside) 10 access-list VPN_NAT outside
    static (inside,outside) tcp interface smtp EXCHANGE smtp netmask 255.255.255.255
    static (inside,outside) tcp interface https EXCHANGE https netmask 255.255.255.255
    access-group inside_access_in in interface inside
    access-group nk-acl in interface outside
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authorization command LOCAL
    http server enable
    http 192.168.0.0 255.255.255.0 inside
    snmp-server host inside 192.168.0.16 community public
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    telnet 192.168.0.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcp-client client-id interface outside
    dhcpd dns 217.27.32.196
    dhcpd address 192.168.0.100-192.168.0.200 inside
    dhcpd dns 192.168.0.10 interface inside
    dhcpd enable inside
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy customerVPN internal
    group-policy customerVPN attributes
    dns-server value 192.168.0.10
    vpn-tunnel-protocol IPSec
    password-storage enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value customerVPN_splitTunnelAcl
    default-domain value customer.local
    username xxx password 8SYsAcRU4s6DpQP1 encrypted privilege 0
    username xxx attributes
    vpn-group-policy TUNNEL1
    username xxx password C6M4Xy7t0VOLU3bS encrypted privilege 0
    username xxx attributes
    vpn-group-policy PAPAGROUP
    username xxx password RU2zcsRqQAwCkglQ encrypted privilege 0
    username xxx attributes
    vpn-group-policy customerVPN
    username xxx password zfP8z5lE6WK/sSjY encrypted privilege 15
    tunnel-group customerVPN type ipsec-ra
    tunnel-group customerVPN general-attributes
    address-pool VPN_POOL2
    default-group-policy customerVPN
    tunnel-group customerVPN ipsec-attributes
    pre-shared-key *
    tunnel-group-map default-group DefaultL2LGroup
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:a4dfbb82008f78756fe4c7d029871ec1
    : end
    ciscoasa#                           

    Well lots of new features have been hinted at for ASA 9.2 but I've not seen anything as far as an Engineering Commit or Customer Commit for that feature.
    Site-site VPN in multiple context mode was added in 9.0(1) and I have customers have been asking for the remote access features as well.
    I will remember to ask about that at Cisco Live next month.

  • Asa 5505 to pix

    I've been pulling my hair out on this one.  I had 3 tunnels using a pix firewall at each location going to the main office (I didn't set it up).  One of the pix toasted, so I'm trying to replace it with a cisco asa 5505.  I created the tunnel, it sees the tunnel on both sides, I can see the encaps and decaps at the main office, but I can't ping from the new tunnel to the main office, or vice-versa.  I've tried all kinds of things, rebuilt the tunnel umpteen times, and I just can't see where the problem is.  Maybe fresh eyes can save my hair.  I hope someone sees something that I missed.  Here's the config:
    : Saved
    ASA Version 7.2(2)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 142.176.18.178 255.255.255.252
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex half
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    clock timezone AST -4
    clock summer-time ADT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 142.177.1.2
    name-server 142.177.129.11
    domain-name default.domain.invalid
    access-list outside_cryptomap_20 extended permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
    access-list outside_cryptomap_40 extended permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
    access-list outside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
    pager lines 24
    logging enable
    logging history debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (inside) 1 10.0.1.2-10.0.1.254 netmask 255.255.255.0
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (outside) 0 access-list outside_nat0_outbound
    nat (outside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 142.176.18.177 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    http server enable
    http 10.0.1.0 255.255.255.0 inside
    http 24.222.27.154 255.255.255.255 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt noproxyarp outside
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 20 match address outside_cryptomap_20
    crypto map outside_map 20 set peer 142.176.4.90
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 20 set reverse-route
    crypto map outside_map 40 match address outside_cryptomap_40
    crypto map outside_map 40 set peer 142.176.4.90
    crypto map outside_map 40 set transform-set ESP-3DES-SHA
    crypto map outside_map 40 set reverse-route
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group 142.176.4.90 type ipsec-l2l
    tunnel-group 142.176.4.90 ipsec-attributes
    pre-shared-key *
    tunnel-group-map enable rules
    tunnel-group-map default-group 142.176.4.90
    telnet 10.0.1.220 255.255.255.255 inside
    telnet 10.0.1.0 255.255.255.0 inside
    telnet 24.222.27.154 255.255.255.255 outside
    telnet timeout 5
    ssh 24.222.27.154 255.255.255.255 outside
    ssh timeout 5
    console timeout 0
    dhcpd dns 142.177.1.2 142.177.129.11
    dhcpd auto_config outside
    dhcpd option 3 ip 10.0.1.1
    dhcpd address 10.0.1.2-10.0.1.129 inside
    dhcpd option 3 ip 10.0.1.1 interface inside
    dhcpd enable inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:7f220b76774dd4827498398c39a951f7
    : end
    asdm image disk0:/asdm-522.bin
    no asdm history enable

    Hi Eric,
    Thanks for the problem description
    May I know the peer IP address of the new tunnel?
    Can you also include the configuration of the other VPN device?
    Your collaboration on this issue is highly appreciated.

  • ASA5510 dynamic VPN from RV042

    So far I have a complete phase 1, and an almost complete phase 2, but one thing I can't figure out. I see this in the debug.
    peer is not authenticated by xauth - drop connection.
    I get it right after the proxy is setup.
    Here is my config
    group-policy DefaultRAGroup attributes
    vpn-idle-timeout none
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    password-storage enable
    nem enable
    tunnel-group DefaultRAGroup general-attributes
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 user-authentication none
    I have tried many different configurations on both sides, but they all fail with the same error of peer not authenticated by xauth.

