OAS 4.0.8.1 RH62 www port 80 (permision denied)

Hi
I can start wrksf
i can start admin
But i cannot start www listener port
I recive permision denied while
assinging a port (domain ... addres .. port:80)
Apache does not installed
Thank you
null

Hi
Forget it
I start www (port 80 under 1024 ) with root
account
it works well
Thanks
null

Similar Messages

  • WebCache Failed to start : Failed to assign port 80: Permission denied

    Hi All,
    I have three server running IAS 10.1.2.0.2, running forms and reports application. One Infra and two Midtier.
    Suddenly Midtier1 is crashed, but before it happen I have already backup with TAR : OracleHome and all its related configuration files.
    After the crash, I reinstall the RH Linux same version and update and then restore ( TAR -xvf ) the backup that I have.
    When I run opmnctl startall, all ias-component started, EXCEPT one : WEB CACHE.
    When I look at Webcache event Log, here is the error :
    [11/May/2004:17:29:05 +0700] [notification 9612] [ecid: -] OracleAS Web Cache 10g (10.1.2), Build 10.1.2.0.2 050802
    [11/May/2004:17:29:05 +0700] [notification 9612] [ecid: -] OracleAS Web Cache 10g (10.1.2), Build 10.1.2.0.2 050802
    [11/May/2004:17:29:05 +0700] [notification 9403] [ecid: -] Maximum number of file/socket descriptors set to 900.
    [11/May/2004:17:29:05 +0700] [notification 9403] [ecid: -] Maximum number of file/socket descriptors set to 900.
    [11/May/2004:17:29:05 +0700] [notification 13002] [ecid: -] Maximum allowed incoming connections are 700
    [11/May/2004:17:29:05 +0700] [notification 13002] [ecid: -] Maximum allowed incoming connections are 700
    [11/May/2004:17:29:05 +0700] [alert 13305] [ecid: -] Failed to assign port 80: Permission denied
    [11/May/2004:17:29:05 +0700] [alert 9707] [ecid: -] Failed to start the server.
    [11/May/2004:17:29:05 +0700] [alert 9609] [ecid: -] The server process could not initialize.
    [11/May/2004:17:29:05 +0700] [notification 9610] [ecid: -] The server is exiting.
    [11/May/2004:17:29:05 +0700] [alert 9000] [ecid: -] Process 3268 exit(1) at 890:main.c [Build 10.1.2.0.2 050802]
    [11/May/2004:17:29:05 +0700] [warning 11917] [ecid: -] SSL wallet Origin Server Wallet file /etc/ORACLE/WALLETS/oraias/ewallet.p12 does not exist.
    [11/May/2004:17:29:05 +0700] [warning 11917] [ecid: -] SSL wallet Origin Server Wallet file /etc/ORACLE/WALLETS/oraias/ewallet.der does not exist.
    [11/May/2004:17:29:05 +0700] [warning 11919] [ecid: -] The SSL wallet autologin file /etc/ORACLE/WALLETS/oraias/cwallet.sso does not exist. Wallet does not appear to be autologin wallet.
    [11/May/2004:17:29:05 +0700] [warning 11921] [ecid: -] The origin server wallet did not open. Operating without wallet for backend. Only Diffie-Hellman anonymous connections supported to origin servers.
    [11/May/2004:17:29:05 +0700] [warning 11922] [ecid: -] Origin Server Wallet wallet fails to open at location /etc/ORACLE/WALLETS/oraias, NZE-28759, as user oraias
    [11/May/2004:17:29:06 +0700] [notification 9607] [ecid: -] The admin server started successfully.
    How can I solve this problem ?
    Thank you for your help,
    xtanto

    Hi xtanto,
    You may not have set up the privileges for running on a port less than 1024 (i.e. port 80) in your old back-uped tar-file.
    Please check Chapter 8 "Running webcached with Root Privilege" in the Web Cache Admin document.
    http://download-east.oracle.com/docs/cd/B14099_19/caching.1012/b14046/basics.htm#sthref1060
    Regards,
    Martin

  • How 2 config OID 10.1.2.02 OAS install? Cannot get past HOST / Port screen?

    My problem is I cannot figure out HOW to install / configure OID, so that I get past the host / port screen ... there is nothing in my Programs links that indicates anything. The "DIPadmin" won't let me log in ... I am really stuck and really annoyed. Don't even know if I need OID, but can't seem to install OAS10g w/o it.
    The installation guide does NOT EVEN HAVE "Internet Directory" IN THE INDEX of a 380 page document ... it devotes a WHOLE CHAPTER to how to set up users ... BUT IT SEEMS TO BE A BIG SECRET as to what the host name and port number should be.
    Can ANYONE Clarify this for me??
    I am trying to install 10.1.2.0.2 (I do not think I want the BEA weblogic server, at least, not yet). What I want is a server for Forms/Reports 10g, maybe BI, maybe portal ... don't know if I really need a repository. ... and also want to use ApEx via this Apache webserver config, if at all possible (can I put a DBLINK in the metadata repository, to link to the real db? do I want to?)
    I will be buy-you-a-beer-at-ODTUG-grateful, if someone could clue me in as to what I am missing.
    Suzanne

    I can see the enormous torment you got in your attempts to install OAS and because of your years of this torture, let me share you some notes here.
    Let me try what could be an easy way to have an OAS installation with version 10.1.2.0.2. This will be good for a portal installation. minor changes can lead you to install BI or webcache types.
    there is a whole bunch of assumptions and details that are important but they may again give problems for a new person in installing the OAS. so I am skipping them all. this installation will be a simple single system install with both infra and midtier on the same system. you can run the second part of the installation (midtier on another system too which should be connected in the network). but again, first have the simplest piece, then look for sophistication.
    i can see that you are working on Windows system.
    edit etc/hosts file
    please beware; this assumes that you are using a clean system. that means, no other applications are critically relying on your etc/hosts file. and editing this file will not affect their functioning. also, i am assuming that this machine that you have will not be exposed behind your company's firewalls. so even by naming it www.myfirstoas.com, you won't actually be going to this URL on internet.
    edit your etc/hosts file as follows, then you should be all set:
    xx.x.x.xxx www.myfirstoas.com
    give the ip address of your machine in this case;
    Now install the Infrastructure first:
    These will be the answers of the first few questions asked;
    Infra Home: Infra1012
    Location: D:\ORACLE\Infra1012
    Confirmed that I have administrator privileges on the machine;
    -- orcldefaultsubscriber=dc=myfirstoas,dc=com
    automatic port assignments
    go with the suggested namespace = dc=myfirstoas,dc=com
    DB Name: infra.myfirstoas.com
    SID : infra
    using same password for:
    SYS, SYSTEM, SYSMAN, DBSNMP : myfirstoas01
    instance name : Infra1012
    ias_admin pwd : myoasadmin01
    click install
    -- that should be all you need to install the Infrastructure 10.1.2.0.2.
    now i would advise that you keep writing all installation info in your notes and save it. Also copy and paste the message of successful completion in it, and save it.
    now reboot your system.
    now install Middletier;
    after reboot, rerun the OUI installer:
    Midtier Home: Midtier1012
    Location: D:\ORACLE\Midtier1012
    Confirm that you have administrator privileges on the machine;
    -- orcldefaultsubscriber=dc=myfirstoas,dc=com
    -- configured with OID on
    host : www.myfirstoas.com
    port : 389
    username: orcladmin
    pwd : myoasadmin01 (note that this is the pwd for your ias_admin account for infra)
    DB connect string: www.myfirstoas.com:1521:infra.myfirstoas.com:infra.myfirstoas.com
    instance name: Midtier1012
    ias_admin pwd: oasAdmin02 (i kept the two ias_admin pwds different to highlight that the infra and midtier instances are different)
    click install
    -- that should be enough to install midtier.
    again, always keep all installation info in your notes and save it. Also copy and paste the message of successful completion in it, and save it.
    also, always reboot your system after any installation to avoid weird transient problems.
    it should all be done in about 3 hours or so.
    hope that helps!
    AMN

  • JMS Bridge from WLS to OAS not working; automatic redirection to JMS Port

    We have setup a JMS Bridge inbetween Weblogic Server 10.3.0 and Oracle App Server 10.1.3. In our test environment it is working fine. But, in LIVE, we are facing a problem. Firewall is there inbetween OAS and WLS.
    1. OAS Admin port 6003, is blocked by firewall. So, from outside environment we can't connect to this port.
    2. OAS Port 12401 (RMI Port) is not-blocked
    3. OAS Port 12601 (JMS Port) is blocked by firewall
    4. We created credential "JMS_USER" while configuring QueueConnFactory at OAS end and used it while setting up WLS JMS Bridge
    We are using ormi://172.24.255.59:12401/default as Provider URL from Weblogic while creating JMS Bridge.
    Problem
    ========
    While connecting from WLS we are getting the following error from WLS end:
    javax.jms.JMSException: Unable to create a connection to "apgst366/172.24.255.59:12,601" as user "JMS_USER".
         at com.evermind.server.jms.JMSUtils.make(JMSUtils.java:1050)
         at com.evermind.server.jms.JMSUtils.toJMSException(JMSUtils.java:1130)
         at com.evermind.server.jms.EvermindConnection.<init>(EvermindConnection.java:132)
         at com.evermind.server.jms.EvermindQueueConnection.<init>(EvermindQueueConnection.java:71)
    Question
    =========
    1) We are requesting for 12401; then why the JMS Port 12601 is being referred?
    2) Is there any automatic redirection from OAS end?
    3) Will unblocking the 12601 port by Firewall help?
    Please help me, as this has become a burning issue for us.
    Thanks in advance.

