Nested sites in site manager

I tried to see if I could have nested sites in the site
manager and it looks like that works.
c:/www/site1/webroot < ------ (root for first site, inner
site)
c:/www/site1 <--------------------(root for second site,
outer site) (I will need this to work on some files under this
folder and also be able to upload them through DW)
Has anyone tried that before and are there any unapparent
consequences for doing this?
I will avoid working on any files that belong to the inner
site from the outer site to avoid the links getting corrupted.
The reason I am trying this is related to a this question I
had few days ago.
This
is the other post
Thanks,
Shahim

You can have a site definition whose root folder is within
the root of
another site. You will have problems with synchronization in
that
configuration.
Murray --- ICQ 71997575
Adobe Community Expert
(If you *MUST* email me, don't LAUGH when you do so!)
==================
http://www.dreamweavermx-templates.com
- Template Triage!
http://www.projectseven.com/go
- DW FAQs, Tutorials & Resources
http://www.dwfaq.com - DW FAQs,
Tutorials & Resources
http://www.macromedia.com/support/search/
- Macromedia (MM) Technotes
==================
"Shahim" <[email protected]> wrote in
message
news:e40kc8$mhr$[email protected]..
>I tried to see if I could have nested sites in the site
manager and it
>looks
> like that works.
>
> c:/www/site1/webroot < ------ (root for first site,
inner site)
> c:/www/site1 <--------------------(root for second
site, outer site) (I
> will
> need this to work on some files under this folder and
also be able to
> upload
> them through DW)
>
> Has anyone tried that before and are there any
unapparent consequences for
> doing this?
>
> I will avoid working on any files that belong to the
inner site from the
> outer
> site to avoid the links getting corrupted.
>
> The reason I am trying this is related to a this
question I had few days
> ago.
>
>
>
>
http://www.adobe.com/cfusion/webforums/forum/messageview.cfm?catid=189&threadid=
> 1151984&enterthread=y
>
> Thanks,
> Shahim
>

Similar Messages

  • How to handle multiple site to site IPsec vpn on ASA, any best practice to to manage multiple ipsec vpn configrations

    how to handle multiple site to site IPsec vpn on ASA, any best practice to to manage multiple ipsec vpn configurations
    before ver 8.3 and after version 8.3 ...8.4.. 9 versions..

    Hi,
    To my understanding you should be able to attach the same cryptomap to the other "outside" interface or perhaps alternatively create a new crypto map that you attach only to your new "outside" interface.
    Also I think you will probably need to route the remote peer ip of the VPN connection towards the gateway IP address of that new "outside" and also the remote network found behind the VPN connection.
    If you attempt to use VPN Client connection instead of L2L VPN connection with the new "outside" interface then you will run into routing problems as naturally you can have 2 default routes active at the sametime (default route would be required on the new "outside" interface if VPN Client was used since you DONT KNOW where the VPN Clients are connecting to your ASA)
    Hope this helps
    - Jouni

  • Add Site System Roles (Management Point)

    To resolve an issue I was having with the management point role I have removed it.
    I left it for an hour and then restarted the server and the role had been removed. When I tried to re-add the role the option is greyed out. I believe this is due to the Server being the primary site but am finding it hard to get any definitive answer on
    how to re-add the role.
    Currently my site has no management point.
    My question is HOW DO I RE-ADD THE ROLE OF "MANAGEMENT POINT"?
    Will the configuration management setup wizard allow me to do this, whilst retaining the current roles and config?

    I thought it was a permissions issue at first to. Signed into the server with the service account used to install SCCM and also explicitly named my domain account as a local admin despite me being a domain admin. Furthermore, I have access to remove the
    roles from the server and permission to add and remove roles to all other servers.
    Adding role
    In management console Administration>Site Configuration>Servers and Site System Roles
    This bring up the list of servers and when left clicked their roles. I right click on the server in question and the option to "add site system roles" is greyed out as are the sub-options under start and the option to delete.
    Will screen shot in the morning

  • Is it possible to nest an iWeb site into another iWeb site?

    Hello,
    Is ist possible to nest iWeb sites?
    Let's assume I have two iWeb sites, called site A and site B. Site A is my main site, and I would like to insert site B into A, so that 'site B' appears in the navigator, and that clicking site B in site A's navigator will take me to site B?
    I could drag all of site B's content elements (blog, albums etc) to A, but this would make them appear all in site A's navigator, which would give a clutter of section titles.
    Suggestions?
    Best wishes,
    Olaf.

    What you do is get rid of the standard navigation by unchecking the "display navigation menu" box of the "page" inspector for each page of your site.
    Build a new navigation in a text box with links to all the pages in Site A plus a link to site B. Copy and paste this navigation to all the pages of your site.
    Repeat for site B.

  • Azure Site-to-Site VPN works, but RDP/Server Manager/Replication does not.

    Hi,
    At home, I have a Raspberry Pi with Raspbian as OS. I have installed OpenSwan to make a Site-to-Site VPN between the Raspberry and Azure. The Raspberry has an IP Address of 192.168.1.2 behind NAT. Ping works from both sites, but I'm not able to RDP or for
    example manage the servers within the Server Manager. The AD Replication doesn't work either, but I was able to join a VM in Azure over this VPN. I'm using the following configuration:
    Network topology:
    • 192.168.1.0/24 - Home network
    • 192.168.2.0/24 - Azure network
    • 192.168.1.1 - Home router's private IP
    • 192.168.1.2 - Raspberry Pi
    I enabled L2TP Passthrough in the router firewall and I tried to forward the following ports to my RPI:
    • UDP 500
    • UDP 4500
    I also tried to place the Pi in the DMZ.
    My ipsec.conf looks like this:
    version 2.0
    config setup
        nat_traversal=yes
        virtual_private=%4:192.168.1.0/24
        protostack=auto
        interfaces="ipsec0=eth0"
    conn azure
        authby=secret
        auto=start
        type=tunnel
        left=192.168.1.2
        leftsubnet=192.168.1.0/24
        leftnexthop=192.168.1.1
        right=[Azure IP]
        rightsubnet=192.168.2.0/24
        ike=3des-sha1-modp1024,aes128-sha1-modp1024
        esp=3des-sha1,aes128-sha1
        pfs=no
    ipsec.secrets:
    192.168.1.2 [Azure IP] : PSK "AzureSecret"
    That got the link up and running, to allow routing between sites:
    /etc/sysctl.conf:
    net.ipv4.ip_forward = 1
    net.ipv4.conf.all.accept_redirects = 0
    net.ipv4.conf.all.send_redirects = 0
    net.ipv4.conf.default.rp_filter = 0
    net.ipv4.conf.default.accept_source_route = 0
    net.ipv4.conf.default.send_redirects = 0
    net.ipv4.icmp_ignore_bogus_error_responses = 1
    IPtables rules:
    iptables -A FORWARD -s 192.168.2.0/24 -m policy --dir in --pol ipsec -j ACCEPT
    iptables -A FORWARD -s 192.168.1.0/24 -m policy --dir out --pol ipsec -j ACCEPT
    iptables -A INPUT -p udp -m udp --dport 500 -j ACCEPT
    iptables -A INPUT -p udp -m udp --dport 4500 -j ACCEPT
    iptables -A INPUT -m policy --dir in --pol ipsec -j ACCEPT
    iptables -A INPUT -p esp -j ACCEPT
    The NAT table allows the Azure VM's to connect to any machine on my home network:
    iptables -A PREROUTING –t nat -i eth0 -p udp -m udp --dport 4500 -j DNAT --to-destination [Azure IP]:4500
    iptables -A PREROUTING –t nat -i eth0 -p udp -m udp --dport 500 -j DNAT --to-destination [Azure IP]:500
    iptables –t nat -A POSTROUTING -o eth0 -j MASQUERADE
    With all this I can ping and communicate in both directions, all Azure VM's can see my home network, all home network machines can see my Azure VM's.
    Any idea what's going wrong? Thank you!

