Management IP unreachable

Hello everyone!!
I am facing this problem on different switches on my network on different days, the thing is that the switch is working fine and none of the users is facing in connection problem ,but I can not reach my switch (ping and telnet)from anywhere (core switch, normal PC) and this issue will last for 20:30 mins and then going to a different switch.
I really appreciate if someone tells me what is going on.
Many Thanks 

There is not much detail here to work with. Based on the little bit that we know I would offer these suggestions:
- is it possible that two devices are configured with the same IP address resulting in IP address conflict where sometime you get to one and sometimes to the other?
- is it possible that there is some spanning tree issue that sometimes makes the switch management address unreachable?
- is it possible that there is some issue with ARP finding the MAC address of the management IP?
HTH
Rick

Similar Messages

  • Managed Server unreached after view JNDI tree

    I have issue with WLS managed server to see if anyone know that
    Version WLS 10.3.1.0
    I create 11G soa domain , soa_server1 as managed server .
    When I open JNDI tree window of soa_server1 , I can see some error mark in eis node , when I close it . I am never able to see the view JNDI tree link ,and state of soa_server1 change to UNKNOW. actually soa_server1 still working
    Again , try to use WSLT to browse JNDI of soa_server1
    got this exception:
    Caused by: java.rmi.UnmarshalException: Problem finding error class; nested exception is:
    java.lang.ClassNotFoundException: oracle.sdpinternal.messaging.driver.email.EmailResourceAdapter
    at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:234)
    at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:348)
    at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:259)
    at weblogic.jndi.internal.ServerNamingNode_1031_WLStub.list(Unknown Source)
    at weblogic.jndi.internal.WLContextImpl.list(WLContextImpl.java:217)
    ... 35 more
    Caused by: java.lang.ClassNotFoundException: oracle.sdpinternal.messaging.driver.email.EmailResourceAdapter
    at weblogic.utils.classloaders.GenericClassLoader.checkMagicNumber(GenericClassLoader.java:432)
    at weblogic.utils.classloaders.GenericClassLoader.defineClass(GenericClassLoader.java:336)
    at weblogic.rmi.utils.WLRMIClassLoaderDelegate.loadClass(WLRMIClassLoaderDelegate.java:215)
    at weblogic.rmi.utils.WLRMIClassLoaderDelegate.loadClass(WLRMIClassLoaderDelegate.java:135)
    at weblogic.rmi.utils.Utilities.loadClass(Utilities.java:306)
    Any clue?
    Kevin
    Edited by: kyi on Oct 23, 2009 12:14 PM

    Hi Kyi,
    Can you check if that class had been loaded successfully?.
    For JRocket :- add "-Xverbose:class,load -Xverboselog:classload.txt" to JVM options.
    For Sun :- add "-verbose:class" to JVM options.
    Thanks.
    Vijay Bheemineni.

  • WLST - Failing to run nmConnect() command / node manager becomes unreachabl

    Hello guys,
    I'm facing some issues to setup some configurations of one application that I've deployed on weblogic 10.3.3.0.
    One of the needed steps in order to configure this applications is open the WLST in offline mode an run 2 commands:
    */bea/mytrack/wlserver_10.3/common/bin/wlst.sh*
    Then I try to connect in the nodemanager:
    * wls:/offline> nmConnect('admin30800','weblogic_password',port='30801',domainName='track30800')*
    The following error returns:
    Connecting to Node Manager ...
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=thawte Primary Root CA - G3,OU=(c) 2008 thawte\, Inc. - For authorized use only,OU=Certification Services Division,O=thawte\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "OU=Security Communication RootCA2,O=SECOM Trust Systems CO.\,LTD.,C=JP". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=VeriSign Universal Root Certification Authority,OU=(c) 2008 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=KEYNECTIS ROOT CA,OU=ROOT,O=KEYNECTIS,C=FR". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    <Jul 13, 2011 2:23:45 PM CDT> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
    Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 123, in nmConnect
    File "<iostream>", line 646, in raiseWLSTException
    WLSTException: Error occured while performing nmConnect : Cannot connect to Node Manager. : Access to domain 'track30800' for user 'admin30800' denied
    I did some research and found this thread here: http://kr.forums.oracle.com/forums/thread.jspa?threadID=788163
    that solves the initial problem, however after I performed the nmConnect and a storeUserConfig() command, I exit() from the WLST and restart the node manager with success, the node manager becomes unreachable.
    I used the WL adm console and access -> appdomain -> environments -> machines -> monitoring -> node manager status to check the unreachable status.
    Thanks in advance,
    Davinod

    Nice it worked!!
    However when I try to start the servers controlled by this node manager I got this error:
    -sh-3.2$ <Jul 14, 2011 8:43:42 AM> <WARNING> <Exception while starting server 'track30800-01'>
    java.io.FileNotFoundException: /u01/track30800/user_projects/domains/track30800/servers/track30800-01/data/nodemanager/boot.properties (Permission denied)
    at java.io.FileOutputStream.open(Native Method)
    at java.io.FileOutputStream.<init>(FileOutputStream.java:179)
    at java.io.FileOutputStream.<init>(FileOutputStream.java:131)
    at weblogic.nodemanager.server.ServerManager.saveBootIdentity(ServerManager.java:495)
    at weblogic.nodemanager.server.ServerManager.saveStartupConfig(ServerManager.java:438)
    at weblogic.nodemanager.server.ServerManager.start(ServerManager.java:301)
    at weblogic.nodemanager.server.Handler.handleStart(Handler.java:567)
    at weblogic.nodemanager.server.Handler.handleCommand(Handler.java:118)
    at weblogic.nodemanager.server.Handler.run(Handler.java:70)
    at java.lang.Thread.run(Thread.java:619)
    Jul 14, 2011 8:43:42 AM weblogic.nodemanager.server.Handler handleStart
    WARNING: Exception while starting server 'track30800-01'
    java.io.FileNotFoundException: /u01/track30800/user_projects/domains/track30800/servers/track30800-01/data/nodemanager/boot.properties (Permission denied)
    at java.io.FileOutputStream.open(Native Method)
    at java.io.FileOutputStream.<init>(FileOutputStream.java:179)
    at java.io.FileOutputStream.<init>(FileOutputStream.java:131)
    at weblogic.nodemanager.server.ServerManager.saveBootIdentity(ServerManager.java:495)
    at weblogic.nodemanager.server.ServerManager.saveStartupConfig(ServerManager.java:438)
    at weblogic.nodemanager.server.ServerManager.start(ServerManager.java:301)
    at weblogic.nodemanager.server.Handler.handleStart(Handler.java:567)
    at weblogic.nodemanager.server.Handler.handleCommand(Handler.java:118)
    at weblogic.nodemanager.server.Handler.run(Handler.java:70)
    at java.lang.Thread.run(Thread.java:619)
    <Jul 14, 2011 8:43:42 AM CDT> <Error> <NodeManager> <BEA-300048> <Unable to start the server track30800-01 : Exception while starting server 'track30800-01'>
    Edited: Should I change the chmod for 777 for this file in order to check that all users have write permission?
    -rw-r--r-- 1 root iluser 193 Jun 24 11:05 boot.properties
    Did I miss a step?
    Thanks,
    Davinod
    Edited by: davinod on Jul 14, 2011 6:58 AM

  • Unreachable devices report

    Hi,
    I noticed in Cisco Prime 4.2 when we try to look for devices that are unreachable, we went to Reports>Inventory>Management Status>Unreachable Devices, but the devices indicated there are currently Up. We have another Cisco Prime Demo server not connected to the production network, it is monitoring another set of devices. We went to Unreachable Devices report from the Demo server but this time it shows no Unreachable Devices but currently 2 devices were disconnected from the network. How come this report is unreliable? Do know a report tool from Cisco Prime 4.2 that is accurate aside from the Event Monitor?
    Thanks in advance for the help.

    Hi Benjo,
    Yes , it is completely different from them, with poller you are polling devices with different OID's in the background.
    for e.g in the device avaiblity it is using sysuptime ...etc
    check the below link:
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/lms_monitor/mnt-perf.html#wp1542387
    Thanks-
    Afroj

  • Devices showing unreachable in LMS 4.2

    Hi ,
    I have discovered my switches in LMS but it is showing unreachable what can be the reason ?
    Looking forward for your comments .
    thanks in advance,
    Pandian G K

    I also have hundreds of unreachable devices found by CDP and the only report that has any data is the one that's created when clicking on the number of unreachable devices in the summary screen. There is no data when I go to Reports>Inventory>Management Status>Unreachable Devices while the discovery is running.
    From everything I have read this means that SNMP is not responding to RO requests but this seems quite inadequate based on the fact that these are found with CDP. I could understand only providing a IP addresses for an unreachable device discovered with a ping sweep but CDP gives a huge mount of information about a connected device and all LMS returns is an IP address and its neighbors.
    Is there anyway to get more detailed information about the unreachable devices without turning on debug and running the discovery again? We are discovering thousands of devices and it's taken 4 days so far so starting over is not really an option based on the timeframe we have for this project.
    I will try to see if the log files show any useful information but I have a feeling that trying to do this for hundreds of devices will not be a good use of time and the advice to just telnet or SSH to each device to validate their credentials will also take a huge amount of time as we could easily have over a thousand unreachable devices by the time the discovery is finished.
    Also, DCR verification is only for devices that end up in the DCR, which unreachable devices do not and none of the discovery reports seem to have any data until the discovery is complete so trying to get this info during a large discovery has proven difficult at best. Any advice would be very much appreciated.