    I have tried it with it on, with it off and always the same thing comes back. 
    Here is aaa common 50 debug
    Initiating tunnel group policy lookup (Svr Grp: GROUP_POLICY_DB)
    AAA FSM: In AAA_BindServer
    AAA_BindServer: Using server:
    AAA FSM: In AAA_SendMsg
    User: DefaultRAGroup
    Resp:
    grp_policy_ioctl(0x0a250e40, 114698, 0xa9372788)
    grp_policy_ioctl: Looking up DefaultRAGroup
    callback_aaa_task: status = 1, msg =
    AAA FSM: In aaa_backend_callback
    aaa_backend_callback: Handle = 114, pAcb = 0xadae6da0
    AAA task: aaa_process_msg(0xa9373220) received message type 1
    AAA FSM: In AAA_ProcSvrResp
    Back End response:
    Tunnel Group Policy Status: 1 (ACCEPT)
    AAA FSM: In AAA_NextFunction
    AAA_NextFunction: i_fsm_state = IFSM_TUNN_GRP_POLICY, auth_status = ACCEPT
    AAA_NextFunction: New i_fsm_state = IFSM_DONE,
    AAA FSM: In AAA_ProcessFinal
    AAA FSM: In AAA_Callback
    user attributes:
      1     User-Name(1)     14    "DefaultRAGroup"
      2     User-Password(2)      0    0xae048023   ** Unresolved Attribute **
    user policy attributes:
    None
    tunnel policy attributes:
      1     Idle-Timeout(28)      4    0
      2     Tunnelling-Protocol(4107)      4    12
      3     Store-PW(4112)      4    1
      4     Group-Policy(4121)     14    "DefaultRAGroup"
      5     Network-Extension-Mode-Allowed(4160)      4    1
    AAA API: In aaa_close
    AAA API: In aaa_send_acct_start
    AAA task: aaa_process_msg(0xa9373220) received message type 3
    In aaai_close_session (114)
    AAA API: In aaa_open
    AAA session opened: handle = 115
    AAA API: In aaa_process_async
    aaa_process_async: sending AAA_MSG_PROCESS
    AAA task: aaa_process_msg(0xa9373220) received message type 0
    AAA FSM: In AAA_StartAAATransaction
    AAA FSM: In AAA_InitTransaction
    aaai_policy_name_to_server_id(DefaultRAGroup)
    Got server ID 0 for group policy DB
    and isakmp 127 with the relevant information. Up to this point it passes.
    Feb 24 14:27:54 [IKEv1 DECODE]Group = DefaultRAGroup, IP = x.x.x.x, ID_IPV4_ADDR_SUBNET ID received--10.253.20.0--255.255.255.0
    Feb 24 14:27:54 [IKEv1]Group = DefaultRAGroup, IP = x.x.x.x, Received remote IP Proxy Subnet data in ID Payload:   Address 10.253.20.0, Mask 255.255.255.0, Protocol 0, Port 0
    Feb 24 14:27:54 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = x.x.x.x, processing ID payload
    Feb 24 14:27:54 [IKEv1 DECODE]Group = DefaultRAGroup, IP = x.x.x.x, ID_IPV4_ADDR ID received
    66.252.79.16
    Feb 24 14:27:54 [IKEv1]Group = DefaultRAGroup, IP = x.x.x.x., Received local Proxy Host data in ID Payload:  Address x.x.x.x, Protocol 0, Port 0
    Feb 24 14:27:54 [IKEv1]Group = DefaultRAGroup, IP = x.x.x.x, peer is not authenticated by xauth - drop connection.
    Feb 24 14:27:54 [IKEv1]Group = DefaultRAGroup, IP = x.x.x.x, QM FSM error (P2 struct &0xace21cd8, mess id 0xb4d2530a)!
    Feb 24 14:27:54 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = x.x.x.x, IKE QM Responder FSM error history (struct &0xace21cd8)  , :  QM_DONE, EV_ERROR-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, EV_COMP_HASH-->QM_BLD_MSG2, EV_VALIDATE_MSG-->QM_BLD_MSG2, EV_DECRYPT_OK-->QM_BLD_MSG2, NullEvent
    Feb 24 14:27:54 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = x.x.x.x, sending delete/delete with reason message

  • Sh crypto iskamp sa on VPN ASA

    Hi Everyone,
    I am studying about VPN these days.
    I did
    sh crypto isakmp sa
       Active SA: 8
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 8
    1   IKE Peer: 198.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    2   IKE Peer: 197.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    3   IKE Peer: 163.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    4   IKE Peer: 51.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    5   IKE Peer: 71.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    6   IKE Peer: 207.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    7   IKE Peer: 71.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    8   IKE Peer: 68.x
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    Need to know what does this 8 peers mean here does this mean that it has IPSEC tunnels to 8 of these devices?
    Regards
    Mahesh

    Hi Jouni,
    Here is info
    sh run crypto
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set strong esp-aes esp-sha-hmac
    crypto ipsec transform-set strongest esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set strongest strong
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 1
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp ipsec-over-tcp port 10000
    sh run group-policy
    group-policy XGroupPolicy internal
    group-policy XGroupPolicy attributes
    wins-server none
    dns-server value 192.168.50.1
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec
    password-storage disable
    ip-comp disable
    re-xauth enable
    group-lock none
    pfs disable
    ipsec-udp enable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain value corp.com
    split-dns none
    intercept-dhcp disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 15
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    msie-proxy pac-url none
    vlan none
    nac-settings none
    address-pools value PoolCorp
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      homepage none
      svc dtls enable
      svc mtu 1406
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client 30
      svc dpd-interval gateway 30
      svc compression deflate
      svc modules value vpngina
      svc profiles none
      svc ask none default webvpn
      customization value DfltCustomization
    group-policy DfltGrpPolicy attributes
    wins-server value 192.168.50.1
    dns-server value 192.168.50.1
    vpn-tunnel-protocol IPSec svc
    ipsec-udp enable
    default-domain value corp.com
    user-authentication-idle-timeout 15
    address-pools value PoolDefault
    group-policy YGroupPolicy internal
    group-policy YGroupPolicy attributes
    wins-server value 192.168.50.1
    dns-server value 192.168.50.1
    dhcp-network-scope none
    vpn-tunnel-protocol IPSec
    default-domain value corp.com
    address-pools value PoolDefault
    Thanks for helping me out.
    Regards
    Mahesh

  • Adventures implementing NEM between 5520 and 5505...