    Hi Arvind,
    I can confirm that RDP from the server in Azure works to my home lab. It doesn't work from my home lab (DC01) to Azure (DC02-1). I did a capture on my DC01 with NetMon.
    DC01 is 192.168.1.10 (home)
    DC02-1 is 192.168.2.4 (Azure)
    I found the following 'errors' in the capture:
    - Scale factor not supported
    - Checksum: 0x9EBF, Disregarded
    Do you know what's the problem?
    Take a look at the capture below:
    215 11:24:20 27-12-2014 1.8730574 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:Flags=CE....S., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=4073688143, Ack=0, Win=8192 ( Negotiating scale factor 0x8 ) = 8192 {TCP:5, IPv4:11}
    222 11:24:20 27-12-2014 1.9105602 mstsc.exe 192.168.2.4 192.168.1.10 TCP TCP:Flags=.E.A..S., SrcPort=MS WBT Server(3389), DstPort=50487, PayloadLen=0, Seq=3665192609, Ack=4073688144, Win=64000 ( Scale factor not supported ) = 64000 {TCP:5, IPv4:11}
    223 11:24:20 27-12-2014 1.9106166 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:Flags=...A...., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=4073688144, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    224 11:24:20 27-12-2014 1.9118241 mstsc.exe 192.168.1.10 192.168.2.4 RDP RDP:Windows stub parser: Requires full Common parsers. See the "How Do I Change Parser Set Options(Version 3.3 or before) or Configure Parser Profile (Version 3.4)" help topic for tips on loading these parser sets. {TCP:5, IPv4:11}
    236 11:24:20 27-12-2014 2.2214169 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    262 11:24:21 27-12-2014 2.8307052 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    338 11:24:22 27-12-2014 4.0339011 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    370 11:24:23 27-12-2014 4.9156751 mstsc.exe 192.168.2.4 192.168.1.10 TCP TCP:Flags=.E.A..S., SrcPort=MS WBT Server(3389), DstPort=50487, PayloadLen=0, Seq=3665192609, Ack=4073688144, Win=64000 ( Scale factor not supported ) = 64000 {TCP:5, IPv4:11}
    371 11:24:23 27-12-2014 4.9157253 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:Flags=...A...., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    383 11:24:23 27-12-2014 5.2369090 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    429 11:24:25 27-12-2014 6.4450070 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    520 11:24:27 27-12-2014 8.8541736 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    587 11:24:29 27-12-2014 10.9267084 mstsc.exe 192.168.2.4 192.168.1.10 TCP TCP:Flags=...A..S., SrcPort=MS WBT Server(3389), DstPort=50487, PayloadLen=0, Seq=3665192609, Ack=4073688144, Win=64000 ( Scale factor not supported ) = 64000 {TCP:5, IPv4:11}
    Frame: Number = 587, Captured Frame Length = 62, MediaType = ETHERNET
    + Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[MAC Address],SourceAddress:[B8-27-EB-8C-CA-84]
    + Ipv4: Src = 192.168.2.4, Dest = 192.168.1.10, Next Protocol = TCP, Packet ID = 17414, Total IP Length = 48
    - Tcp: Flags=...A..S., SrcPort=MS WBT Server(3389), DstPort=50487, PayloadLen=0, Seq=3665192609, Ack=4073688144, Win=64000 ( Scale factor not supported ) = 64000
    SrcPort: MS WBT Server(3389)
    DstPort: 50487
    SequenceNumber: 3665192609 (0xDA7666A1)
    AcknowledgementNumber: 4073688144 (0xF2CF8C50)
    + DataOffset: 112 (0x70)
    + Flags: ...A..S.
    Window: 64000 ( Scale factor not supported ) = 64000
    Checksum: 0x57F9, Good
    UrgentPointer: 0 (0x0)
    + TCPOptions:
    588 11:24:29 27-12-2014 10.9267808 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[Dup Ack #371]Flags=...A...., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    698 11:24:32 27-12-2014 13.6755119 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:[ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840 {TCP:5, IPv4:11}
    Frame: Number = 698, Captured Frame Length = 73, MediaType = ETHERNET
    + Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[MAC Address],SourceAddress:[MAC Address]
    + Ipv4: Src = 192.168.1.10, Dest = 192.168.2.4, Next Protocol = TCP, Packet ID = 17408, Total IP Length = 59
    - Tcp: [ReTransmit #224]Flags=...AP..., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=19, Seq=4073688144 - 4073688163, Ack=3665192610, Win=515 (scale factor 0x8) = 131840
    SrcPort: 50487
    DstPort: MS WBT Server(3389)
    SequenceNumber: 4073688144 (0xF2CF8C50)
    AcknowledgementNumber: 3665192610 (0xDA7666A2)
    + DataOffset: 80 (0x50)
    + Flags: ...AP...
    Window: 515 (scale factor 0x8) = 131840
    Checksum: 0x9EBF, Disregarded
    UrgentPointer: 0 (0x0)
    RetransmitPayload: Binary Large Object (19 Bytes)
    722 11:24:32 27-12-2014 14.3901288 mstsc.exe 192.168.1.10 192.168.2.4 TCP TCP:Flags=C..A.R.., SrcPort=50487, DstPort=MS WBT Server(3389), PayloadLen=0, Seq=4073688163, Ack=3665192610, Win=0 (scale factor 0x8) = 0 {TCP:5, IPv4:11}

  • I would like to be able to have any cookie I choose to accept on a given website be deleated as soon as I leave or close that website so that my surfing does not get tracked from site to site. I don't see an option for that. Is any one working on that?

    I don't want my surfing to tracked from site to site.
    Some sites require cookies be turned on in order to access the data I want or to perform a transaction.
    Right now, I have Firefox set to not accept cookies until I run into a site that requires cookies be accepted.
    Once I need to turn cookies on, I return to "Options" and select accept cookies but not 3rd party cookies.
    I will then be surfing along and occasionally check what cookies have been placed. There may be several placed I did not know were placed. I assume my surfing has been being tracked and I don't like that as a point of privacy.
    Is there a privacy setting I am missing, an application or extension I can download, or is the Mozilla team working on this as a feature?

    As far as I know, [https://addons.mozilla.org/firefox/addon/classicthemerestorer/ the Classic Theme Restorer add-on] is the only way move the Reload button outside the address bar.
    # Install [https://addons.mozilla.org/firefox/addon/classicthemerestorer/ Classic Theme Restorer] and restart Firefox when prompted.
    # Open the Add-ons Manager (Ctrl+Shift+A; Mac: Command+Shift+A), then the Extensions category.
    # Next to Classic Theme Restorer, click the Options button.
    # On the Main tab, make sure "Movable back-forward button" and "Hide urlbars stop & reload buttons" are checked. You might also want to check "Combine stop & reload buttons". Close the options window when done.
    # Right-click an empty area of the tab bar and choose Customize.
    # Drag the Back/Forward, Stop and Reload buttons onto the navigation toolbar.
    # Click the Exit Customize button in the lower right corner when done.
    That being said, I should point out that you can reload pages in other ways.
    * Right-click any tab and choose Reload.
    * Right-click an empty area of the page and choose Reload.
    * Press F5.
    * Press Ctrl+R (Mac: Command+R).

  • Site to Site Replication only works for a few hours in the morning (each morning)

    We have been fighting an odd active directory replication issue for over a month now and I am hoping that someone can provide some insight. We have 5 AD servers in the following orientation...
    Site HQ
    - PRIME running Windows 2008 R2
    - AD2 running Windows 2008 R2
    Site COLO
    - AD3 running Windows 2008 (not R2)
    - AD3NEW running Windows 2008 R2
    Site BRANCH
    - AD4 running Windows 2008 R2
    The domain is at the Windows 2008 Functional Level.
    There are always on site to site VPNs between all 3 sites and IP Intersite Transports Site Links defined for all 3 possible connections with Cost of 100 and interval of 15. Each IP site link is configured with a schedule of available all day long.
    Every day the following sequence of events happens...
    * Somewhere between 6:30 and 7:30am all the servers start to sync with each other perfectly. We can make AD changes and they replicate across all servers without issues. During this time all the repadmin commands work well across all servers.
    * Typically somewhere in the 10:30 to 11:30am time frame we start to get errors replicating data - specifically between the HQ and COLO sites. This manifests itself as Event 1232 Call Timeout from the DC RPC Client and and Event 1925 from the KCC. Additionally
    repadmin commands fail when attempting to connect to the BRANCH servers.
    * For the rest of the day the intra-site replication between PRIME and AD2 work fine - and periodically the BRANCH AD server is updated as well. But the COLO sites remain unreplicated and continue to get errors for the remainder of the day. While this down
    - the ability to ping and remote desktop between the servers is perfectly fine - so even if there were a network hiccup that happens - the network is stable for hours without the sites recovering.
    * Magically the next morning around 6:30 and 7:30am all the servers are able to replicate without issue and we get 3-5 hours of immediate replication and then it happens again.
    As I stated above - there is always on site-to-site VPN connections between all 3 sites that are actively monitored by PRTG. These connections remain open all day long. The Site topology has the COLO servers attempting to replicate with the HQ servers -
    and both sites have 100MB data connections that remain active during the entire time. Additionally PRTG bandwidth monitoring shows that these links have no spikes in traffic anywhere near the max capacity of those links during the time that the outages begin
    nor during the rest of the day.
    Does anyone have any insight as to why these servers would stop communicating with each other about the same time every day and report errors? Also why it would magically start to work again each day without any changes being made to the network or the AD
    configuration?
    This has been going on for over a month now. When it first started to happen we had 1 Windows 2008 server and 2 Windows 2003 servers in the HQ. We phased out the Windows 2003 servers and upgraded the functional level to Windows 2008 - that did not solve
    the problem. We tried to put a new Windows 2008 R2 server out at the COLO site hoping that if it was limited to the other server then only the one server would be impacted. But now they both appear to be having connectivity issues at the same time.
    It is as if there is one hung connection that is blocking all the other syncs to this site and then someone each morning that bottleneck is released.
    Thank you in advance for any direction you can provide.

    As was stated above - ALL Domain Controllers have direct access to each other through Firewall to Firewall site to site VPNs and the Inter-Site Transport Links mirror that setup. So from the OS perspective any of the AD servers can directly connect to any
    other one.
    There are 3 IP Inter-Site Transport Links defined
    HQ < - > COLO   (Contains HQ and COLO sites) Cost 100  Replication Interval 15
    HQ < - > BRANCH  (Contains HQ and Branch sites) Cost 100 Replication Interval 15
    COLO < - > BRANCH  (Contains COLO and Branch sites) Cost 100 Replication Interval 15
    And on IP Inter-Site Transports "Bridge all site links" is enabled (although disabling it doesn't fix this problem as we have already tried that).
    Right now the servers are claiming (via Active Directory) to be unable to replicate with each other. But I am able to do direct pings as well as open stream sockets using "telnet <otherserver> <port>" on ports 3268 (gc), 88 (kerberos),
    389 (ldap), 135 (replication), 636 (ldap ssl), 53 (DNS). So there is nothing that I can see between the servers that is blocking TCP connectivity.
    I cannot seem to make this any clearer. The sites are 100% functional and responsive for several hours per day - and then mysteriously go into a state of complete denial for a lack of a better word for the rest of the day - only to return back to normal
    again reliably each morning.
    It is as if the sites get into a mode where something in the RPC area are simply refusing to talk to each other despite the servers having full access at the network level.
    Another data point to add to this mystery. While it is in the state where the HQ and COLO servers are refusing to sync with each other. You can launch the AD Users and Computers snap-in, right mouse click on the domain, change the Current Directory server
    and all 5 servers show up as ONLINE. You can pick any of them (including the one that is unable to replicate with) and make a direct change on that server.
    So while the servers are complaining about being unable to talk to each other - the snap in is connecting between those servers and is able to modify it without issue.
    Conversely - when the replication is failing the DNS management tool is unable to connect to the remote servers (i.e. COLO can show itself and the other COLO server. HQ can show PRIME, DC2, and DC4 without issue. But no overlap).
    Not sure that helps at all - but shows our frustration when two servers refuse to replicate but you can easily remote connect from one to the other and make the change.