  • Sqlnet Communication problem

    Hi Community,
    I have a challenge getting 2 Oracle servers with each located in "internal" and "DMZ" network segments.
    The oracle server on the internal network can communicate with the one on the DMZ but the one on the DMZ can NOT talk to the one on the internal network.
    The customer wants the architecture to enable realtime data updates on the Oracle in DMZ.
    My config is as follows: I need help.
    ciscoasa# wr t
    : Saved
    ASA Version 8.4(3)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.1.184.131 Proxy_Server
    name 192.168.10.1 Internet_Router
    name 10.1.184.122 Mail_Server
    name 10.1.184.116 Mail_Server_2
    name 10.1.184.121 Mail_Server_3
    dns-guard
    interface GigabitEthernet0/0
    nameif Inside
    security-level 100
    ip address 10.1.184.1 255.255.248.0 standby 10.1.184.254
    interface GigabitEthernet0/1
    description LAN/STATE Failover Interface
    interface GigabitEthernet0/2
    nameif DMZ
    security-level 50
    ip address 192.168.30.1 255.255.255.0 standby 192.168.30.2
    interface GigabitEthernet0/3
    nameif Outside
    security-level 0
    ip address 192.168.10.2 255.255.255.0 standby 192.168.10.20
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    clock timezone GMT 1
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network Proxy_Server
    host 10.1.184.131
    object network Mail_Server
    host 10.1.184.122
    object network Internet_Router
    host 192.168.10.1
    description Created during name migration
    object network Mail_Server_2
    host 10.1.184.116
    description Created during name migration
    object network Mail_Server_3
    host 10.1.184.121
    description Created during name migration
    object network WebServer1
    host 192.168.30.3
    object network InternalNetwork
    subnet 10.1.184.0 255.55.248.0
    object network DMZ-IdentityPool
    range 192.168.30.30 192.168.30.254
    object network WebServer2
    host 192.168.30.4
    object network obj-remote
    subnet 192.168.0.0 255.255.255.0
    object network obj-DMZ
    subnet 192.16.30.0 255.255.255.0
    object network DatabaseServer
    host 10.1.184.134
    object network AppServer
    host 10.1.184.126
    object network MailServer
    host 10.1.184.116
    access-list Inside_access_in extended permit ip object Proxy_Server any
    access-list Inside_access_in extended permit ip host 10.1.184.190 any
    access-list Inside_access_in extended permit ip host 10.1.184.83 any
    access-list Inside_access_in extended permit icmp host 10.1.184.190 any
    access-list Inside_access_in extended permit ip host 10.1.184.67 any inactive
    access-list Inside_access_in extended permit ip host 10.1.184.83 object Internet_Router
    access-list Inside_access_in extended permit ip host 10.1.184.190 object Internet_Router
    access-list Inside_access_in extended permit udp any any
    access-list Inside_access_in extended permit icmp any any
    access-list Inside_access_in extended permit ip object Mail_Server any
    access-list Inside_access_in extended permit tcp object Mail_Server any eq smtp
    access-list Inside_access_in extended permit ip object Mail_Server_2 any
    access-list Inside_access_in extended permit tcp object Mail_Server_2 any eq smtp
    access-list Inside_access_in extended deny tcp any any eq smtp
    access-list Inside_access_in extended permit icmp host 10.1.184.43 any
    access-list Inside_access_in extended permit ip object Mail_Server_3 any
    access-list Inside_access_in extended permit tcp object Mail_Server_3 any eq smtp
    access-list Inside_access_in extended permit ip host 10.1.184.190 host 192.168.30.3
    access-list Inside_access_in extended permit tcp object InternalNetwork host 192.168.30.3 eq www
    access-list Inside_access_in extended permit ip host 10.1.184.137 host 10.1.184.133
    access-list Inside_access_in extended permit ip host 10.1.184.62 host 10.1.184.133
    access-list Inside_access_in extended permit ip host 10.1.184.117 any
    access-list Inside_access_in extended permit ip host 10.1.184.117 object Internet_Router
    access-list Inside_access_in extended permit ip host 10.1.184.129 any
    access-list Inside_access_in extended permit ip host 10.1.184.129 object Internet_Router
    access-list Inside_access_in extended permit ip host 10.1.184.150 host 10.1.184.133
    access-list Inside_access_in extended permit ip host 10.1.184.150 any
    access-list Inside_access_in extended permit ip host 10.1.184.190 host 192.168.30.4
    access-list Inside_access_in extended permit tcp object InternalNetwork host 192.168.30.4 eq www
    access-list Inside_access_in extended permit tcp host 10.1.184.134 host 192.168.30.4 eq sqlnet
    access-list Outside_access_in extended permit udp any eq domain object Proxy_Server
    access-list Outside_access_in extended permit icmp object Internet_Router any
    access-list Outside_access_in extended permit icmp any host 10.1.184.190
    access-list Outside_access_in extended permit icmp any host 10.1.184.83 inactive
    access-list Outside_access_in extended permit tcp any object Proxy_Server eq https
    access-list Outside_access_in extended permit tcp any object Proxy_Server eq www
    access-list Outside_access_in extended permit tcp any object Mail_Server eq smtp inactive
    access-list Outside_access_in extended permit tcp any object Mail_Server_2 eq pop3
    access-list Outside_access_in extended permit udp any eq domain object Mail_Server_2
    access-list Outside_access_in extended permit tcp any object Mail_Server eq imap4 inactive
    access-list Outside_access_in extended permit icmp any object Mail_Server inactive
    access-list Outside_access_in extended permit tcp any object Mail_Server_2 eq smtp
    access-list Outside_access_in extended permit tcp any object Mail_Server_2 eq imap4
    access-list Outside_access_in extended permit icmp any object Mail_Server_2
    access-list Outside_access_in extended permit icmp any host 10.1.184.43
    access-list Outside_access_in extended permit tcp any host 192.168.30.3 eq www
    access-list Outside_access_in extended permit tcp any host 192.168.30.3 eq https
    access-list Outside_access_in extended permit icmp any host 192.168.30.3
    access-list Outside_access_in extended permit icmp any any echo-reply
    access-list Outside_access_in extended permit icmp any host 192.168.30.3 echo
    access-list Outside_access_in extended permit tcp any host 192.168.30.4 eq www
    access-list Outside_access_in extended permit tcp any host 192.168.30.4 eq https
    access-list Outside_access_in extended permit icmp any host 192.168.30.4 echo
    access-list Outside_access_in extended permit icmp any host 192.168.30.4
    access-list branchgroup-SplitACL standard permit 10.0.0.0 255.0.0.0
    access-list branchgroup-SplitACL standard permit 192.168.30.0 255.255.255.0
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 host 192.168.30.116 eq smtp
    access-list DMZ_access_in extended permit icmp host 192.168.30.4 any
    access-list DMZ_access_in extended permit ip host 192.168.30.4 host 192.168.30.134
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 host 192.168.30.134 eq sqlnet
    pager lines 24
    logging enable
    logging timestamp
    logging standby
    logging emblem
    logging list InformationalLog level informational
    logging list InformationalLog message 101001
    logging buffer-size 16384
    logging console notifications
    logging monitor errors
    logging buffered critical
    logging trap errors
    logging asdm critical
    logging mail informational
    logging host Inside 10.1.184.132
    logging host Inside 10.1.184.190 6/1470
    logging debug-trace
    logging ftp-server 10.1.184.190 \\marinasec\akanoa akanoa *****
    logging permit-hostdown
    logging class auth buffered emergencies trap emergencies
    logging class bridge buffered emergencies trap emergencies
    logging class config buffered alerts trap emergencies
    logging class ip buffered emergencies trap alerts
    logging class sys trap alerts
    logging class ca trap emergencies
    logging class email buffered emergencies trap errors
    mtu Inside 1500
    mtu DMZ 1500
    mtu Outside 1500
    mtu management 1500
    ip local pool remoteusers 192.168.0.1-192.168.0.254
    failover
    failover lan unit secondary
    failover lan interface stateful_failover GigabitEthernet0/1
    failover replication http
    failover link stateful_failover GigabitEthernet0/1
    failover interface ip stateful_failover 192.168.20.1 255.255.255.252 standby 192.168.20.2
    no monitor-interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Inside
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (DMZ,Outside) source static obj-DMZ obj-DMZ destination static obj-remote obj-remote
    nat (Inside,Outside) source static InternalNetwork InternalNetwork destination static obj-remote obj-remote
    object network Mail_Server
    nat (Inside,Outside) static Mail_Server no-proxy-arp route-lookup
    object network WebServer1
    nat (DMZ,Outside) static 192.168.30.3 dns
    object network WebServer2
    nat (DMZ,Outside) static 192.168.30.4 dns
    object network DatabaseServer
    nat (Inside,DMZ) static 192.168.30.134
    object network AppServer
    nat (Inside,DMZ) static 192.168.30.126
    object network MailServer
    nat (Inside,DMZ) static 192.168.30.116
    access-group Inside_access_in in interface Inside
    access-group DMZ_access_in in interface DMZ
    access-group Outside_access_in in interface Outside
    route Outside 0.0.0.0 0.0.0.0 Internet_Router 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server vpn protocol radius
    aaa-server vpn (Inside) host 10.1.184.119
    key *****
    aaa-server vpn (Inside) host 10.1.184.120
    key *****
    user-identity default-domain LOCAL
    http server enable
    http 10.1.184.190 255.255.255.255 Inside
    http 10.1.184.2 255.255.255.255 Inside
    http 10.1.184.83 255.255.255.255 Inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set rmtset esp-3des esp-md5-hmac
    crypto dynamic-map dyn1 1 set ikev1 transform-set rmtset
    crypto dynamic-map dyn1 1 set reverse-route
    crypto map mymap 1 ipsec-isakmp dynamic dyn1
    crypto map mymap interface Outside
    crypto ikev1 enable Outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 43200
    telnet 10.1.184.83 255.255.255.255 Inside
    telnet 10.1.184.190 255.255.255.255 Inside
    telnet 10.1.184.167 255.255.255.255 Inside
    telnet timeout 5
    ssh 10.1.184.83 255.255.255.255 Inside
    ssh 10.1.184.190 255.255.255.255 Inside
    ssh 10.1.184.43 255.255.255.255 Inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    webvpn
    group-policy branchgroup internal
    group-policy branchgroup attributes
    dns-server value 10.1.184.120
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value branchgroup-SplitACL
    default-domain value marinasecuritieslimited.com
    username sannib password 3gB/xWLMBVp/AjjW encrypted
    username adebimpel password O./lZ/3rlYD/87u2 encrypted
    username ojoawob password w1h9Aq2Welzv1fuW encrypted
    username agbajer password NuDaZPLHC0BcF7iI encrypted
    username oyenihib password eoxptVEUfczen6VR encrypted
    username odewolef password yB12L9t1gcr.Wgx/ encrypted
    username mainuser password 8KBTvbq5FOuoFce2 encrypted privilege 15
    username maakano password c1Cb3uSluyfsyWUb encrypted
    tunnel-group branchgroup type remote-access
    tunnel-group branchgroup general-attributes
    address-pool remoteusers
    default-group-policy branchgroup
    tunnel-group branchgroup ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    class class-default
      user-statistics accounting
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    hpm topN enable
    Cryptochecksum:bbe838eb9af33fc84083989823bc0c22
    : end
    [OK]
    ciscoasa#

    Hi,
    Seems to me that you have configured Static NAT from "inside" to "dmz" so that the "inside" servers are visible to the "dmz" with the IP address belonging to the "dmz"
    Is this something that you absolutely need? Is there something preventing you from using the IP address ranges on both "inside" and "dmz" and not doing NAT for them at all between those interfaces?
    IF you want to keep the current setup intact regarding NAT, change the DMZ ACL to use the actual 10.1.184.x IP addresses as the destination IP address in the ACL.
    In other words, always use the Real IP address of the host in the ACL configuration, NOT the NAT IP address. After doing that change I suppose it should also work for "dmz" to "inside". (NAT IP was used in the ACL in the ASA versions 8.2 and below, the Real IP address is used in software 8.3 and above)
    Change
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 host 192.168.30.116 eq smtp
    access-list DMZ_access_in extended permit icmp host 192.168.30.4 any
    access-list DMZ_access_in extended permit ip host 192.168.30.4 host 192.168.30.134
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 host 192.168.30.134 eq sqlnet
    To
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 host 10.1.184.116 eq smtp
    access-list DMZ_access_in extended permit icmp host 192.168.30.4 any
    access-list DMZ_access_in extended permit ip host 192.168.30.4 host 10.1.184.134
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 host 10.1.184.134 eq sqlnet
    You can also use the "object" names in the ACL.
    Which would be
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 object MailServer eq smtp
    access-list DMZ_access_in extended permit icmp host 192.168.30.4 any
    access-list DMZ_access_in extended permit ip host 192.168.30.4 object DatabaseServer
    access-list DMZ_access_in extended permit tcp host 192.168.30.4 object DatabaseServer eq sqlnet
    Hope the above helps Please ask more if needed.
    - Jouni