    Can anybody please help me?

  • OAS 4.0.8.1 Listener www fails on Linux

    Hi people,
    I've installed Oracle Application Server 4.0.8.1 on Slackware 7.0 e I don't achieve to start the www listener. It seems to be that the user that owns the application server don't have enoght privileges to initialize the listener.
    Does anybody kwnows what's happening?
    Thanks for attention,
    Fabio

    <BLOCKQUOTE><font size="1" face="Verdana, Arial">quote:</font><HR>Originally posted by Rodgerh:
    Rob
    I have OAS 4.0.8.1 succefully running on 4 Linux boxes, 6.1 and 6.2.
    All of them display the same message during startup. The ip address 0.0.0.0 in the message is normal.<HR></BLOCKQUOTE>
    Do you have Oracle 8i installed on the SAME MACHINE as 4.0.8.1?
    Thanks.
    null

  • BEA-002606: Weblogic server runs on port 80 - permission denied.

    Hi,
    I am new to weblogic, just started to playing around with it. I setup weblogic server with a cluster consisting of 2 servers, all running locally. I was trying to configure the web server functionality on weblogic 10.3. I followed the exact steps described at http://edocs.bea.com/wls/docs103/config_wls/web_server.html, but I keep on getting a permission denied error:
    <Dec 2, 2008 3:00:10 PM> <Info> <NodeManager> <Working directory is "/opt/bea/user_projects/domains/firstDomain">
    <Dec 2, 2008 3:00:10 PM> <Info> <NodeManager> <Server output log file is "/opt/bea/user_projects/domains/firstDomain/servers/server03/logs/server03.out">
    <Dec 2, 2008 3:00:12 PM MYT> <Info> <WebLogicServer> <BEA-000377> <Starting WebLogic Server with Java HotSpot(TM) Server VM Version 10.0-b19 from Sun Microsystems Inc.>
    <Dec 2, 2008 3:00:13 PM MYT> <Info> <Management> <BEA-141107> <Version: WebLogic Server 10.3 Fri Jul 25 16:30:05 EDT 2008 1137967 >
    <Dec 2, 2008 3:00:16 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to STARTING>
    <Dec 2, 2008 3:00:16 PM MYT> <Info> <WorkManager> <BEA-002900> <Initializing self-tuning thread pool>
    <Dec 2, 2008 3:00:16 PM MYT> <Notice> <Log Management> <BEA-170019> <The server log file /opt/bea/user_projects/domains/firstDomain/servers/server03/logs/server03.log is opened. All server side log events will be written to this file.>
    <Dec 2, 2008 3:00:26 PM MYT> <Notice> <Security> <BEA-090082> <Security initializing using security realm myrealm.>
    <Dec 2, 2008 3:00:41 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to STANDBY>
    <Dec 2, 2008 3:00:41 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to STARTING>
    <Dec 2, 2008 3:00:44 PM MYT> <Notice> <Log Management> <BEA-170027> <The Server has established connection with the Domain level Diagnostic Service successfully.>
    <Dec 2, 2008 3:00:44 PM MYT> <Notice> <Cluster> <BEA-000197> <Listening for announcements from cluster using unicast cluster messaging>
    <Dec 2, 2008 3:00:44 PM MYT> <Notice> <Cluster> <BEA-000133> <Waiting to synchronize with other running members of Cluster-00.>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to ADMIN>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to RESUMING>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <Cluster> <BEA-000162> <Starting "async" replication service with remote cluster address "null">
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <Cluster> <BEA-000162> <Starting "man" replication service with remote cluster address "null">
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <Cluster> <BEA-000162> <Starting "man-async" replication service with remote cluster address "null">
    <Dec 2, 2008 3:01:14 PM MYT> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "Default". The address 172.16.141.1 might be incorrect or another process is using port 80: java.net.BindException: Permission denied.>
    <Dec 2, 2008 3:01:14 PM MYT> <Emergency> <Security> <BEA-090087> <Server failed to bind to the configured Admin port. The port may already be used by another process.>
    <Dec 2, 2008 3:01:14 PM MYT> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "Default[3]". The address 127.0.0.1 might be incorrect or another process is using port 80: java.net.BindException: Permission denied.>
    <Dec 2, 2008 3:01:14 PM MYT> <Critical> <WebLogicServer> <BEA-000362> <Server failed. Reason: Server failed to bind to any usable port. See preceeding log message for details.>
    <Dec 2, 2008 3:01:14 PM MYT> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "Default[2]". The address 10.8.8.31 might be incorrect or another process is using port 80: java.net.BindException: Permission denied.>
    <Dec 2, 2008 3:01:14 PM MYT> <Error> <Server> <BEA-002606> <Unable to create a server socket for listening on channel "Default[1]". The address 192.168.140.1 might be incorrect or another process is using port 80: java.net.BindException: Permission denied.>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
    <Dec 2, 2008 3:01:14 PM MYT> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <Cluster> <BEA-000163> <Stopping "async" replication service>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <Cluster> <BEA-000163> <Stopping "man" replication service>
    <Dec 2, 2008 3:01:14 PM MYT> <Notice> <Cluster> <BEA-000163> <Stopping "man-async" replication service>
    <Dec 2, 2008 3:01:15 PM> <Debug> <NodeManager> <Waiting for the process to die: 19768>
    <Dec 2, 2008 3:01:15 PM> <Info> <NodeManager> <Server failed during startup so will not be restarted>
    <Dec 2, 2008 3:01:15 PM> <Debug> <NodeManager> <runMonitor returned, setting finished=true and notifying waiters>
    Netstat shows:
    netstat -an | grep 172.16.141.1
    tcp6 0 0 172.16.141.1:7001 :::* LISTEN
    tcp6 0 0 172.16.141.1:7005 :::* LISTEN
    tcp6 0 0 172.16.141.1:43991 172.16.141.1:7001 ESTABLISHED
    tcp6 0 0 172.16.141.1:7005 172.16.141.1:46728 ESTABLISHED
    tcp6 0 0 172.16.141.1:7001 172.16.141.1:43991 ESTABLISHED
    tcp6 0 0 172.16.141.1:46728 172.16.141.1:7005 ESTABLISHED
    tcp6 1 0 172.16.141.1:43999 172.16.141.1:7001 CLOSE_WAIT
    udp 0 0 172.16.141.1:137 0.0.0.0:*
    udp 0 0 172.16.141.1:138 0.0.0.0:*
    Port 80 is not being used by the IP. Am quite lost at the moment on how to troubleshoot this problem.
    Appreciate any advice offered. Thanks in advance.

    There's not much benefit to having 2 instances on the same machines vs having one instance on that machine. Putting a load balancer in front of a machine with 2 hosts only helps you when you lose a mgd server - but not when you lose an entire machine ( since both mgd servers go away too )
    Consider:
    Mgd Server A on machine myHost1 with java memory 512m/512m
    Mgd Server B on machine myHost1 with java memory512m/512m
    vs
    Mgd Server A on machine myHost1 with java memory 1024m/1024m
    vs
    Mgd Server A on machine myHost1 with java memory1024m/1024m
    Mgd Server B on machine myHost2 with java memory 1024m/1024m
    The first config is your current situation. Your two mgd servers are fighting each other for processing time & memory on that machine. They can't use the same ports, so how does a user decide which port to use when they access your application?
    The second config combines their resources into one mgd server
    The third gives you load balancing ability - you can survive the loss of a machine. Also note that since the 2 instances are on DIFFERENT machines, they CAN use the same non-SSL and SSL ports.

  • Cannot make OAS 4.0.8.2 work.

    Hi,
    I have recently download the OAS4082 NT version and installed on my Windows 2000 Professional machine.
    I can successfully start the OAS manager from the port:8888. The www and admin listeners are both working. I can also access the port:8080 which is my www port. But, I cannot start any of the applications installed on the OAS server. If my machine's name is "mymachine". Then, the following URL only give me the page not found error message: "http://mymachine:8080/owsstat".
    Please help me. Thank you very much!
    Sincerely,
    Xin Zhang

    Problem solved.
    I deleted OAS 4.0.8.2.0 and installed Web-to-go. Then I installed OAS 4.0.8.2.0.