  • Site to Site VPN Problems With 2801 Router and ASA 5505

    Hello,
    I am having some issue setting up a site to site ipsec VPN between a Cisco 2801 router and a Cisco ASA 5505. I was told there was a vpn previously setup with an old hosting provider, but those connections have been servered. Right now I am trying to get the sites to talk to the 2801. Here ere are my current configs, please let me know if you need anything else. Im stumped on this one. Thanks.
    IP scheme at SIte A:
    IP    172.19.3.x
    sub 255.255.255.128
    GW 172.19.3.129
    Site A Ciscso 2801 Router
    Current configuration : 11858 bytes
    version 12.4
    service timestamps debug datetime localtime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname router-2801
    boot-start-marker
    boot-end-marker
    logging message-counter syslog
    logging buffered 4096
    aaa new-model
    aaa authentication login userauthen group radius local
    aaa authorization network groupauthor local
    aaa session-id common
    clock timezone est -5
    clock summer-time zone recurring last Sun Mar 2:00 1 Sun Nov 2:00
    dot11 syslog
    ip source-route
    ip dhcp excluded-address 172.19.3.129 172.19.3.149
    ip dhcp excluded-address 172.19.10.1 172.19.10.253
    ip dhcp excluded-address 172.19.3.140
    ip dhcp ping timeout 900
    ip dhcp pool DHCP
       network 172.19.3.128 255.255.255.128
       default-router 172.19.3.129
       domain-name domain.local
       netbios-name-server 172.19.3.7
       option 66 ascii 172.19.3.225
       dns-server 172.19.3.140 208.67.220.220 208.67.222.222
    ip dhcp pool VoiceDHCP
       network 172.19.10.0 255.255.255.0
       default-router 172.19.10.1
       dns-server 208.67.220.220 8.8.8.8
       option 66 ascii 172.19.10.2
       lease 2
    ip cef
    ip inspect name SDM_LOW cuseeme
    ip inspect name SDM_LOW dns
    ip inspect name SDM_LOW ftp
    ip inspect name SDM_LOW h323
    ip inspect name SDM_LOW https
    ip inspect name SDM_LOW icmp
    ip inspect name SDM_LOW imap
    ip inspect name SDM_LOW pop3
    ip inspect name SDM_LOW netshow
    ip inspect name SDM_LOW rcmd
    ip inspect name SDM_LOW realaudio
    ip inspect name SDM_LOW rtsp
    ip inspect name SDM_LOW esmtp
    ip inspect name SDM_LOW sqlnet
    ip inspect name SDM_LOW streamworks
    ip inspect name SDM_LOW tftp
    ip inspect name SDM_LOW tcp
    ip inspect name SDM_LOW udp
    ip inspect name SDM_LOW vdolive
    no ip domain lookup
    ip domain name domain.local
    multilink bundle-name authenticated
    key chain key1
    key 1
       key-string 7 06040033484B1B484557
    crypto pki trustpoint TP-self-signed-3448656681
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3448bb6681
    revocation-check none
    rsakeypair TP-self-signed-344bbb56681
    crypto pki certificate chain TP-self-signed-3448656681
    certificate self-signed 01
      3082024F
                quit
    username admin privilege 15 password 7 F55
    archive
    log config
      hidekeys
    crypto isakmp policy 10
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key XXXXX address 209.118.0.1
    crypto isakmp key xxxxx address SITE B Public IP
    crypto isakmp keepalive 40 5
    crypto isakmp nat keepalive 20
    crypto isakmp client configuration group IISVPN
    key 1nsur3m3
    dns 172.19.3.140
    wins 172.19.3.140
    domain domain.local
    pool VPN_Pool
    acl 198
    crypto isakmp profile IISVPNClient
       description VPN clients profile
       match identity group IISVPN
       client authentication list userauthen
       isakmp authorization list groupauthor
       client configuration address respond
    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    crypto dynamic-map Dynamic 5
    set transform-set myset
    set isakmp-profile IISVPNClient
    qos pre-classify
    crypto map VPN 10 ipsec-isakmp
    set peer 209.118.0.1
    set peer SITE B Public IP
    set transform-set myset
    match address 101
    qos pre-classify
    crypto map VPN 65535 ipsec-isakmp dynamic Dynamic
    track 123 ip sla 1 reachability
    delay down 15 up 10
    class-map match-any VoiceTraffic
    match protocol rtp audio
    match protocol h323
    match protocol rtcp
    match access-group name VOIP
    match protocol sip
    class-map match-any RDP
    match access-group 199
    policy-map QOS
    class VoiceTraffic
        bandwidth 512
    class RDP
        bandwidth 768
    policy-map MainQOS
    class class-default
        shape average 1500000
      service-policy QOS
    interface FastEthernet0/0
    description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$$FW_INSIDE$
    ip address 172.19.3.129 255.255.255.128
    ip access-group 100 in
    ip inspect SDM_LOW in
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    interface FastEthernet0/0.10
    description $ETH-VoiceVLAN$$
    encapsulation dot1Q 10
    ip address 172.19.10.1 255.255.255.0
    ip inspect SDM_LOW in
    ip nat inside
    ip virtual-reassembly
    interface FastEthernet0/1
    description "Comcast"
    ip address PUB IP 255.255.255.248
    ip access-group 102 in
    ip inspect SDM_LOW out
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map VPN
    interface Serial0/1/0
    description "Verizon LEC Circuit ID: w0w13908 Site ID: U276420-1"
    bandwidth 1536
    no ip address
    encapsulation frame-relay IETF
    frame-relay lmi-type ansi
    interface Serial0/1/0.1 point-to-point
    bandwidth 1536
    ip address 152.000.000.18 255.255.255.252
    ip access-group 102 in
    ip verify unicast reverse-path
    ip inspect SDM_LOW out
    ip nat outside
    ip virtual-reassembly
    frame-relay interface-dlci 500 IETF 
    crypto map VPN
    service-policy output MainQOS
    interface Serial0/2/0
    description "PAETEC 46.HCGS.788446.CV (Verizon ID) / 46.HCGS.3 (PAETEC ID)"
    ip address 123.252.123.102 255.255.255.252
    ip access-group 102 in
    ip inspect SDM_LOW out
    ip nat outside
    ip virtual-reassembly
    encapsulation ppp
    crypto map VPN
    service-policy output MainQOS
    ip local pool VPN_Pool 172.20.3.130 172.20.3.254
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 50.00.000.110 track 123
    ip route 0.0.0.0 0.0.0.0 111.252.237.000 254
    ip route 122.112.197.20 255.255.255.255 209.252.237.101
    ip route 208.67.220.220 255.255.255.255 50.78.233.110
    no ip http server
    no ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip flow-top-talkers
    top 20
    sort-by bytes
    ip nat inside source route-map COMCAST interface FastEthernet0/1 overload
    ip nat inside source route-map PAETEC interface Serial0/2/0 overload
    ip nat inside source route-map VERIZON interface Serial0/1/0.1 overload
    ip nat inside source static tcp 172.19.3.140 21 PUB IP 21 extendable
    ip access-list extended VOIP
    permit ip 172.20.3.0 0.0.0.127 host 172.19.3.190
    permit ip host 172.19.3.190 172.20.3.0 0.0.0.127
    ip radius source-interface FastEthernet0/0
    ip sla 1
    icmp-echo 000.67.220.220 source-interface FastEthernet0/1
    timeout 10000
    frequency 15
    ip sla schedule 1 life forever start-time now
    access-list 23 permit 172.19.3.0 0.0.0.127
    access-list 23 permit 172.19.3.128 0.0.0.127
    access-list 23 permit 173.189.251.192 0.0.0.63
    access-list 23 permit 107.0.197.0 0.0.0.63
    access-list 23 permit 173.163.157.32 0.0.0.15
    access-list 23 permit 72.55.33.0 0.0.0.255
    access-list 23 permit 172.19.5.0 0.0.0.63
    access-list 100 remark "Outgoing Traffic"
    access-list 100 deny   ip 67.128.87.156 0.0.0.3 any
    access-list 100 deny   ip host 255.255.255.255 any
    access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
    access-list 100 permit tcp host 172.19.3.190 any eq smtp
    access-list 100 permit tcp host 172.19.3.137 any eq smtp
    access-list 100 permit tcp any host 66.251.35.131 eq smtp
    access-list 100 permit tcp any host 173.201.193.101 eq smtp
    access-list 100 permit ip any any
    access-list 100 permit tcp any any eq ftp
    access-list 101 remark "Interesting VPN Traffic"
    access-list 101 permit ip 172.19.3.128 0.0.0.127 172.19.3.0 0.0.0.127
    access-list 101 permit ip 172.20.3.128 0.0.0.127 172.19.3.0 0.0.0.127
    access-list 101 permit ip 172.19.3.128 0.0.0.127 host 172.19.250.10
    access-list 101 permit ip 172.19.3.128 0.0.0.127 host 172.19.250.11
    access-list 101 permit tcp any any eq ftp
    access-list 101 permit tcp any any eq ftp-data
    access-list 102 remark "Inbound Access"
    access-list 102 permit udp any host 152.179.53.18 eq non500-isakmp
    access-list 102 permit udp any host 152.179.53.18 eq isakmp
    access-list 102 permit esp any host 152.179.53.18
    access-list 102 permit ahp any host 152.179.53.18
    access-list 102 permit udp any host 209.000.000.102 eq non500-isakmp
    access-list 102 permit udp any host 209.000.000.102 eq isakmp
    access-list 102 permit esp any host 209.000.000.102
    access-list 102 permit ahp any host 209.000.000.102
    access-list 102 permit udp any host PUB IP eq non500-isakmp
    access-list 102 permit udp any host PUB IP eq isakmp
    access-list 102 permit esp any host PUB IP
    access-list 102 permit ahp any host PUB IP
    access-list 102 permit ip 72.55.33.0 0.0.0.255 any
    access-list 102 permit ip 107.0.197.0 0.0.0.63 any
    access-list 102 deny   ip 172.19.3.128 0.0.0.127 any
    access-list 102 permit icmp any any echo-reply
    access-list 102 permit icmp any any time-exceeded
    access-list 102 permit icmp any any unreachable
    access-list 102 permit icmp any any
    access-list 102 deny   ip any any log
    access-list 102 permit tcp any host 172.19.3.140 eq ftp
    access-list 102 permit tcp any host 172.19.3.140 eq ftp-data established
    access-list 102 permit udp any host SITE B Public IP  eq non500-isakmp
    access-list 102 permit udp any host SITE B Public IP  eq isakmp
    access-list 102 permit esp any host SITE B Public IP
    access-list 102 permit ahp any host SITE B Public IP
    access-list 110 remark "Outbound NAT Rule"
    access-list 110 remark "Deny VPN Traffic NAT"
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.19.3.0 0.0.0.127
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.19.10.0 0.0.0.255
    access-list 110 deny   ip 172.19.10.0 0.0.0.255 172.19.3.128 0.0.0.127
    access-list 110 deny   ip 172.20.3.128 0.0.0.127 172.19.3.0 0.0.0.127
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 host 172.19.250.11
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 host 172.19.250.10
    access-list 110 permit ip 172.19.3.128 0.0.0.127 any
    access-list 110 permit ip 172.19.10.0 0.0.0.255 any
    access-list 198 remark "Networks for IISVPN Client"
    access-list 198 permit ip 172.19.3.0 0.0.0.127 172.20.3.128 0.0.0.127
    access-list 198 permit ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
    access-list 199 permit tcp any any eq 3389
    route-map PAETEC permit 10
    match ip address 110
    match interface Serial0/2/0
    route-map COMCAST permit 10
    match ip address 110
    match interface FastEthernet0/1
    route-map VERIZON permit 10
    match ip address 110
    match interface Serial0/1/0.1
    snmp-server community 123 RO
    radius-server host 172.19.3.7 auth-port 1645 acct-port 1646 key 7 000000000000000
    control-plane
    line con 0
    line aux 0
    line vty 0 4
    access-class 23 in
    privilege level 15
    transport input telnet ssh
    line vty 5 15
    access-class 23 in
    privilege level 15
    transport input telnet ssh
    scheduler allocate 20000 1000
    ntp server 128.118.25.3
    ntp server 217.150.242.8
    end
    IP scheme at site B:
    ip     172.19.5.x
    sub  255.255.255.292
    gw   172.19.5.65
    Cisco ASA 5505 at Site B
    ASA Version 8.2(5)
    hostname ASA5505
    domain-name domain.com
    enable password b04DSH2HQqXwS8wi encrypted
    passwd b04DSH2HQqXwS8wi encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 172.19.5.65 255.255.255.192
    interface Vlan2
    nameif outside
    security-level 0
    ip address SITE B public IP 255.255.255.224
    boot system disk0:/asa825-k8.bin
    ftp mode passive
    clock timezone est -5
    clock summer-time zone recurring last Sun Mar 2:00 last Sun Oct 2:00
    dns server-group DefaultDNS
    domain-name iis-usa.com
    same-security-traffic permit intra-interface
    object-group network old hosting provider
    network-object 72.55.34.64 255.255.255.192
    network-object 72.55.33.0 255.255.255.0
    network-object 173.189.251.192 255.255.255.192
    network-object 173.163.157.32 255.255.255.240
    network-object 66.11.1.64 255.255.255.192
    network-object 107.0.197.0 255.255.255.192
    object-group network old hosting provider
    network-object host 172.19.250.10
    network-object host 172.19.250.11
    access-list 100 extended permit ip 172.19.5.64 255.255.255.192 object-group old hosting provider
    access-list 100 extended permit ip 172.19.5.64 255.255.255.192 172.19.3.128 255.255.255.128
    access-list 10 extended deny ip 0.0.0.0 255.0.0.0 any
    access-list 10 extended deny ip 127.0.0.0 255.0.0.0 any
    access-list 10 extended deny ip 169.254.0.0 255.255.0.0 any
    access-list 10 extended deny ip 172.16.0.0 255.255.0.0 any
    access-list 10 extended deny ip 224.0.0.0 224.0.0.0 any
    access-list 10 extended permit icmp any any echo-reply
    access-list 10 extended permit icmp any any time-exceeded
    access-list 10 extended permit icmp any any unreachable
    access-list 10 extended permit icmp any any traceroute
    access-list 10 extended permit icmp any any source-quench
    access-list 10 extended permit icmp any any
    access-list 10 extended permit tcp object-group old hosting provider any eq 3389
    access-list 10 extended permit tcp any any eq https
    access-list 10 extended permit tcp any any eq www
    access-list 110 extended permit ip 172.19.5.64 255.255.255.192 172.19.3.0 255.255.255.128
    access-list 110 extended permit ip 172.19.5.64 255.255.255.192 object-group old hosting provider
    pager lines 24
    logging enable
    logging timestamp
    logging console emergencies
    logging monitor emergencies
    logging buffered warnings
    logging trap debugging
    logging history debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip verify reverse-path interface inside
    ip verify reverse-path interface outside
    ip audit name jab attack action alarm drop reset
    ip audit name probe info action alarm drop reset
    ip audit interface outside probe
    ip audit interface outside jab
    ip audit info action alarm drop reset
    ip audit attack action alarm drop reset
    ip audit signature 2000 disable
    ip audit signature 2001 disable
    ip audit signature 2004 disable
    ip audit signature 2005 disable
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit 75.150.169.48 255.255.255.240 outside
    icmp permit 72.44.134.16 255.255.255.240 outside
    icmp permit 72.55.33.0 255.255.255.0 outside
    icmp permit any outside
    icmp permit 173.163.157.32 255.255.255.240 outside
    icmp permit 107.0.197.0 255.255.255.192 outside
    icmp permit 66.11.1.64 255.255.255.192 outside
    icmp deny any outside
    asdm image disk0:/asdm-645.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list 100
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group 10 in interface outside
    route outside 0.0.0.0 0.0.0.0 174.78.151.225 1
    timeout xlate 3:00:00
    timeout conn 24:00:00 half-closed 0:10:00 udp 0:10:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 24:00:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http 107.0.197.0 255.255.255.192 outside
    http 66.11.1.64 255.255.255.192 outside
    snmp-server host outside 107.0.197.29 community *****
    snmp-server host outside 107.0.197.30 community *****
    snmp-server host inside 172.19.250.10 community *****
    snmp-server host outside 172.19.250.10 community *****
    snmp-server host inside 172.19.250.11 community *****
    snmp-server host outside 172.19.250.11 community *****
    snmp-server host outside 68.82.122.239 community *****
    snmp-server host outside 72.55.33.37 community *****
    snmp-server host outside 72.55.33.38 community *****
    snmp-server host outside 75.150.169.50 community *****
    snmp-server host outside 75.150.169.51 community *****
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map VPNMAP 10 match address 110
    crypto map VPNMAP 10 set peer 72.00.00.7 old vpn public ip Site B Public IP
    crypto map VPNMAP 10 set transform-set ESP-3DES-MD5
    crypto map VPNMAP 10 set security-association lifetime seconds 86400
    crypto map VPNMAP 10 set security-association lifetime kilobytes 4608000
    crypto map VPNMAP interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 20
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 172.19.5.64 255.255.255.192 inside
    telnet 172.19.3.0 255.255.255.128 outside
    telnet timeout 60
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 60
    console timeout 0
    management-access inside
    dhcpd dns 172.19.3.140
    dhcpd wins 172.19.3.140
    dhcpd ping_timeout 750
    dhcpd domain iis-usa.com
    dhcpd address 172.19.5.80-172.19.5.111 inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection scanning-threat shun except object-group old hosting provider
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 128.118.25.3 source outside
    ntp server 217.150.242.8 source outside
    tunnel-group 72.00.00.7 type ipsec-l2l
    tunnel-group 72.00.00.7 ipsec-attributes
    pre-shared-key *****
    tunnel-group old vpn public ip type ipsec-l2l
    tunnel-group old vpn public ip ipsec-attributes
    pre-shared-key *****
    tunnel-group SITE A Public IP  type ipsec-l2l
    tunnel-group SITE A Public IP  ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect netbios
      inspect tftp
      inspect pptp
      inspect sip 
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:
    : end