  • Confused with this ASA - VPN config issue

    Hello. Can anyone help me here? I am new to the ASA config and commands. Everything works well, enough, on this ASA except the VPN. A client can connect but cannot access anything inside or outside. Here is the config. Can someone please take a look and tell me why VPN is not working? I don't want to set up split-tunneling, I would prefer everything to go through the firewall. Also, if you see something else wrong (or have a better implementation) then please let me know.
    ASA Version 8.4(2)
    hostname FIREWALL_NAME
    enable password Some_X's_here encrypted
    passwd Some_X's_here encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/0.22
    description Public Internet space via VLAN 22
    vlan 22
    nameif Public_Internet
    security-level 0
    ip address 1.3.3.7 255.255.255.248
    interface Ethernet0/1
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.42
    description Private LAN space via VLAN 42
    shutdown
    vlan 42
    nameif Private_CDATA
    security-level 100
    ip address 10.30.136.1 255.255.255.0
    interface Ethernet0/1.69
    description Private LAN space via VLAN 69
    vlan 69
    nameif Private_ODATA
    security-level 100
    ip address 10.30.133.1 255.255.255.0
    interface Ethernet0/1.95
    description Private LAN space via VLAN 95
    shutdown
    vlan 95
    nameif Private_OVOICE
    security-level 100
    ip address 192.168.102.254 255.255.255.0
    interface Ethernet0/1.96
    description Private LAN space via VLAN 96
    shutdown
    vlan 96
    nameif Private_CVOICE
    security-level 100
    ip address 192.168.91.254 255.255.255.0
    interface Ethernet0/1.3610
    description Private LAN subnet via VLAN 3610
    shutdown
    vlan 3610
    nameif Private_CeDATA
    security-level 100
    ip address 10.10.100.18 255.255.255.240
    interface Ethernet0/1.3611
    description Private LAN space via VLAN 3611
    shutdown
    vlan 3611
    nameif Private_CeVOICE
    security-level 100
    ip address 10.10.100.66 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    security-level 0
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.69.1 255.255.255.0
    management-only
    banner exec WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    banner exec
    banner exec                                    ,
    banner exec                                  .';
    banner exec                              .-'` .'
    banner exec                            ,`.-'-.`\
    banner exec                           ; /     '-'
    banner exec                           | \       ,-,
    banner exec                           \  '-.__   )_`'._                      \|/
    banner exec                            '.     ```      ``'--._[]--------------*
    banner exec                           .-' ,                   `'-.           /|\
    banner exec                            '-'`-._           ((   o   )
    banner exec                                   `'--....(`- ,__..--'
    banner exec                                            '-'`
    banner exec
    banner exec frickin' sharks with frickin' laser beams attached to their frickin' heads
    banner login WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    banner asdm WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network CD_3610-GW
    host 10.10.100.17
    description First hop to 3610
    object network CV_3611-GW
    host 10.10.100.65
    description First hop to 3611
    object network GW_22-EXT
    host 1.3.3.6
    description First hop to 22
    object service MS-RDC
    service tcp source range 1024 65535 destination eq 3389
    description Microsoft Remote Desktop Connection
    object network HDC-LAN
    subnet 192.168.200.0 255.255.255.0
    description DC LAN subnet
    object network HAM-LAN
    subnet 192.168.110.0 255.255.255.0
    description HAM LAN subnet
    object service MSN
    service tcp source range 1 65535 destination eq 1863
    description MSN Messenger
    object network BCCs
    host 2.1.8.1
    description BCCs server access
    object network ODLW-EXT
    host 7.1.1.5
    description OTTDl
    object network SWINDS-INT
    host 10.30.133.67
    description SWINDS server
    object network SWINDS(192.x.x.x)-INT
    host 192.168.100.67
    description SWINDS server
    object service YMSG
    service tcp source range 1 65535 destination eq 5050
    description Yahoo Messenger
    object service c.b.ca1
    service tcp source range 1 65535 destination eq citrix-ica
    description Connections to the bc portal.
    object service c.b.ca2
    service tcp source range 1 65535 destination eq 2598
    description Connections to the bc portal.
    object service HTTP-EXT(7001)
    service tcp source range 1 65535 destination eq 7001
    description HTTP Extended on port 7001.
    object service HTTP-EXT(8000-8001)
    service tcp source range 1 65535 destination range 8000 8001
    description HTTP Extended on ports 8000-8001.
    object service HTTP-EXT(8080-8081)
    service tcp source range 1 65535 destination range 8080 8081
    description HTTP Extended on ports 8080-8081.
    object service HTTP-EXT(8100)
    service tcp source range 1 65535 destination eq 8100
    description HTTP Extended on port 8100.
    object service HTTP-EXT(8200)
    service tcp source range 1 65535 destination eq 8200
    description HTTP Extended on port 8200.
    object service HTTP-EXT(8888)
    service tcp source range 1 65535 destination eq 8888
    description HTTP Extended on port 8888.
    object service HTTP-EXT(9080)
    service tcp source range 1 65535 destination eq 9080
    description HTTP Extended on port 9080.
    object service ntp
    service tcp source range 1 65535 destination eq 123
    description TCP NTP on port 123.
    object network Pl-EXT
    host 7.1.1.2
    description OPl box.
    object service Pl-Admin
    service tcp source range 1 65535 destination eq 8443
    description Pl Admin portal
    object network FW-EXT
    host 1.3.3.7
    description External/Public interface IP address of firewall.
    object network Rs-EXT
    host 7.1.1.8
    description Rs web portal External/Public IP.
    object network DWDM-EXT
    host 2.1.2.1
    description DWDM.
    object network HM_VPN-EXT
    host 6.2.9.7
    description HAM Man.
    object network SIM_MGMT
    host 2.1.1.1
    description SIM Man.
    object network TS_MGMT
    host 2.1.1.4
    description TS Man.
    object network TS_MGMT
    host 2.1.2.2
    description TS Man.
    object service VPN-TCP(1723)
    service tcp source range 1 65535 destination eq pptp
    description For PPTP control path.
    object service VPN-UDP(4500)
    service udp source range 1 65535 destination eq 4500
    description For L2TP(IKEv1) and IKEv2.
    object service VPN-TCP(443)
    service tcp source range 1 65535 destination eq https
    description For SSTP control and data path.
    object service VPN-UDP(500)
    service udp source range 1 65535 destination eq isakmp
    description For L2TP(IKEv1) and IKEv2.
    object network RCM
    host 6.1.8.2
    description RCM
    object network RCM_Y
    host 6.1.8.9
    description RCM Y
    object network r.r.r.c163
    host 2.1.2.63
    description RCV IP.
    object network r.r.r.c227
    host 2.1.2.27
    description RCV IP.
    object network v.t.c-EXT
    host 2.5.1.2
    description RTICR
    object service VPN-TCP(10000)
    service tcp source range 1 65535 destination eq 10000
    description For TCP VPN over port 1000.
    object service BGP-JY
    service tcp source range 1 65535 destination eq 21174
    description BPG
    object network KooL
    host 192.168.100.100
    description KooL
    object network FW_Test
    host 1.3.3.7
    description Testing other External IP
    object network AO_10-30-133-0-LAN
    range 10.30.133.0 10.30.133.229
    description OLS 10.30.133.0/24
    object network AC_10-30-136-0-LAN
    subnet 10.30.136.0 255.255.255.0
    description CLS 10.30.136.0/24
    object network NETWORK_OBJ_192.168.238.0_27
    subnet 192.168.238.0 255.255.255.224
    object-group network All_Private_Interfaces
    description All private interfaces
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    network-object 10.10.100.16 255.255.255.240
    network-object 10.10.100.64 255.255.255.252
    network-object 192.168.102.0 255.255.255.0
    network-object 192.168.91.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service cb.ca
    description All ports required for cb.ca connections.
    service-object object c.b.ca1
    service-object object c.b.ca2
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq https
    service-object udp destination eq snmp
    object-group service FTP
    description All FTP ports (20 + 21)
    service-object tcp destination eq ftp
    service-object tcp destination eq ftp-data
    object-group service HTTP-EXT
    description HTTP Extended port ranges.
    service-object object HTTP-EXT(7001)
    service-object object HTTP-EXT(8000-8001)
    service-object object HTTP-EXT(8080-8081)
    service-object object HTTP-EXT(8100)
    service-object object HTTP-EXT(8200)
    service-object object HTTP-EXT(8888)
    service-object object HTTP-EXT(9080)
    object-group service ICMP_Any
    description ICMP: Any Type, Any Code
    service-object icmp alternate-address
    service-object icmp conversion-error
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp information-reply
    service-object icmp information-request
    service-object icmp mask-reply
    service-object icmp mask-request
    service-object icmp mobile-redirect
    service-object icmp parameter-problem
    service-object icmp redirect
    service-object icmp router-advertisement
    service-object icmp router-solicitation
    service-object icmp source-quench
    service-object icmp time-exceeded
    service-object icmp timestamp-reply
    service-object icmp timestamp-request
    service-object icmp traceroute
    service-object icmp unreachable
    service-object icmp6 echo
    service-object icmp6 echo-reply
    service-object icmp6 membership-query
    service-object icmp6 membership-reduction
    service-object icmp6 membership-report
    service-object icmp6 neighbor-advertisement
    service-object icmp6 neighbor-redirect
    service-object icmp6 neighbor-solicitation
    service-object icmp6 packet-too-big
    service-object icmp6 parameter-problem
    service-object icmp6 router-advertisement
    service-object icmp6 router-renumbering
    service-object icmp6 router-solicitation
    service-object icmp6 time-exceeded
    service-object icmp6 unreachable
    service-object icmp
    object-group service NTP
    description TCP and UPD NTP protocol
    service-object object ntp
    service-object udp destination eq ntp
    object-group service DM_INLINE_SERVICE_3
    group-object FTP
    group-object HTTP-EXT
    group-object ICMP_Any
    group-object NTP
    service-object tcp-udp destination eq domain
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq ssh
    service-object ip
    object-group service DM_INLINE_SERVICE_4
    group-object NTP
    service-object tcp destination eq daytime
    object-group network SWINDS
    description Both Internal IP addresses (192 + 10)
    network-object object SWINDS-INT
    network-object object SWINDS(192.x.x.x)-INT
    object-group service IM_Types
    description All messenger type applications
    service-object object MSN
    service-object object YMSG
    service-object tcp-udp destination eq talk
    service-object tcp destination eq aol
    service-object tcp destination eq irc
    object-group service SNMP
    description Both poll and trap ports.
    service-object udp destination eq snmp
    service-object udp destination eq snmptrap
    object-group service DM_INLINE_SERVICE_2
    group-object FTP
    service-object object MS-RDC
    service-object object Pl-Admin
    group-object SNMP
    object-group network DM_INLINE_NETWORK_1
    network-object object FW-EXT
    network-object object Rs-EXT
    object-group network AMV
    description connections for legacy AM
    network-object object DWDM-EXT
    network-object object HAM_MGMT
    network-object object SIM_MGMT
    network-object object TS_MGMT
    network-object object TS_MGMT
    object-group service IKEv2_L2TP
    description IKEv2 and L2TP VPN configurations
    service-object esp
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    object-group service PPTP
    description PPTP VPN configuration
    service-object gre
    service-object object VPN-TCP(1723)
    object-group service SSTP
    description SSTP VPN configuration
    service-object object VPN-TCP(443)
    object-group network RvIPs
    description Rv IP addresses
    network-object object RCM
    network-object object RCM_Y
    network-object object r.r.r.c163
    network-object object r.r.r.c227
    network-object object v.t.c-EXT
    object-group service Rvs
    description Rv configuration.
    service-object object VPN-TCP(10000)
    service-object object VPN-UDP(500)
    object-group service DM_INLINE_SERVICE_5
    service-object object BGP-JY
    service-object tcp destination eq bgp
    object-group network Local_Private_Subnets
    description OandCl DATA
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    access-list Public/Internet_access_out remark Block all IM traffic out.
    access-list Public/Internet_access_out extended deny object-group IM_Types object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Access from SWINDS to DLM portal
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_1 object-group SWINDS object ODLW-EXT
    access-list Public/Internet_access_out remark Allow access to BMC portal
    access-list Public/Internet_access_out extended permit object-group cb.ca object-group Local_Private_Subnets object BCCs
    access-list Public/Internet_access_out remark Allow basic services out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_3 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow WhoIS traffic out.
    access-list Public/Internet_access_out extended permit tcp object-group Local_Private_Subnets any eq whois
    access-list Public/Internet_access_out remark Allow Network Time protocols out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_4 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow all IP based monitoring traffic to Pl.
    access-list Public/Internet_access_out extended permit ip object-group SWINDS object Pl-EXT
    access-list Public/Internet_access_out remark Allow Management traffic to Pl-JY.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_2 object-group Local_Private_Subnets object Pl-EXT
    access-list Public/Internet_access_out remark Allow FTP traffic to Grimlock and RS FTP.
    access-list Public/Internet_access_out extended permit object-group FTP object-group Local_Private_Subnets object-group DM_INLINE_NETWORK_1
    access-list Public/Internet_access_out remark Allow VPN traffic to AM-JY.
    access-list Public/Internet_access_out extended permit object-group IKEv2_L2TP object-group Local_Private_Subnets object-group AMV
    access-list Public/Internet_access_out remark Allow VPN traffic to RCm devices.
    access-list Public/Internet_access_out extended permit object-group Rvs object-group Local_Private_Subnets object-group RvIPs
    access-list Public/Internet_access_out remark Allow BPG traffic out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_5 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow Kool server out.
    access-list Public/Internet_access_out extended permit ip object KooL any
    pager lines 24
    logging enable
    logging history informational
    logging asdm informational
    logging mail notifications
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu Public_Internet 1500
    mtu Private_CDATA 1500
    mtu Private_ODATA 1500
    mtu Private_OVOICE 1500
    mtu Private_CVOICE 1500
    mtu Private_CeDATA 1500
    mtu Private_CeVOICE 1500
    mtu management 1500
    ip local pool AO-VPN_Pool 192.168.238.2-192.168.238.30 mask 255.255.255.224
    ip verify reverse-path interface Public_Internet
    ip verify reverse-path interface Private_CDATA
    ip verify reverse-path interface Private_ODATA
    ip verify reverse-path interface Private_OVOICE
    ip verify reverse-path interface Private_CVOICE
    ip verify reverse-path interface Private_CeDATA
    ip verify reverse-path interface Private_CeVOICE
    ip verify reverse-path interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any Public_Internet
    no asdm history enable
    arp timeout 14400
    nat (Private_ODATA,Public_Internet) source dynamic AO_10-30-133-0-LAN interface
    nat (Private_CDATA,Public_Internet) source dynamic AC_10-30-136-0-LAN interface
    nat (Private_ODATA,Public_Internet) source static any any destination static NETWORK_OBJ_192.168.238.0_27 NETWORK_OBJ_192.168.238.0_27 no-proxy-arp route-lookup
    access-group Public/Internet_access_out out interface Public_Internet
    route Public_Internet 0.0.0.0 0.0.0.0 1.3.3.6 1
    route Private_CeDATA 10.0.0.0 255.0.0.0 10.10.100.17 1
    route Private_CeDATA 10.1.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.3.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.5.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.11.106.74 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 10.30.128.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.130.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.131.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.132.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.134.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.135.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.67.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.224.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 4.1.1.19 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 1.1.1.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 1.1.1.13 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.24 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.27 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.17.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.64 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.66 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.110 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.251.57 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.56.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.57.152 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 192.168.3.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.9.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.20.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.21.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.30.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.40.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.41.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.50.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.60.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.61.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.70.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.101.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.110.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.200.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.251.177.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 2.1.2.7 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 2.1.2.74 255.255.255.255 10.10.100.17 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (Private_ODATA) host 10.30.133.21
    timeout 5
    nt-auth-domain-controller Cool_Transformer_Name
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.69.0 255.255.255.0 management
    snmp-server host Private_ODATA 10.30.133.67 poll community Some_*s_here version 2c
    snmp-server location OT
    snmp-server contact [email protected]
    snmp-server community Some_*s_here
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change fru-insert fru-remove
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps remote-access session-threshold-exceeded
    snmp-server enable traps connection-limit-reached
    snmp-server enable traps cpu threshold rising
    snmp-server enable traps ikev2 start stop
    snmp-server enable traps nat packet-discard
    sysopt noproxyarp Public_Internet
    sysopt noproxyarp Private_CDATA
    sysopt noproxyarp Private_ODATA
    sysopt noproxyarp Private_OVOICE
    sysopt noproxyarp Private_CVOICE
    sysopt noproxyarp Private_CeDATA
    sysopt noproxyarp Private_CeVOICE
    sysopt noproxyarp management
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Public_Internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Public_Internet_map interface Public_Internet
    crypto ikev1 enable Public_Internet
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh 10.30.133.0 255.255.255.0 Private_ODATA
    ssh 192.168.69.0 255.255.255.0 management
    ssh timeout 2
    ssh version 2
    console timeout 5
    dhcprelay server 10.30.133.13 Private_ODATA
    dhcprelay enable Private_CDATA
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.30.133.13 prefer
    ntp server 132.246.11.227
    ntp server 10.30.133.21
    webvpn
    group-policy AO-VPN_Tunnel internal
    group-policy AO-VPN_Tunnel attributes
    dns-server value 10.30.133.21 10.30.133.13
    vpn-tunnel-protocol ikev1
    default-domain value ao.local
    username helpme password Some_X's_here encrypted privilege 1
    username helpme attributes
    service-type nas-prompt
    tunnel-group AO-VPN_Tunnel type remote-access
    tunnel-group AO-VPN_Tunnel general-attributes
    address-pool AO-VPN_Pool
    authentication-server-group AD
    default-group-policy AO-VPN_Tunnel
    tunnel-group AO-VPN_Tunnel ipsec-attributes
    ikev1 pre-shared-key Some_*s_here
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    class class-default
      user-statistics accounting
    service-policy global_policy global
    smtp-server 192.168.200.25
    prompt hostname context
    no call-home reporting anonymous
    Thanks,
    Jeff.                  