    So, help...
    I'm unsure how to best solve my issue...
    I have a 5520 acting as a VPN server... and 5505's acting as clients... 
    The 5505's connect fine when using "client mode" but things go sideways when I try and use NEM...  Namely, they never complete a connection...
    debug vpnclient shows this repeating rather fast...  (this device is connected a Fios connection behind a gateway/router... (it's my test environment and it does work when I have the device setup in "vpnclient mode client-mode"...
    Some of my remote sites are configured directly with a public IP (issued via DHCP) others are behind a 3rd party firewall/device that I have no control over... but again, these sites currently work as "vpnclient mode client-mode"...
    VPNC INFO: Reconnect to new peer - 168.156.248.2
    VPNC CLI: access-list _vpnc_acl permit ip host 10.1.10.33 host 168.156.248.2
    VPNC CLI: crypto map _vpnc_cm 10 match address _vpnc_acl
    VPNC CLI: crypto map _vpnc_cm 10 set peer 168.156.248.2
    VPNC CLI: crypto map _vpnc_cm 10 set transform-set _vpnc_tset_1 _vpnc_tset_2 _vpnc_tset_3 _vpnc_tset_4 _vpnc_tset_5 _vpnc_tset_6 _vpnc_tset_7 _vpnc_tset_8 _vpnc_tset_9 _vpnc_tset_10 _vpnc_tset_11
    VPNC CLI: crypto map _vpnc_cm 10 set security-association lifetime seconds 2147483647
    VPNC CLI: crypto map _vpnc_cm 10 set security-association lifetime kilobytes 2147483647
    VPNC CLI: crypto map _vpnc_cm 10 set phase1-mode aggressive
    VPNC CLI: crypto map _vpnc_cm interface outside
    VPNC CLI: tunnel-group 168.156.248.2 type ipsec-ra
    VPNC CLI: tunnel-group 168.156.248.2 ipsec-attributes
               pre-shared-key edcc
    VPNC INFO: vpnc_unselect_peer()
    VPNC CLI: clear configure tunnel-group
    VPNC CLI: clear configure crypto map _vpnc_cm
    VPNC CLI: no access-list _vpnc_acl permit ip host 10.1.10.33 host 168.156.248.2
    VPNC INFO: Setting SUA state to 'idle'
    The primary reason I'm trying to do this is so my server admin guy can see the clients who are behind the 5505's...
    I don't know how much of the config file you need to be meaningful and I'm a bit leary of posting too much anyway...
    From one of the 5505's (I'm running 8.2(3) )
    dns server-group DefaultDNS
    domain-name edcc.ctc.edu
    access-list 110 extended permit ip any any
    access-list inside_nat0_outbound extended permit ip any any
    access-list outside_cryptomap_10 extended permit ip any any
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto isakmp enable outside
    vpnclient server 168.156.248.2
    vpnclient mode network-extension-mode
    vpnclient vpngroup <group> password *****
    vpnclient username <useraccount> password *****
    vpnclient enable
    On the 5520:
    (running 8.2(5))
    crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set myset esp-des esp-md5-hmac
    crypto ipsec transform-set transform-amzn esp-aes esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec security-association replay window-size 128
    crypto ipsec df-bit clear-df outside
    crypto dynamic-map dyna 30 match address l2tp_acl
    crypto dynamic-map dyna 30 set transform-set myset
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set TRANS_ESP_3DES_MD5 ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map mymap 1 match address 110
    crypto map mymap 1 set peer x.x.x.68
    crypto map mymap 1 set transform-set ESP-3DES-MD5
    crypto map mymap 20 match address 200
    crypto map mymap 20 set peer x.x.x.7
    crypto map mymap 20 set transform-set ESP-AES-128-SHA
    crypto map mymap 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map mymap interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 3600
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    group-policy edcc-split-tunnel internal
    group-policy edcc-split-tunnel attributes
    wins-server value 10.230.100.23 10.230.100.22
    dns-server value 10.230.100.23 10.230.100.22
    vpn-tunnel-protocol IPSec svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value edcc_splitTunnelAcl
    default-domain value edcc.ctc.edu
    group-policy edcc-no-split-tunnel internal
    group-policy edcc-no-split-tunnel attributes
    vpn-tunnel-protocol IPSec svc
    split-tunnel-policy tunnelall
    group-policy DfltGrpPolicy attributes
    wins-server value 10.230.100.23 10.230.100.22
    dns-server value 10.230.100.23 10.230.100.22
    vpn-tunnel-protocol IPSec
    password-storage enable
    ip-comp enable
    re-xauth enable
    pfs enable
    ipsec-udp enable
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value edcc_splitTunnelAcl
    default-domain value edcc.ctc.edu
    nac-settings value DfltGrpPolicy-nac-framework-create
    group-policy l2tp-tunnel internal
    group-policy l2tp-tunnel attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc
    split-tunnel-policy tunnelall
    tunnel-group DefaultL2LGroup ipsec-attributes
    pre-shared-key *****
    tunnel-group DefaultRAGroup general-attributes
    address-pool main-edcc-pool
    authentication-server-group admin LOCAL
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *****
    peer-id-validate cert
    tunnel-group DefaultRAGroup ppp-attributes
    no authentication chap
    authentication ms-chap-v2
    tunnel-group x.x.x.68 type ipsec-l2l
    tunnel-group x.x.x.68 ipsec-attributes
    pre-shared-key *****
    tunnel-group outside type remote-access
    tunnel-group outside general-attributes
    address-pool main-edcc-pool
    authentication-server-group admin LOCAL
    default-group-policy edcc-split-tunnel
    tunnel-group outside ipsec-attributes
    pre-shared-key *****
    tunnel-group edcc ppp-attributes
    authentication ms-chap-v2
    tunnel-group xinside type remote-access
    tunnel-group xinside general-attributes
    address-pool main-edcc-pool
    authentication-server-group admin LOCAL
    default-group-policy edcc-no-split-tunnel
    tunnel-group xinside ipsec-attributes
    pre-shared-key *****
    tunnel-group xinside ppp-attributes
    authentication ms-chap-v2
    tunnel-group l2tp type remote-access
    tunnel-group l2tp general-attributes
    address-pool main-edcc-pool
    authentication-server-group admin LOCAL
    default-group-policy l2tp-tunnel
    tunnel-group l2tp ipsec-attributes
    pre-shared-key *****
    isakmp ikev1-user-authentication none
    tunnel-group l2tp ppp-attributes
    authentication ms-chap-v2
    tunnel-group x.x.x.7 type ipsec-l2l
    tunnel-group x.x.x.7 ipsec-attributes
    pre-shared-key *****
    no tunnel-group-map enable ou
    no tunnel-group-map enable ike-id
    no tunnel-group-map enable peer-ip
    Any idea's?  Obviously I have a few adventures here...     

    Or any suggestions on an alternative configuration for the remote sites?     

  • Tunnel comes up the syn packets denied on inbound interface

    Hi all,
    I have a issue with a ASA site to site VPN.
    The Phase 1 and 2 negotiate fine but then when i see a syn initiated for the SFTP i see the syn denied in the logs even though it is allowed through.
    I have changed the addresses in the config as a example the src is 1.1.1.1 and the dest 2.2.2.2.  Config below:
    access-list inside_access_in extended permit tcp host 1.1.1.1 host 2.2.2.2 eq 222
    access-list SFTP extended permit tcp host 1.1.1.1 host 2.2.2.2
    crypto map outside_map 50 match address SFTP
    crypto map outside_map 50 set pfs group5
    crypto map outside_map 50 set peer VPN_GW
    crypto map outside_map 50 set transform-set ESP-AES-256-SHA
    crypto map outside_map 50 set security-association lifetime seconds 3600
    crypto map outside_map 50 set security-association lifetime kilobytes 4608000
    crypto map outside_map 50 set nat-t-disable
    The phase 1 and phase 2 seem to negotiate fine.
    But i get no encryption/decryption on a sh crypto ipsec sa.
    Also i see the syn on the inside interface being denied from source 1.1.1.1.
    So what appears to be happening is the initial packets are allowed through to setup the tunnel but then the additional packets appear to be denied.
    Any help appreciated.
    Thanks
    Kev