    I have removed the old "set peer" and have added:
    IOS router:
    access-list 101 permit ip 172.19.3.128 0.0.0.127 172.19.5.64 0.0.0.65
    ASA fw:
    access-list 110 extended permit ip 172.19.5.64 255.255.255.192 172.19.3.128 255.255.255.128
    on the router I have also added;
    access-list 110 deny  ip 172.19.3.128 0.0.0.127 172.19.5.64 0.0.0.63
    Here is my acl :
    access-list 110 remark "Outbound NAT Rule"
    access-list 110 remark "Deny VPN Traffic NAT"
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.19.3.0 0.0.0.127
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.19.10.0 0.0.0.255
    access-list 110 deny   ip 172.19.10.0 0.0.0.255 172.19.3.128 0.0.0.127
    access-list 110 deny   ip 172.20.3.128 0.0.0.127 172.19.3.0 0.0.0.127
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 host 172.19.250.11
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 host 172.19.250.10
    access-list 110 permit ip 172.19.3.128 0.0.0.127 any
    access-list 110 permit ip 172.19.10.0 0.0.0.255 any
    access-list 110 deny   ip 172.19.3.128 0.0.0.127 172.19.5.64 0.0.0.63
    access-list 198 remark "Networks for IISVPN Client"
    access-list 198 permit ip 172.19.3.0 0.0.0.127 172.20.3.128 0.0.0.127
    access-list 198 permit ip 172.19.3.128 0.0.0.127 172.20.3.128 0.0.0.127
    Still no ping tothe other site.