    I tried those commands but this started getting messy and so I looked at the current config and it was not the same as what I originally posted.  Looks like some changes were implemented but not saved so the config that I posted what slightly different.  Thank you for all your suggestions.  Here is the new config, confirmed as the current running and saved config.  Same situation as before though.  I can connect using the Cisco VPN client but can only ping myself and can't get out to the Internet or access anything internal.  If someone can take a look it would be greatly appreciated.  The main difference is the VPN pool has been set as a subset of the 10.30.133.0 network instead of using a separate subnet (VPN pool is 10.30.133.200 - 10.30.133.230).
    ASA Version 8.4(2)
    hostname FIREWALL_NAME
    enable password Some_X's_here encrypted
    passwd Some_X's_here encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/0.22
    description Public Internet space via VLAN 22
    vlan 22
    nameif Public_Internet
    security-level 0
    ip address 1.3.3.7 255.255.255.248
    interface Ethernet0/1
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.42
    description Private LAN space via VLAN 42
    shutdown
    vlan 42
    nameif Private_CDATA
    security-level 100
    ip address 10.30.136.1 255.255.255.0
    interface Ethernet0/1.69
    description Private LAN space via VLAN 69
    vlan 69
    nameif Private_ODATA
    security-level 100
    ip address 10.30.133.1 255.255.255.0
    interface Ethernet0/1.95
    description Private LAN space via VLAN 95
    shutdown
    vlan 95
    nameif Private_OVOICE
    security-level 100
    ip address 192.168.102.254 255.255.255.0
    interface Ethernet0/1.96
    description Private LAN space via VLAN 96
    shutdown
    vlan 96
    nameif Private_CVOICE
    security-level 100
    ip address 192.168.91.254 255.255.255.0
    interface Ethernet0/1.3610
    description Private LAN subnet via VLAN 3610
    shutdown
    vlan 3610
    nameif Private_CeDATA
    security-level 100
    ip address 10.10.100.18 255.255.255.240
    interface Ethernet0/1.3611
    description Private LAN space via VLAN 3611
    shutdown
    vlan 3611
    nameif Private_CeVOICE
    security-level 100
    ip address 10.10.100.66 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    security-level 0
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.69.1 255.255.255.0
    management-only
    banner exec WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    banner exec
    banner exec                                    ,
    banner exec                                  .';
    banner exec                              .-'` .'
    banner exec                            ,`.-'-.`\
    banner exec                           ; /     '-'
    banner exec                           | \       ,-,
    banner exec                           \  '-.__   )_`'._                      \|/
    banner exec                            '.     ```      ``'--._[]--------------*
    banner exec                           .-' ,                   `'-.           /|\
    banner exec                            '-'`-._           ((   o   )
    banner exec                                   `'--....(`- ,__..--'
    banner exec                                            '-'`
    banner exec
    banner exec frickin' sharks with frickin' laser beams attached to their frickin' heads
    banner login WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    banner asdm WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network CD_3610-GW
    host 10.10.100.17
    description First hop to 3610
    object network CV_3611-GW
    host 10.10.100.65
    description First hop to 3611
    object network GW_22-EXT
    host 1.3.3.6
    description First hop to 22
    object network Ts-LAN
    host 192.168.100.4
    description TS
    object service MS-RDC
    service tcp source range 1024 65535 destination eq 3389
    description Microsoft Remote Desktop Connection
    object network HDC-LAN
    subnet 192.168.200.0 255.255.255.0
    description DC LAN subnet
    object network HAM-LAN
    subnet 192.168.110.0 255.255.255.0
    description HAM LAN subnet
    object service MSN
    service tcp source range 1 65535 destination eq 1863
    description MSN Messenger
    object network BCCs
    host 2.1.8.1
    description BCCs server access
    object network ODLW-EXT
    host 7.1.1.5
    description OTTDl
    object network SWINDS-INT
    host 10.30.133.67
    description SWINDS server
    object network SWINDS(192.x.x.x)-INT
    host 192.168.100.67
    description SWINDS server
    object service YMSG
    service tcp source range 1 65535 destination eq 5050
    description Yahoo Messenger
    object service c.b.ca1
    service tcp source range 1 65535 destination eq citrix-ica
    description Connections to the bc portal.
    object service c.b.ca2
    service tcp source range 1 65535 destination eq 2598
    description Connections to the bc portal.
    object service HTTP-EXT(7001)
    service tcp source range 1 65535 destination eq 7001
    description HTTP Extended on port 7001.
    object service HTTP-EXT(8000-8001)
    service tcp source range 1 65535 destination range 8000 8001
    description HTTP Extended on ports 8000-8001.
    object service HTTP-EXT(8080-8081)
    service tcp source range 1 65535 destination range 8080 8081
    description HTTP Extended on ports 8080-8081.
    object service HTTP-EXT(8100)
    service tcp source range 1 65535 destination eq 8100
    description HTTP Extended on port 8100.
    object service HTTP-EXT(8200)
    service tcp source range 1 65535 destination eq 8200
    description HTTP Extended on port 8200.
    object service HTTP-EXT(8888)
    service tcp source range 1 65535 destination eq 8888
    description HTTP Extended on port 8888.
    object service HTTP-EXT(9080)
    service tcp source range 1 65535 destination eq 9080
    description HTTP Extended on port 9080.
    object service ntp
    service tcp source range 1 65535 destination eq 123
    description TCP NTP on port 123.
    object network Pl-EXT
    host 7.1.1.2
    description OPl box.
    object service Pl-Admin
    service tcp source range 1 65535 destination eq 8443
    description Pl Admin portal
    object network FW-EXT
    host 1.3.3.7
    description External/Public interface IP address of firewall.
    object network Rs-EXT
    host 7.1.1.8
    description Rs web portal External/Public IP.
    object network DWDM-EXT
    host 2.1.2.1
    description DWDM.
    object network HM_VPN-EXT
    host 6.2.9.7
    description HAM Man.
    object network SIM_MGMT
    host 2.1.1.1
    description SIM Man.
    object network TS_MGMT
    host 2.1.1.4
    description TS Man.
    object network TS_MGMT
    host 2.1.2.2
    description TS Man.
    object service VPN-TCP(1723)
    service tcp source range 1 65535 destination eq pptp
    description For PPTP control path.
    object service VPN-UDP(4500)
    service udp source range 1 65535 destination eq 4500
    description For L2TP(IKEv1) and IKEv2.
    object service VPN-TCP(443)
    service tcp source range 1 65535 destination eq https
    description For SSTP control and data path.
    object service VPN-UDP(500)
    service udp source range 1 65535 destination eq isakmp
    description For L2TP(IKEv1) and IKEv2.
    object network RCM
    host 6.1.8.2
    description RCM
    object network RCM_Y
    host 6.1.8.9
    description RCM Y
    object network r.r.r.c163
    host 2.1.2.63
    description RCV IP.
    object network r.r.r.c227
    host 2.1.2.27
    description RCV IP.
    object network v.t.c-EXT
    host 2.5.1.2
    description RTICR
    object service VPN-TCP(10000)
    service tcp source range 1 65535 destination eq 10000
    description For TCP VPN over port 1000.
    object service BGP-JY
    service tcp source range 1 65535 destination eq 21174
    description BPG
    object network KooL
    host 192.168.100.100
    description KooL
    object network FW_Test
    host 1.3.3.7
    description Testing other External IP
    object network AO_10-30-133-0-LAN
    subnet 10.30.133.0 255.255.255.0
    description OLS 10.30.133.0/24
    object network AC_10-30-136-0-LAN
    subnet 10.30.136.0 255.255.255.0
    description CLS 10.30.136.0/24
    object-group network All_Private_Interfaces
    description All private interfaces
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    network-object 10.10.100.16 255.255.255.240
    network-object 10.10.100.64 255.255.255.252
    network-object 192.168.102.0 255.255.255.0
    network-object 192.168.91.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service cb.ca
    description All ports required for cb.ca connections.
    service-object object c.b.ca1
    service-object object c.b.ca2
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq https
    service-object udp destination eq snmp
    object-group service FTP
    description All FTP ports (20 + 21)
    service-object tcp destination eq ftp
    service-object tcp destination eq ftp-data
    object-group service HTTP-EXT
    description HTTP Extended port ranges.
    service-object object HTTP-EXT(7001)
    service-object object HTTP-EXT(8000-8001)
    service-object object HTTP-EXT(8080-8081)
    service-object object HTTP-EXT(8100)
    service-object object HTTP-EXT(8200)
    service-object object HTTP-EXT(8888)
    service-object object HTTP-EXT(9080)
    object-group service ICMP_Any
    description ICMP: Any Type, Any Code
    service-object icmp alternate-address
    service-object icmp conversion-error
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp information-reply
    service-object icmp information-request
    service-object icmp mask-reply
    service-object icmp mask-request
    service-object icmp mobile-redirect
    service-object icmp parameter-problem
    service-object icmp redirect
    service-object icmp router-advertisement
    service-object icmp router-solicitation
    service-object icmp source-quench
    service-object icmp time-exceeded
    service-object icmp timestamp-reply
    service-object icmp timestamp-request
    service-object icmp traceroute
    service-object icmp unreachable
    service-object icmp6 echo
    service-object icmp6 echo-reply
    service-object icmp6 membership-query
    service-object icmp6 membership-reduction
    service-object icmp6 membership-report
    service-object icmp6 neighbor-advertisement
    service-object icmp6 neighbor-redirect
    service-object icmp6 neighbor-solicitation
    service-object icmp6 packet-too-big
    service-object icmp6 parameter-problem
    service-object icmp6 router-advertisement
    service-object icmp6 router-renumbering
    service-object icmp6 router-solicitation
    service-object icmp6 time-exceeded
    service-object icmp6 unreachable
    service-object icmp
    object-group service NTP
    description TCP and UPD NTP protocol
    service-object object ntp
    service-object udp destination eq ntp
    object-group service DM_INLINE_SERVICE_3
    group-object FTP
    group-object HTTP-EXT
    group-object ICMP_Any
    group-object NTP
    service-object tcp-udp destination eq domain
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq ssh
    service-object ip
    object-group service DM_INLINE_SERVICE_4
    group-object NTP
    service-object tcp destination eq daytime
    object-group network SWINDS
    description Both Internal IP addresses (192 + 10)
    network-object object SWINDS-INT
    network-object object SWINDS(192.x.x.x)-INT
    object-group service IM_Types
    description All messenger type applications
    service-object object MSN
    service-object object YMSG
    service-object tcp-udp destination eq talk
    service-object tcp destination eq aol
    service-object tcp destination eq irc
    object-group service SNMP
    description Both poll and trap ports.
    service-object udp destination eq snmp
    service-object udp destination eq snmptrap
    object-group service DM_INLINE_SERVICE_2
    group-object FTP
    service-object object MS-RDC
    service-object object Pl-Admin
    group-object SNMP
    object-group network DM_INLINE_NETWORK_1
    network-object object FW-EXT
    network-object object Rs-EXT
    object-group network AMV
    description connections for legacy AM
    network-object object DWDM-EXT
    network-object object HAM_MGMT
    network-object object SIM_MGMT
    network-object object TS_MGMT
    network-object object TS_MGMT
    object-group service IKEv2_L2TP
    description IKEv2 and L2TP VPN configurations
    service-object esp
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    object-group service PPTP
    description PPTP VPN configuration
    service-object gre
    service-object object VPN-TCP(1723)
    object-group service SSTP
    description SSTP VPN configuration
    service-object object VPN-TCP(443)
    object-group network RvIPs
    description Rv IP addresses
    network-object object RCM
    network-object object RCM_Y
    network-object object r.r.r.c163
    network-object object r.r.r.c227
    network-object object v.t.c-EXT
    object-group service Rvs
    description Rv configuration.
    service-object object VPN-TCP(10000)
    service-object object VPN-UDP(500)
    object-group service DM_INLINE_SERVICE_5
    service-object object BGP-JY
    service-object tcp destination eq bgp
    object-group network Local_Private_Subnets
    description OandCl DATA
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    object-group service IPSec
    description IPSec traffic
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    access-list Public/Internet_access_out remark Block all IM traffic out.
    access-list Public/Internet_access_out extended deny object-group IM_Types object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Access from SWINDS to DLM portal
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_1 object-group SWINDS object ODLW-EXT
    access-list Public/Internet_access_out remark Allow access to BMC portal
    access-list Public/Internet_access_out extended permit object-group cb.ca object-group Local_Private_Subnets object BCCs
    access-list Public/Internet_access_out remark Allow basic services out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_3 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow WhoIS traffic out.
    access-list Public/Internet_access_out extended permit tcp object-group Local_Private_Subnets any eq whois
    access-list Public/Internet_access_out remark Allow Network Time protocols out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_4 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow all IP based monitoring traffic to Pl.
    access-list Public/Internet_access_out extended permit ip object-group SWINDS object Pl-EXT
    access-list Public/Internet_access_out remark Allow Management traffic to Pl-JY.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_2 object-group Local_Private_Subnets object Pl-EXT
    access-list Public/Internet_access_out remark Allow FTP traffic to Grimlock and RS FTP.
    access-list Public/Internet_access_out extended permit object-group FTP object-group Local_Private_Subnets object-group DM_INLINE_NETWORK_1
    access-list Public/Internet_access_out remark Allow VPN traffic to AM-JY.
    access-list Public/Internet_access_out extended permit object-group IKEv2_L2TP object-group Local_Private_Subnets object-group AMV
    access-list Public/Internet_access_out remark Allow VPN traffic to RCm devices.
    access-list Public/Internet_access_out extended permit object-group Rvs object-group Local_Private_Subnets object-group RvIPs
    access-list Public/Internet_access_out remark Allow BPG traffic out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_5 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow Kool server out.
    access-list Public/Internet_access_out extended permit ip object KooL any
    pager lines 24
    logging enable
    logging history informational
    logging asdm informational
    logging mail notifications
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu Public_Internet 1500
    mtu Private_CDATA 1500
    mtu Private_ODATA 1500
    mtu Private_OVOICE 1500
    mtu Private_CVOICE 1500
    mtu Private_CeDATA 1500
    mtu Private_CeVOICE 1500
    mtu management 1500
    ip local pool AO-VPN_Pool 192.168.238.2-192.168.238.30 mask 255.255.255.224
    ip verify reverse-path interface Public_Internet
    ip verify reverse-path interface Private_CDATA
    ip verify reverse-path interface Private_ODATA
    ip verify reverse-path interface Private_OVOICE
    ip verify reverse-path interface Private_CVOICE
    ip verify reverse-path interface Private_CeDATA
    ip verify reverse-path interface Private_CeVOICE
    ip verify reverse-path interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any Public_Internet
    no asdm history enable
    arp timeout 14400
    nat (Private_ODATA,Public_Internet) source dynamic AO_10-30-133-0-LAN interface
    nat (Private_CDATA,Public_Internet) source dynamic AC_10-30-136-0-LAN interface
    nat (Private_ODATA,Public_Internet) source static any any destination static NETWORK_OBJ_192.168.238.0_27 NETWORK_OBJ_192.168.238.0_27 no-proxy-arp route-lookup
    access-group Public/Internet_access_out out interface Public_Internet
    route Public_Internet 0.0.0.0 0.0.0.0 1.3.3.6 1
    route Private_CeDATA 10.0.0.0 255.0.0.0 10.10.100.17 1
    route Private_CeDATA 10.1.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.3.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.5.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.11.106.74 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 10.30.128.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.130.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.131.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.132.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.134.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.135.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.67.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.224.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 4.1.1.19 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 1.1.1.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 1.1.1.13 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.24 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.27 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.29 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.17.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.64 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.66 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.110 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.251.57 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.56.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.57.152 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 192.168.3.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.9.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.20.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.21.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.30.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.40.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.41.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.50.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.60.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.61.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.70.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.101.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.110.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.200.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.251.177.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 2.1.2.7 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 2.1.2.74 255.255.255.255 10.10.100.17 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (Private_ODATA) host 10.30.133.21
    timeout 5
    nt-auth-domain-controller Cool_Transformer_Name
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.69.0 255.255.255.0 management
    snmp-server host Private_ODATA 10.30.133.67 poll community Some_*s_here version 2c
    snmp-server location OT
    snmp-server contact [email protected]
    snmp-server community Some_*s_here
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change fru-insert fru-remove
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps remote-access session-threshold-exceeded
    snmp-server enable traps connection-limit-reached
    snmp-server enable traps cpu threshold rising
    snmp-server enable traps ikev2 start stop
    snmp-server enable traps nat packet-discard
    sysopt noproxyarp Public_Internet
    sysopt noproxyarp Private_CDATA
    sysopt noproxyarp Private_ODATA
    sysopt noproxyarp Private_OVOICE
    sysopt noproxyarp Private_CVOICE
    sysopt noproxyarp Private_CeDATA
    sysopt noproxyarp Private_CeVOICE
    sysopt noproxyarp management
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Public_Internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Public_Internet_map interface Public_Internet
    crypto ikev1 enable Public_Internet
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh 10.30.133.0 255.255.255.0 Private_ODATA
    ssh 192.168.69.0 255.255.255.0 management
    ssh timeout 2
    ssh version 2
    console timeout 5
    dhcprelay server 10.30.133.13 Private_ODATA
    dhcprelay enable Private_CDATA
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.30.133.13 prefer
    ntp server 132.246.11.227
    ntp server 10.30.133.21
    webvpn
    group-policy AO-VPN_Tunnel internal
    group-policy AO-VPN_Tunnel attributes
    dns-server value 10.30.133.21 10.30.133.13
    vpn-tunnel-protocol ikev1
    default-domain value ao.local
    username helpme password Some_X's_here encrypted privilege 1
    username helpme attributes
    service-type nas-prompt
    tunnel-group AO-VPN_Tunnel type remote-access
    tunnel-group AO-VPN_Tunnel general-attributes
    address-pool AO-VPN_Pool
    authentication-server-group AD
    default-group-policy AO-VPN_Tunnel
    tunnel-group AO-VPN_Tunnel ipsec-attributes
    ikev1 pre-shared-key Some_*s_here
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny 
    inspect sunrpc
    inspect xdmcp
    inspect sip 
    inspect netbios
    inspect tftp
    inspect ip-options
    class class-default
    user-statistics accounting
    service-policy global_policy global
    smtp-server 192.168.200.25
    prompt hostname context
    no call-home reporting anonymous
    Thanks in advance,
    Jeff.

