Monitoring VPN Clients

Hi guys,
I have a need to monitor VPN clients where I have TMG 2010 as my VPN server.
I just want to know from where clients are initiated their vpns.I mean their vlaid IPs not which TMG gives them.
Is there any third party software to do this?
Thanks

Hi,
When configuring the VPN connection on the TMG server, which kind of IP address assignment method you had selected?
If you select the static address pool, then the remote VPN clients would obtain IP addresses from this range.
If you have a DHCP server and select DHCP option, then
TMG firewall will request 10 IP addresses from the DHCP scope each time to assign its VPN interface an IP address and to assign IP addresses to the VPN clients.
More information:
Configuring VPN address assignment
Best regards,
Susie

Similar Messages

  • Asa 5505 vpn from internet native vpn client, tcp discarted 1723

    Hello to all,
    I'm configuring this asa for to connect home users to my network using the native microsoft vpn clients with windows xp over internet.
    This asa have on the outside interface one public intenet ip and in the inside inferface have configured in the the network 192.168.0.x and i want to acces to this network from internet users using native vpn clients.
    I tested with one pc connected directly to the outside interface and works well, but when i connect this interface to internet and tried to connect on user to the vpn i can see in the logs this, and can't connect with error 800.
    TCP request discarded from "public_ip_client/61648" to outside:publicip_outside_interface/1723"
    Can help me please?, Very thanks in advance !
    (running configuration)
    : Saved
    ASA Version 8.4(3)
    hostname ciscoasa
    enable password *** encrypted
    passwd *** encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address publicinternetaddress 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network gatewayono
    host gatewayofinternetprovideraccess
    description salida gateway ono
    object service remotointerno
    service tcp destination eq 3389
    description remoto
    object network pb_clienteing_2
    host 192.168.0.15
    description Pebble cliente ingesta 2
    object service remotoexternopebble
    service tcp destination eq 5353
    description remotoexterno
    object network actusmon
    host 192.168.0.174
    description Actus monitor web
    object service Web
    service tcp destination eq www
    description 80
    object network irdeto
    host 192.168.0.31
    description Irdeto
    object network nmx_mc_p
    host 192.168.0.60
    description NMX Multicanal Principal
    object network nmx_mc_r
    host 192.168.0.61
    description NMX multicanal reserva
    object network tarsys
    host 192.168.0.10
    description Tarsys
    object network nmx_teuve
    host 192.168.0.30
    description nmx cabecera teuve
    object network tektronix
    host 192.168.0.20
    description tektronix vnc
    object service vnc
    service tcp destination eq 5900
    description Acceso vnc
    object service exvncnmxmcr
    service tcp destination eq 5757
    description Acceso vnc externo nmx mc ppal
    object service exvncirdeto
    service tcp destination eq 6531
    description Acceso vnc externo irdeto
    object service exvncnmxmcp
    service tcp destination eq 5656
    object service exvnctektronix
    service tcp destination eq 6565
    object service exvncnmxteuve
    service tcp destination eq 6530
    object service ssh
    service tcp destination eq ssh
    object service sshtedialexterno
    service tcp destination eq 5454
    object-group service puertosabiertos tcp
    description remotedesktop
    port-object eq 3389
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object object irdeto
    network-object object nmx_mc_p
    network-object object nmx_mc_r
    network-object object nmx_teuve
    network-object object tektronix
    object-group service vpn udp
    port-object eq 1723
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq https
    port-object eq pptp
    object-group network DM_INLINE_NETWORK_2
    network-object object actusmon
    network-object object tarsys
    access-list inside_access_in extended permit object remotointerno any any
    access-list inside_access_in extended permit object ssh any any
    access-list inside_access_in extended permit object-group TCPUDP any any eq www
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended permit object vnc any any
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit object remotointerno any object pb_clienteing_2
    access-list outside_access_in extended permit object-group TCPUDP any object actusmon eq www
    access-list outside_access_in remark Acceso tedial ssh
    access-list outside_access_in extended permit tcp any object tarsys eq ssh
    access-list outside_access_in extended permit object vnc any object-group DM_INLINE_NETWORK_1
    access-list outside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
    access-list outside_access_in extended deny icmp any any
    access-list corporativa standard permit 192.168.0.0 255.255.255.0
    access-list Split-Tunnel-ACL standard permit 192.168.0.0 255.255.255.0
    pager lines 24
    logging enable
    logging monitor debugging
    logging asdm debugging
    logging debug-trace
    mtu inside 1500
    mtu outside 1500
    ip local pool clientesvpn 192.168.0.100-192.168.0.110 mask 255.255.255.0
    ip local pool clientesvpn2 192.168.1.120-192.168.1.130 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (outside,inside) source static any interface destination static interface actusmon service Web Web unidirectional
    nat (outside,inside) source static any interface destination static interface tarsys service sshtedialexterno ssh unidirectional
    nat (outside,inside) source static any interface destination static interface pb_clienteing_2 service remotoexternopebble remotointerno unidirectional
    nat (outside,inside) source static any interface destination static interface irdeto service exvncirdeto vnc unidirectional
    nat (outside,inside) source static any interface destination static interface nmx_mc_p service exvncnmxmcp vnc unidirectional
    nat (outside,inside) source static any interface destination static interface nmx_mc_r service exvncnmxmcr vnc unidirectional
    nat (outside,inside) source static any interface destination static interface nmx_teuve service exvncnmxteuve vnc unidirectional
    nat (outside,inside) source static any interface destination static interface tektronix service exvnctektronix vnc unidirectional
    nat (any,outside) source dynamic DM_INLINE_NETWORK_2 interface
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside per-user-override
    route outside 0.0.0.0 0.0.0.0 gatewayinternetprovideracces 1
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    eou allow none
    aaa local authentication attempts max-fail 10
    http server enable
    http 192.168.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set clientewindowsxp esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set clientewindowsxp mode transport
    crypto ipsec ikev1 transform-set L2TP-IKE1-Transform-Set esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set L2TP-IKE1-Transform-Set mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 1 set ikev1 transform-set clientewindowsxp
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto dynamic-map L2TP-MAP 10 set ikev1 transform-set L2TP-IKE1-Transform-Set
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map L2TP-VPN-MAP 20 ipsec-isakmp dynamic L2TP-MAP
    crypto map L2TP-VPN-MAP interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint Ingenieria
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.0.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd dns 8.8.8.8
    dhcpd auto_config outside
    dhcpd address 192.168.0.5-192.168.0.36 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    no threat-detection basic-threat
    no threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point Ingenieria outside
    webvpn
    tunnel-group-list enable
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    wins-server none
    dns-server value 192.168.0.1
    vpn-tunnel-protocol l2tp-ipsec
    default-domain none
    group-policy DfltGrpPolicy attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    group-policy ingenieria internal
    group-policy ingenieria attributes
    vpn-tunnel-protocol l2tp-ipsec
    default-domain none
    group-policy L2TP-Policy internal
    group-policy L2TP-Policy attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Split-Tunnel-ACL
    intercept-dhcp enable
    username ingenieria password 4fD/5xY/6BwlkjGqMZbnKw== nt-encrypted privilege 0
    username ingenieria attributes
    vpn-group-policy ingenieria
    username rjuve password SjBNOLNgSkUi5KWk/TUsTQ== nt-encrypted
    tunnel-group DefaultRAGroup general-attributes
    address-pool clientesvpn
    address-pool clientesvpn2
    authentication-server-group (outside) LOCAL
    authorization-server-group LOCAL
    default-group-policy L2TP-Policy
    authorization-required
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group DefaultRAGroup ppp-attributes
    no authentication chap
    authentication ms-chap-v2
    class-map inspection_default
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:59b54f1d10fe829aeb47bafee57ba95e
    : end
    no asdm history enable

    Yes with this command creates this
    policy-map global_policy
        class inspection_default
         inspect pptp
    But don't work. I also tried to add the pptp and gre in the outside access rules but nothing...
    I don't understand why if a connect directly to the outside interface with the same outside network works well.
    ej: the pc have 89.120.145.14 ip and the outside asa have 89.120.145.140 and if I create one vpn in this pc the outside ip 89.120.145.140 with the correct parameters the asa don't discart 1723 and connect ok but if this ip is not of this range discards 1723...