  • Internet connexion problem for remote site in Site to site VPN asa 5505

    Hi all
    I'm configuring a site to site Ipsec VPN in 2 sites using ASA 5505 V 8.2, The VPN is working fine i can ping machine in the 2 sides but the problem is the remote site dont' have internet.
    The architecture is, we 2 site Site1 is the main site and Site2 is secondary site there will be Site3, ...
    The internet connection is based in Site1 and site2 and site 3 will have internet connection through Site1. Site1, Site2 and Site 3 is interconnected by Ipsec VPN.
    Here is my ASA 5505 Configuration :
    SITE 1:
    ASA Version 8.2(5)
    hostname test-malabo
    domain-name test.mg
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd ta.qizy4R//ChqQH encrypted
    names
    interface Ethernet0/0
     description "Sortie Internet"
     switchport access vlan 2
    interface Ethernet0/1
     description "Interconnexion"
     switchport access vlan 171
    interface Ethernet0/2
     description "management"
     switchport access vlan 10
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 41.79.49.42 255.255.255.192
    interface Vlan10
     nameif mgmt
     security-level 0
     ip address 10.12.1.100 255.255.0.0
    interface Vlan171
     nameif interco
     security-level 0
     ip address 10.22.19.254 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
     domain-name test.mg
    object-group network LAN-MALABO
     description LAN DE MALABO
     network-object 192.168.1.0 255.255.255.0
    object-group network LAN-BATA
     description LAN DE BATA
     network-object 192.168.2.0 255.255.255.0
    object-group network LAN-LUBA
     description LAN DE LUBA
     network-object 192.168.3.0 255.255.255.0
    access-list interco_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu mgmt 1500
    mtu interco 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    icmp permit any interco
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (interco) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 41.79.49.1 1
    route interco 192.168.3.0 255.255.255.0 10.22.19.5 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map interco_map0 1 match address interco_1_cryptomap
    crypto map interco_map0 1 set pfs group1
    crypto map interco_map0 1 set peer 10.22.19.5
    crypto map interco_map0 1 set transform-set ESP-3DES-SHA
    crypto map interco_map0 interface interco
    crypto ca trustpoint _SmartCallHome_ServerCA
     crl configure
    crypto isakmp enable interco
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet 192.168.1.0 255.255.255.0 inside
    telnet 10.12.0.0 255.255.0.0 mgmt
    telnet timeout 30
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 10.12.0.0 255.255.0.0 mgmt
    ssh timeout 30
    console timeout 0
    management-access interco
    dhcpd option 3 ip 192.168.1.1
    dhcpd address 192.168.1.100-192.168.1.254 inside
    dhcpd dns 41.79.48.66 8.8.8.8 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    username admin password eY/fQXw7Ure8Qrz7 encrypted privilege 15
    tunnel-group 10.22.19.5 type ipsec-l2l
    tunnel-group 10.22.19.5 ipsec-attributes
     pre-shared-key *****
     isakmp keepalive threshold 60 retry 5
    class-map inspection_default
     match default-inspection-traffic
    policy-map global_policy
     class inspection_default
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect snmp
      inspect icmp
    prompt hostname context
    call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:5aa0d27f15e49ea597c8097cfdb755b8
    : end
    SITE2:
    ASA Version 8.2(5)
    hostname test-luba
    domain-name test.eg
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
     description "Sortie Interco-Internet"
     switchport access vlan 2
    interface Ethernet0/1
     description "management"
     switchport access vlan 10
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.3.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 10.22.19.5 255.255.255.0
    interface Vlan10
     nameif mgmt
     security-level 0
     ip address 10.12.1.101 255.255.0.0
    ftp mode passive
    dns server-group DefaultDNS
     domain-name test.eg
    object-group network LAN-MALABO
     description LAN DE MALABO
     network-object 192.168.1.0 255.255.255.0
    object-group network LAN-BATA
     description LAN DE BATA
     network-object 192.168.2.0 255.255.255.0
    object-group network LAN-LUBA
     description LAN DE LUBA
     network-object 192.168.3.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu mgmt 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list inside_nat0_outbound
    route outside 0.0.0.0 0.0.0.0 10.22.19.254 1
    route outside 192.168.1.0 255.255.255.0 10.22.19.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map0 1 match address outside_1_cryptomap
    crypto map outside_map0 1 set pfs group1
    crypto map outside_map0 1 set peer 10.22.19.254
    crypto map outside_map0 1 set transform-set ESP-3DES-SHA
    crypto map outside_map0 interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
     crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet 10.12.0.0 255.255.0.0 mgmt
    telnet timeout 30
    ssh 192.168.3.0 255.255.255.0 inside
    ssh 10.12.0.0 255.255.0.0 mgmt
    ssh timeout 30
    console timeout 0
    management-access outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    username admin password eY/fQXw7Ure8Qrz7 encrypted privilege 15
    tunnel-group 10.22.19.254 type ipsec-l2l
    tunnel-group 10.22.19.254 ipsec-attributes
     pre-shared-key *****
     isakmp keepalive threshold 60 retry 5
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:185bd689118ba24f9a0ef2f7e80494f6
    Can anybody help why my remote site can't connect to Internet.
    REgards,
    Raitsarevo

    Hi Carv,
    Thanks for your reply. i have done finally
    i used no crypto ipsec nat-transparency udp-encapsulation in my end router only.
    and in remote access VPN i have enabled UDP for client configuration. the most imprtant is i have given IP add of same LAN pool to VPN user,
    Regards,
    Satya.M

  • One router on ASA 5505 Site to Site VPN can't ping other router

    I have two Cisco ASA routers and I have a site to site vpn set up between the two. The VPN link works but Site A can't ping anything on Site B. Site B can ping Site A. Site B can ping other pcs on it's own network. Site A has been in place for a while and has other site to site VPNs that work fine, so I think the problem is with Site B. Here is the config for Site B:
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(4)1
    hostname SaskASA
    enable password POgOWyKyb0jgJ1Hm encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.16.1 255.255.254.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    ftp mode passive
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network NETWORK_OBJ_192.168.16.0_23
    subnet 192.168.16.0 255.255.254.0
    object network NETWORK_OBJ_192.168.2.0_23
    subnet 192.168.2.0 255.255.254.0
    access-list outside_cryptomap extended permit ip 192.168.16.0 255.255.254.0 192.168.2.0 255.255.254.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static NETWORK_OBJ_192.168.16.0_23 NETWORK_OBJ_192.168.16.0_23 destination static NETWORK_OBJ_192.168.2.0_23 NETWORK_OBJ_192.168.2.0_23 no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    nat (inside,outside) after-auto source dynamic any interface
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable 444
    http 192.168.16.0 255.255.254.0 inside
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 207.228.xx.xx
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map interface outside
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcp-client client-id interface outside
    dhcpd auto_config outside
    dhcpd address 192.168.16.100-192.168.16.200 inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy GroupPolicy_207.228.xx.xxinternal
    group-policy GroupPolicy_207.228.xx.xx attributes
    vpn-tunnel-protocol ikev1 ikev2
    username User password shbn5zbLkuHP/mJX encrypted privilege 15
    tunnel-group 207.228.xx.xxtype ipsec-l2l
    tunnel-group 207.228.xx.xxgeneral-attributes
    default-group-policy GroupPolicy_207.228.xx.xx
    tunnel-group 207.228.xx.xxipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:f06bd1d6d063318339d98417b171175e
    : end
    Any ideas? Thanks.

    I looked over the config for Site A, but couldn't find anything unusual. Perhaps I'm overlooking something. Here is the config for site A:
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.2(1)
    hostname SiteA
    domain-name domain
    enable password POgOWyKyb0jgJ1Hm encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.254.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 192.168.2.6
    domain-name domain
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.14.0 255.255.254.0
    network-object 192.168.4.0 255.255.254.0
    network-object 192.168.6.0 255.255.254.0
    network-object 192.168.8.0 255.255.254.0
    object-group network DM_INLINE_NETWORK_2
    network-object 192.168.12.0 255.255.254.0
    network-object 192.168.14.0 255.255.254.0
    network-object 192.168.4.0 255.255.254.0
    network-object 192.168.6.0 255.255.254.0
    network-object 192.168.8.0 255.255.254.0
    access-list outside_1_cryptomap extended permit ip 192.168.2.0 255.255.254.0 object-group DM_INLINE_NETWORK_1
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.254.0 object-group DM_INLINE_NETWORK_2
    access-list inside_nat0_outbound extended permit ip any 192.168.15.192 255.255.255.192
    access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.254.0 192.168.16.0 255.255.254.0
    access-list VPNGeo_splitTunnelAcl standard permit any
    access-list outside_2_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.6.0 255.255.254.0
    access-list outside_3_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.4.0 255.255.254.0
    access-list outside_4_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.8.0 255.255.254.0
    access-list outside_5_cryptomap extended permit ip 192.168.2.0 255.255.254.0 192.168.16.0 255.255.254.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool GeoVPNPool 192.168.15.200-192.168.15.254 mask 255.255.254.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable 444
    http 192.168.2.0 255.255.254.0 inside
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group1
    crypto map outside_map 1 set peer 207.228.xx.xx
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map 2 match address outside_2_cryptomap
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer 208.119.xx.xx
    crypto map outside_map 2 set transform-set ESP-3DES-SHA
    crypto map outside_map 3 match address outside_3_cryptomap
    crypto map outside_map 3 set pfs group1
    crypto map outside_map 3 set peer 208.119.xx.xx
    crypto map outside_map 3 set transform-set ESP-3DES-SHA
    crypto map outside_map 4 match address outside_4_cryptomap
    crypto map outside_map 4 set pfs
    crypto map outside_map 4 set peer 208.119.xx.xx
    crypto map outside_map 4 set transform-set ESP-3DES-SHA
    crypto map outside_map 5 match address outside_5_cryptomap
    crypto map outside_map 5 set pfs group1
    crypto map outside_map 5 set peer 70.64.xx.xx
    crypto map outside_map 5 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcp-client client-id interface outside
    dhcpd auto_config outside
    dhcpd address 192.168.2.100-192.168.2.254 inside
    dhcpd auto_config outside interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy VPNGeo internal
    group-policy VPNGeo attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPNGeo_splitTunnelAcl
    username user password shbn5zbLkuHP/mJX encrypted privilege 15
    username namepassword vP98Lj8Vm5SLs9PW encrypted
    username nameattributes
    vpn-group-policy VPNGeo
    tunnel-group 207.228.xx.xxtype ipsec-l2l
    tunnel-group 207.228.xx.xxipsec-attributes
    pre-shared-key *
    tunnel-group VPNGeo type remote-access
    tunnel-group VPNGeo general-attributes
    address-pool GeoVPNPool
    default-group-policy VPNGeo
    tunnel-group VPNGeo ipsec-attributes
    pre-shared-key *
    tunnel-group 208.119.xx.xxtype ipsec-l2l
    tunnel-group 208.119.xx.xxipsec-attributes
    pre-shared-key *
    tunnel-group 208.119.xx.xx type ipsec-l2l
    tunnel-group 208.119.xx.xx ipsec-attributes
    pre-shared-key *
    tunnel-group 208.119.xx.xxtype ipsec-l2l
    tunnel-group 208.119.xx.xxipsec-attributes
    pre-shared-key *
    tunnel-group 70.64.xx.xxtype ipsec-l2l
    tunnel-group 70.64.xx.xxipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:e3adf4e597198f58cd21e508aabdbab9
    : end