  • ASA 5505 unable to access ASDM ( just needs some ports ope and FWDing setup)

    I was able to access the ASDM launcher in the browser yesterday   via    https://192.168.111.1/admin and I was stuck there as the browser version says that my ASA image does not work with my ASDM version...      So i tried some trouble shooting and think that i may have changed the image to an image that does not exist.     (I'm not sure where it is that I would actually place that image either)    Now i am unable to access through the browser at all.
    Anyways, I am ok with SSH/CLI and have been using my firewall in this manner.   I am walking into this companies current configuration and simply need to do the following:
    I need to OPEN ports 9000, 85, 40085, 49005 so that my mobile device can pull my security cameras in the office 
    I need to set port forwarding so that any connections that hit outside-in ip address 205.214.36.53:1610 >>> http://192.168.111.30:1610/AndroidWS/     for our new mobile CRM.
    I have been through some of your related discussions and am falling short somewhere.   Please help
    here is my "show run"  and my "dir"
    ciscoasa(config)# show run
    : Saved
    ASA Version 9.0(2)
    hostname ciscoasa
    domain-name scec.local
    enable password ol40hHpZTtZQFXMJ encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd ol40hHpZTtZQFXMJ encrypted
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif INSIDE
     security-level 100
     ip address 192.168.111.1 255.255.255.0
    interface Vlan2
     nameif OUTSIDE
     security-level 0
     ip address 205.214.236.50 255.255.255.240
    boot system disk0:/asa902-k8.bin
    boot system disk0:/asa825-k8.bin
    boot system disk0:/asa831-k8.bin
    ftp mode passive
    dns domain-lookup INSIDE
    dns domain-lookup OUTSIDE
    dns server-group DefaultDNS
     name-server 192.168.111.50
     name-server 8.8.8.8
     domain-name scec.local
    object network LAN
     subnet 192.168.111.0 255.255.255.0
    object network SERVER1
     host 192.168.111.50
    object network SERVER1_PUBLIC
     host 205.214.236.51
    object network SERVER2
     host 192.168.111.20
    object network SERVER2_PUBLIC
     host 205.214.236.52
    object network SERVER3
     host 192.168.111.30
    object network SERVER3_PUBLIC
     host 205.214.236.53
    object network SERVER4
     host 192.168.111.40
    object network SERVER4_PUBLIC
     host 205.214.236.54
    object network SERVER5
     host 192.168.111.10
    object network SERVER5_PUBLIC
     host 205.214.236.55
    object-group service SERVER1_PORTS tcp
     port-object eq www
     port-object eq https
     port-object eq smtp
     port-object eq pop3
     port-object eq imap4
     port-object eq 3389
    object-group service SERVER2_PORTS tcp
     port-object eq 3389
    object-group service SERVER3_PORTS tcp
     port-object eq 3389
    object-group service SERVER4_PORTS tcp
     port-object eq 3389
    object-group service SERVER5_PORTS tcp
     port-object eq 3389
     port-object eq www
     port-object eq https
    access-list OUTSIDE_IN extended deny ip 10.0.0.0 255.0.0.0 any log
    access-list OUTSIDE_IN extended deny ip 172.16.0.0 255.240.0.0 any log
    access-list OUTSIDE_IN extended deny ip 192.168.0.0 255.255.0.0 any log
    access-list OUTSIDE_IN extended deny ip 127.0.0.0 255.0.0.0 any log
    access-list OUTSIDE_IN extended deny ip 0.0.0.0 255.255.255.0 any log
    access-list OUTSIDE_IN extended deny ip 244.0.0.0 255.255.255.240 any log
    access-list OUTSIDE_IN extended deny ip host 255.255.255.255 any log
    access-list OUTSIDE_IN extended permit icmp any any echo-reply
    access-list OUTSIDE_IN extended permit icmp any any time-exceeded
    access-list OUTSIDE_IN extended permit icmp any any unreachable
    access-list OUTSIDE_IN extended permit tcp any object SERVER1 object-group SERVER1_PORTS
    access-list OUTSIDE_IN extended permit tcp any object SERVER2 object-group SERVER2_PORTS
    access-list OUTSIDE_IN extended permit tcp any object SERVER3 object-group SERVER3_PORTS
    access-list OUTSIDE_IN extended permit tcp any object SERVER4 object-group SERVER4_PORTS
    access-list OUTSIDE_IN extended permit tcp any object SERVER5 object-group SERVER5_PORTS
    access-list inside-out extended permit ip any any
    pager lines 24
    logging asdm informational
    mtu INSIDE 1500
    mtu OUTSIDE 1500
    ip audit name OUTSIDE_ATTACK attack action alarm drop
    ip audit name OUTSIDE_INFO info action alarm
    ip audit name INSIDE_ATTACK attack action alarm drop reset
    ip audit name INSIDE_INFO info action alarm
    ip audit interface INSIDE INSIDE_INFO
    ip audit interface OUTSIDE OUTSIDE_INFO
    ip audit interface OUTSIDE OUTSIDE_ATTACK
    ip audit signature 2000 disable
    ip audit signature 2001 disable
    ip audit signature 2004 disable
    ip audit signature 2005 disable
    ip audit signature 6051 disable
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-509.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (INSIDE,OUTSIDE) source static SERVER1 SERVER1_PUBLIC
    nat (INSIDE,OUTSIDE) source static SERVER2 SERVER2_PUBLIC
    nat (INSIDE,OUTSIDE) source static SERVER3 SERVER3_PUBLIC
    nat (INSIDE,OUTSIDE) source static SERVER4 SERVER4_PUBLIC
    nat (INSIDE,OUTSIDE) source static SERVER5 SERVER5_PUBLIC
    object network LAN
     nat (INSIDE,OUTSIDE) dynamic interface
    access-group inside-out in interface INSIDE
    access-group OUTSIDE_IN in interface OUTSIDE
    route OUTSIDE 0.0.0.0 0.0.0.0 205.214.236.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    aaa authorization exec LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 INSIDE
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association pmtu-aging infinite
    crypto ca trustpool policy
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 INSIDE
    ssh 0.0.0.0 0.0.0.0 OUTSIDE
    ssh timeout 5
    ssh version 2
    console timeout 0
    dhcpd option 3 ip 192.168.111.1
    dhcpd address 192.168.111.100-192.168.111.200 INSIDE
    dhcpd dns 192.168.111.50 8.8.8.8 interface INSIDE
    dhcpd enable INSIDE
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    username wti password OIEBfkGT1DRShCnN encrypted privilege 15
    username admin password g/t7o/eHDKMomDrS encrypted privilege 15
    username vpnuser password 8DcFkqJ9hi39UQw. encrypted privilege 15
    username sysadmin password mi1AUI982JWkJuWt encrypted
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:6dd04d2527e7929343ebd090969e18a1
    : end
    ciscoasa(config)# dir
    Directory of disk0:/
    148    -rwx  15390720     09:08:54 Jul 31 2013  asa825-k8.bin      
    149    -rwx  27611136     09:43:48 Oct 31 2013  asa902-k8.bin
    150    -rwx  2048         00:00:00 Jan 01 1980  FSCK0000.REC
    20     drwx  2048         09:12:16 Jul 31 2013  coredumpinfo
    151    -rwx  16280544     09:14:46 Jul 31 2013  asdm-645.bin
    10     drwx  2048         09:19:42 Jul 31 2013  log
    19     drwx  2048         09:20:08 Jul 31 2013  crypto_archive
    153    -rwx  14240396     14:14:18 Jun 11 2014  asdm-631.bin
    154    -rwx  4096         00:00:00 Jan 01 1980  FSCK0001.REC
    155    -rwx  12998641     09:20:28 Jul 31 2013  csd_3.5.2008-k9.pkg
    156    drwx  2048         09:20:30 Jul 31 2013  sdesktop
    157    -rwx  6487517      09:20:32 Jul 31 2013  anyconnect-macosx-i386-2.5.2014-k9.pkg
    158    -rwx  6689498      09:20:36 Jul 31 2013  anyconnect-linux-2.5.2014-k9.pkg
    159    -rwx  4678691      09:20:38 Jul 31 2013  anyconnect-win-2.5.2014-k9.pkg
    160    -rwx  4096         00:00:00 Jan 01 1980  FSCK0002.REC
    161    -rwx  4096         00:00:00 Jan 01 1980  FSCK0003.REC
    162    -rwx  4096         00:00:00 Jan 01 1980  FSCK0004.REC
    163    -rwx  6144         00:00:00 Jan 01 1980  FSCK0005.REC
    164    -rwx  6144         00:00:00 Jan 01 1980  FSCK0006.REC
    165    -rwx  6144         00:00:00 Jan 01 1980  FSCK0007.REC
    166    -rwx  22528        00:00:00 Jan 01 1980  FSCK0008.REC
    167    -rwx  38912        00:00:00 Jan 01 1980  FSCK0009.REC
    168    -rwx  34816        00:00:00 Jan 01 1980  FSCK0010.REC
    169    -rwx  43008        00:00:00 Jan 01 1980  FSCK0011.REC
    170    -rwx  2048         00:00:00 Jan 01 1980  FSCK0012.REC
    171    -rwx  26624        00:00:00 Jan 01 1980  FSCK0013.REC
    172    -rwx  2048         00:00:00 Jan 01 1980  FSCK0014.REC
    173    -rwx  26624        00:00:00 Jan 01 1980  FSCK0015.REC
    174    -rwx  2048         00:00:00 Jan 01 1980  FSCK0016.REC
    175    -rwx  2505         09:46:08 Oct 31 2013  8_2_5_0_startup_cfg.sav
    176    -rwx  1189         09:46:12 Oct 31 2013  upgrade_startup_errors_201310310946.log
    177    -rwx  100          16:42:40 Jun 10 2014  upgrade_startup_errors_201406101642.log
    178    -rwx  100          14:52:26 Jun 11 2014  upgrade_startup_errors_201406111452.log
    127004672 bytes total (21886976 bytes free)
    Please let me know if you need any other information from me so that i can get our mobile devices to connect to the new CRM from outside the network and allow the owner access on his mobile device to the company cameras.
    ************** (NOTE: I can do both of these things currently from within the network without any issues)*************
    THANKS

    Jgreene -
    This doesn't specifically answer your question, but if you want to get ASDM functionality back you need to load a newer version onto flash memory and then point the ASA to that with the configuration command:
    asdm image disk0:/asdm-version.bin
    You are running  ASA Version 9.0(2) so you need at least version 7 of ASDM to support that.  Interestingly enough your "asdm image" statement in your config points to asdm-509.bin and you have asdm-631.bin and asdm-645.bin on flash.  None of those will work.  I suggest loading up asdm-721.bin and changing the asdm image statement accordingly.  I am pretty sure a reboot is required after that is done.
    Good Luck!
    -Jeff

  • 2 OAS on the same server

    we have installed a OAS 10.1.3.0 on Linux. is it posble to install OAS 10.1.3.3 on the same server, is there any confliction?
    if it posible, how can I change the port number for the 2nd OAS? or will it detect the port have been used and choose diffrent port? how do I install the 2nd one, should I install another OAS 10.1.3.0 and apply patch on it to upgrade to OAS 10.1.3.3?