    Morning Jennifer,
    Thanks for your continued assistance with this.
    Going through the config i see vpn-filter 10 applied under:
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter value 10
    This is tied to ACL 10 which doesnt appear to have the public ip for this in.
    This looks like a likey candidate to me.
    Config below:
    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2012.07.31 12:56:34 =~=~=~=~=~=~=~=~=~=~=~=
    sh run
    : Saved
    ASA Version 7.0(8)
    hostname FW
    domain-name default.domain.invalid
    enable password Wh3rCbG41fzpd0M. encrypted
    passwd YYrn5ri6t.SCggWC encrypted
    names
    name 195.11.205.145 EXT_IP1
    name 80.169.148.99 EXT_IP3
    name 80.169.148.98 EXT_IP2
    name 155.136.89.20 Coutts_Gateway_VPN
    name 80.169.148.112 S21_Test_VPN
    name 155.136.150.115 Coutts_Host_VPN
    name 80.169.148.114 EXT_IP5
    name 80.168.148.96 S21_Range
    name 80.169.148.100 EXT_IP6
    name 59.154.30.158 EXT_IP7
    name 195.166.102.62 EXT_IP4
    name 193.8.50.231 Coutts_Gateway_VPN_Switz
    dns-guard
    interface Ethernet0/0
    description Outside interface 0/0
    speed 100
    duplex full
    nameif outside
    security-level 0
    ip address 80.169.124.4 255.255.255.224
    interface Ethernet0/1
    description Inside interface 0/1
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.0.0
    interface Ethernet0/2
    description DMZ interface 0/2
    nameif dmz
    security-level 50
    ip address 10.10.10.1 255.255.255.0
    interface Ethernet0/3
    description LAN/STATE Failover Interface
    interface Management0/0
    shutdown
    nameif management
    security-level 100
    no ip address
    ftp mode passive
    clock timezone GMT/BST 0
    clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    object-group service TCP_Port_Group tcp
    port-object eq smtp
    port-object range ftp-data ftp
    port-object eq 123
    port-object eq www
    port-object eq https
    port-object eq domain
    port-object eq ftp-data
    port-object eq ftp
    port-object eq 3389
    port-object eq ssh
    object-group service UDP_Port_Group udp
    port-object eq ntp
    port-object eq 21
    port-object eq 20
    port-object eq domain
    object-group network Trusted_Ext_Hosts
    network-object EXT_IP1 255.255.255.255
    network-object EXT_IP2 255.255.255.255
    network-object EXT_IP3 255.255.255.255
    network-object EXT_IP4 255.255.255.255
    network-object EXT_IP5 255.255.255.255
    network-object EXT_IP6 255.255.255.255
    network-object EXT_IP7 255.255.255.255
    object-group service www_services tcp
    port-object eq www
    port-object eq https
    object-group service TCP_CSG tcp
    port-object eq www
    port-object eq domain
    port-object eq https
    port-object eq 1080
    port-object eq citrix-ica
    object-group network Trusted_Ext_Hosts_ref
    network-object EXT_IP1 255.255.255.255
    network-object EXT_IP2 255.255.255.255
    network-object EXT_IP3 255.255.255.255
    network-object EXT_IP4 255.255.255.255
    network-object EXT_IP5 255.255.255.255
    network-object EXT_IP6 255.255.255.255
    object-group network S21_Range
    network-object S21_Range 255.255.255.224
    access-list inside_access_in extended permit tcp 192.168.100.0 255.255.255.0 any object-group TCP_Port_Group
    access-list inside_access_in extended permit udp 192.168.100.0 255.255.255.0 any object-group UDP_Port_Group
    access-list inside_access_in extended deny ip 192.168.0.0 255.255.0.0 any
    access-list dmz_access_in extended permit tcp host 10.10.10.5 192.168.0.0 255.255.0.0 object-group TCP_CSG
    access-list dmz_access_in extended permit tcp host 10.10.10.5 any object-group TCP_Port_Group
    access-list dmz_access_in extended permit udp host 10.10.10.5 any object-group UDP_Port_Group
    access-list dmz_access_in extended permit tcp host 10.10.10.7 192.168.0.0 255.255.0.0 object-group TCP_CSG
    access-list dmz_access_in extended permit tcp host 10.10.10.7 any object-group TCP_Port_Group
    access-list dmz_access_in extended permit udp host 10.10.10.7 any object-group UDP_Port_Group
    access-list dmz_access_in extended deny ip 10.10.10.0 255.255.255.0 any
    access-list outside_access_in extended permit tcp any host 80.169.124.36 eq www
    access-list outside_access_in extended permit tcp object-group Trusted_Ext_Hosts host 80.169.124.35 object-group www_services
    access-list outside_access_in extended permit tcp object-group Trusted_Ext_Hosts host 80.169.124.37 object-group www_services
    access-list outside_access_in extended deny ip any any
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.10.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 host 193.8.50.180
    access-list inside_access_out extended permit tcp object-group Trusted_Ext_Hosts_ref 192.168.0.0 255.255.0.0 eq 3389
    access-list inside_access_out extended permit tcp any host 192.168.100.24 eq www
    access-list inside_access_out extended permit tcp 10.10.10.0 255.255.255.0 192.168.0.0 255.255.0.0 object-group TCP_CSG
    access-list inside_access_out extended deny ip 10.10.10.0 255.255.255.0 192.168.0.0 255.255.0.0
    access-list outside_cryptomap_30 extended permit ip host 80.169.124.35 155.136.30.0 255.255.254.0
    access-list outside_cryptomap_30 extended permit ip host 80.169.124.37 155.136.30.0 255.255.254.0
    access-list 10 extended permit tcp any host 80.169.124.35 object-group www_services
    access-list 10 extended permit tcp any host 10.10.10.5 object-group www_services
    access-list 10 extended permit tcp any host 80.169.124.37 object-group www_services
    access-list 10 extended permit tcp any host 10.10.10.7 object-group www_services
    access-list COUTTS_SWITZ_SFTP extended permit tcp 192.168.100.0 255.255.255.0 host 193.8.50.180 eq ssh
    access-list outside_cryptomap_40 extended permit ip host 80.169.124.35 155.136.0.0 255.255.0.0
    access-list outside_cryptomap_40 extended permit ip host 80.169.124.37 155.136.0.0 255.255.0.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu dmz 1500
    mtu management 1500
    failover
    failover lan unit primary
    failover lan interface Failover Ethernet0/3
    failover polltime interface 10
    failover key *****
    failover link Failover Ethernet0/3
    failover interface ip Failover 172.16.31.249 255.255.255.248 standby 172.16.31.250
    no monitor-interface management
    icmp permit any outside
    asdm image disk0:/asdm-508.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 10 interface
    global (outside) 20 80.169.124.32
    global (dmz) 10 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 20 192.168.0.0 255.255.0.0
    nat (inside) 10 0.0.0.0 0.0.0.0
    nat (dmz) 20 10.10.10.0 255.255.255.0
    nat (dmz) 10 0.0.0.0 0.0.0.0
    static (inside,outside) 80.169.124.33 192.168.100.11 netmask 255.255.255.255
    static (inside,outside) 80.169.124.34 192.168.100.21 netmask 255.255.255.255
    static (dmz,outside) 80.169.124.35 10.10.10.5 netmask 255.255.255.255
    static (inside,outside) 80.169.124.36 192.168.100.24 netmask 255.255.255.255
    static (dmz,outside) 80.169.124.37 10.10.10.7 netmask 255.255.255.255
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    access-group inside_access_out out interface inside
    access-group dmz_access_in in interface dmz
    route outside 0.0.0.0 0.0.0.0 80.169.124.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
    timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter value 10
    vpn-tunnel-protocol IPSec
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    client-firewall none
    client-access-rule none
    webvpn
      functions none
      port-forward-name value Application Access
    username Admin password 5VZ2yiLE0W2kEsod encrypted privilege 15
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.100.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 30 match address outside_cryptomap_30
    crypto map outside_map 30 set peer 155.136.17.70
    crypto map outside_map 30 set transform-set ESP-AES-256-SHA
    crypto map outside_map 30 set security-association lifetime seconds 28800
    crypto map outside_map 30 set security-association lifetime kilobytes 4608000
    crypto map outside_map 30 set nat-t-disable
    crypto map outside_map 40 match address outside_cryptomap_40
    crypto map outside_map 40 set peer Coutts_Gateway_VPN
    crypto map outside_map 40 set transform-set ESP-AES-256-SHA
    crypto map outside_map 40 set security-association lifetime seconds 3600
    crypto map outside_map 40 set security-association lifetime kilobytes 4608000
    crypto map outside_map 40 set nat-t-disable
    crypto map outside_map 50 match address COUTTS_SWITZ_SFTP
    crypto map outside_map 50 set pfs group5
    crypto map outside_map 50 set peer Coutts_Gateway_VPN_Switz
    crypto map outside_map 50 set transform-set ESP-AES-256-SHA
    crypto map outside_map 50 set security-association lifetime seconds 3600
    crypto map outside_map 50 set security-association lifetime kilobytes 4608000
    crypto map outside_map 50 set nat-t-disable
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 50 authentication pre-share
    isakmp policy 50 encryption aes-256
    isakmp policy 50 hash sha
    isakmp policy 50 group 2
    isakmp policy 50 lifetime 86400
    tunnel-group 155.136.17.70 type ipsec-l2l
    tunnel-group 155.136.17.70 ipsec-attributes
    pre-shared-key *
    tunnel-group 155.136.89.20 type ipsec-l2l
    tunnel-group 155.136.89.20 ipsec-attributes
    pre-shared-key *
    tunnel-group 193.8.50.231 type ipsec-l2l
    tunnel-group 193.8.50.231 ipsec-attributes
    pre-shared-key *
    telnet timeout 5
    ssh 192.168.100.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 10
    dhcpd lease 3600
    dhcpd ping_timeout 50
    ntp server 193.228.143.13 source outside
    Cryptochecksum:87a0c89dced7eb36d9a9b2854eea3b95
    : end
    FW#
    Cheers