  • Cisco ASA Site to Site IPSEC VPN and NAT question

    Hi Folks,
    I have a question regarding both Site to Site IPSEC VPN and NAT. Basically what I want to achieve is to do the following:
    ASA2  is at HQ and ASA1 is a remote site. I have no problem setting up a  static static Site to Site IPSEC VPN between sites. Hosts residing at  10.1.0.0/16 are able to communicate with hosts at 192.168.1.0/24, but  what i want is to setup NAT with IPSEC VPN so that host at 10.1.0.0/16  will communicate with hosts at 192.168.1.0/24 with translated addresses
    Just an example:
    Host N2 (10.1.0.1/16) will communicate with host N1 192.168.1.5 with  destination lets say 10.23.1.5 not 192.168.1.5 (Notice the last octet  should be the same in this case .5)
    The same  translation for the rest of the communication (Host N2 pings host N3  destination ip 10.23.1.6 not 192.168.1.6. again last octet is the same)
    It sounds a bit confusing for me but i have seen this type of setup  before when I worked for managed service provider where we had  connection to our clients (Site to Site Ipsec VPN with NAT, not sure how  it was setup)
    Basically we were communicating  with client hosts over site to site VPN but their real addresses were  hidden and we were using translated address as mentioned above  10.23.1.0/24 instead of (real) 192.168.1.0/24, last octet should be the  same.
    Appreciate if someone can shed some light on it.

    Hi,
    Ok so were going with the older NAT configuration format
    To me it seems you could do the following:
    Configure the ASA1 with Static Policy NAT 
    access-list L2LVPN-POLICYNAT permit ip 192.168.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    static (inside,outside) 10.23.1.0 access-list L2LVPN-POLICYNAT
    Because the above is a Static Policy NAT it means that the translation will only be done when the destination network is 10.1.0.0/16
    If you for example have a basic PAT configuration for inside -> outside traffic, the above NAT configuration and the actual PAT configuration wont interfere with eachother
    On ASA2 side you can normally configure NAT0 / NAT Exemption for the 10.1.0.0/16 network 
    access-list INSIDE-NONAT remark L2LVPN NONAT
    access-list INSIDE-NONAT permit ip 10.1.0.0 255.255.0.0 10.23.1.0 255.255.255.0
    nat (inside) 0 access-list INSIDE-NONAT
    You will have to take into consideration that your access-list defining the L2L-VPN encrypted traffic must reflect the new NAT network 
    ASA1: access-list L2LVPN-ENCRYPTIONDOMAIN permit ip 10.23.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    ASA2: access-list L2LVPN-ENCRYPTIONDOMAIN permit ip 10.1.0.0 255.255.0.0 10.23.1.0 255.255.255.0
    I could test this setup tomorrow at work but let me know if it works out.
    Please rate if it was helpful
    - Jouni

  • ASA 5520 site-to-site VPN question

    Hello,
    We have a Cisco 5520 ASA 8.2(1) connected to a Cisco RVS4000 router via an IPsec Site-to-Site VPN. The RVS4000 is located at a branch office. The tunnel works beautifully. When computers at the remote site are turned on the tunnel is established, and data is transferred back and forth.
    The only issue I'm having is being able to Remote Desktop to the branch office computers, or ping for that matter. I can ping and Remote Desktop from the branch office computers to computers at the main site where the ASA is located.
    After doing some research, I came across the this command;
    sysopt connection permit-vpn
    I haven't tried entering the command yet, but was wondering if this is something that I can try initially to see it it resolves the problem.
    Thanks,
    John

    What are your configs and network diagrams at each location?  What are you doing for DNS?  I can help quicker with that info.  Also, here are some basic site to site VPN examples if it helps.
    hostname cisco
    domain-name cisco.com
    enable password XXXXXXXX encrypted
    passwd XXXXXXXXXXX encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address XXX.XXX.XXX.XXX 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.0.0.2 255.255.255.0
    interface Ethernet0/2
    nameif backup
    security-level 0
    no ip address
    interface Ethernet0/3
    nameif outsidetwo
    security-level 0
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    dns server-group DefaultDNS
    domain-name cisco.com
    same-security-traffic permit intra-interface
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.10.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.2.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.4.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list XXX extended permit ip 10.90.238.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list XXX extended permit ip 10.90.238.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list nonat extended permit ip 10.0.10.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.2.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.4.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list split standard permit 10.0.0.0 255.255.255.0
    access-list split standard permit 10.90.238.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 1048576
    logging buffered errors
    logging trap notifications
    logging asdm informational
    logging class vpn buffered debugging
    mtu outside 1500
    mtu inside 1500
    mtu backup 1500
    mtu outsidetwo 1500
    mtu management 1500
    ip local pool vpnpool 10.0.10.100-10.0.10.200
    ip audit name Inbound-Attack attack action alarm drop
    ip audit name Inbound-Info info action alarm
    ip audit interface outside Inbound-Info
    ip audit interface outside Inbound-Attack
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inbound in interface outside
    route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map dynmap 10 set transform-set myset
    crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
    crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address XXX
    crypto map outside_map 1 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 1 set transform-set myset
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto map outside_map 2 match address XXX2
    crypto map outside_map 2 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 2 set transform-set myset
    crypto map outside_map 2 set security-association lifetime seconds 28800
    crypto map outside_map 2 set security-association lifetime kilobytes 4608000
    crypto map outside_map 3 match address XXX3
    crypto map outside_map 3 set pfs
    crypto map outside_map 3 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 3 set transform-set myset
    crypto map outside_map 3 set security-association lifetime seconds 28800
    crypto map outside_map 3 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic dynmap
    crypto map outside_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 60
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy XXXgroup internal
    group-policy XXXgroup attributes
    dns-server value XXX.XXX.XXX.XXX
    vpn-idle-timeout 30
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split
    default-domain value domain.local
    username XXX24 password XXXX encrypted privilege 15
    username admin password XXXX encrypted
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    tunnel-group XXXgroup type remote-access
    tunnel-group XXXgroup general-attributes
    address-pool vpnpool
    default-group-policy rccgroup
    tunnel-group XXXgroup ipsec-attributes
    pre-shared-key XXXXXXXXXX
    isakmp ikev1-user-authentication none
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily

  • Site-to-site VPN with dual ASA 5510s

    Hi,
    I have recently been asked to configure a VPN between two sites using an ASA 5510 at each end. I used the VPN Site-to-site wizard in ASDM on both devices and followed the instructions for the wizard to the letter. However I don't seem able to get any kind of VPN up and running. If anyone could point out where I'm going wrong then I would very much appreciate it.