  • VPN client cannot access inside hosts

    Hello,
        I have an ASA 5505 device with the attached configuration and my vpn clients can connect to it fine.  Although, once a vpn client is connected they cannot RDP, ping, or telnet any internal hosts.  The goal is to have a connected vpn client to have all access rights as anyone sitting on the internal network.  Any assistance is greatly appreciated.
    : Saved
    ASA Version 7.2(3)
    hostname Kappa-GW01
    domain-name Kappa.com
    enable password xxxxxxxxx encrypted
    names
    name 172.20.42.42 UMEFTP2 description UMAP FTP2
    name 172.20.40.246 UMEMAIL1 description Exchange Server
    name 172.20.41.3 UMERPS
    name x.x.81.81 Wilkes
    name x.x.84.41 KappaPittston
    dns-guard
    interface Ethernet0/0
    shutdown
    nameif outside
    security-level 0
    ip address x.x.148.194 255.255.255.248
    interface Ethernet0/1
    nameif Outside_Windstream
    security-level 0
    ip address x.x.205.210 255.255.255.240
    interface Ethernet0/2
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    passwd 7Tpgc2AiWGxbNjkj encrypted
    boot system disk0:/asa723-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name Kappa.com
    object-group network Blue_Bell_Internal_Networks
    description Blue Bell internal network Group
    network-object 192.168.100.0 255.255.255.0
    network-object 10.0.0.0 255.255.255.0
    network-object 10.0.1.0 255.255.255.0
    network-object 10.0.2.0 255.255.255.0
    object-group network VPN-Sites
    network-object host Wilkes
    network-object host KappaPittston
    object-group network Michigan_VPN_GRP
    network-object 172.20.40.0 255.255.252.0
    object-group network ASA_OutSide_Vendors
    description ASA OutSide Vendor Access
    access-list 101 extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 10.0.1.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl remark Blue Bell Office
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl remark Williamston Office
    access-list KappaVPN_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
    access-list KappaVPN_splitTunnelAcl remark Pittston Office
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.10.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.30.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 172.20.40.0 255.255.252.0 inactive
    access-list inside_nat0_outbound extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.30.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.30.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
    access-list outside_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
    access-list umeemp_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.30.0 255.255.255.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
    access-list outside_5_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list inside_access_in extended permit ip any any
    access-list 102 extended permit tcp any any eq 2000
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq smtp
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq pop3 inactive
    access-list Outside_Winstream_access_in extended permit udp object-group VPN-Sites interface Outside_Windstream eq isakmp
    access-list Outside_Winstream_access_in extended permit tcp object-group ASA_OutSide_Vendors host x.x.205.217 eq 4080
    access-list Outside_Winstream_access_in remark SMTP Access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq smtp
    access-list Outside_Winstream_access_in remark POP access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq pop3
    access-list Outside_Winstream_access_in remark OWA Access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq https
    access-list Outside_Winstream_access_in extended permit tcp host x.x.87.65 host x.x.205.218 eq 3389
    access-list Outside_Winstream_access_in extended permit udp host x.x.56.111 eq ntp host x.x.205.216 eq ntp
    access-list Outside_Winstream_access_in remark OWA UMAP
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq https
    access-list Outside_Winstream_access_in remark JLAN
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.215 eq https
    access-list Outside_Winstream_access_in remark UMERPS
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq https
    access-list Outside_Winstream_access_in remark UMERPS
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq ssh
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq https
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq 5494
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.214 eq www
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq 8081
    access-list Outside_Winstream_access_in extended permit icmp any any echo
    access-list outside_6_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list outside_6_cryptomap extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_11 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_10 extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_5 extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_12 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
    access-list nonat extended permit ip any any inactive
    pager lines 24
    logging enable
    logging asdm debugging
    logging flash-bufferwrap
    mtu outside 1500
    mtu Outside_Windstream 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn-pool 192.168.100.100-192.168.100.200
    no failover
    monitor-interface outside
    monitor-interface Outside_Windstream
    monitor-interface inside
    monitor-interface management
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (Outside_Windstream) 1 x.x.205.216 netmask 255.0.0.0
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 172.20.40.0 255.255.252.0
    nat (inside) 1 10.0.0.0 255.255.0.0
    static (inside,Outside_Windstream) x.x.205.217 10.0.0.20 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.220 10.0.0.21 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.218 10.0.0.15 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.215 172.20.40.145 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.211 UMEMAIL1 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.212 UMERPS netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.213 172.20.40.243 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.214 172.20.40.146 netmask 255.255.255.255
    access-group acl_inbound in interface outside
    access-group Outside_Winstream_access_in in interface Outside_Windstream
    route Outside_Windstream 0.0.0.0 0.0.0.0 x.x.205.209 1
    route inside 172.20.40.0 255.255.252.0 10.0.0.3 1
    route inside 10.0.30.0 255.255.255.0 10.0.0.254 1
    route inside 10.0.1.0 255.255.255.0 10.0.0.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server BBPA-SRV-DC01 protocol radius
    aaa-server BBPA-SRV-DC01 host 10.0.0.15
    timeout 5
    key G6G7#02bj!
    aaa-server UMAP protocol radius
    aaa-server UMAP host 172.20.40.245
    timeout 5
    key gfrt1a
    aaa-server UMAP host 172.20.40.244
    timeout 5
    key gfrt1a
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 10.0.0.0 255.255.255.0 inside
    http 10.0.0.15 255.255.255.255 inside
    http 192.168.1.0 255.255.255.0 management
    http 192.168.100.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto dynamic-map Outside_Windstream_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map Outside_Windstream_dyn_map 40 set pfs
    crypto dynamic-map Outside_Windstream_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto map outside_map 5 match address outside_5_cryptomap
    crypto map outside_map 5 set peer Wilkes
    crypto map outside_map 5 set transform-set ESP-3DES-SHA
    crypto map outside_map 10 match address outside_6_cryptomap
    crypto map outside_map 10 set peer KappaPittston
    crypto map outside_map 10 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto map Outside_Windstream_map 5 match address Outside_Windstream_cryptomap_5
    crypto map Outside_Windstream_map 5 set peer Wilkes
    crypto map Outside_Windstream_map 5 set transform-set ESP-3DES-SHA
    crypto map Outside_Windstream_map 10 match address Outside_Windstream_cryptomap_10
    crypto map Outside_Windstream_map 10 set peer KappaPittston
    crypto map Outside_Windstream_map 10 set transform-set ESP-3DES-SHA
    crypto map Outside_Windstream_map 65535 ipsec-isakmp dynamic Outside_Windstream_dyn_map
    crypto map Outside_Windstream_map interface Outside_Windstream
    crypto isakmp enable Outside_Windstream
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 3600
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    telnet 10.0.0.0 255.255.0.0 inside
    telnet timeout 5
    ssh 10.0.0.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ftp
      inspect skinny
      inspect pptp
    service-policy global_policy global
    webvpn
    enable Outside_Windstream
    svc image disk0:/sslclient-win-1.1.4.177.pkg 1
    svc enable
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
      svc required
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy umeemp internal
    group-policy umeemp attributes
    dns-server value 172.20.40.245
    vpn-filter none
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value KappaVPN_splitTunnelAcl
    default-domain value umapinc.com
    group-policy KappaVPN internal
    group-policy KappaVPN attributes
    wins-server value 10.0.0.15
    dns-server value 10.0.0.15
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value umeemp_splitTunnelAcl
    default-domain value kappa.loc
    username gwadmin password AVjtEPq7nvtiAAk0 encrypted
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool vpn-pool
    authentication-server-group BBPA-SRV-DC01
    authorization-required
    tunnel-group KappaVPN type ipsec-ra
    tunnel-group KappaVPN general-attributes
    address-pool vpn-pool
    authentication-server-group BBPA-SRV-DC01
    default-group-policy KappaVPN
    tunnel-group KappaVPN ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.131.62 type ipsec-l2l
    tunnel-group x.x.131.62 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.232.2 type ipsec-l2l
    tunnel-group x.x.232.2 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.49.114 type ipsec-l2l
    tunnel-group x.x.49.114 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.226.218 type ipsec-l2l
    tunnel-group x.x.226.218 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.116.133 type ipsec-l2l
    tunnel-group x.x.116.133 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.21.36 type ipsec-l2l
    tunnel-group x.x.21.36 ipsec-attributes
    pre-shared-key *
    tunnel-group umeemp type ipsec-ra
    tunnel-group umeemp general-attributes
    address-pool vpn-pool
    authentication-server-group UMAP
    default-group-policy umeemp
    tunnel-group umeemp ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.81.81 type ipsec-l2l
    tunnel-group x.x.81.81 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.84.41 type ipsec-l2l
    tunnel-group x.x.84.41 ipsec-attributes
    pre-shared-key *
    prompt hostname context
    Cryptochecksum:xxxxxxxxxxxxxxxxxxxxx
    : end
    asdm image disk0:/asdm-523.bin
    no asdm history enable