    Thank you for reply.
    but I have 2 things need to be clearified:
    1. what's the purpose of "use the apache from 10.1.3.0 and use it to create oc4j mountpoints for your 10.1.3.3 installation"
    2. in cureent download ,the 10.1.3.3 is avalible as a patch, should I install the 2nd 10.1.3.0 and then do upgrading to 10.1.3.3?
    thanks

  • FTP Port ERROR Forwarding in Cisco ASA 8.2(5), Very Intersting.

    Hi,
    I  have the following configuration on a Cisco ASA 8.2(5), all the traffic  to the port 5000 go to an IP Camera and www 80 it's forward throught static NAT to a Web Server without problem,  I have the same Configuration for a FTP SERVER Windows and FTP Server Linux and doesn't make the foward to an internal IP address.  Attach is  the configuration I would like to know what is causing the problems.
    The  FTP Server Are running locally without any problems, when I try to  reach it for the Outside interface then i  can't, this is in the only  port i can't forward.
    I really appreciate your help.
    Thanks
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password dAWCvYvyr2FRISo5 encrypted
    passwd dAWCvYvyr2FRISo5 encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.2 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    ftp mode passive
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 8.8.4.4
    name-server 8.8.8.8
    name-server 196.3.81.132
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service TEST2 tcp
    port-object eq www
    port-object eq https
    access-list 101 extended permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list 101 extended permit icmp any interface outside echo-reply
    access-list 101 extended permit udp any any eq 5000
    access-list 101 extended permit udp any any eq ntp
    access-list 101 extended permit udp any 192.168.1.0 255.255.255.0 eq tftp
    access-list 102 extended permit icmp any interface outside echo-reply
    access-list 102 extended permit icmp any interface outside
    access-list 102 extended permit ip any host 192.168.1.5
    access-list 102 extended permit tcp any host 192.168.1.5 eq 5000
    access-list 102 extended permit tcp any interface outside eq 5000
    access-list 102 extended permit tcp any host 192.168.1.5 eq https
    access-list 102 extended permit tcp any any eq 5000
    access-list 102 extended permit ip any host 192.168.1.8
    access-list 102 extended permit tcp any any eq telnet
    access-list 102 extended permit tcp any interface outside object-group TEST2
    access-list 102 extended permit ip any 192.168.1.0 255.255.255.0
    access-list 102 extended permit tcp any interface outside eq www
    access-list 102 extended permit tcp any interface outside eq ftp
    access-list 102 extended permit tcp any interface outside eq ftp-data
    access-list 102 extended permit tcp any any eq ftp
    access-list 103 extended permit udp any 192.168.1.0 255.255.255.0 eq tftp
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 192.168.1.0 255.255.255.0
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 5000 192.168.1.5 5000 netmask 255.255.255.255
    static (inside,outside) tcp interface www 192.168.1.15 www netmask 255.255.255.255
    static (inside,outside) tcp interface ftp 192.168.1.15 ftp netmask 255.255.255.255
    static (inside,outside) tcp interface ftp-data 192.168.1.15 ftp-data netmask 255.255.255.255
    access-group 102 in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 225.255.255.0 inside
    telnet timeout 30
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.10-192.168.1.41 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username cabelen password tJPt4MkXkeex6ITZ encrypted
    class-map ftp-class
    match access-list 102
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect ftp
      inspect dns preset_dns_map
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:3465bc9d04198e9df80787c0c039db27
    : end
    ciscoasa#

    This is the results of the log it didn't not find the public ip address which im making FTP connection.
    ciscoasa#  sh logg | i 147.197.115.171
    ciscoasa#  sh logg
    Syslog logging: enabled
        Facility: 20
        Timestamp logging: disabled
        Standby logging: disabled
        Debug-trace logging: disabled
        Console logging: disabled
        Monitor logging: disabled
        Buffer logging: level debugging, 88 messages logged
        Trap logging: disabled
        History logging: disabled
        Device ID: disabled
        Mail logging: disabled
        ASDM logging: level informational, 68 messages logged
    connection 125407 for outside:111.221.74.28/443 to inside:192.168.1.24/24483 duration 0:02:01 bytes
    44
    %ASA-7-609002: Teardown local-host outside:111.221.74.28 duration 0:02:01
    %ASA-7-710005: UDP request discarded from 192.168.1.24/138 to inside:192.168.1.255/138
    %ASA-6-302016: Teardown UDP connection 125402 for outside:177.0.186.239/57036 to inside:192.168.1.24
    /24483 duration 0:02:02 bytes 220
    %ASA-7-609002: Teardown local-host outside:177.0.186.239 duration 0:02:02
    %ASA-6-302016: Teardown UDP connection 125408 for outside:89.240.135.18/47096 to inside:192.168.1.24
    /24483 duration 0:02:01 bytes 44
    %ASA-7-609002: Teardown local-host outside:89.240.135.18 duration 0:02:01
    %ASA-6-302016: Teardown UDP connection 125409 for outside:111.221.77.145/40037 to inside:192.168.1.2
    4/24483 duration 0:02:01 bytes 486
    %ASA-7-609002: Teardown local-host outside:111.221.77.145 duration 0:02:01
    %ASA-6-302016: Teardown UDP connection 125410 for outside:64.4.23.148/40014 to inside:192.168.1.24/2
    4483 duration 0:02:01 bytes 178
    %ASA-7-609002: Teardown local-host outside:64.4.23.148 duration 0:02:01
    %ASA-6-305012: Teardown dynamic UDP translation from inside:192.168.1.24/24483 to outside:69.86.151.
    109/54119 duration 0:03:00
    %ide:216.146.39.70/80 to inside:192.168.1.5/3628 duration 0:00:00 bytes 303 TCP FINs
    %ASA-7-609002: Teardown local-host outside:216.146.39.70 duration 0:00:00
    nable_15' executed the 'configure terminal' command.
    %ASA-6-302015: Built inbound UDP connection 125412 for inside:192.168.1.20/68 (192.168.1.20/68) to i
    dentity:192.168.1.2/67 (192.168.1.2/67)
    %ASA-6-604103: DHCP daemon interface inside:  address granted 0128.987b.d28e.e7 (192.168.1.20)
    %ASA-6-302016: Teardown UDP connection 125411 for inside:192.168.1.27/68 to identity:192.168.1.2/67
    duration 0:02:01 bytes 623
    %ASA-5-111008: User 'enable_15' executed the 'no access-list 102 extended permit ip any 192.168.1.0
    255.255.255.0' command.
    %ASA-6-302010: 20 in use, 234 most used
    %ASA-5-111008: User 'enable_15' executed the 'no access-list 102 extended permit ip any host 192.168
    .1.8' command.
    %ASA-5-111005: 192.168.1.24 end configuration: OK
    %ASA-6-302016: Teardown UDP connection 125412 for inside:192.168.1.20/68 to identity:192.168.1.2/67
    duration 0:02:01 bytes 641
    %ASA-7-609001: Built local-host outside:209.128.96.248
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.20/57764 to outside:69.86.151.109
    /50424
    %ASA-6-302013: Built outbound TCP connection 125413 for outside:209.128.96.248/80 (209.128.96.248/80
    ) to inside:192.168.1.20/57764 (69.86.151.109/50424)
    %ASA-7-111009: User 'enable_15' executed cmd: show running-config
    %ASA-7-111009: User 'enable_15' executed cmd: show logging
    %ASA-7-609001: Built local-host outside:174.35.22.69
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.24/51106 to outside:69.86.151.109
    /53818
    %ASA-6-302013: Built outbound TCP connection 125414 for outside:174.35.22.69/80 (174.35.22.69/80) to
    inside:192.168.1.24/51106 (69.86.151.109/53818)
    %ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.24/51107 to outside:69.86.151.109
    /12433
    %ASA-6-302013: Built outbound TCP connection 125415 for outside:174.35.22.69/80 (174.35.22.69/80) to
    inside:192.168.1.24/51107 (69.86.151.109/12433)
    %ASA-7-609001: Built local-host outside:8.8.8.8
    %ASA-6-305011: Built dynamic UDP translation from inside:192.168.1.24/51214 to outside:69.86.151.109
    /42103
    %ASA-6-302015: Built outbound UDP connection 125416 for outside:8.8.8.8/53 (8.8.8.8/53) to inside:19
    2.168.1.24/51214 (69.86.151.109/42103)
    %ASA-6-302016: Teardown UDP connection 125416 for outside:8.8.8.8/53 to inside:192.168.1.24/51214 du
    ration 0:00:00 bytes 176
    %ASA-7-609002: Teardown local-host outside:8.8.8.8 duration 0:00:00
    %ASA-6-302014: Teardown TCP connection 125414 for outside:174.35.22.69/80 to inside:192.168.1.24/511
    06 duration 0:00:06 bytes 2075 TCP FINs
    %ASA-6-302014: Teardown TCP connection 125415 for outside:174.35.22.69/80 to inside:192.168.1.24/511
    07 duration 0:00:06 bytes 3016 TCP FINs
    %ASA-7-609002: Teardown local-host outside:174.35.22.69 duration 0:00:06
    ciscoasa#