    Here is the sanitised running config of SiteA:
    ASA Version 8.0(2)
    hostname MCRASA
    domain-name isal.local
    enable password xxx
    names
    interface Ethernet0/0
    description External WAN
    nameif outside
    security-level 0
    ip address 81.*.*.82 255.255.255.240
    interface Ethernet0/1
    description Internal LAN
    nameif inside
    security-level 100
    ip address 192.168.254.2 255.255.255.0
    interface Ethernet0/2
    description Demarcation zone
    nameif dmz
    security-level 50
    ip address 10.30.30.1 255.255.255.0
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    description MCRASA management
    nameif management
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    management-only
    passwd xxx
    ftp mode passive
    dns server-group DefaultDNS
    domain-name isal.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_1_cryptomap extended permit ip 192.168.254.0 255.255.255.0 host 82.*.*.50
    access-list inside_nat0_outbound extended permit ip 192.168.254.0 255.255.255.0 host 82.*.*.50
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu dmz 1500
    mtu management 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-602.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 81.*.*.82 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.254.0 255.255.255.0 inside
    http 192.168.2.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 82.*.*.50
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp enable inside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.254.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access management
    dhcpd address 192.168.2.2-192.168.2.5 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    service-policy global_policy global
    webvpn
    csd image disk0:/securedesktop-asa-3.2.1.103-k9.pkg
    username fraser password xxx encrypted privilege 15
    username fraser attributes
    memberof LOCAL
    tunnel-group 82.*.*.50 type ipsec-l2l
    tunnel-group 82.*.*.50 ipsec-attributes
    pre-shared-key *
    prompt hostname context
    Cryptochecksum:xxx

  • Site-to-site vpn with 2 asa and home router

    I am trying to establish a site-to-site vpn between 2 ASAs and am able to get the tunnel to establish and can get connectivity from the remote end of the connection to the local side. However, traffic from the local side is not able to get to the remote end. We have 2 ASA 5505 establishing the tunnel, on the remote end there is a linksys home router forwarding all traffic to the ASA outside interface on a private subnet. Our layout is as follows.
    Internal Network              Local ASA                   ISP1      ISP2          Remote Router                       Remote ASA                 Remote Network
    192.168.1.0/24         local-gateway/public ip                                 public ip/192.168.0.1/24     192.168.0.10/10.10.10.254         10.10.10.0/24
    10.10.10.0/24 (remote) -> 192.168.1.0/24 (local) works
    192.168.1.0/24 (local) -> 10.10.10.0/24 (remote) does not work
    Below are the configs of the local and remote asa. any help would be greatly appreaciated.
    local-asa
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.6 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Switch
    host 192.168.1.5
    description 2960-24 Switch
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network Mark_Public
    host 76.98.2.63
    description Mark Public
    object network Mark
    subnet 10.10.10.0 255.255.255.0
    description Marks Network
    object network Mark_routed_subnet
    subnet 192.168.0.0 255.255.255.0
    access-list outside_access_in extended permit icmp any4 any4 echo-reply
    access-list outside_access_in extended permit tcp any object home-app-svr object-group DM_INLINE_TCP_2
    access-list outside_access_in extended permit ip object Mark 192.168.1.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 object Mark
    access-list Home standard permit 192.168.1.0 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any outside
    asdm image disk0:/asdm-711.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static Mark Mark no-proxy-arp
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group outside_access_in in interface outside
    route outside 10.10.10.0 255.255.255.0 24.163.112.1 1
    route outside 10.10.10.0 255.255.255.0 76.98.2.63 128
    aaa-server Radius protocol radius
    aaa-server Radius (inside) host 192.168.1.101
    key *****
    user-identity default-domain LOCAL
    aaa authentication ssh console Radius LOCAL
    aaa authentication telnet console Radius LOCAL
    aaa authentication enable console Radius LOCAL
    aaa authentication http console Radius LOCAL
    aaa authentication serial console Radius LOCAL
    aaa accounting enable console Radius
    aaa accounting serial console Radius
    aaa accounting ssh console Radius
    aaa accounting telnet console Radius
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 66.162.9.0 255.255.255.0 outside
    http 76.98.2.63 255.255.255.255 outside
    http 10.10.10.0 255.255.255.0 inside
    snmp-server host inside 192.168.1.101 community *****
    snmp-server location 149 Cinder Cross
    snmp-server contact Ted Stout
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps cpu threshold rising
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map0 1 match address outside_cryptomap
    crypto map outside_map0 1 set peer 76.98.2.63
    crypto map outside_map0 1 set ikev1 transform-set ESP-3DES-MD5 ESP-3DES-SHA
    crypto map outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map0 interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=stout-fw
    keypair vpn.stoutte.homeip.net
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment terminal
    crl configure
    crypto ca trustpoint Home--Server-CA
    enrollment terminal
    subject-name CN=stout-fw,O=home
    keypair HOME-SERVER-CA
    crl configure
    crypto ca trustpoint HOME-SSL
    enrollment terminal
    fqdn stoutfw.homeip.net
    subject-name CN=stoutfw,O=Home
    keypair HOME-SSL
    no validation-usage
    crl configure
    crypto ca trustpoint SelfSigned
    enrollment self
    fqdn stoutfw.homeip.net
    subject-name CN=stout-fw
    keypair SelfSigned
    crl configure
    crypto ca trustpoint ASDM_TrustPoint2
    enrollment self
    fqdn 192.168.1.6
    subject-name CN=stout-fw
    keypair SelfSigned
    crl configure
    crypto ca trustpool policy
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 20
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access inside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 192.168.1.5 source inside prefer
    ssl trust-point SelfSigned outside
    ssl trust-point ASDM_TrustPoint2 inside
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    vpn-tunnel-protocol ikev1
    username stoutte password 0w8WOxYi69SDg3bs encrypted privilege 15
    username stoutte attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect profiles value VPN_client_profile type user
    tunnel-group 76.98.2.63 type ipsec-l2l
    tunnel-group 76.98.2.63 general-attributes
    default-group-policy GroupPolicy1
    tunnel-group 76.98.2.63 ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    authentication-server-group Radius LOCAL
    default-group-policy GroupPolicy_VPN
    dhcp-server link-selection 192.168.1.101
    tunnel-group VPN webvpn-attributes
    group-alias VPN enable
    class-map inspection_default
    match default-inspection-traffic
    remote-asa
    : Saved
    ASA Version 9.1(1)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.10.10.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 192.168.0.10 255.255.255.0
    ftp mode passive
    clock timezone EDT -5
    clock summer-time EDT recurring
    dns server-group DefaultDNS
    domain-name netlab.com
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Ted
    subnet 192.168.1.0 255.255.255.0
    description Teds Network
    object network Ted_Public
    host 24.163.116.187
    object network outside_private
    subnet 192.168.0.0 255.255.255.0
    object network NETWORK_OBJ_10.10.10.0_24
    subnet 10.10.10.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 10.10.10.0 255.255.255.0 object Ted
    access-list outside_access_in extended permit icmp any4 any4 echo-reply
    access-list outside_access_in extended permit ip object Ted 10.10.10.0 255.255.255.0
    access-list outside_access_in extended permit ip object Ted_Public any
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    logging debug-trace
    nat (inside,outside) source static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 destination static Ted Ted no-proxy-arp
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 192.168.0.1 1
    route outside 192.168.1.0 255.255.255.0 192.168.0.1 1
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 24.163.116.187 255.255.255.255 outside
    http 192.168.0.0 255.255.255.0 outside
    http 10.10.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto map outside_map2 1 match address outside_cryptomap
    crypto map outside_map2 1 set peer 24.163.116.187
    crypto map outside_map2 1 set ikev1 transform-set ESP-3DES-MD5 ESP-3DES-SHA
    crypto map outside_map2 interface outside
    crypto ikev2 enable outside
    crypto ikev2 enable inside
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    ssh 10.10.10.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    dhcpd address 10.10.10.1-10.10.10.20 inside
    dhcpd enable inside
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    vpn-tunnel-protocol ikev1
    username admin password 8Ec7AqG6iwxq6gQ2 encrypted privilege 15
    tunnel-group 24.163.116.187 type ipsec-l2l
    tunnel-group 24.163.116.187 general-attributes
    default-group-policy GroupPolicy1
    tunnel-group 24.163.116.187 ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:2f4107de10e7171c3d951745c56b8d01
    : end
    no asdm history enable