    I'm sorry, I misunderstood what you were asking.  Yes those three networks are on the inside of our ASA.  we have 2 outside of the ASA (10.0.2.x, 10.0.10.x).  When our clients vpn they connect to the x.x.205.210 ip address, which maps them depending on the preshared key that puts them on either the kappaVPN or the umeempVPN.  (I am kind of new to configuring the ASA).  When the cisco vpn client connects to the network, I checked the statistics and it lists all of our LAN networks under secure routes.  I cannot ping anything inside the LAN nor can I connect RDP, telnet or anything.
    Hope this answers your questions, just let me know if you need any more information.
    -Rudy

  • Cisco VPN Client installation freezes on Windows 7

    Hello,
    I am in need of some help installing the Cisco VPN Client on a Windows 7 workstation.
    Here are some details:
    Cisco VPN Client Version: 5.0.07.0410
    Operation System: Microsoft Windows 7 Enterprise, 32-bit, version 6.1, build 7600
    PC Hardware: IBM Thinkpad T42, Type 2373-7WE
    Issue Description:
    I attempted to install the Cisco VPN Client on the computer with the local administrator account in Windows 7. The computer was given a clean installation of Microsoft Windows 7 Enterprise (Existing HDD partitions were deleted and formatted). After the OS installation, I installed the network driver via Windows Update, and proceeded to run the installation for the Cisco VPN Client. The installation apears to proceed smoothly until the installation progress indicator reaches the point where it states that it is installing the "Deterministic Network Enhancer." Shortly reaching this point, the Windows CPU Usage monitor reaches 100% and the operating system freezes.
    I have tried the following actions, which failed to successfully install the software:
    a) Installing Cisco VPN Client 5.0.00.0340 produced the same problem.
    b) Reformatted the hard drive, installed Windows 7, and tried to install the Cisco VPN Client again, but failed.
    c) Used Windows 7 System Restore to restore OS state prior to the installation of the Cisco VPN Client. Then, ran Citrix's winfix.exe tool. After that, I ran Citrix's dneupdate.msi program for 32-bit Windows operating systems, but that also crashed the OS mid-way through the installation/update.
    d) This URL from Citrix (http://www.citrix.com/lang/English/lp/lp_1680845.asp) suggested changing a Windows registry key, then try re-installing the Cisco VPN Client. However, that did not work.
    I am at a loss as to how to resolve this issue. If anyone can provide some suggestions or a solution to this issue, I would greatly appreciate it.
    Regards,
    Samson

    Welcome to the forums !
    The only version of 10gR2 that is certified/supported on Win 7 Pro or higher is 10.2.0.5. Pl see this related thread for further information
    Re: Oracle 10g 64 bit install on Windows 7 platform
    http://download.oracle.com/docs/cd/B19306_01/relnotes.102/b14264/toc.htm#CHDFHIEA
    10.2.0.5 is only available on My Oracle Support, access to which requires a valid support contract purchased from Oracle
    HTH
    Srini

  • Asa 8.2 access files share on outside network from VPN Client.

    please help me
    I have cisco asa 5505 with 8.2
    outside is 111.22.200.51
    inside is 192.168.1.0/24 dhcp
    vpnpool is 192.168.10.1-192.168.10.30
    configured split tunnel to vpn client to access web
    I was able to connect from outside via vpn.
    Goal is access fileserver(on window) on 111.22.200.21 from vpn clients.
    internal client can access the share folder
    vpn client cannot access ther share on 111.22.200.21
    ============================
    names
    name 192.168.1.1 ciscogw
    name 111.21.200.1 umgw
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
     switchport access vlan 5
    interface Ethernet0/4
    interface Ethernet0/5
     switchport access vlan 5
    interface Ethernet0/6
     switchport access vlan 5
    interface Ethernet0/7
     switchport access vlan 5
    interface Vlan1
     nameif inside
     security-level 100
     ip address ciscogw 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 111.22.200.51 255.255.255.0
    interface Vlan5
     no nameif
     security-level 50
     ip address dhcp setroute
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns server-group DefaultDNS
     domain-name vpn.nmecsc.org
    access-list RAteam_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 192.168.10.1-192.168.10.30 mask 255.255.255.224
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 111.22.200.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
      quit
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.5-192.168.1.50 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd wins 111.22.210.65 111.22.210.61 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
     enable outside
    group-policy DfltGrpPolicy attributes
     banner value WARNING: Unauthorized access to this system is forbidden and will be prosecuted by law. By accessing this system, you agree that your actions may be monitored if unauthorized usage is suspected.
    group-policy RA_SSLVPN internal
    group-policy RA_SSLVPN attributes
     vpn-tunnel-protocol webvpn
     webvpn
      url-list value team
    group-policy RAteam internal
    group-policy RAteam attributes
     wins-server value 111.22.210.65
     dns-server value  8.8.8.8 8.8.4.4
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value RAteam_splitTunnelAcl
     default-domain value vpn.nmecsc.org
    username teamssl2 password 5ZBa0qXxwLBPpvoR encrypted privilege 0
    username teamssl2 attributes
     vpn-group-policy RA_SSLVPN
    username team2 password 5ZBa0qXxwLBPpvoR encrypted privilege 0
    username team2 attributes
     vpn-group-policy RAteam
    username teamssl1 password 5ZBa0qXxwLBPpvoR encrypted privilege 0
    username teamssl1 attributes
     vpn-group-policy RA_SSLVPN
    username team1 password 5ZBa0qXxwLBPpvoR encrypted privilege 0
    username team1 attributes
     vpn-group-policy RAteam
    tunnel-group team type remote-access
    tunnel-group team general-attributes
     default-group-policy RA_SSLVPN
    tunnel-group team webvpn-attributes
     group-alias team enable
     group-url https://111.22.200.51/team enable
    tunnel-group RAteam type remote-access
    tunnel-group RAteam general-attributes
     address-pool vpnpool
     default-group-policy RAteam
    tunnel-group RAteam ipsec-attributes
     pre-shared-key *
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:680b9059ca6ca6610857bab04d855031