  • Simple Port Forwarding / ACL Question

    Hi Everyone,
    I'm kind of a novice when it comes to Cisco configuration. I went to college for networking but haven't used it enough since graduating and I'm having some trouble with opening some ports for email to my home PC.
    Specifically i'm trying to set up IMAP with Gmail to be downloaded to my Mozilla Thunderbird client. I'm using a similar syntax for other ports that i've opened but it isn't working. I also did a "show access list" and saw that one of my rules had hit counts on it but i'm not sure what this means as far as troubleshooting goes.
    Can someone lend a hand and explain what i'm doing wrong? If you're feeling extra nice could you let me know what I would need to do to open some Xbox Live ports as well? The rules aren't set up yet but the ports are present in my config. I've bolded the relevant ports below.
    *** Config ****
    ASA Version 8.2(5)
    hostname RyansFirewall
    enable password C5OQraC02mISnP8p encrypted
    passwd 3mBdM08UO1apR0bB encrypted
    names
    name 192.168.1.130 theking
    name 192.168.1.240 wap
    name 192.168.1.252 cam
    name 192.168.1.253 switch
    name 192.168.1.150 xbox
    name x.x.x.x vpnreactor
    name x.x.x.x HSoftware
    name x.x.x.x Mom_and_Dad
    interface Ethernet0/0
    description Connection_to_Cable_Modem
    switchport access vlan 10
    interface Ethernet0/1
    description Cisco_Catalyst_2960
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    description Guest_Wireless
    switchport access vlan 20
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    description Private_Internal_Lan
    nameif inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Vlan10
    description WOW_Internet
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    description Guest_Wireless
    no forward interface Vlan1
    nameif dmz
    security-level 30
    ip address 172.16.1.254 255.255.255.0
    boot system disk0:/asa825-k8.bin
    ftp mode passive
    clock timezone Eastern -5
    object-group network outside_ip_group
    description This group contains a list of allowed public IP Addresses
    network-object HSoftware 255.255.255.255
    network-object Mom_and_Dad 255.255.255.255
    object-group service Xbox_Ports tcp-udp
    description Ports needed for Xbox Live
    port-object eq www
    port-object eq 88
    port-object eq domain
    port-object eq 3074
    object-group service Email_Ports tcp-udp
    description Ports needed for Email
    port-object eq 143
    port-object eq 465
    port-object eq 587
    port-object eq 993
    access-list outside_access_in extended permit tcp object-group outside_ip_group any eq 1024
    access-list outside_access_in extended permit tcp any any eq 3389
    access-list outside_access_in extended permit tcp any any eq ftp
    access-list outside_access_in extended permit gre host vpnreactor host theking
    access-list outside_access_in extended permit tcp host vpnreactor host theking eq pptp
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended permit icmp any any time-exceeded
    access-list outside_access_in extended permit icmp any any unreachable
    access-list outside_access_in extended permit tcp object-group outside_ip_group any eq 5900
    access-list outside_access_in extended permit tcp any any object-group Email_Ports
    access-list outside_access_in extended permit udp any any object-group Email_Ports
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-635.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (outside) 1 access-list outside_access_in
    nat (dmz) 1 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 3389 theking 3389 netmask 255.255.255.255
    static (inside,outside) tcp interface ftp theking ftp netmask 255.255.255.255
    static (inside,outside) tcp interface 1024 cam 1024 netmask 255.255.255.255
    static (inside,outside) tcp interface 5900 theking 5900 netmask 255.255.255.255
    static (inside,outside) tcp interface 143 theking 143 netmask 255.255.255.255
    static (inside,outside) tcp interface 465 theking 465 netmask 255.255.255.255
    static (inside,outside) tcp interface 587 theking 587 netmask 255.255.255.255
    static (inside,outside) tcp interface 993 theking 993 netmask 255.255.255.255
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh Mom_and_Dad 255.255.255.255 outside
    ssh HSoftware 255.255.255.255 outside
    ssh timeout 10
    console timeout 10
    dhcpd address 192.168.1.2-192.168.1.25 inside
    dhcpd dns x.x.x.x x.x.x.x interface inside
    dhcpd lease 10800 interface inside
    dhcpd domain RyanJohn interface inside
    dhcpd enable inside
    dhcpd address 172.16.1.2-172.16.1.25 dmz
    dhcpd dns 8.8.8.8 8.8.4.4 interface dmz
    dhcpd domain RyanJohnGuest interface dmz
    dhcpd enable dmz
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username XXXXX password ZpRIy72StEDDpdfG encrypted
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:3c7abf7d5d55aba0e19d5da340132000
    : end
    *** Show Access List ****
    RyansFirewall# show access-list outside_access_in
    access-list outside_access_in; 19 elements; name hash: 0x6892a938
    access-list outside_access_in line 1 extended permit tcp object-group outside_ip_group any eq 1024 0xf13a69fb
      access-list outside_access_in line 1 extended permit tcp host HSoftware any eq 1024 (hitcnt=0) 0xc8c42900
      access-list outside_access_in line 1 extended permit tcp host Mom_and_Dad any eq 1024 (hitcnt=0) 0x7e777675
    access-list outside_access_in line 2 extended permit tcp any any eq 3389 (hitcnt=7451) 0x51a647d7
    access-list outside_access_in line 3 extended permit tcp any any eq ftp (hitcnt=11) 0x8d0d5aac
    access-list outside_access_in line 4 extended permit gre host vpnreactor host theking (hitcnt=0) 0x894a4bbb
    access-list outside_access_in line 5 extended permit tcp host vpnreactor host theking eq pptp (hitcnt=0) 0xcb0322a8
    access-list outside_access_in line 6 extended permit icmp any any echo-reply (hitcnt=563) 0x54b872f3
    access-list outside_access_in line 7 extended permit icmp any any time-exceeded (hitcnt=703) 0x03690eb3
    access-list outside_access_in line 8 extended permit icmp any any unreachable (hitcnt=7408) 0x5c2fa603
    access-list outside_access_in line 9 extended permit tcp object-group outside_ip_group any eq 5900 0xe88875b2
      access-list outside_access_in line 9 extended permit tcp host HSoftware any eq 5900 (hitcnt=0) 0x2208e16f
      access-list outside_access_in line 9 extended permit tcp host Mom_and_Dad any eq 5900 (hitcnt=0) 0xa3aaaedd
    access-list outside_access_in line 10 extended permit tcp any any object-group Email_Ports 0x91529965
      access-list outside_access_in line 10 extended permit tcp any any eq imap4 (hitcnt=17) 0x53d153bd
      access-list outside_access_in line 10 extended permit tcp any any eq 465 (hitcnt=0) 0x4d992f5e
      access-list outside_access_in line 10 extended permit tcp any any eq 587 (hitcnt=0) 0x734d200d
      access-list outside_access_in line 10 extended permit tcp any any eq 993 (hitcnt=0) 0xb91930a9
    access-list outside_access_in line 11 extended permit udp any any object-group Email_Ports 0xe12dbb9d
      access-list outside_access_in line 11 extended permit udp any any eq 143 (hitcnt=0) 0x34d1c49d
      access-list outside_access_in line 11 extended permit udp any any eq 465 (hitcnt=0) 0x5cc4b908
      access-list outside_access_in line 11 extended permit udp any any eq 587 (hitcnt=0) 0x6e3b53a3
      access-list outside_access_in line 11 extended permit udp any any eq 993 (hitcnt=0) 0x7f9dd9b7