  • VPN client cannot access inside hosts

    Hello,
        I have an ASA 5505 device with the attached configuration and my vpn clients can connect to it fine.  Although, once a vpn client is connected they cannot RDP, ping, or telnet any internal hosts.  The goal is to have a connected vpn client to have all access rights as anyone sitting on the internal network.  Any assistance is greatly appreciated.
    : Saved
    ASA Version 7.2(3)
    hostname Kappa-GW01
    domain-name Kappa.com
    enable password xxxxxxxxx encrypted
    names
    name 172.20.42.42 UMEFTP2 description UMAP FTP2
    name 172.20.40.246 UMEMAIL1 description Exchange Server
    name 172.20.41.3 UMERPS
    name x.x.81.81 Wilkes
    name x.x.84.41 KappaPittston
    dns-guard
    interface Ethernet0/0
    shutdown
    nameif outside
    security-level 0
    ip address x.x.148.194 255.255.255.248
    interface Ethernet0/1
    nameif Outside_Windstream
    security-level 0
    ip address x.x.205.210 255.255.255.240
    interface Ethernet0/2
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    passwd 7Tpgc2AiWGxbNjkj encrypted
    boot system disk0:/asa723-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name Kappa.com
    object-group network Blue_Bell_Internal_Networks
    description Blue Bell internal network Group
    network-object 192.168.100.0 255.255.255.0
    network-object 10.0.0.0 255.255.255.0
    network-object 10.0.1.0 255.255.255.0
    network-object 10.0.2.0 255.255.255.0
    object-group network VPN-Sites
    network-object host Wilkes
    network-object host KappaPittston
    object-group network Michigan_VPN_GRP
    network-object 172.20.40.0 255.255.252.0
    object-group network ASA_OutSide_Vendors
    description ASA OutSide Vendor Access
    access-list 101 extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 10.0.1.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl remark Blue Bell Office
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl remark Williamston Office
    access-list KappaVPN_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
    access-list KappaVPN_splitTunnelAcl remark Pittston Office
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.10.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.30.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 172.20.40.0 255.255.252.0 inactive
    access-list inside_nat0_outbound extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.30.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.30.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
    access-list outside_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
    access-list umeemp_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.30.0 255.255.255.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
    access-list outside_5_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list inside_access_in extended permit ip any any
    access-list 102 extended permit tcp any any eq 2000
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq smtp
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq pop3 inactive
    access-list Outside_Winstream_access_in extended permit udp object-group VPN-Sites interface Outside_Windstream eq isakmp
    access-list Outside_Winstream_access_in extended permit tcp object-group ASA_OutSide_Vendors host x.x.205.217 eq 4080
    access-list Outside_Winstream_access_in remark SMTP Access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq smtp
    access-list Outside_Winstream_access_in remark POP access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq pop3
    access-list Outside_Winstream_access_in remark OWA Access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq https
    access-list Outside_Winstream_access_in extended permit tcp host x.x.87.65 host x.x.205.218 eq 3389
    access-list Outside_Winstream_access_in extended permit udp host x.x.56.111 eq ntp host x.x.205.216 eq ntp
    access-list Outside_Winstream_access_in remark OWA UMAP
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq https
    access-list Outside_Winstream_access_in remark JLAN
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.215 eq https
    access-list Outside_Winstream_access_in remark UMERPS
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq https
    access-list Outside_Winstream_access_in remark UMERPS
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq ssh
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq https
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq 5494
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.214 eq www
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq 8081
    access-list Outside_Winstream_access_in extended permit icmp any any echo
    access-list outside_6_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list outside_6_cryptomap extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_11 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_10 extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_5 extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_12 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
    access-list nonat extended permit ip any any inactive
    pager lines 24
    logging enable
    logging asdm debugging
    logging flash-bufferwrap
    mtu outside 1500
    mtu Outside_Windstream 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn-pool 192.168.100.100-192.168.100.200
    no failover
    monitor-interface outside
    monitor-interface Outside_Windstream
    monitor-interface inside
    monitor-interface management
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (Outside_Windstream) 1 x.x.205.216 netmask 255.0.0.0
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 172.20.40.0 255.255.252.0
    nat (inside) 1 10.0.0.0 255.255.0.0
    static (inside,Outside_Windstream) x.x.205.217 10.0.0.20 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.220 10.0.0.21 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.218 10.0.0.15 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.215 172.20.40.145 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.211 UMEMAIL1 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.212 UMERPS netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.213 172.20.40.243 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.214 172.20.40.146 netmask 255.255.255.255
    access-group acl_inbound in interface outside
    access-group Outside_Winstream_access_in in interface Outside_Windstream
    route Outside_Windstream 0.0.0.0 0.0.0.0 x.x.205.209 1
    route inside 172.20.40.0 255.255.252.0 10.0.0.3 1
    route inside 10.0.30.0 255.255.255.0 10.0.0.254 1
    route inside 10.0.1.0 255.255.255.0 10.0.0.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server BBPA-SRV-DC01 protocol radius
    aaa-server BBPA-SRV-DC01 host 10.0.0.15
    timeout 5
    key G6G7#02bj!
    aaa-server UMAP protocol radius
    aaa-server UMAP host 172.20.40.245
    timeout 5
    key gfrt1a
    aaa-server UMAP host 172.20.40.244
    timeout 5
    key gfrt1a
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 10.0.0.0 255.255.255.0 inside
    http 10.0.0.15 255.255.255.255 inside
    http 192.168.1.0 255.255.255.0 management
    http 192.168.100.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto dynamic-map Outside_Windstream_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map Outside_Windstream_dyn_map 40 set pfs
    crypto dynamic-map Outside_Windstream_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto map outside_map 5 match address outside_5_cryptomap
    crypto map outside_map 5 set peer Wilkes
    crypto map outside_map 5 set transform-set ESP-3DES-SHA
    crypto map outside_map 10 match address outside_6_cryptomap
    crypto map outside_map 10 set peer KappaPittston
    crypto map outside_map 10 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto map Outside_Windstream_map 5 match address Outside_Windstream_cryptomap_5
    crypto map Outside_Windstream_map 5 set peer Wilkes
    crypto map Outside_Windstream_map 5 set transform-set ESP-3DES-SHA
    crypto map Outside_Windstream_map 10 match address Outside_Windstream_cryptomap_10
    crypto map Outside_Windstream_map 10 set peer KappaPittston
    crypto map Outside_Windstream_map 10 set transform-set ESP-3DES-SHA
    crypto map Outside_Windstream_map 65535 ipsec-isakmp dynamic Outside_Windstream_dyn_map
    crypto map Outside_Windstream_map interface Outside_Windstream
    crypto isakmp enable Outside_Windstream
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 3600
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    telnet 10.0.0.0 255.255.0.0 inside
    telnet timeout 5
    ssh 10.0.0.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ftp
      inspect skinny
      inspect pptp
    service-policy global_policy global
    webvpn
    enable Outside_Windstream
    svc image disk0:/sslclient-win-1.1.4.177.pkg 1
    svc enable
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
      svc required
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy umeemp internal
    group-policy umeemp attributes
    dns-server value 172.20.40.245
    vpn-filter none
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value KappaVPN_splitTunnelAcl
    default-domain value umapinc.com
    group-policy KappaVPN internal
    group-policy KappaVPN attributes
    wins-server value 10.0.0.15
    dns-server value 10.0.0.15
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value umeemp_splitTunnelAcl
    default-domain value kappa.loc
    username gwadmin password AVjtEPq7nvtiAAk0 encrypted
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool vpn-pool
    authentication-server-group BBPA-SRV-DC01
    authorization-required
    tunnel-group KappaVPN type ipsec-ra
    tunnel-group KappaVPN general-attributes
    address-pool vpn-pool
    authentication-server-group BBPA-SRV-DC01
    default-group-policy KappaVPN
    tunnel-group KappaVPN ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.131.62 type ipsec-l2l
    tunnel-group x.x.131.62 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.232.2 type ipsec-l2l
    tunnel-group x.x.232.2 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.49.114 type ipsec-l2l
    tunnel-group x.x.49.114 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.226.218 type ipsec-l2l
    tunnel-group x.x.226.218 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.116.133 type ipsec-l2l
    tunnel-group x.x.116.133 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.21.36 type ipsec-l2l
    tunnel-group x.x.21.36 ipsec-attributes
    pre-shared-key *
    tunnel-group umeemp type ipsec-ra
    tunnel-group umeemp general-attributes
    address-pool vpn-pool
    authentication-server-group UMAP
    default-group-policy umeemp
    tunnel-group umeemp ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.81.81 type ipsec-l2l
    tunnel-group x.x.81.81 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.84.41 type ipsec-l2l
    tunnel-group x.x.84.41 ipsec-attributes
    pre-shared-key *
    prompt hostname context
    Cryptochecksum:xxxxxxxxxxxxxxxxxxxxx
    : end
    asdm image disk0:/asdm-523.bin
    no asdm history enable

    I'm sorry, I misunderstood what you were asking.  Yes those three networks are on the inside of our ASA.  we have 2 outside of the ASA (10.0.2.x, 10.0.10.x).  When our clients vpn they connect to the x.x.205.210 ip address, which maps them depending on the preshared key that puts them on either the kappaVPN or the umeempVPN.  (I am kind of new to configuring the ASA).  When the cisco vpn client connects to the network, I checked the statistics and it lists all of our LAN networks under secure routes.  I cannot ping anything inside the LAN nor can I connect RDP, telnet or anything.
    Hope this answers your questions, just let me know if you need any more information.
    -Rudy

  • A report about reachable devices in LMS report tools

                       Hi all,
    is possible to display a report about reachable devices in DCR database? The report about unreachable devices is only in the reports menu in LMS 4.2.4 (Reports > Inventory > Management Status >Unreachable Devices).
    I tried to use the report designer, but there is no possibility to create a rule for this report.:-( Similarly I tried to create group devices, but I didn't find some criteria for this type of group. Thanks.
    Roman

    Hi Roman,
    As per my knowledge , there is no such report available in LMS, however I would suggest you to create a POLLER for DEVICE AVAILBLITY  to achive your goal.
    Go to  Monitor > Performance Settings > Setup > Pollers     >> click Create Poller.
    check the below link for more information:
    http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_lan_management_solution/4.2/user/guide/lms_monitor/mnt-perf.html#wp1542387
    Thanks-
    Afroz
    [Do rate the useful post]

  • 5520 to 5525 all access rules being ignored.