    I just upgrade asa to 9.3
    add access-list but still no luck. I attached the diagram.
    name 192.168.1.1 ciscogw
    ip local pool vpnpool 192.168.10.1-192.168.10.50 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address ciscogw 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 111.22.200.51 255.255.255.0
    boot system disk0:/asa923-k8.bin
    ftp mode passive
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network NETWORK_OBJ_192.168.1.0_24
     subnet 192.168.1.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_26
     subnet 192.168.10.0 255.255.255.192
    access-list ipsec_group_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list ipsec_group_splitTunnelAcl standard permit host 111.22.200.21
    access-list ipsec_group_splitTunnelAcl standard permit 111.22.200.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-731-101.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.10.0_26 NETWORK_OBJ_192.168.10.0_26 no-proxy-arp route-lookup
    object network obj_any
     nat (inside,outside) dynamic interface
    route outside 0.0.0.0 0.0.0.0 111.22.200.1 1
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
     enable outside
     tunnel-group-list enable
    group-policy ssl_vpn internal
    group-policy ssl_vpn attributes
     vpn-tunnel-protocol ssl-clientless
     webvpn
      url-list value carino
    group-policy DfltGrpPolicy attributes
    group-policy ipsec_group internal
    group-policy ipsec_group attributes
     dns-server value 8.8.8.8 8.8.4.4
     vpn-tunnel-protocol ikev1
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value ipsec_group_splitTunnelAcl

  • Problems w/ VPN Server & Cisco VPN Client on same machine

    I really wish that I read about how the developer of the program iVPN no longer supports his work BEFORE I paid for it. It's a great, simple, GUI frontend to the existing Leopard VPN server built in to regular (non-server) OSX...
    Anyway, on my Mac that stays @ home:
    (1) - I have the iVPN server set up & running to allow me to connect (from my iphone or another computer on the road) to my Mac @ home using L2TP.
    (2) - When I'm @ home and need to connect to my company's network, I need to use the Cisco VPN Client (which uses IPSec etc).
    So, I found out that when I need to use my Mac to connect to work, I first have to open up the iVPN server to click "Stop Server" (which has me enter my password twice sometimes). Now I close iVPN until I'm done, then open up Activity Monitor for the purpose of finding the still-running process "racoon". I realized this not because it's published info, but because if I don't do this, and try to connect to work using the Cisco VPN Client, it simply will not connect. So, I quit the process "racoon" (which also has me enter my password because it's running as root yada yada). NOW, I can load Cisco VPN Client and successfully connect to my company's network. When I'm finished here, I disconnect the C.V.C., then reopen iVPN Server and restart my server (enter password again).
    Is there any way I can make the process "racoon" quit automatically when I turn off the iVPN server? I'd email the developer but I guess that's a lost cause now. It's a shame because he did a fabulous job making iVPN & gave the less computer-networking-literate-user the ability to create their own VPN server without using Terminal.
    I thought about the possibility of using iVPN to create a PPTP connection instead of L2TP - thinking that would allow me to keep my iVPN PPTP server running at all times, even when I wanted to use the CVC to connect OUT to work - but:
    (1) - I would like the increased security of L2TP.
    (2) - When I tried running a PPTP server, and connecting to it from iPhone or other computer, I was NOT able to access the other devices on my network, or the internet. I couldn't even open up a webpage to check whatismyip.com (while sending all traffic over VPN). And yes, the IP Address Range that I have iVPN handing out is within my normal home network's range.
    My end goal for all of this when using my Mac is to be able to leave my iVPN server running at all times, while still being able to run the Cisco VPN CLIENT to connect to my company's network.
    Or, at least not having to open up Activity Monitor to quit the process racoon... let alone having to enter my password 3 times after opening up iVPN, again to stop the server, again to quit the process racoon. Then a forth when I'm all done and need to start the iVPN server again.
    Am I going about this the wrong way? Is there an easier way to accomplish these secure connections? There is a slight possibility of me upgrading and running a dedicated Mac Mini server of some sort perhaps with the real OSX Server. But not right now. I think I'm over complicating this. I mean, my needs are pretty simple:
    (1) - Need to connect TO my Mac from IPhone / someone else's Mac or PC for: VNC over SSH, SSH/SFTP file level access, in the future shared network volumes (time capsule). I'd use Back To My Mac for all of this but I don't always connect FROM a Mac.
    (2) - Need to connect FROM my Mac to work VPN for: VNC to my work PC to access our company's Windows-only program (dual booting into boot camp or using a virtual machine is out of the question), using Mocha for AS400 access, thinking about using file sharing on work PC but not needed so far.
    So it's really just VNC and sometimes SFTP. The "S" being important to me. That's why I don't like the idea of doing away with my iVPN server and just forwarding the outside ports. I use the Vine VNC Server which when checked, only allows access over SSH. The only other remote-logins are used from my iphone using an app called BriefCase (SSH to browse files on remote machine), or using an SFTP client on a computer.
    Thank you for reading all of this, and in advance for any insight you can offer.

    If the two servers need the same ports, then hosting two different VPN packages on the same box usually won't work.
    A firewall-based VPN service can be an option; that external box can deal with NAT and routing and other such and can field incoming or LAN-to-LAN VPNs, and your internal Mac boxes located "behind" that box can be free to initiate outbound VPNs.