    Hi Riyasat,
    Here is the result of the command. I'm a little confused though as it said it passed through although this port is still not open to my inside host.
    RyansFirewall# packet-tracer input outside tcp 8.8.8.8 465 Outside_IP 465 detailed
    Phase: 1
    Type: UN-NAT
    Subtype: static
    Result: ALLOW
    Config:
    static (inside,outside) tcp interface 465 theking 465 netmask 255.255.255.255
      match tcp inside host theking eq 465 outside any
        static translation to Outside_IP/465
        translate_hits = 0, untranslate_hits = 2
    Additional Information:
    NAT divert to egress interface inside
    Untranslate Outside_IP/465 to theking/465 using netmask 255.255.255.255
    Phase: 2
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group outside_access_in in interface outside
    access-list outside_access_in extended permit tcp any any eq 465
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xd863ac20, priority=12, domain=permit, deny=false
            hits=9, user_data=0xd613bd70, cs_id=0x0, flags=0x0, protocol=6
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=465, dscp=0x0
    Phase: 3
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xd7de9018, priority=0, domain=inspect-ip-options, deny=true
            hits=20003, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 4
    Type: NAT
    Subtype: host-limits
    Result: ALLOW
    Config:
    nat (outside) 1 access-list outside_access_in
      match tcp outside any outside any eq 3389
        dynamic translation to pool 1 (Outside_IP [Interface PAT])
        translate_hits = 0, untranslate_hits = 0
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xd7e62278, priority=2, domain=host, deny=false
            hits=25913, user_data=0xd7e61e60, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 5
    Type: HOST-LIMIT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xd7debf90, priority=0, domain=host-limit, deny=false
            hits=143, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 6
    Type: NAT
    Subtype: rpf-check
    Result: ALLOW
    Config:
    static (inside,outside) tcp interface 465 theking 465 netmask 255.255.255.255
      match tcp inside host theking eq 465 outside any
        static translation to Outside_IP/465
        translate_hits = 0, untranslate_hits = 2
    Additional Information:
    Forward Flow based lookup yields rule:
    out id=0xd7e84380, priority=5, domain=nat-reverse, deny=false
            hits=3, user_data=0xd7e58b08, cs_id=0x0, flags=0x0, protocol=6
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=theking, mask=255.255.255.255, port=465, dscp=0x0
    Phase: 7
    Type: NAT
    Subtype: host-limits
    Result: ALLOW
    Config:
    static (inside,outside) tcp interface 3389 theking 3389 netmask 255.255.255.255
      match tcp inside host theking eq 3389 outside any
        static translation to 0.0.0.0/3389
        translate_hits = 0, untranslate_hits = 107
    Additional Information:
    Reverse Flow based lookup yields rule:
    in  id=0xd7e70e30, priority=5, domain=host, deny=false
            hits=1642, user_data=0xd7e6c678, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=theking, mask=255.255.255.255, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 8
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Reverse Flow based lookup yields rule:
    in  id=0xd7d9e160, priority=0, domain=inspect-ip-options, deny=true
            hits=30929, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 9
    Type: FLOW-CREATION
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    New flow created with id 31012, packet dispatched to next module
    Module information for forward flow ...
    snp_fp_tracer_drop
    snp_fp_inspect_ip_options
    snp_fp_tcp_normalizer
    snp_fp_translate
    snp_fp_adjacency
    snp_fp_fragment
    snp_ifc_stat
    Module information for reverse flow ...
    snp_fp_tracer_drop
    snp_fp_inspect_ip_options
    snp_fp_translate
    snp_fp_tcp_normalizer
    snp_fp_adjacency
    snp_fp_fragment
    snp_ifc_stat
    Result:
    input-interface: outside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: allow

  • Need Help on Port Blocking in ASA

    Dear All,
    I have configured firewall and allow only port 443 and deny all tcp ports for destination, but when i am scanning from port scanner it shows several tcp ports are enabled.. need your seuggestion and help on it.. how to block these tcp ports..
    Early response is required..
    Thanks

    Hi,
    Still don't know the ports that were supposedly open.
    Though if that is the ACL you have bound to the "outside" interface on the ASA then it should be blocking the connections through the ASA for everything else other than the TCP/443 for a single destination IP address.
    Then there is naturally the ASAs own services and ports on which its listening on.
    You can check that with the following command
    show asp table socket
    Most likely the ports that are open on the ASA are the ones used for management purposes perhaps
    Those set with the following commands
    telnet
    ssh
    http
    You also have the option to create an ACL that blocks all traffic to the ASA "outside" interface IP address. You can then attach it with "access-group" command
    access-group in interface outside control-plane
    This would limit the "To the Box" traffic. Though the above mentioned management commands "telnet", "ssh" and "http" would still override this ACL.
    - Jouni

  • Extended ACL permit ip and allowed ports

                       Hi everyone
    Need to confirm if we have extended ACL with object group below
    access-list xy_access_in extended permit ip object-group xy_subnets object-group cisco_ynetworks
    will above ACL allow all the ports  on the destination object group?
    Thanks
    mahesh

    And to illustrate the situation above
    Situation 1 - Only allow rule exists on the ACL
    object-group network SOURCE
    network-object 10.10.10.0 255.255.255.0
    network-object 10.10.20.0 255.255.255.0
    object-group network DESTINATION
    network-object 10.10.100.0 255.255.255.0
    network-object 10.10.200.0 255.255.255.0
    access-list SOURCE-IN permit ip object-group SOURCE object-group DESTINATION
    The above ACL would
    Allow ALL TCP/UDP source and destination ports
    Allow those from the source networks of SOURCE to the destination networks of DESTINATION
    Situation 2 - Deny rules exist before the allowing rule
    object-group network SOURCE
    network-object 10.10.10.0 255.255.255.0
    network-object 10.10.20.0 255.255.255.0
    object-group network DESTINATION
    network-object 10.10.100.0 255.255.255.0
    network-object 10.10.200.0 255.255.255.0
    access-list SOURCE-IN deny ip host 10.10.10.10 host 10.10.100.100
    access-list SOURCE-IN deny tcp host 10.10.10.10 host 10.10.200.200 eq 80
    access-list SOURCE-IN permit ip object-group SOURCE object-group DESTINATION
    The above ACL would
    First block ALL TCP/UDP traffic from host 10.10.10.10 to host 10.10.100.100
    It would also block TCP traffic from host 10.10.10.10 to host 10.10.200.200 on the destination port TCP/80
    It would then allow ALL TCP/UDP traffic from the source networks of SOURCE to the destination networks of DESTINATION
    The key thing to notice ofcourse would be that we have blocked some traffic on the first 2 lines of the ACL and then allowed ALL TCP/UDP traffic.
    So host 10.10.10.10 cant communicate with host 10.10.100.100 on any port since the "deny" rule for that is at the top of the ACL BEFORE the rule that allows ALL TCP/UDP traffic between these networks.
    In the other case the TCP/80 destination traffic from host 10.10.10.10 to host 10.10.200.200 would be blocked BUT rest of the TCP/UDP traffic would be allowed by the rule using the "object-group"
    - Jouni

  • SSO Authentication Not Working

    Our configuration is HTML DB v1.6.0.00.87 running on our host name hostx with port 7779 and the OAS HTTP server running on hostx on port 7778.
    I had our administrator follow the instructions in http://www.oracle.com/technology/products/database/htmldb/howtos/sso_partner_app.html for registering HTML DB as a partner application. I have one HTML DB application setup for an authentication scheme of "Based on authentication scheme from gallery:Oracle Application Server Single Sign-On (HTML DB as Partner Application)". When I attempt to run it from Application Builder, I get the error below and it then directs me to http://hostx:7779/pls/our_dad/f? and the "p=" is missing for some reason and gives me a "Error ERR-7620 Could not determine workspace for application ()." error.
    Error in portal_sso_redirect: missing application registration:
    Error p_partner_app_name:g_listener_token:HTML_DB:hostx:7778
    Please register this application as described in the installation guide.
    Redirecting to login server for authentication.
    The URL for running the application is: http://hostx:7779/pls/our_dad/f?p=101:1
    My system administrator has checked to see the HTML_DB listener token is set correctly. When she queried against the wwsec_enabler_config_info$ table the token looks OK. It returns 7779 as the port number, but the error message above is listing 7778. Why?
    What can we look at to determine the cause of this problem? I am struggling because I am not familiar with the Oracle Application Server environment.

    Now SERVER_PORT and HTTP_PORT are both 7778 in SQL Workshop. They are both pointing to the port that HTTP is running on. Is this correct? I would assume not because the HTML DB application that uses the SSO Partner App. scheme is still giving me the same error:
    Error in portal_sso_redirect: missing application registration:
    Error p_partner_app_name:g_listener_token:HTML_DB:hostx:7778
    Please register this application as described in the installation guide.
    Redirecting to login server for authentication.
    If HTTP is running on port 7778, then should HTTP_PORT be 7778? I assume, yes.
    If HTML DB was installed on port 7779, then should SERVER_PORT be 7779? I assume, yes.
    What sets the values of SERVER_PORT and HTTP_PORT within HTML DB?
    My admin reran regapp.sql and defined the HTML_DB listener token as HTML_DB:hostx:7779, yet based on the error above HTTP is looking on port 7778 for HTML DB and not finding it. Am I interpreting the error correctly?

  • Cisco ASA 5505 site to site Multiple subnet.