    I copied my config from my old 5520 to our new 5525 and when I cut over to it from the inside out I could get to the internet no problem but from the outside in none of our access rules were working.  Could someone take a look at our config and maybe inlighten me on the problem please.  Thanks,
    http://www.ebay.com/itm/290951611556?ssPageName=STRK:MEWNX:IT&_trksid=p3984.m1497.l2649
    : Saved
    : Written by admin at 02:33:30.875 EDT Mon Sep 30 2013
    ASA Version 8.6(1)2
    hostname ColASA01-HA
    domain-name corp.COMPANY.com
    names
    name 172.22.5.133 ColBarracuda description Colo Barracuda Internal
    name 74.XXX.XXX.133 ColBarracuda- description Colo Barracuda External
    name 74.XXX.XXX.132 ColVPN- description Colo VPN External
    name 172.22.5.138 ww2 description ww2 Internal
    name 74.XXX.XXX.138 ww2- description ww2 External
    name 172.22.5.139 www1 description www1 Internal
    name 74.XXX.XXX.139 www1- description www1 External
    name 172.22.5.140 www1-COMPANY.co.uk description www1 COMPANY.co.uk Internal
    name 172.22.5.143 ColSysAid description ColSysAid Internal
    name 74.XXX.XXX.143 ColSysAid- description ColSysAid External
    name 172.22.5.141 Colww3 description Colww3 Internal
    name 74.XXX.XXX.141 Colww3- description Colww3 External
    name 10.1.1.100 Facts description Facts Internal
    name 74.XXX.XXX.135 Facts- description Facts External
    name 74.XXX.XXX.144 ftp.boundree.co.uk- description ftp.COMPANY.co.uk External
    name 172.22.5.144 ftp.COMPANY.co.uk description ftp.COMPANY.co.uk Internal
    name 10.101.0.24 Dubmss01 description Voicemail Server - Internal
    name 74.XXX.XXX.145 Dubmss01- description Voicemail Sever - External
    name 172.22.5.146 ColBI01 description ColBI01 Internal
    name 74.XXX.XXX.146 ColBI01- description ColBI01 External
    name 172.22.5.147 ColMOSS01 description ColMOSS01 Internal
    name 74.XXX.XXX.147 ColMOSS01- description ColMOSS01 External
    name 172.22.5.149 ambutrak description AmbuTRAK Internal
    name 74.XXX.XXX.149 ambutrak- description AmbuTRAK External
    name 172.22.5.136 NSTrax description NSTrax Internal
    name 74.XXX.XXX.136 NSTrax- description NSTrax External
    name 172.22.5.150 btmu description BTMU Internal
    name 74.XXX.XXX.150 btmu- description BTMU External
    name 172.22.5.155 w2k-isoft description w2k-isoft Internal
    name 74.XXX.XXX.155 w2k-isoft- description w2k-isoft External
    name 172.22.5.142 Colexch01 description Colexch01 Internal
    name 172.22.5.151 Coltixdb description Coltxdb Internal
    name 74.XXX.XXX.151 Coltixdb- description Coltixdb External
    name 172.22.5.156 colexcas description colexcas Internal
    name 74.XXX.XXX.156 colexcas- description colexcas External
    name 172.22.3.74 colexcas01 description colexcas01 Internal
    name 172.22.3.75 colexcas02 description colexcas02 Internal
    name 172.22.5.157 ColFTP01 description ColFTP01 Internal
    name 74.XXX.XXX.157 ColFTP01- description ColFTP01 External
    name 172.22.5.158 www.COMPANY.com description www.COMPANY.com Internal
    name 74.XXX.XXX.158 www.COMPANY.com- description www.COMPANY.com External
    name 172.22.5.159 act.COMPANY.com description COMPANY ACT Internal - colww4
    name 74.XXX.XXX.159 act.COMPANY.com- description COMPANY ACT External
    name 172.22.3.93 test.COMPANY.com description test.COMPANY.com Internal
    name 172.22.5.161 ColdevAS2 description ColdevAS2 Internal
    name 74.XXX.XXX.160 Rewards.COMPANY.com- description COMPANY Rewards External
    name 74.XXX.XXX.153 as2.COMPANY.com- description as2.COMPANY.com External
    name 74.XXX.XXX.161 as2test.COMPANY.com- description as2test.COMPANY.com External
    name 172.22.5.153 colas2 description colas2 Internal
    name 172.22.5.160 colww5 description colww5 Internal
    name 172.22.3.91 colexcas01NLB description colexcas01 NLB Interface
    name 172.22.3.92 colexcas02NLB description colexcas02 NLB Interface
    name 172.22.3.100 ColVPN description Colo VPN Internal
    name 172.22.5.134 intra.COMPANY.com description on NewPortal
    name 74.XXX.XXX.134 intra.COMPANY.com- description It's on NewPortal
    name 10.1.0.80 asgard description asgard Internal
    name 74.XXX.XXX.163 www.COMPANY.net- description www.COMPANY.net External
    name 172.22.5.165 crmws.COMPANY.com description ColCrmRouter01 Internal
    name 74.XXX.XXX.165 crmws.COMPANY.com- description ColCrmRouter01 External
    name 10.1.5.137 dubngwt description Test Next Gen Web Farm Internal
    name 74.XXX.XXX.137 dubngwt- description Test Next Gen Web Farm External
    name 10.1.0.87 dubexcas description Dublin CAS NLB
    name 10.1.0.85 dubexcas01 description Dublin CAS Server
    name 10.1.0.86 dubexcas02 description Dublin CAS Server
    name 74.XXX.XXX.166 collync01- description Lync Edge Server External
    name 74.XXX.XXX.167 coltmg01- description TMG Server External
    name 172.23.2.166 collync01 description Lync Edge Server DMZ
    name 172.23.2.167 coltmg01 description TMG Server DMZ
    name 172.22.5.168 COMPANYfed.com description COMPANYfed.com Internal
    name 74.XXX.XXX.168 COMPANYfed.com- description COMPANYfed.com External
    name 172.22.3.60 www1.COMPANY.com description www1.COMPANY.com Internal
    name 74.XXX.XXX.169 www1.COMPANY.com- description www1.COMPANY.com External
    name 172.22.3.63 www1.COMPANYfed.com description www1.COMPANYfed.com Internal
    name 74.XXX.XXX.171 www1.COMPANYfed.com- description www1.COMPANYfed.com External
    name 172.22.3.61 www2.COMPANY.com description www2.COMPANY.com Internal
    name 74.XXX.XXX.170 www2.COMPANY.com- description www2.COMPANY.com External
    name 172.22.3.64 www2.COMPANYfed.com description www2.COMPANYfed.com Internal
    name 74.XXX.XXX.172 www2.COMPANYfed.com- description www2.COMPANYfed.com External
    name 172.22.5.154 COMPANY.com description COMPANY.com Web Farm Production
    name 74.XXX.XXX.154 COMPANY.com- description COMPANY.com Web Farm Outside
    name 184.XXX.XXX.226 PMISonicWALL description PMI SonicWALL
    name 10.10.0.0 PMI_SonicWALL-Subnet description PMI LAN
    name 10.1.0.0 DublinData description Dublin Data Network
    name 10.2.0.0 SouthavenData description Southaven Data Network
    name 10.0.0.0 BrentwoodData description Brentwood Data Network
    name 10.8.0.0 GilbertData description Gilbert Data Network
    name 10.101.0.0 DublinVoIP description Dublin VoIP Network
    name 10.110.0.0 PMI_SonicWALL-VOICSubnet
    name 172.24.3.50 ColUT04-PCITrust
    name 172.22.3.31 coldc01
    name 172.22.3.4 coldc02
    name 172.22.3.23 ColWSUS02 description Windows Update Server
    name 74.XXX.XXX.175 monitor.COMPANY.com- description PRTG Network Monitor
    name 172.22.3.150 ColPRTG01 description PRTG Monitor
    dns-guard
    interface GigabitEthernet0/0
    description Connected to Internet via COLRTR01
    speed 100
    duplex full
    shutdown
    nameif outside
    security-level 0
    ip address 74.XXX.XXX.130 255.255.255.192 standby 74.XXX.XXX.176
    ospf cost 10
    interface GigabitEthernet0/1
    description Connected to Colo LAN
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 172.22.1.8 255.255.0.0 standby 172.22.1.50
    ospf cost 10
    authentication key eigrp 10 Fiyalt1 key-id 1
    authentication mode eigrp 10 md5
    interface GigabitEthernet0/2
    nameif DMZ
    security-level 10
    ip address 172.23.2.1 255.255.255.0 standby 172.23.2.50
    ospf cost 10
    interface GigabitEthernet0/3
    description Connected to COLSW01 port 9 - PCI Trust Area (no internet)
    nameif Colo_PCI_Trust
    security-level 100
    ip address 172.24.3.1 255.255.255.0 standby ColUT04-PCITrust
    ospf cost 10
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/6
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/7
    description LAN/STATE Failover Interface
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.200.20 255.255.0.0 standby 10.1.200.21
    ospf cost 10
    management-only
    boot system disk0:/asa861-2-smp-k8.bin
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns server-group DefaultDNS
    domain-name corp.COMPANY.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj-172.22.255.0
    subnet 172.22.255.0 255.255.255.0
    object network PMI_SonicWALL-Subnet
    subnet 10.10.0.0 255.255.0.0
    object network obj-172.24.3.0
    subnet 172.24.3.0 255.255.255.0
    object network ColWSUS02
    host 172.22.3.23
    object network ambutrak
    host 172.22.5.149
    object network ambutrak-
    host 74.XXX.XXX.149
    object network btmu
    host 172.22.5.150
    object network btmu-
    host 74.XXX.XXX.150
    object network ColBarracuda
    host 172.22.5.133
    object network ColBarracuda-
    host 74.XXX.XXX.133
    object network ColBI01
    host 172.22.5.146
    object network ColBI01-
    host 74.XXX.XXX.146
    object network colexcas
    host 172.22.5.156
    object network colexcas-
    host 74.XXX.XXX.156
    object network ColMOSS01
    host 172.22.5.147
    object network ColMOSS01-
    host 74.XXX.XXX.147
    object network COMPANY.com
    host 172.22.5.154
    object network COMPANY.com-
    host 74.XXX.XXX.154
    object network Coltixdb
    host 172.22.5.151
    object network Coltixdb-
    host 74.XXX.XXX.151
    object network Colww3
    host 172.22.5.141
    object network Colww3-
    host 74.XXX.XXX.141
    object network ColSysAid
    host 172.22.5.143
    object network ColSysAid-
    host 74.XXX.XXX.143
    object network ColVPN
    host 172.22.3.100
    object network ColVPN-
    host 74.XXX.XXX.132
    object network colas2
    host 172.22.5.153
    object network as2.COMPANY.com-
    host 74.XXX.XXX.153
    object network Dubmss01
    host 10.101.0.24
    object network Dubmss01-
    host 74.XXX.XXX.145
    object network Facts
    host 10.1.1.100
    object network Facts-
    host 74.XXX.XXX.135
    object network ftp.COMPANY.co.uk
    host 172.22.5.144
    object network ftp.boundree.co.uk-
    host 74.XXX.XXX.144
    object network NSTrax
    host 172.22.5.136
    object network NSTrax-
    host 74.XXX.XXX.136
    object network w2k-isoft
    host 172.22.5.155
    object network w2k-isoft-
    host 74.XXX.XXX.155
    object network www1
    host 172.22.5.139
    object network www1-
    host 74.XXX.XXX.139
    object network ww2
    host 172.22.5.138
    object network ww2-
    host 74.XXX.XXX.138
    object network ColFTP01
    host 172.22.5.157
    object network ColFTP01-
    host 74.XXX.XXX.157
    object network www.COMPANY.com
    host 172.22.5.158
    object network www.COMPANY.com-
    host 74.XXX.XXX.158
    object network act.COMPANY.com
    host 172.22.5.159
    object network act.COMPANY.com-
    host 74.XXX.XXX.159
    object network colww5
    host 172.22.5.160
    object network Rewards.COMPANY.com-
    host 74.XXX.XXX.160
    object network ColdevAS2
    host 172.22.5.161
    object network as2test.COMPANY.com-
    host 74.XXX.XXX.161
    object network intra.COMPANY.com
    host 172.22.5.134
    object network intra.COMPANY.com-
    host 74.XXX.XXX.134
    object network asgard
    host 10.1.0.80
    object network www.COMPANY.net-
    host 74.XXX.XXX.163
    object network crmws.COMPANY.com
    host 172.22.5.165
    object network crmws.COMPANY.com-
    host 74.XXX.XXX.165
    object network dubngwt
    host 10.1.5.137
    object network dubngwt-
    host 74.XXX.XXX.137
    object network COMPANYfed.com
    host 172.22.5.168
    object network COMPANYfed.com-
    host 74.XXX.XXX.168
    object network www1.COMPANYfed.com
    host 172.22.3.63
    object network www1.COMPANYfed.com-
    host 74.XXX.XXX.171
    object network www2.COMPANYfed.com
    host 172.22.3.64
    object network www2.COMPANYfed.com-
    host 74.XXX.XXX.172
    object network www1.COMPANY.com
    host 172.22.3.60
    object network www1.COMPANY.com-
    host 74.XXX.XXX.169
    object network www2.COMPANY.com
    host 172.22.3.61
    object network www2.COMPANY.com-
    host 74.XXX.XXX.170
    object network ColPRTG01
    host 172.22.3.150
    object network monitor.COMPANY.com-
    host 74.XXX.XXX.175
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network collync01
    host 172.23.2.166
    object network collync01-
    host 74.XXX.XXX.166
    object network coltmg01
    host 172.23.2.167
    object network coltmg01-
    host 74.XXX.XXX.167
    object-group service DM_INLINE_SERVICE_1
    service-object gre
    service-object tcp destination eq pptp
    object-group service Barracuda tcp
    port-object eq 8000
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq www
    port-object eq https
    port-object eq smtp
    port-object eq ssh
    group-object Barracuda
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq www
    port-object eq https
    port-object eq smtp
    object-group service DM_INLINE_TCP_3 tcp
    port-object eq www
    port-object eq https
    port-object eq smtp
    object-group service DM_INLINE_TCP_5 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_7 tcp
    port-object eq www
    port-object eq https
    object-group service mySQL tcp
    description mySQL Database
    port-object eq 3306
    object-group service DM_INLINE_TCP_9 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_10 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_11 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_12 tcp
    port-object eq www
    port-object eq https
    object-group service as2 tcp
    description as2
    port-object eq 4080
    port-object eq 5080
    port-object eq https
    port-object eq 6080
    object-group network DM_INLINE_NETWORK_2
    network-object host ColBarracuda
    network-object host ww2
    network-object host www1
    network-object host colexcas01
    network-object host colexcas02
    network-object host colexcas
    network-object host test.COMPANY.com
    network-object host colexcas01NLB
    network-object host colexcas02NLB
    network-object host dubexcas01
    network-object host dubexcas02
    network-object host dubexcas
    object-group service SQLServer tcp
    description Microsoft SQL Server
    port-object eq 1433
    object-group service DM_INLINE_TCP_13 tcp
    port-object eq www
    port-object eq https
    port-object eq smtp
    object-group service DM_INLINE_TCP_14 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_15 tcp
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_1
    network-object host as2.COMPANY.com-
    network-object host as2test.COMPANY.com-
    object-group service DM_INLINE_TCP_6 tcp
    port-object eq www
    port-object eq https
    object-group service rdp tcp
    description Remote Desktop Protocol
    port-object eq 3389
    object-group service DM_INLINE_TCP_8 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_16 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_17 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_4 tcp
    port-object eq www
    port-object eq https
    object-group service LyncEdge tcp-udp
    description sip-tls, 443, 444, rtp 50000-59999, stun udp 3478
    port-object eq 3478
    port-object eq 443
    port-object eq 444
    port-object range 50000 59999
    port-object eq 5061
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_TCP_18 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_19 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_20 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_21 tcp
    port-object eq www
    port-object eq https
    object-group service DM_INLINE_TCP_22 tcp
    port-object eq www
    port-object eq https
    object-group network PMIVPNNetworks
    description VPN Networks to PMI
    network-object BrentwoodData 255.255.0.0
    network-object DublinData 255.255.0.0
    network-object SouthavenData 255.255.0.0
    network-object GilbertData 255.255.0.0
    network-object 172.22.0.0 255.255.0.0
    network-object DublinVoIP 255.255.0.0
    object-group network PMI_SonicWALL-Subnets
    network-object PMI_SonicWALL-Subnet 255.255.0.0
    network-object PMI_SonicWALL-VOICSubnet 255.255.0.0
    object-group network COLDCs
    network-object host coldc01
    network-object host coldc02
    access-list inside_access_in remark Allow SMTP from certain servers.
    access-list inside_access_in extended permit tcp object-group DM_INLINE_NETWORK_2 any eq smtp
    access-list inside_access_in remark No SMTP except from allowed servers
    access-list inside_access_in extended deny tcp any any eq smtp log errors
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in remark For debugging (can enable logging)
    access-list inside_access_in extended deny ip any any
    access-list outside_access_in remark Allow Ping
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in remark Allow VPN
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object ColVPN-
    access-list outside_access_in remark Allow SMTP, HTTP, and HTTPS to the Exchange CAS NLB Cluster
    access-list outside_access_in extended permit tcp any object colexcas- object-group DM_INLINE_TCP_13
    access-list outside_access_in remark Allow SMTP, SSH, and Web
    access-list outside_access_in extended permit tcp any object ColBarracuda- object-group DM_INLINE_TCP_1
    access-list outside_access_in remark Allow HTTP and HTTPS to AmbuTRAK
    access-list outside_access_in extended permit tcp any object ambutrak- object-group DM_INLINE_TCP_10
    access-list outside_access_in remark Allow SMTP, HTTP and HTTPS to ww2
    access-list outside_access_in extended permit tcp any object ww2- object-group DM_INLINE_TCP_2
    access-list outside_access_in remark Allow SMTP, HTTP and HTTPS to www1
    access-list outside_access_in extended permit tcp any object www1- object-group DM_INLINE_TCP_3
    access-list outside_access_in remark Allow portal.bouindtree.com to COLMOSS01