  • Cannot connect using VPN client

    Hi, I have a problem configuring my CISCO ASA 5515-x for VPN client. I succesfully configure AnyConnect and SSL VPN but when client using VPN Client software, they cannot establish the VPN connection. This is my configuration and attached is the error occured when connecting to the firewall. Can anyone help me solve this problem?
    : Saved
    ASA Version 9.1(1)
    hostname ciscoasa
    domain-name g
    ip local pool vpn_client 192.168.2.200-192.168.2.254 mask 255.255.255.0
    ip local pool vpn_250 192.168.3.1-192.168.3.254 mask 255.255.255.0
    interface GigabitEthernet0/0
    nameif DIGI
    security-level 0
    ip address 210.48.*.* 255.255.255.0
    interface GigabitEthernet0/1
    nameif LAN
    security-level 0
    ip address 192.168.2.5 255.255.255.0
    interface GigabitEthernet0/2
    nameif Pone
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    management-only
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    ftp mode passive
    clock timezone MYT 8
    dns domain-lookup DIGI
    dns server-group DefaultDNS
    name-server 8.8.8.8
    domain-name g
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network NETWORK_OBJ_113.20.*.*_24
    subnet 113.20.*.* 255.255.255.0
    object network NETWORK_OBJ_210.48.*.*_24
    subnet 210.48.*.* 255.255.255.0
    object network CsHiew
    host 192.168.2.9
    object network ERPServer
    host 192.168.2.2
    object network Giap
    host 192.168.2.126
    object network Jennifer
    host 192.168.2.31
    object network KCTan
    host 192.168.2.130
    object network KCTan-NB
    host 192.168.2.77
    object network MailServer
    host 192.168.2.6
    object network YHKhoo
    host 192.168.2.172
    object network Aslina
    host 192.168.2.59
    object network Law
    host 192.168.2.38
    object network Nurul
    host 192.168.2.127
    object network Laylee
    host 192.168.2.17
    object network Ms_Pan
    host 192.168.2.188
    object network Peck_Ling
    host 192.168.2.248
    object network Pok_Leng
    host 192.168.2.36
    object network UBS
    host 192.168.2.21
    object network Ainie
    host 192.168.2.11
    object network Angie
    host 192.168.2.116
    object network Carol
    host 192.168.2.106
    object network ChunKit
    host 192.168.2.72
    object network KKPoong
    host 192.168.2.121
    object network Ben
    host 192.168.2.147
    object network Eva
    host 192.168.2.37
    object network Jacklyn
    host 192.168.2.135
    object network Siew_Peng
    host 192.168.2.149
    object network Suki
    host 192.168.2.61
    object network Yeow
    host 192.168.2.50
    object network Danny
    host 192.168.2.40
    object network Frankie
    host 192.168.2.101
    object network Jamal
    host 192.168.2.114
    object network OcLim
    host 192.168.2.177
    object network Charles
    host 192.168.2.210
    object network Ho
    host 192.168.2.81
    object network YLChow
    host 192.168.2.68
    object network Low
    host 192.168.2.58
    object network Sfgan
    host 192.168.2.15
    object network Joey
    host 192.168.2.75
    object network Rizal
    host 192.168.2.79
    object network 190
    host 192.168.2.190
    object network 191
    host 192.168.2.191
    object network 192
    host 192.168.2.192
    object network 193
    host 192.168.2.193
    object network 194
    host 192.168.2.194
    object network 199
    host 192.168.2.199
    object network 201
    host 192.168.2.201
    object network 203
    host 192.168.2.203
    object network 204
    host 192.168.2.204
    object network 205
    host 192.168.2.205
    object network CNC214
    host 192.168.2.214
    object network Liyana
    host 192.168.2.16
    object network Aipin
    host 192.168.2.22
    object network Annie
    host 192.168.2.140
    object network Ikah
    host 192.168.2.54
    object network Sue
    host 192.168.2.113
    object network Zaidah
    host 192.168.2.32
    object network CKWong
    host 192.168.2.33
    object network KhooSC
    host 192.168.2.47
    object network Neexon-PC
    host 192.168.2.179
    object network Neexon_NB
    host 192.168.2.102
    object network kc
    host 192.168.2.130
    object network P1
    subnet 192.168.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.0_24
    subnet 192.168.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.192_26
    subnet 192.168.2.192 255.255.255.192
    object network NETWORK_OBJ_192.168.10.192_26
    subnet 192.168.10.192 255.255.255.192
    object network VPN
    subnet 192.68.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.3.0_24
    subnet 192.168.3.0 255.255.255.0
    object-group network HPTM_DIGI
    network-object object CsHiew
    network-object object ERPServer
    network-object object Giap
    network-object object Jennifer
    network-object object KCTan
    network-object object KCTan-NB
    network-object object MailServer
    network-object object YHKhoo
    object-group network Inventory
    network-object object Aslina
    network-object object Law
    network-object object Nurul
    object-group network Account
    network-object object Laylee
    network-object object Ms_Pan
    network-object object Peck_Ling
    network-object object Pok_Leng
    network-object object UBS
    object-group network HR
    network-object object Ainie
    network-object object Angie
    object-group network Heeroz
    network-object object Carol
    network-object object ChunKit
    network-object object KKPoong
    object-group network Sales
    network-object object Ben
    network-object object Eva
    network-object object Jacklyn
    network-object object Siew_Peng
    network-object object Suki
    network-object object Yeow
    object-group network Production
    network-object object Danny
    network-object object Frankie
    network-object object Jamal
    network-object object OcLim
    object-group network Engineering
    network-object object Charles
    network-object object Ho
    network-object object YLChow
    network-object object Joey
    network-object object Rizal
    object-group network Purchasing
    network-object object Low
    network-object object Sfgan
    object-group network Wireless
    network-object object 190
    network-object object 191
    network-object object 192
    network-object object 193
    network-object object 194
    network-object object 199
    network-object object 201
    network-object object 203
    network-object object 204
    network-object object 205
    object-group network IT
    network-object object CNC214
    network-object object Liyana
    object-group network Skype
    network-object object Aipin
    network-object object Annie
    network-object object Ikah
    network-object object Sue
    network-object object Zaidah
    object-group network HPTM-P1
    network-object object CKWong
    network-object object KhooSC
    network-object object Neexon-PC
    network-object object Neexon_NB
    object-group service DM_INLINE_SERVICE_1
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_2
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    access-list DIGI_access_in extended permit ip any any
    access-list DIGI_access_in extended permit icmp any any echo
    access-list LAN_access_in extended deny object-group DM_INLINE_SERVICE_2 object-group Skype any
    access-list LAN_access_in extended deny object-group DM_INLINE_SERVICE_1 object 205 any
    access-list LAN_access_in extended permit ip any any
    access-list DIGI_cryptomap extended permit ip object VPN 113.20.*.* 255.255.255.0
    access-list Pq_access_in extended permit ip any any
    access-list splittun-vpngroup1 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    logging recipient-address aaa@***.com level errors
    mtu DIGI 1500
    mtu LAN 1500
    mtu Pone 1500
    mtu management 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711(1).bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (DIGI,LAN) source static any interface
    nat (Pone,LAN) source static any interface
    nat (DIGI,DIGI) source static NETWORK_OBJ_210.48.*.*_24 NETWORK_OBJ_210.48.*.*_24 destination static NETWORK_OBJ_113.20.*.*_24 NETWORK_OBJ_113.20.*.*_24 no-proxy-arp route-lookup
    nat (LAN,DIGI) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.2.192_26 NETWORK_OBJ_192.168.2.192_26 no-proxy-arp route-lookup
    nat (LAN,DIGI) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.10.192_26 NETWORK_OBJ_192.168.10.192_26 no-proxy-arp route-lookup
    nat (LAN,any) source static any any destination static VPN VPN
    nat (LAN,DIGI) source static any any destination static NETWORK_OBJ_192.168.3.0_24 NETWORK_OBJ_192.168.3.0_24 no-proxy-arp route-lookup
    nat (LAN,DIGI) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.3.0_24 NETWORK_OBJ_192.168.3.0_24 no-proxy-arp route-lookup
    object network VPN
    nat (any,DIGI) dynamic interface
    nat (LAN,Pone) after-auto source dynamic any interface dns
    nat (LAN,DIGI) after-auto source dynamic any interface dns
    access-group DIGI_access_in in interface DIGI
    access-group LAN_access_in in interface LAN
    access-group Pq_access_in in interface Pone
    route Pone 0.0.0.0 0.0.0.0 10.1.*.* 2
    route DIGI 0.0.0.0 0.0.0.0 210.48..*.* 3
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.2.0 255.255.255.0 LAN
    http 0.0.0.0 0.0.0.0 DIGI
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto dynamic-map DIGI_access_in 20 set ikev1 transform-set ESP-3DES-SHA
    crypto map DIGI_map 65535 ipsec-isakmp dynamic DIGI_access_in
    crypto map DIGI_map interface DIGI
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn sslvpn.cisco.com
    subject-name CN=sslvpn.cisco.com
    keypair hpmtkeypair
    crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
    certificate ed15c051
        308201ef 30820158 a0030201 020204ed 15c05130 0d06092a 864886f7 0d010105
        0500303c 31193017 06035504 03131073 736c7670 6e2e6369 73636f2e 636f6d31
        1f301d06 092a8648 86f70d01 09021610 73736c76 706e2e63 6973636f 2e636f6d
        301e170d 31333036 32313038 30343438 5a170d32 33303631 39303830 3434385a
        303c3119 30170603 55040313 1073736c 76706e2e 63697363 6f2e636f 6d311f30
        1d06092a 864886f7 0d010902 16107373 6c76706e 2e636973 636f2e63 6f6d3081
        9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100a9 7715ca9e
        4d63204e 66e6517b 9a560be8 188603cc 90bb39a7 c61ef0d8 cd74bf19 8ec33146
        5176547f f43615a2 b8917a03 3a5a9dd6 e087a78a 74bf3a8e 6d7cfad2 0678253d
        b03a677a 52e9ebc0 8e044353 e9fe2055 3cafafa3 3ec74ef9 45eaf8d6 8e554879
        db9bf2fb ebcdb5c3 011bf61f 8c139ed1 a00d300a 8fe4784f 173c7702 03010001
        300d0609 2a864886 f70d0101 05050003 81810046 d32b20a6 a1efb0b5 29c7ed00
        11c0ce87 c58228c9 aae96197 eb275f9a f9da57a1 fc895faf 09a24c0c af43772b
        2818ec29 0a56eb33 c0e56696 dd1fa3bb 151ee0e4 18d27366 92177a31 b2f7842b
        4f5145b9 942fbc49 c785f925 3a909c17 2593efcc 2e410b5c d3026fe1 f48d93c1
        744333e2 c377e5d3 62eebb63 abca4109 d57bb0
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable DIGI client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable DIGI
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    track 1 rtr 123 reachability
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 DIGI
    ssh timeout 5
    console timeout 0
    vpn-sessiondb max-other-vpn-limit 250
    vpn-sessiondb max-anyconnect-premium-or-essentials-limit 2
    vpn load-balancing
    interface lbpublic DIGI
    interface lbprivate DIGI
    dhcp-client client-id interface Pone
    dhcpd address 192.168.2.10-192.168.2.150 LAN
    dhcpd dns 210.48.*.* 210.48.*.* interface LAN
    dhcpd enable LAN
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ssl trust-point ASDM_TrustPoint0 DIGI
    webvpn
    enable DIGI
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles anyhpmt_client_profile disk0:/anyhpmt_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    tunnel-group-preference group-url
    group-policy sslpolicy internal
    group-policy sslpolicy attributes
    vpn-tunnel-protocol ssl-clientless
    webvpn
      url-list none
    group-policy GroupPolicy_anyhpmt internal
    group-policy GroupPolicy_anyhpmt attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
    default-domain value g
    webvpn
      anyconnect profiles value anyhpmt_client_profile type user
    group-policy vpngroup1 internal
    group-policy vpngroup1 attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value splittun-vpngroup1
    default-domain value g
    address-pools value vpn_250
    group-policy newvpn internal
    group-policy newvpn attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    default-domain value g
    username cshiew password KK1oQOhoxfwWvya4 encrypted
    username cshiew attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect ask none default anyconnect
    username newuser password GJrqM3H2KqQZv/MI encrypted privilege 1
    tunnel-group vpngroup1 type remote-access
    tunnel-group vpngroup1 general-attributes
    address-pool vpn_250
    default-group-policy vpngroup1
    tunnel-group vpngroup1 webvpn-attributes
    group-alias vpngroup1 enable
    tunnel-group vpngroup1 ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group sslhpmt type remote-access
    tunnel-group sslhpmt general-attributes
    default-group-policy sslpolicy
    tunnel-group sslhpmt webvpn-attributes
    group-alias sslhpmt enable
    tunnel-group anyhpmt type remote-access
    tunnel-group anyhpmt general-attributes
    address-pool vpn_client
    default-group-policy GroupPolicy_anyhpmt
    tunnel-group anyhpmt webvpn-attributes
    group-alias anyhpmt enable
    tunnel-group-map default-group vpngroup1
    class-map global-class
    match any
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    class global-class
      cxsc fail-open
    class class-default
      user-statistics accounting
    policy-map global-policy
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:7a5ee8ff016e63420802423269da864b
    : end