    Hi. I need some help configuring my cisco asa 5505.
    I've set up a VPN tunnel between two ASA 5505
    Site 1:
    Subnet 192.168.77.0
    Site 2:
    Have multiple vlans and now the tunnel goes to vlan400 - 192.168.1.0
    What I need help with:
    From site 1 i need to be able to reach another vlan on site 2. vlan480 - 192.168.20.0
    And from site 1 I need to reach 192.168.77.0 subnet from vlan480 - 192.168.20.0
    Vlan480 is used for phones. In vlan480 we have a PABX central.
    Is this possible to do?
    Any help would be greatfully appreciated!
    Config site 2:
    : Saved
    ASA Version 7.2(2)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    names
    name 192.168.1.250 DomeneServer
    name 192.168.1.10 NotesServer
    name 192.168.1.90 OvServer
    name 192.168.1.97 TerminalServer
    name 192.168.1.98 w8-eyeshare
    name 192.168.50.10 w8-print
    name 192.168.1.94 w8-app
    name 192.168.1.89 FonnaFlyMedia
    interface Vlan1
    nameif Vlan1
    security-level 100
    ip address 192.168.200.100 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address 79.x.x.226 255.255.255.224
    ospf cost 10
    interface Vlan400
    nameif vlan400
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    ospf cost 10
    interface Vlan450
    nameif Vlan450
    security-level 100
    ip address 192.168.210.1 255.255.255.0
    ospf cost 10
    interface Vlan460
    nameif Vlan460-SuldalHotell
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    ospf cost 10
    interface Vlan461
    nameif Vlan461-SuldalHotellGjest
    security-level 100
    ip address 192.168.3.1 255.255.255.0
    ospf cost 10
    interface Vlan462
    nameif Vlan462-Suldalsposten
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    ospf cost 10
    interface Vlan470
    nameif vlan470-Kyrkjekontoret
    security-level 100
    ip address 192.168.202.1 255.255.255.0
    ospf cost 10
    interface Vlan480
    nameif vlan480-Telefoni
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    ospf cost 10
    interface Vlan490
    nameif Vlan490-QNapBackup
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    ospf cost 10
    interface Vlan500
    nameif Vlan500-HellandBadlands
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    ospf cost 10
    interface Vlan510
    nameif Vlan510-IsTak
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    ospf cost 10
    interface Vlan600
    nameif Vlan600-SafeQ
    security-level 100
    ip address 192.168.50.1 255.255.255.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    switchport access vlan 500
    switchport trunk allowed vlan 400,450,460-462,470,480,500,510,600,610
    switchport mode trunk
    interface Ethernet0/3
    switchport access vlan 490
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd x encrypted
    ftp mode passive
    clock timezone WAT 1
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group service Lotus_Notes_Utgaaande tcp
    description Frim Notes og ut til alle
    port-object eq domain
    port-object eq ftp
    port-object eq www
    port-object eq https
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq pptp
    port-object eq smtp
    object-group service Lotus_Notes_inn tcp
    description From alle og inn til Notes
    port-object eq www
    port-object eq lotusnotes
    port-object eq pop3
    port-object eq smtp
    object-group service Reisebyraa tcp-udp
    port-object range 3702 3702
    port-object range 5500 5500
    port-object range 9876 9876
    object-group service Remote_Desktop tcp-udp
    description Tilgang til Remote Desktop
    port-object range 3389 3389
    object-group service Sand_Servicenter_50000 tcp-udp
    description Program tilgang til Sand Servicenter AS
    port-object range 50000 50000
    object-group service VNC_Remote_Admin tcp
    description Frå oss til alle
    port-object range 5900 5900
    object-group service Printer_Accept tcp-udp
    port-object range 9100 9100
    port-object eq echo
    object-group icmp-type Echo_Ping
    icmp-object echo
    icmp-object echo-reply
    object-group service Print tcp
    port-object range 9100 9100
    object-group service FTP_NADA tcp
    description Suldalsposten NADA tilgang
    port-object eq ftp
    port-object eq ftp-data
    object-group service Telefonsentral tcp
    description Hoftun
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    port-object eq telnet
    object-group service Printer_inn_800 tcp
    description Fra 800  nettet og inn til 400 port 7777
    port-object range 7777 7777
    object-group service Suldalsposten tcp
    description Sending av mail vha Mac Mail programmet - åpner smtp
    port-object eq pop3
    port-object eq smtp
    object-group service http2 tcp
    port-object range 81 81
    object-group service DMZ_FTP_PASSIVE tcp-udp
    port-object range 55536 56559
    object-group service DMZ_FTP tcp-udp
    port-object range 20 21
    object-group service DMZ_HTTPS tcp-udp
    port-object range 443 443
    object-group service DMZ_HTTP tcp-udp
    port-object range 8080 8080
    object-group service DNS_Query tcp
    port-object range domain domain
    object-group service DUETT_SQL_PORT tcp-udp
    description For kobling mellom andre nett og duett server
    port-object range 54659 54659
    access-list outside_access_in extended permit ip any any
    access-list outside_access_out extended permit ip any any
    access-list vlan400_access_in extended deny ip any host 149.20.56.34
    access-list vlan400_access_in extended deny ip any host 149.20.56.32
    access-list vlan400_access_in extended permit ip any any
    access-list Vlan450_access_in extended deny ip any host 149.20.56.34
    access-list Vlan450_access_in extended deny ip any host 149.20.56.32
    access-list Vlan450_access_in extended permit ip any any
    access-list Vlan460_access_in extended deny ip any host 149.20.56.34
    access-list Vlan460_access_in extended deny ip any host 149.20.56.32
    access-list Vlan460_access_in extended permit ip any any
    access-list vlan400_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_Utgaaande
    access-list vlan400_access_out extended permit tcp any host DomeneServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host TerminalServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host OvServer object-group http2
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Lotus_Notes_inn
    access-list vlan400_access_out extended permit tcp any host NotesServer object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-eyeshare object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host w8-app object-group Remote_Desktop
    access-list vlan400_access_out extended permit tcp any host FonnaFlyMedia range 8400 8600
    access-list vlan400_access_out extended permit udp any host FonnaFlyMedia range 9000 9001
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host DomeneServer
    access-list vlan400_access_out extended permit tcp 192.168.4.0 255.255.255.0 host w8-app object-group DUETT_SQL_PORT
    access-list Vlan500_access_in extended deny ip any host 149.20.56.34
    access-list Vlan500_access_in extended deny ip any host 149.20.56.32
    access-list Vlan500_access_in extended permit ip any any
    access-list vlan470_access_in extended deny ip any host 149.20.56.34
    access-list vlan470_access_in extended deny ip any host 149.20.56.32
    access-list vlan470_access_in extended permit ip any any
    access-list Vlan490_access_in extended deny ip any host 149.20.56.34
    access-list Vlan490_access_in extended deny ip any host 149.20.56.32
    access-list Vlan490_access_in extended permit ip any any
    access-list Vlan450_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan1_access_out extended permit ip any any
    access-list Vlan1_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan1_access_out extended deny ip any any
    access-list Vlan1_access_out extended permit icmp any any echo-reply
    access-list Vlan460_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit icmp any any object-group Echo_Ping
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_FTP_PASSIVE
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTPS
    access-list Vlan490_access_out extended permit tcp any host 192.168.10.10 object-group DMZ_HTTP
    access-list Vlan500_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan470_access_out extended permit tcp any host 192.168.202.10 object-group Remote_Desktop
    access-list Vlan510_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan480_access_out extended permit ip any any
    access-list Vlan510_access_in extended permit ip any any
    access-list Vlan600_access_in extended permit ip any any
    access-list Vlan600_access_out extended permit icmp any any
    access-list Vlan600_access_out extended permit tcp any host w8-print object-group Remote_Desktop
    access-list Vlan600_access_out extended permit tcp 192.168.1.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.202.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_out extended permit tcp 192.168.210.0 255.255.255.0 host w8-print eq www
    access-list Vlan600_access_in_1 extended permit ip any any
    access-list Vlan461_access_in extended permit ip any any
    access-list Vlan461_access_out extended permit icmp any any object-group Echo_Ping
    access-list vlan400_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap_1 extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list outside_20_cryptomap extended permit ip 192.168.1.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list Vlan462-Suldalsposten_access_in extended permit ip any any
    access-list Vlan462-Suldalsposten_access_out extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_out_1 extended permit icmp any any echo-reply
    access-list Vlan462-Suldalsposten_access_in_1 extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu Vlan1 1500
    mtu outside 1500
    mtu vlan400 1500
    mtu Vlan450 1500
    mtu Vlan460-SuldalHotell 1500
    mtu Vlan461-SuldalHotellGjest 1500
    mtu vlan470-Kyrkjekontoret 1500
    mtu vlan480-Telefoni 1500
    mtu Vlan490-QNapBackup 1500
    mtu Vlan500-HellandBadlands 1500
    mtu Vlan510-IsTak 1500
    mtu Vlan600-SafeQ 1500
    mtu Vlan462-Suldalsposten 1500
    no failover
    monitor-interface Vlan1
    monitor-interface outside
    monitor-interface vlan400
    monitor-interface Vlan450
    monitor-interface Vlan460-SuldalHotell
    monitor-interface Vlan461-SuldalHotellGjest
    monitor-interface vlan470-Kyrkjekontoret
    monitor-interface vlan480-Telefoni
    monitor-interface Vlan490-QNapBackup
    monitor-interface Vlan500-HellandBadlands
    monitor-interface Vlan510-IsTak
    monitor-interface Vlan600-SafeQ
    monitor-interface Vlan462-Suldalsposten
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (vlan400) 0 access-list vlan400_nat0_outbound
    nat (vlan400) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan450) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan460-SuldalHotell) 1 0.0.0.0 0.0.0.0
    nat (Vlan461-SuldalHotellGjest) 1 0.0.0.0 0.0.0.0
    nat (vlan470-Kyrkjekontoret) 1 0.0.0.0 0.0.0.0
    nat (Vlan490-QNapBackup) 1 0.0.0.0 0.0.0.0 dns
    nat (Vlan500-HellandBadlands) 1 0.0.0.0 0.0.0.0
    nat (Vlan510-IsTak) 1 0.0.0.0 0.0.0.0
    nat (Vlan600-SafeQ) 1 0.0.0.0 0.0.0.0
    nat (Vlan462-Suldalsposten) 1 0.0.0.0 0.0.0.0
    static (vlan400,outside) 79.x.x.x DomeneServer netmask 255.255.255.255
    static (vlan470-Kyrkjekontoret,outside) 79.x.x.x 192.168.202.10 netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.x NotesServer netmask 255.255.255.255 dns
    static (vlan400,outside) 79.x.x.231 TerminalServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.234 OvServer netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.232 w8-eyeshare netmask 255.255.255.255
    static (Vlan490-QNapBackup,outside) 79.x.x.233 192.168.10.10 netmask 255.255.255.255 dns
    static (Vlan600-SafeQ,outside) 79.x.x.235 w8-print netmask 255.255.255.255
    static (vlan400,outside) 79.x.x.236 w8-app netmask 255.255.255.255
    static (Vlan450,vlan400) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (Vlan500-HellandBadlands,vlan400) 192.168.30.0 192.168.30.0 netmask 255.255.255.0
    static (vlan400,Vlan500-HellandBadlands) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan450) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,outside) 79.x.x.252 FonnaFlyMedia netmask 255.255.255.255
    static (Vlan462-Suldalsposten,vlan400) 192.168.4.0 192.168.4.0 netmask 255.255.255.0
    static (vlan400,Vlan462-Suldalsposten) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (vlan400,Vlan600-SafeQ) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan400) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,Vlan450) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan600-SafeQ,vlan470-Kyrkjekontoret) 192.168.50.0 192.168.50.0 netmask 255.255.255.0
    static (Vlan450,Vlan600-SafeQ) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
    static (vlan470-Kyrkjekontoret,Vlan600-SafeQ) 192.168.202.0 192.168.202.0 netmask 255.255.255.0
    access-group Vlan1_access_out out interface Vlan1
    access-group outside_access_in in interface outside
    access-group outside_access_out out interface outside
    access-group vlan400_access_in in interface vlan400
    access-group vlan400_access_out out interface vlan400
    access-group Vlan450_access_in in interface Vlan450
    access-group Vlan450_access_out out interface Vlan450
    access-group Vlan460_access_in in interface Vlan460-SuldalHotell
    access-group Vlan460_access_out out interface Vlan460-SuldalHotell
    access-group Vlan461_access_in in interface Vlan461-SuldalHotellGjest
    access-group Vlan461_access_out out interface Vlan461-SuldalHotellGjest
    access-group vlan470_access_in in interface vlan470-Kyrkjekontoret
    access-group vlan470_access_out out interface vlan470-Kyrkjekontoret
    access-group vlan480_access_out out interface vlan480-Telefoni
    access-group Vlan490_access_in in interface Vlan490-QNapBackup
    access-group Vlan490_access_out out interface Vlan490-QNapBackup
    access-group Vlan500_access_in in interface Vlan500-HellandBadlands
    access-group Vlan500_access_out out interface Vlan500-HellandBadlands
    access-group Vlan510_access_in in interface Vlan510-IsTak
    access-group Vlan510_access_out out interface Vlan510-IsTak
    access-group Vlan600_access_in_1 in interface Vlan600-SafeQ
    access-group Vlan600_access_out out interface Vlan600-SafeQ
    access-group Vlan462-Suldalsposten_access_in_1 in interface Vlan462-Suldalsposten
    access-group Vlan462-Suldalsposten_access_out_1 out interface Vlan462-Suldalsposten
    route outside 0.0.0.0 0.0.0.0 79.x.x.225 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    username x password x encrypted privilege 15
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.210.0 255.255.255.0 Vlan450
    http 192.168.200.0 255.255.255.0 Vlan1
    http 192.168.1.0 255.255.255.0 vlan400
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 20 match address outside_20_cryptomap_1
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer 62.92.159.137
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp enable vlan400
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group 62.92.159.137 type ipsec-l2l
    tunnel-group 62.92.159.137 ipsec-attributes
    pre-shared-key *
    telnet 192.168.200.0 255.255.255.0 Vlan1
    telnet 192.168.1.0 255.255.255.0 vlan400
    telnet timeout 5
    ssh 171.68.225.216 255.255.255.255 outside
    ssh timeout 5
    console timeout 0
    dhcpd update dns both
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan1
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface outside
    dhcpd address 192.168.1.100-192.168.1.225 vlan400
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface vlan400
    dhcpd option 3 ip 192.168.1.1 interface vlan400
    dhcpd enable vlan400
    dhcpd address 192.168.210.100-192.168.210.200 Vlan450
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan450
    dhcpd option 3 ip 192.168.210.1 interface Vlan450
    dhcpd enable Vlan450
    dhcpd address 192.168.2.100-192.168.2.150 Vlan460-SuldalHotell
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan460-SuldalHotell
    dhcpd option 3 ip 192.168.2.1 interface Vlan460-SuldalHotell
    dhcpd enable Vlan460-SuldalHotell
    dhcpd address 192.168.3.100-192.168.3.200 Vlan461-SuldalHotellGjest
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan461-SuldalHotellGjest
    dhcpd option 3 ip 192.168.3.1 interface Vlan461-SuldalHotellGjest
    dhcpd enable Vlan461-SuldalHotellGjest
    dhcpd address 192.168.202.100-192.168.202.199 vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.202.1 interface vlan470-Kyrkjekontoret
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan470-Kyrkjekontoret
    dhcpd enable vlan470-Kyrkjekontoret
    dhcpd option 3 ip 192.168.20.1 interface vlan480-Telefoni
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface vlan480-Telefoni
    dhcpd address 192.168.10.80-192.168.10.90 Vlan490-QNapBackup
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan490-QNapBackup
    dhcpd option 3 ip 192.168.10.1 interface Vlan490-QNapBackup
    dhcpd address 192.168.30.100-192.168.30.199 Vlan500-HellandBadlands
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan500-HellandBadlands
    dhcpd option 3 ip 192.168.30.1 interface Vlan500-HellandBadlands
    dhcpd enable Vlan500-HellandBadlands
    dhcpd address 192.168.40.100-192.168.40.150 Vlan510-IsTak
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan510-IsTak
    dhcpd option 3 ip 192.168.40.1 interface Vlan510-IsTak
    dhcpd enable Vlan510-IsTak
    dhcpd address 192.168.50.150-192.168.50.199 Vlan600-SafeQ
    dhcpd option 6 ip 81.167.36.3 81.167.36.11 interface Vlan600-SafeQ
    dhcpd enable Vlan600-SafeQ
    dhcpd address 192.168.4.100-192.168.4.150 Vlan462-Suldalsposten
    dhcpd option 6 ip DomeneServer 81.167.36.11 interface Vlan462-Suldalsposten
    dhcpd option 3 ip 192.168.4.1 interface Vlan462-Suldalsposten
    dhcpd enable Vlan462-Suldalsposten
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    prompt hostname context
    Cryptochecksum:x
    : end
    Config site 1:
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password x encrypted
    passwd x encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.77.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group Telenor
    ip address pppoe setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 15
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_access_in extended permit icmp any any echo-reply log disable
    access-list outside_1_cryptomap extended permit ip 192.168.77.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.77.0 255.255.255.0 192.168.1.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.77.0 255.255.255.0 inside
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 79.160.252.226
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.77.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn group Telenor request dialout pppoe
    vpdn group Telenor localname x
    vpdn group Telenor ppp authentication chap
    vpdn username x password x store-local
    dhcpd auto_config outside
    dhcpd address 192.168.77.100-192.168.77.130 inside
    dhcpd dns 192.168.77.1 interface inside
    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface inside
    dhcpd enable inside
    dhcpd option 6 ip 130.67.15.198 193.213.112.4 interface outside
    tunnel-group 79.160.252.226 type ipsec-l2l
    tunnel-group 79.160.252.226 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:x
    : end