  • Wwan 3G/4G 4G LTE HWIC VPN (with dynamic ip)Configuration assistance to multi context asa

    Hello All
    I have a customer that has several sites all over the world and they want to use 3G and possibly 4G (where available) as  a backup vpn solution.
    I need some assistance/ guidance in configuring the cellular radio and configuring the vpn (dynamic ip)to work over the wwan.
    Countries involved are France, Spain, Australia, Thailand and Malaysia.
    I understand that I will need the APN credentials from the service provider. Is this normally the same for 3g and 4g?
    Do I get chat scripts from them too?
    My vpn gateway in the HQ is a Cisco multi-context asa so I can't configure remote access as its not supported yet. Can I possibly use the 1921 router(4lte hwic installed) at the sites as a  hardware client?
    I have seen the following urls. One has the 3g router as a "remote access" vpn but I guess this won't work in my scenario.
    The other is between ios router and asa which I think will work. I don't need nat on the 3g/4g router as all traffic will be using the vpn.
    http://www.networking-forum.com/blog/?p=708  . Will I need this for all the sub-interfaces I configure on the router
    interface Vlan1
    description LAN
    ip address 10.0.0.14 255.255.255.240
    no ip redirects
    no ip proxy-arp
    ip tcp adjust-mss 1452
    crypto ipsec client ezvpn ASA inside <--is this needed per interface????
    Remote access reference in config:
    group-policy 3GPolicy attributes
    vpn-tunnel-protocol IPSec
    password-storage enable
    nem enable
    tunnel-group 3GRAGroup type remote-access <---Remote access config
    tunnel-group 3GRAGroup general-attributes
    authorization-server-group LOCAL
    default-group-policy 3GPolicy
    tunnel-group 3GRAGroup ipsec-attributes
    pre-shared-key **Same key as the ASA profile on the 881**
    http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112075-dynamic-ipsec-asa-router-ccp.html 
    Anyone got a helpful configuration and guide?
    Thanks
    Feisal

  • Wwan 3G/4G 4G LTE HWIC VPN (with dynamic ip)Configuration assistance

    Hello All
    I have a customer that has several sites all over the world and they want to use 3G and possibly 4G (where available) as  a backup vpn solution.
    I need some assistance/ guidance in configuring the cellular radio and configuring the vpn (dynamic ip)to work over the wwan.
    Countries involved are France, Spain, Australia, Thailand and Malaysia.
    I understand that I will need the APN credentials from the service provider. Is this normally the same for 3g and 4g?
    Do I get chat scripts from them to?
    My vpn gateway in the HQ is a Cisco multi-context asa so I can't configure remote access. Can I possibly use the 1921 as a  hardware client?
    I have seen the following urls. One has the 3g router as a remote access vpn but I guess this won't work in my scenario.
    The other is between ios router and asa which I think will work. I don't need nat on the 3g/4g router but will I need 
    http://www.networking-forum.com/blog/?p=708  . Will I need this for all the sub-interfaces I configure on the router
    interface Vlan1
    description LAN
    ip address 10.0.0.14 255.255.255.240
    no ip redirects
    no ip proxy-arp
    ip tcp adjust-mss 1452
    crypto ipsec client ezvpn ASA inside
    Remote access reference in config:
    group-policy 3GPolicy attributes
    vpn-tunnel-protocol IPSec
    password-storage enable
    nem enable
    tunnel-group 3GRAGroup type remote-access
    tunnel-group 3GRAGroup general-attributes
    authorization-server-group LOCAL
    default-group-policy 3GPolicy
    tunnel-group 3GRAGroup ipsec-attributes
    pre-shared-key **Same key as the ASA profile on the 881**
    http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112075-dynamic-ipsec-asa-router-ccp.html 
    Anyone got a helpful configuration and guide?
    Thanks
    Feisal

    Duplicate post. 
    Go here:  https://supportforums.cisco.com/discussion/12226676/i-want-connect-my-cisco-hq-router-remote-1841-router-using-hwic-3g-gsm-card-and

  • HT1424 IPSec VPN connection brings up login box but will not connect after entering password.  Have tried this on both IPAD and IPhone 4.  Can anyone help?  thanks

    IPSec VPN brings up login box but will not connect after entering password.  Have tried this on both IPAD and IPhone 4.  Can anyone help?

    Uggh, it's so frustrating! I've googled every search phrase I can think of and this seems to be the only thread describing this exact issue. I'm always automatically logged into Facebook on my MBP but just to be sure I logged out and back in and it worked fine.
    I gotta say, I wasn't a fan of the Droid I had preceding this iPhone, and from what I hear the iPhone app for FB is a thousand times better - not that I'd know personally because I can't log in!! - but I could always access my FB account on the droid. Just sayin...

  • Sisco IPSec VPN password not saving.

    Is there a way to store my password in the vpn configuration? I'm using the default client and it keeps prompting my password every time it connects and is annoying.