    I am trying to establish a site-to-site vpn between 2 ASAs and am able to get the tunnel to establish and can get connectivity from the remote end of the connection to the local side. However, traffic from the local side is not able to get to the remote end. We have 2 ASA 5505 establishing the tunnel, on the remote end there is a linksys home router forwarding all traffic to the ASA outside interface on a private subnet. Our layout is as follows.
    Internal Network              Local ASA                   ISP1      ISP2          Remote Router                       Remote ASA                 Remote Network
    192.168.1.0/24         local-gateway/public ip                                 public ip/192.168.0.1/24     192.168.0.10/10.10.10.254         10.10.10.0/24
    10.10.10.0/24 (remote) -> 192.168.1.0/24 (local) works
    192.168.1.0/24 (local) -> 10.10.10.0/24 (remote) does not work
    Below are the configs of the local and remote asa. any help would be greatly appreaciated.
    local-asa
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.6 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Switch
    host 192.168.1.5
    description 2960-24 Switch
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network Mark_Public
    host 76.98.2.63
    description Mark Public
    object network Mark
    subnet 10.10.10.0 255.255.255.0
    description Marks Network
    object network Mark_routed_subnet
    subnet 192.168.0.0 255.255.255.0
    access-list outside_access_in extended permit icmp any4 any4 echo-reply
    access-list outside_access_in extended permit tcp any object home-app-svr object-group DM_INLINE_TCP_2
    access-list outside_access_in extended permit ip object Mark 192.168.1.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.1.0 255.255.255.0 object Mark
    access-list Home standard permit 192.168.1.0 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any outside
    asdm image disk0:/asdm-711.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static Mark Mark no-proxy-arp
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group outside_access_in in interface outside
    route outside 10.10.10.0 255.255.255.0 24.163.112.1 1
    route outside 10.10.10.0 255.255.255.0 76.98.2.63 128
    aaa-server Radius protocol radius
    aaa-server Radius (inside) host 192.168.1.101
    key *****
    user-identity default-domain LOCAL
    aaa authentication ssh console Radius LOCAL
    aaa authentication telnet console Radius LOCAL
    aaa authentication enable console Radius LOCAL
    aaa authentication http console Radius LOCAL
    aaa authentication serial console Radius LOCAL
    aaa accounting enable console Radius
    aaa accounting serial console Radius
    aaa accounting ssh console Radius
    aaa accounting telnet console Radius
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 66.162.9.0 255.255.255.0 outside
    http 76.98.2.63 255.255.255.255 outside
    http 10.10.10.0 255.255.255.0 inside
    snmp-server host inside 192.168.1.101 community *****
    snmp-server location 149 Cinder Cross
    snmp-server contact Ted Stout
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps cpu threshold rising
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map0 1 match address outside_cryptomap
    crypto map outside_map0 1 set peer 76.98.2.63
    crypto map outside_map0 1 set ikev1 transform-set ESP-3DES-MD5 ESP-3DES-SHA
    crypto map outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map0 interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=stout-fw
    keypair vpn.stoutte.homeip.net
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment terminal
    crl configure
    crypto ca trustpoint Home--Server-CA
    enrollment terminal
    subject-name CN=stout-fw,O=home
    keypair HOME-SERVER-CA
    crl configure
    crypto ca trustpoint HOME-SSL
    enrollment terminal
    fqdn stoutfw.homeip.net
    subject-name CN=stoutfw,O=Home
    keypair HOME-SSL
    no validation-usage
    crl configure
    crypto ca trustpoint SelfSigned
    enrollment self
    fqdn stoutfw.homeip.net
    subject-name CN=stout-fw
    keypair SelfSigned
    crl configure
    crypto ca trustpoint ASDM_TrustPoint2
    enrollment self
    fqdn 192.168.1.6
    subject-name CN=stout-fw
    keypair SelfSigned
    crl configure
    crypto ca trustpool policy
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 20
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access inside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 192.168.1.5 source inside prefer
    ssl trust-point SelfSigned outside
    ssl trust-point ASDM_TrustPoint2 inside
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    vpn-tunnel-protocol ikev1
    username stoutte password 0w8WOxYi69SDg3bs encrypted privilege 15
    username stoutte attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect profiles value VPN_client_profile type user
    tunnel-group 76.98.2.63 type ipsec-l2l
    tunnel-group 76.98.2.63 general-attributes
    default-group-policy GroupPolicy1
    tunnel-group 76.98.2.63 ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    authentication-server-group Radius LOCAL
    default-group-policy GroupPolicy_VPN
    dhcp-server link-selection 192.168.1.101
    tunnel-group VPN webvpn-attributes
    group-alias VPN enable
    class-map inspection_default
    match default-inspection-traffic
    remote-asa
    : Saved
    ASA Version 9.1(1)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.10.10.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 192.168.0.10 255.255.255.0
    ftp mode passive
    clock timezone EDT -5
    clock summer-time EDT recurring
    dns server-group DefaultDNS
    domain-name netlab.com
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network Ted
    subnet 192.168.1.0 255.255.255.0
    description Teds Network
    object network Ted_Public
    host 24.163.116.187
    object network outside_private
    subnet 192.168.0.0 255.255.255.0
    object network NETWORK_OBJ_10.10.10.0_24
    subnet 10.10.10.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 10.10.10.0 255.255.255.0 object Ted
    access-list outside_access_in extended permit icmp any4 any4 echo-reply
    access-list outside_access_in extended permit ip object Ted 10.10.10.0 255.255.255.0
    access-list outside_access_in extended permit ip object Ted_Public any
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    logging debug-trace
    nat (inside,outside) source static NETWORK_OBJ_10.10.10.0_24 NETWORK_OBJ_10.10.10.0_24 destination static Ted Ted no-proxy-arp
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 192.168.0.1 1
    route outside 192.168.1.0 255.255.255.0 192.168.0.1 1
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 24.163.116.187 255.255.255.255 outside
    http 192.168.0.0 255.255.255.0 outside
    http 10.10.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto map outside_map2 1 match address outside_cryptomap
    crypto map outside_map2 1 set peer 24.163.116.187
    crypto map outside_map2 1 set ikev1 transform-set ESP-3DES-MD5 ESP-3DES-SHA
    crypto map outside_map2 interface outside
    crypto ikev2 enable outside
    crypto ikev2 enable inside
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    ssh 10.10.10.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    dhcpd address 10.10.10.1-10.10.10.20 inside
    dhcpd enable inside
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    vpn-tunnel-protocol ikev1
    username admin password 8Ec7AqG6iwxq6gQ2 encrypted privilege 15
    tunnel-group 24.163.116.187 type ipsec-l2l
    tunnel-group 24.163.116.187 general-attributes
    default-group-policy GroupPolicy1
    tunnel-group 24.163.116.187 ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:2f4107de10e7171c3d951745c56b8d01
    : end
    no asdm history enable

  • Cisco ASA 5505 Site to Site

    Hello, I am having some issues configuring two ASA's for Site to Site and am seeking some help. I greatly appreciate your times and efforts. When I do a
    L2Lsite2# show crypto isakmp sa
    There are no isakmp sas
    L2Lsite2# show crypto ipsec sa
    There are no ipsec sas
    If I am on side L2Lsite1 I cannot ping 192.168.3.1
    Will repost configs later.
    Thanks again in advance for your help in this important issue.

    Hello,
    I am in need of more help. Now that I have moved the installation I cannot get it to work properly.  The issue is the two asa's can ping eachothers inside interfaces just fine(see below) but they cannot ping any other devices on the network(see below). This issue relates to both sides. Thanks in advance.
    L2Lsite2# ping inside 10.0.0.5 (site1's internal IP)
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.0.0.5, timeout is 2 seconds:
    Success rate is 100 percent (5/5), round-trip min/avg/max = 30/36/40 ms
    L2Lsite2# ping inside 10.0.0.1(device on site1's network)
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    The help is greatly appreciated.
    Side 1:
    L2LSite1# sh run
    : Saved
    ASA Version 7.2(3)
    hostname L2LSite1
    enable password 0M8kPLt5hmzMzfqa encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.0.5 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    access-list crypto_acl extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
    access-list do_not_nat extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list do_not_nat
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa authentication ssh console LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set encryption_type_set esp-3des esp-sha-hmac
    crypto map outside_map 20 match address crypto_acl
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer x.x.x.x
    crypto map outside_map 20 set transform-set encryption_type_set
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    console timeout 5
    management-access inside
    class-map inspection_default
    match default-inspection-traffic
    class-map class
    match default-inspection-traffic
    policy-map type inspect dns dns_inspection
    parameters
      message-length maximum 512
    policy-map policy
    class class
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect snmp
      inspect http
      inspect dns dns_inspection
    service-policy policy global
    username aplus password m6zItLhnhjBU/z6I encrypted
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group x.x.x.x ipsec-attributes
    pre-shared-key *
    prompt hostname context
    Cryptochecksum:ef9e72ae4d06957f050dbc1fd16a842c
    : end
    L2LSite1# sh ipsec sa
    interface: outside
        Crypto map tag: outside_map, seq num: 20, local addr: x.x.x.x
          access-list crypto_acl permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)
          current_peer: x.x.x.x
          #pkts encaps: 17, #pkts encrypt: 17, #pkts digest: 17
          #pkts decaps: 7, #pkts decrypt: 7, #pkts verify: 7
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 17, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: x.x.x.x, remote crypto endpt.: x.x.x.x
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: 14952F72
        inbound esp sas:
          spi: 0x009CB49C (10269852)
             transform: esp-3des esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 7, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (3824999/28369)
             IV size: 8 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x14952F72 (345321330)
             transform: esp-3des esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 7, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (3824998/28369)
             IV size: 8 bytes
             replay detection support: Y
    L2LSite1# packet-tracer input inside icmp 10.0.0.5 8 8 10.0.1.6
    Phase: 1
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 2
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   0.0.0.0         0.0.0.0         outside
    Phase: 3
    Type: ACCESS-LIST
    Subtype:
    Result: DROP
    Config:
    Implicit Rule
    Additional Information:
    Result:      
    input-interface: inside
    input-status: up
    input-line-status: up
    output-interface: outside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    Site 2:
    L2Lsite2# sh run
    : Saved
    ASA Version 7.2(4)
    hostname L2Lsite2
    enable password 0M8kPLt5hmzMzfqa encrypted
    passwd 0M8kPLt5hmzMzfqa encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.49 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    shutdown    
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 8.8.8.8
    access-list crypto_acl extended permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
    access-list do_not_nat extended permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin\
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list do_not_nat
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    aaa authentication ssh console LOCAL
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set encryption_type_set esp-3des esp-sha-hmac
    crypto map outside_map 20 match address crypto_acl
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer x.x.x.x
    crypto map outside_map 20 set transform-set encryption_type_set
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    console timeout 5
    management-access inside
    username aplus password m6zItLhnhjBU/z6I encrypted
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group x.x.x.x ipsec-attributes
    pre-shared-key *
    class-map class
    match default-inspection-traffic
    policy-map type inspect dns dns_inspection
    parameters
      message-length maximum 512
    policy-map policy
    class class
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect snmp
      inspect http
      inspect dns dns_inspection
    service-policy policy global
    prompt hostname context
    Cryptochecksum:4d1dc33d95e4d294a1c96473ef81a393
    : end
    L2Lsite2# sh ipsec sa
    interface: outside
        Crypto map tag: outside_map, seq num: 20, local addr: x.x.x.x
          access-list crypto_acl permit ip 10.0.1.0 255.255.255.0 10.0.0.0 255.255.255.0
          local ident (addr/mask/prot/port): (10.0.1.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
          current_peer: x.x.x.x
          #pkts encaps: 9, #pkts encrypt: 9, #pkts digest: 9
          #pkts decaps: 19, #pkts decrypt: 19, #pkts verify: 19
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 9, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: x.x.x.x , remote crypto endpt.: x.x.x.x
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: 009CB49C
        inbound esp sas:
          spi: 0x14952F72 (345321330)
             transform: esp-3des esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 7, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4274998/28008)
             IV size: 8 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x009CB49C (10269852)
             transform: esp-3des esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 7, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4274999/28008)
             IV size: 8 bytes
             replay detection support: Y
    L2Lsite2# packet-tracer input inside  icmp 10.0.1.49 8 8 10.0.0.1
    Phase: 1
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 2
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   0.0.0.0         0.0.0.0         outside
    Phase: 3
    Type: ACCESS-LIST
    Subtype:
    Result: DROP
    Config:
    Implicit Rule
    Additional Information:
    Result:      
    input-interface: inside
    input-status: up
    input-line-status: up
    output-interface: outside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    Thanks again!

Maybe you are looking for