    Hi,
    The addition of a new network to the existing L2L VPN should be a pretty simple process.
    Essentially you will have to add the network to the Crypto ACL present in the "crypto map" configurations. You will also have to configure the NAT0 configuration for it in the proper interfaces of the ASA. These configurations are all done on both ends of the L2L VPN connection.
    Looking at your above configurations it would seem that you will need the following configurations
    SITE 1
    We add the new network to both the crypto ACL and the NAT0 ACL
    access-list outside_1_cryptomap extended permit ip 192.168.77.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.77.0 255.255.255.0 192.168.20.0 255.255.255.0
    SITE 2
    We add the new network to the crypto ACL
    We create a new NAT0 configuration for the Vlan480 interface as it has no previous NAT0 configuration
    access-list outside_20_cryptomap_1 extended permit ip 192.168.20.0 255.255.255.0 192.168.77.0 255.255.255.0
    access-list VLAN480-NAT0 remark NAT0 for VPN
    access-list VLAN480-NAT0 permit ip 192.168.20.0 255.255.255.0 192.168.77.0 255.255.255.0
    nat (vlan480-Telefoni) 0 access-list VLAN480-NAT0
    These configurations should pretty much do the trick.
    Let me know if it worked
    - Jouni

Maybe you are looking for

  • Want to "move back" my iPhoto library +photos

    Hi, I am new to this forum and after reading a lot of pages I canot find any answer to my question !! I changed my HD on my MBP (I have now a 320Go) and wanted to "get back" from an external HD, my iPhoto library and my files with originals photos wi

  • Error handling in Portal standard forms

    I have a customer who needs to validate input on a Form Based on a Table (standard component). They have tried code, as shown below, as a PLSQL handler on a Save button. This example can obviously be solved with JavaScript validation on the client, b

  • Seeburger AS2 Authentication

    Hello, Wanted to know in Seeburger AS2 Recv Adapter : while authneticating : what is realm field? Realm signifies ? Thank You

  • Aperture 3 and Facebook exporting???  doesn't update

    So I tried the new Facebook exporter from Aperture 3. You can only put pics in a new Facebook album, or drag them into an album that you have created from within Aperture 3. But when I add photos by dragging them, they do not show up on Facebook. Ape

  • I got a Mid 2013 11' Air, but I can't open pages document in my iCloud

    The iWord in Air is 2009, but my Macbook Pages is 2013, I tried to download new Pages several time. NOT work. How can I use my Pages at schooold then? Thanks