    Hi,
    Safwan Hashan napisano:i dont know which output you referring but this is output from the VPN client.
    We need more information.
    I expect debug output from the ASA.
    To enable debugging and syslog messages, perform the following CLI steps:
    1.
    ASA#configure terminal
    ASA(config)# debug crypto ikev1 127
    ASA(config)# debug crypto ipsec 127
    Enable debuging messages for IKEv1 and IPSec.
    2.
    ASA(config)# logging monitor debug
    Sets syslog messages to be sent to Telnet or SSH sessions.
    Note: You can alternately use the logging buffer debug command to send log messages to a buffer, and then view them later using the show logging command.
    3.
    ASA(config)# terminal monitor
    Sends the syslog messages to a Telnet or SSH session.
    4.
    ASA(config)# logging on
    Enables syslog message generation.
    NOTE: This you have enabled.
    Cleanup CLI
    ASA(config)# no debug crypto ikev1
    ASA(config)# no debug crypto ipsec
    ASA(config)# no logging monitor debug
    ASA(config)# no terminal monitor
    More information: Sensible Debugging and Logging
    I have one suggestion. Change and try.
    group-policy vpngroup1 internal
    group-policy vpngroup1 attributes
    no vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    vpn-tunnel-protocol ikev1
    Best regards,
    MB
    Please rate all helpful posts. Thx

  • Monitoring VPN activity

    Hello all,
    I have couple of IKE/IPSEC VPN client connexions enabled over an ASA 5515 and I would like to log VPN activity (user login name, connection time and duration, ...) like information I can see going to "Monitoring >> VPN >> VPN Statistics >> Sessions.
    Thanks for you help
    Regards,

    Thanks Jeff.
    I use Syslog Wacther.
    I have looked for "%ASA-4-722051" or "%ASA-4-113019" but I will get 113019 and it reffers to a disconnection ... :/
    I will check around for the global list of identifiers ... and let you know

  • Monitoring VPN Sessions

    Hi,
    I have configured Remote Access IPSEC VPNS on my Cisco 5510 Security plus firewall now i need to monitor all remote access VPN session records and activities of VPN users as its need.
    Kindly suggest the best solution.
    Regards,
    Arshad Ahmed

    Arshad,
    Just to add my two cents, to Collin´s post (5 stars).
    ASA/PIX: Pass-through Traffic Accounting for VPN Clients Using ACS Configuration Example
    Managing Accounting in NPS
    HTH.
    Portu.
    Please rate any helpful posts and mark this question as answered if you do not have any further questions.

  • Disconnect VPN Client

    Hi,
    I have installed a VPN Server using Easy VPN Server.
    What is the command to show VPN Clients connecting to the VPN server?
    How do I disconnect a VPN Client connection?
    Cheers,
    peiwai

    Thanks!
    That's what you need to do:
    1. Session monitoring
    show crypto session summary
    R100#sh crypto session summary Group ezvpngrp has 1 connections   User (Logins)   cisco (1)Group ezvpngrp2 has 1 connections   User (Logins)   cisco2 (1)
    show crypto session and show cryption session detail will provide more details
    2. User administrative disconnect:
    R100#clear crypto session ?
      active    Clears HA-enabled crypto sessions in the active state
      fvrf      Front-door VRF
      ikev2     Clear ikev2 sessions
      isakmp    Clear crypto sessions belonging to the group
      ivrf      Inside VRF
      local     Clear crypto sessions for a local crypto endpoint
      remote    Clear crypto sessions for a remote IKE peer
      standby   Clears HA-enabled crypto sessions in the standby state
      username  Clear crypto sessions of a user
    clear crypto session username vpnuser would disconnect the user with the name vpnuser
    Let me know if this answer your question.
    Cheers,

  • VPN client using 50% of cpu, causing machine to run hot and fans constantly blow.

    Anyone have any idea how to fix this? I have a Cisco VPN client to access the internet at school, and the process "vpnclient" is using ~51.6 percent of my cpu power. It's not using much "real" memory, but the computer is running pretty consistently at mid-high 70's C with the fans blowing at 6200 RPM constantly. I elevated it to try and get some airflow under it (even though i'm at a desk) and the temperature went down by a couple degrees, but not enough to stop the fans from blowing. I've only got Chrome, activity monitor, and finder open right now so I know the load on the computer shouldn't be bad enough to make the fans blow. Unplugging the machine makes the temperature go down pretty much instantly, but i've never had a problem with this before.
    MacBook, mid-2008, 2.4 ghz with 4g of RAM.