    Hello Mitchell,
    Thank you for letting us know the resolution of this topic.
    Please answer the question as answered so future users can learn from this topic.
    Regards,
    Julio

  • %ASA-7-710005: TCP request discarded error in Client to Site VPN in CISCO ASA 5510

    Hi Friends,
    I'm trying to built client to site VPN in CISCO ASA 5510 8.4(4) and getting below error while connecting cisco VPN client software. Also, I'm getting below log in ASA. Please help me to reslove.
    Error in CISCO VPN Client Software:
    Secure VPN Connection Terminated locally by the client.
    Reason : 414 : Failed to establish a TCP connection.
    Error in CISCO ASA 5510
    %ASA-7-710005: TCP request discarded from <Public IP> /49276 to outside:<Outside Interface IP of my ASA> /10000
    ASA Configuration:
    XYZ# sh run
    : Saved
    ASA Version 8.4(4)
    hostname XYZ
    domain-name XYZ
    enable password 3uLkVc9JwRA1/OXb level 3 encrypted
    enable password R/x90UjisGVJVlh2 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    nameif outside_rim
    security-level 0
    ip address 1.1.1.1 255.255.255.252
    interface Ethernet0/1
    duplex full
    nameif XYZ_DMZ
    security-level 50
    ip address 172.1.1.1 255.255.255.248
    interface Ethernet0/2
    speed 100
    duplex full
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.252
    interface Ethernet0/3
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 3.3.3.3 255.255.255.224
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    boot system disk0:/asa844-k8.bin
    ftp mode passive
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    name-server xx.xx.xx.xx
    domain-name XYZ
    object network obj-172.17.10.3
    host 172.17.10.3
    object network obj-10.1.134.0
    subnet 10.1.134.0 255.255.255.0
    object network obj-208.75.237.0
    subnet 208.75.237.0 255.255.255.0
    object network obj-10.7.0.0
    subnet 10.7.0.0 255.255.0.0
    object network obj-172.17.2.0
    subnet 172.17.2.0 255.255.255.0
    object network obj-172.17.3.0
    subnet 172.17.3.0 255.255.255.0
    object network obj-172.19.2.0
    subnet 172.19.2.0 255.255.255.0
    object network obj-172.19.3.0
    subnet 172.19.3.0 255.255.255.0
    object network obj-172.19.7.0
    subnet 172.19.7.0 255.255.255.0
    object network obj-10.1.0.0
    subnet 10.1.0.0 255.255.0.0
    object network obj-10.2.0.0
    subnet 10.2.0.0 255.255.0.0
    object network obj-10.3.0.0
    subnet 10.3.0.0 255.255.0.0
    object network obj-10.4.0.0
    subnet 10.4.0.0 255.255.0.0
    object network obj-10.6.0.0
    subnet 10.6.0.0 255.255.0.0
    object network obj-10.9.0.0
    subnet 10.9.0.0 255.255.0.0
    object network obj-10.11.0.0
    subnet 10.11.0.0 255.255.0.0
    object network obj-10.12.0.0
    subnet 10.12.0.0 255.255.0.0
    object network obj-172.19.1.0
    subnet 172.19.1.0 255.255.255.0
    object network obj-172.21.2.0
    subnet 172.21.2.0 255.255.255.0
    object network obj-172.16.2.0
    subnet 172.16.2.0 255.255.255.0
    object network obj-10.19.130.201
    host 10.19.130.201
    object network obj-172.30.2.0
    subnet 172.30.2.0 255.255.255.0
    object network obj-172.30.3.0
    subnet 172.30.3.0 255.255.255.0
    object network obj-172.30.7.0
    subnet 172.30.7.0 255.255.255.0
    object network obj-10.10.1.0
    subnet 10.10.1.0 255.255.255.0
    object network obj-10.19.130.0
    subnet 10.19.130.0 255.255.255.0
    object network obj-XXXXXXXX
    host XXXXXXXX
    object network obj-145.248.194.0
    subnet 145.248.194.0 255.255.255.0
    object network obj-10.1.134.100
    host 10.1.134.100
    object network obj-10.9.124.100
    host 10.9.124.100
    object network obj-10.1.134.101
    host 10.1.134.101
    object network obj-10.9.124.101
    host 10.9.124.101
    object network obj-10.1.134.102
    host 10.1.134.102
    object network obj-10.9.124.102
    host 10.9.124.102
    object network obj-115.111.99.133
    host 115.111.99.133
    object network obj-10.8.108.0
    subnet 10.8.108.0 255.255.255.0
    object network obj-115.111.99.129
    host 115.111.99.129
    object network obj-195.254.159.133
    host 195.254.159.133
    object network obj-195.254.158.136
    host 195.254.158.136
    object network obj-209.164.192.0
    subnet 209.164.192.0 255.255.224.0
    object network obj-209.164.208.19
    host 209.164.208.19
    object network obj-209.164.192.126
    host 209.164.192.126
    object network obj-10.8.100.128
    subnet 10.8.100.128 255.255.255.128
    object network obj-115.111.99.130
    host 115.111.99.130
    object network obj-10.10.0.0
    subnet 10.10.0.0 255.255.0.0
    object network obj-115.111.99.132
    host 115.111.99.132
    object network obj-10.10.1.45
    host 10.10.1.45
    object network obj-10.99.132.0
    subnet 10.99.132.0 255.255.255.0
    object-group network Serversubnet
    network-object 10.10.1.0 255.255.255.0
    network-object 10.10.5.0 255.255.255.192
    object-group network XYZ_destinations
    network-object 10.1.0.0 255.255.0.0
    network-object 10.2.0.0 255.255.0.0
    network-object 10.3.0.0 255.255.0.0
    network-object 10.4.0.0 255.255.0.0
    network-object 10.6.0.0 255.255.0.0
    network-object 10.7.0.0 255.255.0.0
    network-object 10.11.0.0 255.255.0.0
    network-object 10.12.0.0 255.255.0.0
    network-object 172.19.1.0 255.255.255.0
    network-object 172.19.2.0 255.255.255.0
    network-object 172.19.3.0 255.255.255.0
    network-object 172.19.7.0 255.255.255.0
    network-object 172.17.2.0 255.255.255.0
    network-object 172.17.3.0 255.255.255.0
    network-object 172.16.2.0 255.255.255.0
    network-object 172.16.3.0 255.255.255.0
    network-object host 10.50.2.206
    object-group network XYZ_us_admin
    network-object 10.3.1.245 255.255.255.255
    network-object 10.5.33.7 255.255.255.255
    network-object 10.211.5.7 255.255.255.255
    network-object 10.3.33.7 255.255.255.255
    network-object 10.211.3.7 255.255.255.255
    object-group network XYZ_blr_networkdevices
    network-object 10.200.10.0 255.255.255.0
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host 172.16.2.21
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host 172.16.2.22
    access-list XYZ extended permit ip 10.19.130.0 255.255.255.0 host XXXXXXXX
    access-list XYZ_PAT extended permit ip 10.19.130.0 255.255.255.0 any
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 195.254.159.133
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 195.254.158.136
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 any
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 209.164.192.0 255.255.224.0
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 209.164.208.19
    access-list XYZ_PAT extended permit ip 10.1.134.0 255.255.255.0 host 209.164.192.126
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.7.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.17.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.17.3.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.3.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.7.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.1.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.3.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.4.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.6.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.9.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.11.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 10.12.0.0 255.255.0.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.19.1.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.21.2.0 255.255.255.0
    access-list nonat extended permit ip 10.1.134.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.2.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.3.0 255.255.255.0
    access-list nonat extended permit ip host 10.19.130.201 172.30.7.0 255.255.255.0
    access-list nonat extended permit ip object-group Serversubnet object-group XYZ_destinations
    access-list nonat extended permit ip 10.10.1.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list nonat extended permit ip 10.19.130.0 255.255.255.0 host XXXXXXXX
    access-list nonat extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list Guest_PAT extended permit ip 10.8.108.0 255.255.255.0 any
    access-list Cacib extended permit ip 10.8.100.128 255.255.255.128 145.248.194.0 255.255.255.0
    access-list Cacib_PAT extended permit ip 10.8.100.128 255.255.255.128 any
    access-list New_Edge extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.7.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.7.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 172.17.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.17.3.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.3.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.7.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.2.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.3.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.4.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.6.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.9.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.11.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.12.0.0 255.255.0.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.19.1.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.21.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.17.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.17.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.7.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.1.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.2.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.3.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.4.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.6.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.9.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.11.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 10.12.0.0 255.255.0.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.19.1.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.21.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.16.2.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list XYZ_global extended permit ip 10.1.134.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.2.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.2.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.3.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.3.0 255.255.255.0
    access-list XYZ_global extended permit ip 172.30.7.0 255.255.255.0 host 10.19.130.201
    access-list XYZ_global extended permit ip host 10.19.130.201 172.30.7.0 255.255.255.0
    access-list XYZ_global extended permit ip object-group Serversubnet object-group XYZ_destinations