    access-list outside_access_in extended permit tcp any object ColMOSS01- object-group DM_INLINE_TCP_9
    access-list outside_access_in remark Allow HTTP and HTTPS to ems.COMPANY.com
    access-list outside_access_in extended permit tcp any object Colww3- object-group DM_INLINE_TCP_5
    access-list outside_access_in remark Allow HTTP and HTTPS to helpdesk.COMPANY.com
    access-list outside_access_in extended permit tcp any object ColSysAid- object-group DM_INLINE_TCP_7
    access-list outside_access_in remark Allow SSH to Facts
    access-list outside_access_in extended permit tcp any object Facts- eq ssh inactive
    access-list outside_access_in remark Allow mySQL to NSTrax for IQ
    access-list outside_access_in extended permit tcp any object NSTrax- object-group mySQL inactive
    access-list outside_access_in remark Allow FTP to ftp.COMPANY.co.uk
    access-list outside_access_in extended permit tcp any object ftp.boundree.co.uk- eq ftp inactive
    access-list outside_access_in remark Allow IMAP to the Voice Mail Server
    access-list outside_access_in extended permit tcp any object Dubmss01- eq imap4
    access-list outside_access_in remark Permit HTTPS to ColBI01 for https://reports.COMPANY.com
    access-list outside_access_in extended permit tcp any object ColBI01- eq https inactive
    access-list outside_access_in remark Allow FTP to btmu.COMPANY.com
    access-list outside_access_in extended permit tcp any object btmu- eq ftp
    access-list outside_access_in remark Allow HTTP and HTTPS to colngwt - the Test Next Gen Web Farm
    access-list outside_access_in extended permit tcp any object dubngwt- object-group DM_INLINE_TCP_17 inactive
    access-list outside_access_in remark Allow HTTP and HTTPS to COMPANYfed.com
    access-list outside_access_in extended permit tcp any object COMPANYfed.com- object-group DM_INLINE_TCP_18
    access-list outside_access_in remark Allow HTTP and HTTPS to colngwp - the Next Gen Web Farm
    access-list outside_access_in extended permit tcp any object COMPANY.com- object-group DM_INLINE_TCP_11
    access-list outside_access_in remark Allow HTTP and HTTPS to Colww5, which is one of our web servers.
    access-list outside_access_in remark rewards.COMPANY.com is going live first on this web server.
    access-list outside_access_in extended permit tcp any object Rewards.COMPANY.com- object-group DM_INLINE_TCP_12
    access-list outside_access_in remark Allow HTTP and HTTPS to act.COMPANY.com
    access-list outside_access_in extended permit tcp any object act.COMPANY.com- object-group DM_INLINE_TCP_15
    access-list outside_access_in remark Allow AS2 (443, 4080, 5080, 6080) to the AS2 Production and Test Machines
    access-list outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_1 object-group as2
    access-list outside_access_in remark Allow HTTP and HTTPS to www.COMPANY.com
    access-list outside_access_in extended permit tcp any object www.COMPANY.com- object-group DM_INLINE_TCP_14
    access-list outside_access_in remark Allow AS2 to w2k-isoft
    access-list outside_access_in extended permit tcp any object w2k-isoft- object-group as2
    access-list outside_access_in remark All SQL Server (SSL) to Coltixdb
    access-list outside_access_in extended permit tcp any object Coltixdb- object-group SQLServer
    access-list outside_access_in remark Allow FTP to ColFTP01
    access-list outside_access_in extended permit tcp any object ColFTP01- eq ftp
    access-list outside_access_in remark allow http/https access in intra.COMPANY.com
    access-list outside_access_in extended permit tcp any object intra.COMPANY.com- object-group DM_INLINE_TCP_6
    access-list outside_access_in remark Allow http and https to asgard
    access-list outside_access_in extended permit tcp any object www.COMPANY.net- object-group DM_INLINE_TCP_8
    access-list outside_access_in remark Allow HTTP and HTTPS to ColCrmRouter01 (crmws.COMPANY.com)
    access-list outside_access_in extended permit tcp any object crmws.COMPANY.com- object-group DM_INLINE_TCP_16
    access-list outside_access_in remark Allow HTTP and HTTPS to coltmg01
    access-list outside_access_in extended permit tcp any object coltmg01- object-group DM_INLINE_TCP_4
    access-list outside_access_in remark Allow Lync Edgel traffic to collync01
    access-list outside_access_in extended permit object-group TCPUDP any object collync01- object-group LyncEdge
    access-list outside_access_in remark Allow HTTP and HTTPS to www1.COMPANY.com
    access-list outside_access_in extended permit tcp any object www1.COMPANY.com- object-group DM_INLINE_TCP_19
    access-list outside_access_in remark Allow HTTP and HTTPS to www2.COMPANY.com
    access-list outside_access_in extended permit tcp any object www2.COMPANY.com- object-group DM_INLINE_TCP_20
    access-list outside_access_in remark Allow HTTP and HTTPS to www1.COMPANYfed.com
    access-list outside_access_in extended permit tcp any object www1.COMPANYfed.com- object-group DM_INLINE_TCP_21
    access-list outside_access_in remark Allow HTTP and HTTPS to www2.COMPANYfed.com
    access-list outside_access_in extended permit tcp any object www2.COMPANYfed.com- object-group DM_INLINE_TCP_22
    access-list outside_access_in extended permit tcp any object monitor.COMPANY.com- eq www
    access-list outside_access_in remark For debugging (can enable logging)
    access-list outside_access_in extended deny ip any any
    access-list inside_nat0_outbound extended permit ip any 172.22.255.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip object-group PMIVPNNetworks object PMI_SonicWALL-Subnet
    access-list inside_nat0_outbound remark Domain Controller one to many rule so PCI Trust servers can reslove DNS names and authenticate.
    access-list inside_nat0_outbound extended permit ip object-group COLDCs 172.24.3.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip object ColWSUS02 172.24.3.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip object-group PMIVPNNetworks object-group PMI_SonicWALL-Subnets
    access-list Colo_PCI_Trust_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm warnings
    logging mail critical
    logging from-address [email protected]
    mtu outside 1500
    mtu inside 1500
    mtu DMZ 1500
    mtu Colo_PCI_Trust 1500
    mtu management 1500
    ip local pool vpnphone-ip-pool 172.22.255.1-172.22.255.254 mask 255.255.255.0
    failover
    failover lan unit primary
    failover lan interface HA GigabitEthernet0/7
    failover key Fiyalt!
    failover link HA GigabitEthernet0/7
    failover interface ip HA 172.16.200.1 255.255.255.248 standby 172.16.200.2
    no monitor-interface DMZ
    no monitor-interface Colo_PCI_Trust
    no monitor-interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit 172.24.3.0 255.255.255.0 Colo_PCI_Trust
    asdm image disk0:/asdm-66114.bin
    asdm location ColVPN- 255.255.255.255 inside
    asdm location ColBarracuda- 255.255.255.255 inside
    asdm location ColBarracuda 255.255.255.255 inside
    asdm location ww2- 255.255.255.255 inside
    asdm location www1- 255.255.255.255 inside
    asdm location ww2 255.255.255.255 inside
    asdm location www1 255.255.255.255 inside
    asdm location Colww3- 255.255.255.255 inside
    asdm location Colww3 255.255.255.255 inside
    asdm location ColSysAid- 255.255.255.255 inside
    asdm location ColSysAid 255.255.255.255 inside
    asdm location Facts 255.255.255.255 inside
    asdm location Facts- 255.255.255.255 inside
    asdm location NSTrax- 255.255.255.255 inside
    asdm location ftp.boundree.co.uk- 255.255.255.255 inside
    asdm location ftp.COMPANY.co.uk 255.255.255.255 inside
    asdm location Dubmss01 255.255.255.255 inside
    asdm location Dubmss01- 255.255.255.255 inside
    asdm location ColBI01- 255.255.255.255 inside
    asdm location ColBI01 255.255.255.255 inside
    asdm location ColMOSS01 255.255.255.255 inside
    asdm location ColMOSS01- 255.255.255.255 inside
    asdm location ambutrak- 255.255.255.255 inside
    asdm location ambutrak 255.255.255.255 inside
    asdm location NSTrax 255.255.255.255 inside
    asdm location btmu- 255.255.255.255 inside
    asdm location btmu 255.255.255.255 inside
    asdm location COMPANY.com- 255.255.255.255 inside
    asdm location COMPANY.com 255.255.255.255 inside
    asdm location as2.COMPANY.com- 255.255.255.255 inside
    asdm location colas2 255.255.255.255 inside
    asdm location w2k-isoft- 255.255.255.255 inside
    asdm location w2k-isoft 255.255.255.255 inside
    asdm location Coltixdb- 255.255.255.255 inside
    asdm location Coltixdb 255.255.255.255 inside
    asdm location colexcas- 255.255.255.255 inside
    asdm location colexcas01 255.255.255.255 inside
    asdm location colexcas02 255.255.255.255 inside
    asdm location colexcas 255.255.255.255 inside
    asdm location ColFTP01- 255.255.255.255 inside
    asdm location ColFTP01 255.255.255.255 inside
    asdm location www.COMPANY.com- 255.255.255.255 inside
    asdm location www.COMPANY.com 255.255.255.255 inside
    asdm location act.COMPANY.com- 255.255.255.255 inside
    asdm location act.COMPANY.com 255.255.255.255 inside
    asdm location Rewards.COMPANY.com- 255.255.255.255 inside
    asdm location colww5 255.255.255.255 inside
    asdm location as2test.COMPANY.com- 255.255.255.255 inside
    asdm location ColdevAS2 255.255.255.255 inside
    asdm location test.COMPANY.com 255.255.255.255 inside
    asdm location colexcas01NLB 255.255.255.255 inside
    asdm location colexcas02NLB 255.255.255.255 inside
    asdm location ColVPN 255.255.255.255 inside
    asdm location intra.COMPANY.com- 255.255.255.255 inside
    asdm location intra.COMPANY.com 255.255.255.255 inside
    asdm location asgard 255.255.255.255 inside
    asdm location www.COMPANY.net- 255.255.255.255 inside
    asdm location crmws.COMPANY.com- 255.255.255.255 inside
    asdm location crmws.COMPANY.com 255.255.255.255 inside
    asdm location dubngwt- 255.255.255.255 inside
    asdm location dubngwt 255.255.255.255 inside
    asdm location dubexcas01 255.255.255.255 inside
    asdm location dubexcas02 255.255.255.255 inside
    asdm location dubexcas 255.255.255.255 inside
    asdm location collync01- 255.255.255.255 inside
    asdm location coltmg01- 255.255.255.255 inside
    asdm location collync01 255.255.255.255 inside
    asdm location coltmg01 255.255.255.255 inside
    asdm location COMPANYfed.com- 255.255.255.255 inside
    asdm location COMPANYfed.com 255.255.255.255 inside
    asdm location www1.COMPANY.com- 255.255.255.255 inside
    asdm location www2.COMPANY.com- 255.255.255.255 inside
    asdm location www1.COMPANYfed.com- 255.255.255.255 inside
    asdm location www2.COMPANYfed.com- 255.255.255.255 inside
    asdm location www1.COMPANY.com 255.255.255.255 inside
    asdm location www2.COMPANY.com 255.255.255.255 inside
    asdm location www1.COMPANYfed.com 255.255.255.255 inside
    asdm location www2.COMPANYfed.com 255.255.255.255 inside
    asdm location PMI_SonicWALL-Subnet 255.255.0.0 inside
    asdm location PMISonicWALL 255.255.255.255 inside
    asdm location BrentwoodData 255.255.0.0 inside
    asdm location GilbertData 255.255.0.0 inside
    asdm location coldc01 255.255.255.255 inside
    asdm location coldc02 255.255.255.255 inside
    asdm location ColWSUS02 255.255.255.255 inside
    asdm location monitor.COMPANY.com- 255.255.255.255 inside
    asdm location ColPRTG01 255.255.255.255 inside
    no asdm history enable
    arp timeout 14400
    nat (inside,any) source static any any destination static obj-172.22.255.0 obj-172.22.255.0 no-proxy-arp
    nat (inside,any) source static PMIVPNNetworks PMIVPNNetworks destination static PMI_SonicWALL-Subnet PMI_SonicWALL-Subnet no-proxy-arp
    nat (inside,any) source static COLDCs COLDCs destination static obj-172.24.3.0 obj-172.24.3.0 no-proxy-arp
    nat (inside,any) source static ColWSUS02 ColWSUS02 destination static obj-172.24.3.0 obj-172.24.3.0 no-proxy-arp
    object network ambutrak
    nat (inside,outside) static ambutrak-
    object network btmu
    nat (inside,outside) static btmu-
    object network ColBarracuda
    nat (inside,outside) static ColBarracuda-
    object network ColBI01
    nat (inside,outside) static ColBI01-
    object network colexcas
    nat (inside,outside) static colexcas-
    object network ColMOSS01
    nat (inside,outside) static ColMOSS01-
    object network COMPANY.com
    nat (inside,outside) static COMPANY.com-
    object network Coltixdb
    nat (inside,outside) static Coltixdb-
    object network Colww3
    nat (inside,outside) static Colww3-
    object network ColSysAid
    nat (inside,outside) static ColSysAid-
    object network ColVPN
    nat (inside,outside) static ColVPN-
    object network colas2
    nat (inside,outside) static as2.COMPANY.com-
    object network Dubmss01
    nat (inside,outside) static Dubmss01-
    object network Facts
    nat (inside,outside) static Facts-
    object network ftp.COMPANY.co.uk
    nat (inside,outside) static ftp.COMPANY.co.uk-
    object network NSTrax
    nat (inside,outside) static NSTrax-
    object network w2k-isoft
    nat (inside,outside) static w2k-isoft-
    object network www1
    nat (inside,outside) static www1-
    object network ww2
    nat (inside,outside) static ww2-
    object network ColFTP01
    nat (inside,outside) static ColFTP01-
    object network www.COMPANY.com
    nat (inside,outside) static www.COMPANY.com-
    object network act.COMPANY.com
    nat (inside,outside) static act.COMPANY.com-
    object network colww5
    nat (inside,outside) static Rewards.COMPANY.com-
    object network ColdevAS2
    nat (inside,outside) static as2test.COMPANY.com-
    object network intra.COMPANY.com
    nat (inside,outside) static intra.COMPANY.com-
    object network asgard
    nat (inside,outside) static www.COMPANY.net-
    object network crmws.COMPANY.com
    nat (inside,outside) static crmws.COMPANY.com-
    object network dubngwt
    nat (inside,outside) static dubngwt-
    object network COMPANYfed.com
    nat (inside,outside) static COMPANYfed.com-
    object network www1.COMPANYfed.com
    nat (inside,outside) static www1.COMPANYfed.com-
    object network www2.COMPANYfed.com
    nat (inside,outside) static www2.COMPANYfed.com-
    object network www1.COMPANY.com
    nat (inside,outside) static www1.COMPANY.com-
    object network www2.COMPANY.com
    nat (inside,outside) static www2.COMPANY.com-
    object network ColPRTG01
    nat (inside,outside) static monitor.COMPANY.com-
    object network obj_any
    nat (inside,outside) dynamic 74.XXX.XXX.131
    object network collync01
    nat (DMZ,outside) static collync01-
    object network coltmg01
    nat (DMZ,outside) static coltmg01-
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    access-group Colo_PCI_Trust_access_in in interface Colo_PCI_Trust
    router eigrp 10
    no auto-summary
    eigrp router-id 172.22.1.8
    network 172.22.0.0 255.255.0.0
    route outside 0.0.0.0 0.0.0.0 74.XXX.XXX.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server Colo protocol radius
    aaa-server Colo (inside) host coldc02
    timeout 5
    key Bound/\Tree
    radius-common-pw Bound/\Tree
    aaa-server Colo (inside) host coldc01
    timeout 5
    key Bound/\Tree
    user-identity default-domain LOCAL
    http server enable
    http 172.22.0.0 255.255.0.0 inside
    http DublinData 255.255.0.0 inside
    http DublinData 255.255.0.0 management
    snmp-server host inside 10.1.0.59 community public
    snmp-server host inside ColPRTG01 community public
    snmp-server location Columbus, OH - Colo
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer PMISonicWALL
    crypto map outside_map 1 set ikev1 transform-set ESP-3DES-SHA
    crypto map outside_map 1 set nat-t-disable
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    crypto ikev1 policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 28800
    telnet BrentwoodData 255.0.0.0 inside
    telnet coldc02 255.255.255.255 inside
    telnet DublinData 255.255.0.0 management
    telnet timeout 5
    ssh 172.22.0.0 255.255.0.0 inside
    ssh DublinData 255.255.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 74.14.179.211 source outside prefer
    ntp server 69.64.72.238 source outside prefer
    ntp server coldc02 source inside
    ntp server 74.120.8.2 source outside prefer
    ntp server 108.61.56.35 source outside prefer
    ntp server coldc01 source inside
    webvpn
    group-policy GroupPolicy_74.XXX.XXX.130 internal
    group-policy GroupPolicy_74.XXX.XXX.130 attributes
    vpn-tunnel-protocol ikev1
    group-policy VPNPHONE internal
    group-policy VPNPHONE attributes
    dns-server value 172.22.3.4 172.22.3.31
    vpn-tunnel-protocol ikev1
    default-domain value corp.COMPANY.com
    tunnel-group VPNPHONE type remote-access
    tunnel-group VPNPHONE general-attributes
    address-pool vpnphone-ip-pool
    authentication-server-group Colo
    default-group-policy VPNPHONE
    tunnel-group VPNPHONE ipsec-attributes
    ikev1 pre-shared-key *
    tunnel-group 184.XXX.XXX.226 type ipsec-l2l
    tunnel-group 184.XXX.XXX.226 ipsec-attributes
    ikev1 pre-shared-key *
    peer-id-validate nocheck
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect tftp
      inspect http
      inspect icmp
      inspect pptp
      inspect icmp error
      inspect ip-options
    class class-default
    service-policy global_policy global
    smtp-server 172.22.5.156
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 18
      subscribe-to-alert-group configuration periodic monthly 18
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:65e78911eefb94bd98892700b143f716
    : end