    Have you tried using the Tunnelblick VPN Client from google? Its a pretty decent piece of software which I run all the time from home, withouth any increase to to fan speed or temp
    used on Macbook 2010 6GB Ram 2.4 core2duo nd Late 2010 MacBook Air

  • Remote Access VPN Clients Cannot Access inside LAN

    I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable.
    : Saved
    ASA Version 8.2(1)
    hostname ASA5505
    domain-name default.domain.invalid
    enable password eelnBRz68aYSzHyz encrypted
    passwd eelnBRz68aYSzHyz encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group dataDSL
    ip address 76.244.75.57 255.255.255.255 pppoe
    interface Vlan3
    nameif dmz
    security-level 50
    ip address 192.168.9.1 255.255.255.0
    interface Vlan10
    nameif outside_cable
    security-level 0
    ip address 50.84.96.178 255.255.255.240
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 10
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit intra-interface
    object-group service Netbios udp
    port-object eq 139
    port-object eq 445
    port-object eq netbios-ns
    object-group service Netbios_TCP tcp
    port-object eq 445
    port-object eq netbios-ssn
    object-group network DM_INLINE_NETWORK_1
    network-object host 192.168.100.177
    network-object host 192.168.100.249
    object-group service Web_Services tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_10
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_11
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_2
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_3
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_4
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_5
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_6
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_7
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_8
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_9
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network VPN
    network-object 192.168.255.0 255.255.255.0
    access-list outside_access_in extended permit icmp any host 76.244.75.61
    access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp
    access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp-data
    access-list outside_access_in extended permit tcp any host 76.244.75.62 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.62 eq https
    access-list outside_access_in extended permit tcp any host 76.244.75.59 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.59 eq https
    access-list outside_access_in extended permit tcp any host 76.244.75.60 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.60 eq https
    access-list outside_access_in extended permit tcp any host 76.244.75.58 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.58 eq https
    access-list dmz_access_in remark Quickbooks
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_6 host 192.168.100.5 eq 56719
    access-list dmz_access_in remark Quickbooks range
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_7 host 192.168.100.5 range 55333 55337
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_8 host 192.168.100.5 eq 1434
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_9 host 192.168.100.5 eq 49398
    access-list dmz_access_in remark QB
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_10 host 192.168.100.5 eq 8019
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_2 host 192.168.100.5 eq 2638
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_11 host 192.168.100.5 object-group Netbios
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_3 host 192.168.100.5 object-group Netbios_TCP
    access-list dmz_access_in extended deny ip host 192.168.9.4 host 192.168.100.5 inactive
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_4 any
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_5 any
    access-list dmz_access_in remark Printer
    access-list dmz_access_in extended permit ip 192.168.9.0 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list dmz_access_in extended permit tcp 192.168.9.0 255.255.255.0 any object-group Web_Services
    access-list dmz_access_in extended permit udp 192.168.9.0 255.255.255.0 any eq domain
    access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.255.0 255.255.255.0 echo-reply
    access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.100.0 255.255.255.0 echo-reply log disable
    access-list dmz_access_in remark QB probably does not need any udp
    access-list dmz_access_in extended permit udp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive
    access-list dmz_access_in remark QB included in other rule range
    access-list dmz_access_in extended permit tcp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive
    access-list dmz_access_in remark May be required for Quickbooks
    access-list dmz_access_in extended permit icmp host 192.168.9.4 host 192.168.100.5
    access-list CAD_capture extended permit ip host 192.168.9.4 host 192.168.100.5
    access-list CAD_capture extended permit ip host 192.168.100.5 host 192.168.9.4
    access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 172.16.10.0 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 172.16.20.0 255.255.255.240
    access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
    access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.9.0 255.255.255.0
    access-list dmz_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0
    access-list outside_cable_access_in extended permit icmp any host 50.84.96.182
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp-data
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq https
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq https
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq https
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq https
    access-list Local_LAN_Access standard permit host 0.0.0.0
    access-list vpnusers_spitTunnelACL extended permit ip 192.168.100.0 255.255.255.0 any
    access-list nonat-in extended permit ip 192.168.100.0 255.255.255.0 172.16.20.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffered informational
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500 
    mtu outside_cable 1500
    ip local pool VPN_IP_range 192.168.255.1-192.168.255.10 mask 255.255.255.0
    ip local pool VPN_Phone 172.16.20.1-172.16.20.10 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 10 interface
    global (outside_cable) 10 interface
    nat (inside) 0 access-list nonat-in
    nat (inside) 10 0.0.0.0 0.0.0.0
    nat (dmz) 0 access-list dmz_nat0_outbound
    nat (dmz) 10 0.0.0.0 0.0.0.0
    static (inside,outside) 76.244.75.62 192.168.100.25 netmask 255.255.255.255 dns
    static (dmz,outside) 76.244.75.61 192.168.9.123 netmask 255.255.255.255 dns
    static (dmz,outside) 76.244.75.59 192.168.9.124 netmask 255.255.255.255 dns
    static (dmz,outside) 76.244.75.58 192.168.9.4 netmask 255.255.255.255 dns
    static (inside,dmz) 192.168.100.0 192.168.100.0 netmask 255.255.255.0
    static (dmz,outside) 76.244.75.60 192.168.9.10 netmask 255.255.255.255 dns
    static (inside,outside_cable) 50.84.96.183 192.168.100.25 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.182 192.168.9.123 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.180 192.168.9.124 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.179 192.168.9.4 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.181 192.168.9.10 netmask 255.255.255.255 dns
    access-group outside_access_in in interface outside
    access-group dmz_access_in in interface dmz
    access-group outside_cable_access_in in interface outside_cable
    route outside_cable 0.0.0.0 0.0.0.0 50.84.96.177 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.100.0 255.255.255.0 inside
    http 204.107.173.0 255.255.255.0 outside
    http 204.107.173.0 255.255.255.0 outside_cable
    http 0.0.0.0 0.0.0.0 outside_cable
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_cable_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_cable_map interface outside_cable
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp enable outside_cable
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 192.168.100.0 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.100.0 255.255.255.0 inside
    ssh 204.107.173.0 255.255.255.0 outside
    ssh 204.107.173.0 255.255.255.0 outside_cable
    ssh 0.0.0.0 0.0.0.0 outside_cable
    ssh timeout 15
    console timeout 0
    vpdn group dataDSL request dialout pppoe
    vpdn group dataDSL localname [email protected]
    vpdn group dataDSL ppp authentication pap
    vpdn username [email protected] password *********
    dhcpd address 192.168.100.30-192.168.100.99 inside
    dhcpd dns 192.168.100.5 68.94.156.1 interface inside
    threat-detection basic-threat
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    webvpn
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 192.168.100.5
    vpn-tunnel-protocol IPSec l2tp-ipsec
    group-policy cad_supplies_RAVPN internal
    group-policy cad_supplies_RAVPN attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value cad_supplies_RAVPN_splitTunnelAcl
    group-policy VPNPHONE internal
    group-policy VPNPHONE attributes
    dns-server value 192.168.100.5
    vpn-tunnel-protocol IPSec
    split-tunnel-policy excludespecified
    split-tunnel-network-list value Local_LAN_Access
    client-firewall none
    client-access-rule none
    username swinc password BlhBNWfh7XoeHcQC encrypted
    username swinc attributes
    vpn-group-policy cad_supplies_RAVPN
    username meredithp password L3lRjzwb7TnwOyZ1 encrypted
    username meredithp attributes
    vpn-group-policy cad_supplies_RAVPN
    service-type remote-access
    username ipphone1 password LOjpmeIOshVdCSOU encrypted privilege 0
    username ipphone1 attributes
    vpn-group-policy VPNPHONE
    username ipphone2 password LOjpmeIOshVdCSOU encrypted privilege 0
    username ipphone2 attributes
    vpn-group-policy VPNPHONE
    username ipphone3 password LOjpmeIOshVdCSOU encrypted privilege 0
    username ipphone3 attributes
    vpn-group-policy VPNPHONE
    username oethera password WKJxJq7L6wmktFNt encrypted
    username oethera attributes
    vpn-group-policy cad_supplies_RAVPN
    service-type remote-access
    username markh password nqH+bk6vj0fR83ai0SAxkg== nt-encrypted
    username markh attributes
    vpn-group-policy cad_supplies_RAVPN
    tunnel-group DefaultRAGroup general-attributes
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    tunnel-group cad_supplies_RAVPN type remote-access
    tunnel-group cad_supplies_RAVPN general-attributes
    address-pool VPN_IP_range
    default-group-policy cad_supplies_RAVPN
    tunnel-group cad_supplies_RAVPN ipsec-attributes
    pre-shared-key *
    tunnel-group VPNPHONE type remote-access
    tunnel-group VPNPHONE general-attributes
    address-pool VPN_Phone
    default-group-policy VPNPHONE
    tunnel-group VPNPHONE ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 1500
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:8b25ecc61861a2baa6d2556a3679cc7c
    : end