    access-list XYZ_global extended permit ip object-group XYZ_destinations object-group Serversubnet
    access-list ML_VPN extended permit ip host 115.111.99.129 209.164.192.0 255.255.224.0
    access-list ML_VPN extended permit ip host 115.111.99.129 host 209.164.208.19
    access-list ML_VPN extended permit ip host 115.111.99.129 host 209.164.192.126
    access-list Da_VPN extended permit ip host 10.9.124.100 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.101 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.102 host 10.125.81.88
    access-list Da_VPN extended permit ip host 10.9.124.100 10.125.81.0 255.255.255.0
    access-list Da_VPN extended permit ip host 10.9.124.101 10.125.81.0 255.255.255.0
    access-list Da_VPN extended permit ip host 10.9.124.102 10.125.81.0 255.255.255.0
    access-list Sr_PAT extended permit ip 10.10.0.0 255.255.0.0 any
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.100 host 10.125.86.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.101 host 10.125.86.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 10.125.80.64 255.255.255.192
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 10.125.64.0 255.255.240.0
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 host 10.125.85.46
    access-list Da_Pd_VPN extended permit ip host 10.9.124.102 host 10.125.86.46
    access-list XYZ_reliance extended permit ip 10.19.130.0 255.255.255.0 145.248.194.0 255.255.255.0
    access-list coextended permit ip host 2.2.2.2 host XXXXXXXX
    access-list coextended permit ip host XXXXXXXXhost 2.2.2.2
    access-list ci extended permit ip 10.1.134.0 255.255.255.0 208.75.237.0 255.255.255.0
    access-list ci extended permit ip 208.75.237.0 255.255.255.0 10.1.134.0 255.255.255.0
    access-list acl-outside extended permit ip host 57.66.81.159 host 172.17.10.3
    access-list acl-outside extended permit ip host 80.169.223.179 host 172.17.10.3
    access-list acl-outside extended permit ip any host 172.17.10.3
    access-list acl-outside extended permit tcp any host 10.10.1.45 eq https
    access-list acl-outside extended permit tcp any any eq 10000
    access-list acl-outside extended deny ip any any log
    pager lines 10
    logging enable
    logging buffered debugging
    mtu outside_rim 1500
    mtu XYZ_DMZ 1500
    mtu outside 1500
    mtu inside 1500
    ip local pool XYZ_c2s_vpn_pool 172.30.10.51-172.30.10.254
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-208.75.237.0 obj-208.75.237.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.7.0.0 obj-10.7.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.17.2.0 obj-172.17.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.17.3.0 obj-172.17.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.2.0 obj-172.19.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.3.0 obj-172.19.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.7.0 obj-172.19.7.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.2.0.0 obj-10.2.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.3.0.0 obj-10.3.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.4.0.0 obj-10.4.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.6.0.0 obj-10.6.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.9.0.0 obj-10.9.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.11.0.0 obj-10.11.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-10.12.0.0 obj-10.12.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.19.1.0 obj-172.19.1.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.21.2.0 obj-172.21.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.1.134.0 obj-10.1.134.0 destination static obj-172.16.2.0 obj-172.16.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.2.0 obj-172.30.2.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.3.0 obj-172.30.3.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.201 obj-10.19.130.201 destination static obj-172.30.7.0 obj-172.30.7.0 no-proxy-arp route-lookup
    nat (inside,any) source static Serversubnet Serversubnet destination static XYZ_destinations XYZ_destinations no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.10.1.0 obj-10.10.1.0 destination static obj-10.2.0.0 obj-10.2.0.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.0 obj-10.19.130.0 destination static obj-XXXXXXXX obj-XXXXXXXX no-proxy-arp route-lookup
    nat (inside,any) source static obj-10.19.130.0 obj-10.19.130.0 destination static obj-145.248.194.0 obj-145.248.194.0 no-proxy-arp route-lookup
    nat (inside,outside) source static obj-10.1.134.100 obj-10.9.124.100
    nat (inside,outside) source static obj-10.1.134.101 obj-10.9.124.101
    nat (inside,outside) source static obj-10.1.134.102 obj-10.9.124.102
    nat (inside,outside) source dynamic obj-10.8.108.0 interface
    nat (inside,outside) source dynamic obj-10.19.130.0 obj-115.111.99.129
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-195.254.159.133 obj-195.254.159.133
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-195.254.158.136 obj-195.254.158.136
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.192.0 obj-209.164.192.0
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.208.19 obj-209.164.208.19
    nat (inside,outside) source dynamic obj-10.1.134.0 obj-115.111.99.129 destination static obj-209.164.192.126 obj-209.164.192.126
    nat (inside,outside) source dynamic obj-10.8.100.128 obj-115.111.99.130
    nat (inside,outside) source dynamic obj-10.10.0.0 obj-115.111.99.132
    nat (inside,outside) source static obj-10.10.1.45 obj-115.111.99.133
    nat (inside,outside) source dynamic obj-10.99.132.0 obj-115.111.99.129
    object network obj-172.17.10.3
    nat (XYZ_DMZ,outside) static 115.111.99.134
    access-group acl-outside in interface outside
    route outside 0.0.0.0 0.0.0.0 115.111.23.129 1
    route outside 0.0.0.0 0.0.0.0 115.254.127.130 10
    route inside 10.10.0.0 255.255.0.0 10.8.100.1 1
    route inside 10.10.1.0 255.255.255.0 10.8.100.1 1
    route inside 10.10.5.0 255.255.255.192 10.8.100.1 1
    route inside 10.8.100.128 255.255.255.128 10.8.100.1 1
    route inside 10.8.108.0 255.255.255.0 10.8.100.1 1
    route inside 10.19.130.0 255.255.255.0 10.8.100.1 1
    route inside 10.99.4.0 255.255.255.0 10.99.130.254 1
    route inside 10.99.132.0 255.255.255.0 10.8.100.1 1
    route inside 10.1.134.0 255.255.255.0 10.8.100.1 1
    route outside 208.75.237.0 255.255.255.0 115.111.23.129 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication telnet console LOCAL
    aaa authorization command LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set vpn2 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn6 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set vpn5 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn7 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set vpn4 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn1 esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set vpn_reliance esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set c2s_vpn esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 86400
    crypto dynamic-map dyn1 1 set ikev1 transform-set c2s_vpn
    crypto dynamic-map dyn1 1 set reverse-route
    crypto map vpn 1 match address XYZ
    crypto map vpn 1 set peer XYZ Peer IP
    crypto map vpn 1 set ikev1 transform-set vpn1
    crypto map vpn 1 set security-association lifetime seconds 3600
    crypto map vpn 1 set security-association lifetime kilobytes 4608000
    crypto map vpn 2 match address NE
    crypto map vpn 2 set peer NE_Peer IP
    crypto map vpn 2 set ikev1 transform-set vpn2
    crypto map vpn 2 set security-association lifetime seconds 3600
    crypto map vpn 2 set security-association lifetime kilobytes 4608000
    crypto map vpn 4 match address ML_VPN
    crypto map vpn 4 set pfs
    crypto map vpn 4 set peer ML_Peer IP
    crypto map vpn 4 set ikev1 transform-set vpn4
    crypto map vpn 4 set security-association lifetime seconds 3600
    crypto map vpn 4 set security-association lifetime kilobytes 4608000
    crypto map vpn 5 match address XYZ_global
    crypto map vpn 5 set peer XYZ_globa_Peer IP
    crypto map vpn 5 set ikev1 transform-set vpn5
    crypto map vpn 5 set security-association lifetime seconds 3600
    crypto map vpn 5 set security-association lifetime kilobytes 4608000
    crypto map vpn 6 match address Da_VPN
    crypto map vpn 6 set peer Da_VPN_Peer IP
    crypto map vpn 6 set ikev1 transform-set vpn6
    crypto map vpn 6 set security-association lifetime seconds 3600
    crypto map vpn 6 set security-association lifetime kilobytes 4608000
    crypto map vpn 7 match address Da_Pd_VPN
    crypto map vpn 7 set peer Da_Pd_VPN_Peer IP
    crypto map vpn 7 set ikev1 transform-set vpn6
    crypto map vpn 7 set security-association lifetime seconds 3600
    crypto map vpn 7 set security-association lifetime kilobytes 4608000
    crypto map vpn interface outside
    crypto map vpn_reliance 1 match address XYZ_rim
    crypto map vpn_reliance 1 set peer XYZ_rim_Peer IP
    crypto map vpn_reliance 1 set ikev1 transform-set vpn_reliance
    crypto map vpn_reliance 1 set security-association lifetime seconds 3600
    crypto map vpn_reliance 1 set security-association lifetime kilobytes 4608000
    crypto map vpn_reliance interface outside_rim
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto isakmp identity address
    no crypto isakmp nat-traversal
    crypto ikev1 enable outside_rim
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28800
    crypto ikev1 policy 2
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    crypto ikev1 policy 4
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 28000
    crypto ikev1 policy 5
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 10.8.100.0 255.255.255.224 inside
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    no threat-detection basic-threat
    no threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy XYZ_c2s_vpn internal
    username testadmin password oFJjANE3QKoA206w encrypted
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXXtype ipsec-l2l
    tunnel-group XXXXXXXXipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XXXXXXXX type ipsec-l2l
    tunnel-group XXXXXXXX ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group XYZ_c2s_vpn type remote-access
    tunnel-group XYZ_c2s_vpn general-attributes
    address-pool XYZ_c2s_vpn_pool
    tunnel-group XYZ_c2s_vpn ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect icmp
      inspect ip-options
    service-policy global_policy global
    privilege show level 3 mode exec command running-config
    privilege show level 3 mode exec command logging
    privilege show level 3 mode exec command crypto
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:caa7476cd348ed89b95d37d4e3c9e1d8
    : end
    XYZ#