    Hi,
    Any ASA using software 8.3 or above that does Static NAT between private and public IP addresses (or any NAT at all) and you want to allow traffic from public network to those Static NATed servers you will need to use the local/real IP address in the ACL statements.
    If your ASA5520 was running 8.3 or above software levels then there should be no major changes compared to an ASA5525-X running 8.6 software level.
    The only situation I can think of right now is if you had used ASA5520 with software 8.2 or below BUT in that case you WOULD NOT have been able to directly copy/paste the configuration to the ASA5525-X device as the lowest software level that the ASA5525-X supports is 8.6(1)
    So I am kind of wondering what the situation has actually been.
    But one thing is certain. You need to use the real/local IP address of the server in the ACL rules even if you are allowing traffic from the public/external network.
    The "packet-tracer" test used to simulate a connection coming to one of your Static NAT public IP address should also tell if your ACLs are configured correctly, among other things.
    - Jouni

  • Notification from oem 11g.2

    hi all ,
    i install db 11g.2 on enterprise linux version 6 during the setup i active the email notification
    please see what oem send me ???what i do ???
    Target Name=IT-RBT:3938
    Target Type=Agent
    Host=IT-RBT
    Metric=Status
    Timestamp=Jan 10, 2012 11:00:36 AM AST
    Severity=Unreachable Start
    Message=Agent has stopped monitoring. The following errors are reported : COLL_DISABLED.
    Notification Rule Name=Agents Unreachable
    Notification Rule Owner=SYSMAN
    Notification Count=1
    what is wrong of this ???
    MANY THANKS

    Check the agent log files
    You can also read the following thread. It is for 10gR2
    Re: The following errors are reported : COLL_DISABLED.
    and also this :
    enterprise manager: agent unreachable
    Edited by: jazz81 on 10-Jan-2012 10:21

  • Oracle Management Console 10g - Job Status - Suspended on Agent Unreachable

    Recently we updated our RDMS from 10.2.0.1 to 10.2.0.4.0 PATCH 25.
    Ever since we upgraded, we have had trouble with our RMAN backups. Now when a scheduled backup begins it never ends. Now whenever we schedule a job, from a backup to any simple system command, the status immediately returns "Suspended on Agent Unreachable".
    We can start and stop the dbconsole successfully, and I can use the OEM to monitor the database, and make changes to that. However, I cannot run any scheduled database jobs through the OEM. However, I can run the rman jobs via the command line.
    The database server, and the OEM console is on the save server. I am not running RAC. Everything database related is on this one server.
    Here are the results for emctl status agent:
    E:\oracle\product\10.2.0\db_1\BIN>emctl status agent
    Oracle Enterprise Manager 10g Database Control Release 10.2.0.4.0
    Copyright (c) 1996, 2007 Oracle Corporation.  All rights reserved.
    Agent Version     : 10.1.0.6.0
    OMS Version       : 10.1.0.6.0
    Protocol Version  : 10.1.0.2.0
    Agent Home        : E:\oracle\product\10.2.0\db_1\content.mydomain.com_ORCL
    Agent binaries    : E:\oracle\product\10.2.0\db_1
    Agent Process ID  : 34372
    Agent URL         : http://content.mydomain.com:3938/emd/main
    Started at        : 2010-01-11 14:58:24
    Started by user   : SYSTEM
    Last Reload       : 2010-01-11 14:58:24
    Last successful upload                       : (none)
    Last attempted upload                        : (none)
    Total Megabytes of XML files uploaded so far :     0.00
    Number of XML files pending upload           :     5016
    Size of XML files pending upload(MB)         :    42.77
    Available disk space on upload filesystem    :    37.94%
    Agent is Running and ReadyHere are the results for emctl status agent:
    E:\oracle\product\10.2.0\db_1\BIN>emctl upload
    Oracle Enterprise Manager 10g Database Control Release 10.2.0.4.0
    Copyright (c) 1996, 2007 Oracle Corporation.  All rights reserved.
    EMD upload error: uploadXMLFiles skipped :: OMS version not checked yet..I think the EMD upload error may be the problem, but I'm unsure how to resolve this.
    What do I need to do in order to resolve this issue?
    If any more info would be useful, please let me know and I will post it immediately.
    thanks.

    Rondeyli,
    Thanks, that was it. I followed your instructions, and was able to get the system to work. I had to alter the commands a bit to get them to work on my system, so here is what I did.
    I performed the following steps:
    1. Ran the following command:
            emctl stop dbconsole
    2. deleted all files in $AGENT_HOME/sysman/emd/upload and $AGENT_HOME/sysman/emd/state
    3. Ran the following command:
           emctl clearstate dbconsole
    4. Ran the following command:
           emctl secure dbconsole
    5. Ran the following command:
           emctl start dbconsoleThis got everything running for me.
    thanks.

  • Oracle VM sever on the Manager -server pool shows status as unreachable

    Hi,
    I have 2.2 Oracle vm server which was working fine , has 4 VMN's on it and was registered to the manager 2.2
    If I go on serverpool or server tab in the manager - it shows inactive and unreachable,even though the sever actually is alive and VM's are running onit.
    Its just the communciation or connection between server and manager is broken somewhere.I really need help
    The Disk and memory status became - 'Not Available" on the manager.
    This was when i initiated - Create new Virtualk machine.
    Usually after next refresh ot comes back ,but in this case - its still on unknown state.
    All the vm's though are up and runnning fine - the status on the manager shows as - powered off.
    If I try to manually - powere on - I get an error in the manager logs -
    Start - /OVS/running_pool/1239_2k8
    PowerOn Failed : Result - failed:<OVSException: no server of type 'xen' ready to run the vm.>
    StackTrace:
    File "/opt/ovs-agent-2.2/OVSSiteVM.py", line 79, in start_vm
    raise e
    Please help
    I have rebooted the server but no luck.
    Thanks....
    Edited by: khushi on Jun 15, 2010 3:33 PM
    Edited by: khushi on Jun 18, 2010 1:42 PM

    I have experienced the same issue. Here is a way to workaround to solve it:
    1. login to OVM manager host as oracle user
    2. Set the propler environment to login to the OVM reporistory database. for exampl in Unix/Linux
    export ORACLE_HOME='/usr/lib/oracle/xe/app/oracle/product/10.2.0/server'
    export PATH=$ORACLE_HOME/bin:$PATH
    export ORACLE_SID=XE
    3. Login to the repository database as ovs user:
    sqlplus ovs/<passsword>
    and run the following SQLs:
    update ovs_server set status = 'Active' where SERVER_NAME = '<OVS serverhostname.domain.com>';
    commitl;
    4. Go to OVM manager and cllick the refresh button on the servers page. The status of the OVS server will be changed to 'Active'
    and you can power on the VM.
    Thanks
    Kai Yu

  • Redundancy management IP and Redundancy port IP unreachable issue

    Hi, all
    I got one interesting issue with wireless 5508 controller. we have ordered two WLCs, one is air5508-12-k9, Anther one is air5508-HA-k9.
    Now, we are going to form HA mode and HA box will become standby mode. One issue we are seeing now. after configuring redundancy management IP and Redundancy port IP to both WLCs. primary WLC are working well that we can ping it's all of IPs successfully, however standby WLC are not working well. even it can't ping itself. management IP has no problem.
    Problem is only for redundancy management IP and redundancy Port IP. One interesting thing is our switch can't learn redundancy port's MAC address even it's connecting and interface shows UP. Primary has no this issue.
    Has anyone have the same issue before or appreciate any suggestions and inputs.
    WLC 1
    (Cisco Controller) >show redundancy sum
                Redundancy Mode = SSO ENABLED
                    Local State = ACTIVE
                     Peer State = UNKNOWN - Communication Down
                           Unit = Primary
                        Unit ID = 7C:0E:CE:64:43:80
               Redundancy State = Non Redundant
                   Mobility MAC = 7C:0E:CE:64:43:80
    Redundancy Management IP Address................. 25.16.228.252
    Peer Redundancy Management IP Address............ 25.16.228.253
    Redundancy Port IP Address....................... 169.254.228.252
    Peer Redundancy Port IP Address.................. 169.254.228.253
    WLC 2 HA
    (Cisco Controller) >show redundancy sum
    Redundancy Mode = SSO DISABLED
         Local State = ACTIVE
          Peer State = N/A
                Unit = Primary
             Unit ID = 7C:0E:CE:4A:23:40
    Redundancy State = N/A
        Mobility MAC = 7C:0E:CE:4A:23:40
    Redundancy Management IP Address................. 25.16.228.253
    Peer Redundancy Management IP Address............ 25.16.228.252
    Redundancy Port IP Address....................... 169.254.228.253
    Peer Redundancy Port IP Address.................. 169.254.228.252
    Thank you so much indeed.

    thank you very much that makes sense, so I will need to change service port address ( maybe a class A or C ) or disconnect that port from the network ...
    thank you again very much your help is really appreciated

  • Enterprise manager Oracle Agent Unreachable

    Hello,
    I have done a fresh install of Oracle 11Gr2 and everything was working fine. I imported a database.
    When i connect trought the EM the Oracle Agent status is: unreachable.
    But everything is working fine, i can connect to the database, i can use the EM, make changes, updates, everything.
    I can't figure out what could be wrong, i already tryed to change the agent password, but the error remains.

    Did you check the agent through GC Setup page (top right corner on any GC page, then click Agents)? Does it say anything there?
    You can always try:
    1. Stop the agent
    2. Do a clearstate (emctl clearstate agent)
    3. Clean the upload and state directories from agent home ($AGENT_HOME/sysman/emd/upload/ and $AGENT_HOME/sysman/emd/state/), remove these files too:
    $AGENT_HOME/sysman/emd/lastupld.xml
    $AGENT_HOME/sysman/emd/agntstmp.txt
    $AGENT_HOME/sysman/emd/blackouts.xml
    $AGENT_HOME/sysman/emd/protocol.ini
    4. Secure the agent and start it again.

Maybe you are looking for

  • Macbook Pro mid 2010 hard drive beep, click, freeze BACK after Lion?

    I have a mid-2010 Macbook Pro and I had the same problem that was described here: https://discussions.apple.com/message/9817201?messageID=9817201#9817201 https://discussions.apple.com/message/15055210#15055210 Like many others, mine stopped beeping a

  • IWeb text not working correctly

    Whenever I try to put a sentences with a space it has a weird symble appear on my web for example Fax:    310-542-** the    is the 3 spaces I put there or tabs. It happens to every sentence. Thanks for helping me out.

  • PDF file opening with blank fields - the field values are not populated.

    Recently, our users have been facing this issue, "data not populating in the PDF fields". We are using FDF in PHP to load the PDF templates and apply the data to the PDF fields. This works fine on many adobe versions but showing empty fields in few a

  • Parsing XML attributes

    Hi. I have the following example of XML structure : create table xxx (xmlval xmltype); insert into xxx values (xmltype('<?xml version="1.0" encoding="utf-8"?> <Records> <Card P1="10" P2="20" /> </Records>')); I have written the following code : decla

  • No process defined for form appraisal template

    when in IMG path "define tabs and process configuration for template",  on the "process configuration tab", I enter data and click Save. I now get the warning message "No process defined for form ..." as a consequence I cannot perform my configuratio