    Hi,
    You have your "group-policy" set so that you have excluding some networks from being tunneled.
    In this access-list named Local_LAN_Access you specify "0.0.0.0"
    Doesnt this mean you are excluding all networks from being tunneled? In other words no traffic goes to your tunnel.
    This access-list should only contain your local LAN network from where you are connecting with the VPN Client. If you dont need to access anything on your local LAN while having the VPN on, you don't even need this setting on. You could just tunnel all traffic instead of excluding some networks.
    - Jouni

  • ASA 5505 VPN client LAN access problem

    Hello,
    I'm not expert in ASA and routing so I ask some support the following case.
    There is a Cisco VPN client (running on Windows 7) and an ASA5505.
    The goals are client could use remote gateway on ASA for Skype and able to access the devices in ASA inside interface.
    The Skype works well but I cannot access devices in the interface inside via VPN connection.
    Can you please check my following config and give me advice to correct NAT or VPN settings?
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password wDnglsHo3Tm87.tM encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    no forward interface Vlan1
    nameif dmz
    security-level 50
    no ip address
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list inside_access_in extended permit tcp 192.168.1.0 255.255.255.0 any
    access-list inside_access_in extended permit udp 192.168.1.0 255.255.255.0 any
    access-list outside_access_in extended permit ip any 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    ip local pool VPNPOOL 10.0.0.200-10.0.0.220 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 1 10.0.0.0 255.255.255.0
    nat (inside) 1 192.168.1.0 255.255.255.0
    nat (outside) 1 10.0.0.0 255.255.255.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 5
    ssh version 2
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.2-192.168.1.33 inside
    dhcpd dns xx.xx.xx.xx interface inside
    dhcpd enable inside
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server value 84.2.44.1
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem enable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy XXXXXX internal
    group-policy XXXXXX attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    username XXXXXX password G910DDfbV7mNprdR encrypted privilege 15
    username XXXXXX password 5p9CbIe7WdF8GZF8 encrypted privilege 0
    username XXXXXX attributes
    vpn-group-policy XXXXXX
    username XXXXX password cRQbJhC92XjdFQvb encrypted privilege 15
    tunnel-group XXXXXX type ipsec-ra
    tunnel-group XXXXXX general-attributes
    address-pool VPNPOOL
    default-group-policy XXXXXX
    tunnel-group XXXXXX ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:a8fbb51b0a830a4ae823826b28767f23
    : end
    ciscoasa#
    Thanks in advance!
    fbela

    config#no nat (inside) 1 10.0.0.0 255.255.255.0 < This is not required.
    Need to add - config#same-security-traffic permit intra-interface
                                     #access-list extended nonat permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0
                                     #nat (inside) 0 access-list nonat
    Please add and test it.
    Thanks
    Ajay

  • VPN client and radius or CAR

    Hello:
    I am trying to setup remote access vpn on IOS router with cisco Radius or CAR.
    the vpn client user needs to be authenticated by group id and password, and user id and password.
    How should I setup CAR, could someone provides me an example?
    I saw this sample, but there is no relationship between user and group.
    Any suggestions?
    thx
    [ //localhost/RADIUS/UserLists/Default/joe-coke ]
    Name = joe-coke
    Description =
    Password = <encrypted>
    AllowNullPassword = FALSE
    Enabled = TRUE
    Group~ =
    BaseProfile~ =
    AuthenticationScript~ =
    AuthorizationScript~ =
    UserDefined1 =
    [ //localhost/RADIUS/UserLists/Default/group1 ]
    Name = group1
    Description =
    Password = <encrypted> (would be "cisco")
    AllowNullPassword = FALSE
    Enabled = TRUE
    Group~ =
    BaseProfile~ = group1profile
    AuthenticationScript~ =
    AuthorizationScript~ =
    UserDefined1 =
    Define the group attributes such as pre-shared key, IP address pool name, etc. using Cisco
    AV-pairs:
    [ //localhost/RADIUS/Profiles/group1profile/Attributes ]
    cisco-avpair = ipsec:key-exchange=ike
    cisco-avpair = ipsec:tunnel-password=cisco123
    cisco-avpair = ipsec:addr-pool=pool1
    Service-Type = Outbound

    you can define the group locally on the router to define the values which the client will use to build the tunnel (pre-shared key, etc). The client's username/pw can then be defined within AAA server to allow access to the network once the tunnel has been established.
    The link below should show how to setup the group config in IOS and you should change the AAA method to point to radius instead of local to authenticate the client at your AAA server.
    http://www.cisco.com/en/US/partner/products/sw/secursw/ps2308/products_configuration_example09186a00801c4246.shtml

  • ASA 5505 VPN clients can't ping router or other clients on network

    I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
    Result of the command: "show running-config"
    : Saved
    ASA Version 7.2(4)
    hostname ASA
    domain-name default.domain.invalid
    enable password kdnFT44SJ1UFX5Us encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.4 Server
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list vpn_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
    static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface www Server www netmask 255.255.255.255
    static (inside,outside) tcp interface https Server https netmask 255.255.255.255
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable 480
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    group-policy vpn internal
    group-policy vpn attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_splitTunnelAcl
    username admin password wwYXKJulWcFrrhXN encrypted privilege 15
    username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
    username VPNuser attributes
    vpn-group-policy vpn
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool VPNpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:df7d1e4f34ee0e155cebe86465f367f5
    : end
    Any ideas what I need to add to get the vpn client to be able to ping the router and clients?
    Thanks.

    I tried that and it didn't work. As for upgrading the ASA version, I'd like to but this is an old router and I don't have a support contract with Cisco anymore, so I can't access the latest firmware.
    here is the runnign config again:
    Result of the command: "show startup-config"
    : Saved
    : Written by enable_15 at 01:48:37.789 MDT Wed Jun 20 2012
    ASA Version 7.2(4)
    hostname ASA
    domain-name default.domain.invalid
    enable password kdnFT44SJ1UFX5Us encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.4 Server
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list vpn_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 10.0.0.192 255.255.255.192
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNpool 10.0.0.220-10.0.0.240 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    asdm location Server 255.255.255.255 inside
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface smtp Server smtp netmask 255.255.255.255
    static (inside,outside) tcp interface pop3 Server pop3 netmask 255.255.255.255
    static (inside,outside) tcp interface www Server www netmask 255.255.255.255
    static (inside,outside) tcp interface https Server https netmask 255.255.255.255
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable 480
    http 10.0.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    group-policy vpn internal
    group-policy vpn attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value vpn_splitTunnelAcl
    username admin password wwYXKJulWcFrrhXN encrypted privilege 15
    username VPNuser password fRPIQoKPyxym36g7 encrypted privilege 15
    username VPNuser attributes
    vpn-group-policy vpn
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool VPNpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:78864f4099f215f4ebdd710051bdb493

Maybe you are looking for