    Thanks Javier.
    But i have revised the VPN confuration. Below are the latest configs. with this latest configs. I'm getting username & password screen while connecting cisco vpn client software. once we entered the login credential. it shows "security communication channel" then it goes to "not connected" state. Can you help me to fix this.
    access-list ACL-RA-SPLIT standard permit host 10.10.1.3
    access-list ACL-RA-SPLIT standard permit host 10.10.1.13
    access-list ACL-RA-SPLIT standard permit host 10.91.130.201
    access-list nonat line 1 extended permit ip host 10.10.1.3 172.30.10.0 255.255.255.0
    access-list nonat line 2 extended permit ip host 10.10.1.13 172.30.10.0 255.255.255.0
    access-list nonat line 3 extended permit ip host 10.91.130.201 172.30.10.0 255.255.255.0
    ip local pool CO-C2S-VPOOL 172.30.10.51-172.30.10.254 mask 255.255.255.0
    group-policy CO-C2S internal
    group-policy CO-C2S attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list vlauel ACL-RA-SPLIT
    dns-server value 10.10.1.3
    tunnel-group TUN-RA-SPLIT type remote-access
    tunnel-group TUN-RA-SPLIT general-attributes
    default-group-policy CO-C2S
    address-pool CO-C2S-VPOOL
    tunnel-group TUN-RA-SPLIT ipsec-attributes
    pre-shared-key sekretk3y
    username ra-user1 password passw0rd1 priv 1
    group-policy CO-C2S internal
    group-policy CO-C2S attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list vlauel ACL-RA-SPLIT
    dns-server value 10.10.1.3
    tunnel-group TUN-RA-SPLIT type remote-access
    tunnel-group TUN-RA-SPLIT general-attributes
    default-group-policy CO-C2S
    address-pool CO-C2S-VPOOL
    tunnel-group TUN-RA-SPLIT ipsec-attributes
    pre-shared-key *********
    username ******* password ******** priv 1
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set 3DES
    crypto map Outside_Map 500 ipsec-isakmp dynamic dynmap
    crypto isakmp identify address
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encr 3des
    hash sha
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set 3DES
    crypto map Outside_Map 500 ipsec-isakmp dynamic dynmap
    crypto map vpn interface outside
    crypto isakmp identify address
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encr 3des
    hash sha
    group 1
    lifetime 3600

Maybe you are looking for

  • RUNTIME ERROR IN GENERATED PROGRAM. Overflow converting ''

    Hi, While executing the below code i am getting the error " RUNTIME ERROR IN GENERATED PROGRAM. Overflow converting ' ' am new to ABAP , can anyone kindly help me where i have went wrong ? . IF ( V_DO_CDS_NAME_MAIN <> '' ).     ABAP.         DATA: re

  • Error in running ownership package for COI

    Dear BPC folks, When we are running  ownership package we are getting following error. /CPMB/MODIFY completed in 0 seconds /CPMB/OWNERSHIP_CALC completed in 0 seconds /CPMB/CLEAR completed in 0 seconds [Selection] CALCOPTION= Yes CALCACCOUNT=POWN COP

  • Count number of times an instructor has taught a class

    Howdy Folks, I'm using a lifeline to see if i can get some help for a question. I apologoze in advance, i know this is a numbers forum, but i am working with an excel spreadsheet and was hopng someone could give me a push in the right direction. i wa

  • Can't bind IPX to NIC

    Printers showing as "not connected". When I run autoexec.ncf, I get an error FFFFFF85- failed to bind ipx to NIC. Checked out tech doc that says no serverid # in autoexec.ncf. Problem is that there is a number assigned to serverid. Serverid is listed

  • HT5934 Any problems in IOS 7 and if I add IOS 7.2 do I get everything?

    Any problems in IOS 7 and if I add IOS 7.2 do I get everything?