Ping to PE interface

I configured the MPLSVPN in my test topology which is chain of 6 router 1 and 6 routers are CE routers and all other are for provier network in which 2 and 5 is PE1 and PE2 router, as PE-CE communication i am using RIP, In both the CE router i have configured 3 loop back interface as internal network.
Here i can see the loopback of each other CEs in their routing tables but i cannot able to ping those loopbacks why?
other strang thing is i can not ping the PE routers interface which are connected with the CE routers so i want to know why i cannot ping the PE routers interface facing to CE routers?
How can i make all those loopback reachable to each other?

Can you pls provide answers in brief for these questions.
1) Ping the remote CE loopback from local CE.
Pass Fail
2) Ping the same subnet from the local PE.
Pass Fail
3) Ping the same subnet from the remote PE connecting the remote CE.
Pass Fail.
4) Check this at Local PE ( show mpls forwarding x.x.x.x [where x.x.x.x is the remote PE loopback])
Pass Fail
5) Check this at the remote PE (show mpls for x.x.x.x [where x.x.x.x is the PE loopback for the local PE])
Pass Fail
6) Finally do a MPLS traceroute or ping from one PE to other.
Pass Fail.
PS: if you dont have MPLS ping/trace in your IOS then do a normal trace from one PE to ther and paste the output.(ideally you should see label swaps with each hop except for the last hop)
This will helps us or may be before you come back, you your self would be able to solve it successfully.
If the above doesnt solve, pls provide a output of "show mpls for" ,a show ip route vrf xx and show ip bgp vpnv4 all vrf xx form both PE's. "show ip route" form both CE's.
Pls mention the PE loopback used for LDP and MPBGP and also the subnet with the problem between CE's.
HTH-Cheers,
Swaroop

Similar Messages

  • I can Ping FW inside interface but can not connect to remote resources

    dear all
    i configer my asa 5520 through ASDM to enable VPN Connection , i follow the cisco steps and it works fine and the anyconnect version 3.1 in Windows 8 - one day troubleshoot for this point only - can connect and have an IP address from the range , but i have something wrong in NAT may be because all guides talking about old ASDM ( NAT Exempt) but i am confeused to apply it on the new ASDM.
    i can ping the inside interface  from my labtop which using anyconnect , but i can not access anything else inside my network
    Please anyone has a solution , please describe it using ASDM , thanks for help
    This is my configuration
    interface GigabitEthernet0/1
    description
    nameif SRV_ZONE
    security-level 50
    ip address 192.168.1.1 255.255.255.0
    interface GigabitEthernet0/2
    description
    nameif TRUST_ZONE
    security-level 100
    ip address 172.17.200.1 255.255.255.0
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif MGMT
    security-level 0
    ip address 10.10.10.1 255.255.255.0
    dns server-group DefaultDNS
    domain-name xxx.xxx.xxx
    object network obj-192.168.1.11
    host 192.168.1.11
    object network obj-xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object service obj-tcp-source-eq-25
    service tcp source eq smtp
    object network obj-192.168.1.12
    host 192.168.1.12
    object network obj-xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object network obj-192.168.1.0
    subnet 192.168.1.0 255.255.255.0
    object service obj-tcp-eq-25
    service tcp destination eq smtp
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network obj-0.0.0.0
    host 0.0.0.0
    object network obj_any-01
    subnet 0.0.0.0 0.0.0.0
    object network obj-172.17.8.8
    host 172.17.8.8
    object network obj-172.17.0.0
    subnet 172.17.0.0 255.255.0.0
    object network obj_any-02
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-03
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-04
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-05
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-06
    subnet 0.0.0.0 0.0.0.0
    object network obj.172.17.8.115
    host 172.17.8.115
    object network obj.xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object service http
    service tcp source eq www destination eq www
    object network obj.xxx.xxx.xxx.xxx
    host xxx.xxx.xxx.xxx
    object service https
    service tcp source eq https destination eq https
    object service newservice
    service tcp source eq pop3 destination eq pop3
    object network mail
    host 172.17.8.8
    description mail     
    object network 192.168.1.11
    host 192.168.1.11
    description smtp     
    object service smtpnew
    service tcp source eq 587 destination eq 587
    object network VPN_RANGE
    description VPN ACCESS RANGE  
    object network VPN_PoOL
    subnet 172.17.16.0 255.255.255.0
    description vpn
    object-group network DM_INLINE_NETWORK_1
    network-object host 192.168.1.11
    network-object host 192.168.1.12
    object-group network Eighth_Floor
    network-object 172.17.8.0 255.255.255.0
    object-group service WEB_SERVICES
    service-object tcp destination eq www
    object-group network ENT_SERVERS
    network-object host 192.168.1.11
    network-object host 192.168.1.1
    object-group network DM_INLINE_NETWORK_2
    network-object 172.17.200.0 255.255.255.0
    network-object 172.17.8.0 255.255.255.0
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq www
    port-object eq https
    port-object eq smtp
    object-group service web tcp
    port-object eq www
    port-object eq xxx
    port-object eq ftp
    port-object eq xxx
    port-object eq xxx
    object-group service xxx_Web_and_Email
    service-object object http
    service-object tcp destination eq pop3
    service-object tcp destination eq smtp
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    access-list DMZ_access_in extended permit ip 192.168.1.0 255.255.255.0 172.17.0.0 255.255.0.0
    access-list DMZ_access_in extended permit ip 192.168.1.0 255.255.255.0 any
    access-list justice_splitTunnelAcl standard permit 10.100.100.0 255.255.255.0
    access-list xxx-VPN_splitTunnelAcl remark vpn
    access-list xxx-VPN_splitTunnelAcl standard permit 172.17.16.0 255.255.255.0
    access-list xxx-VPN_splitTunnelAcl standard permit any
    access-list cap extended permit tcp any host xxx.xxx.xxx.xxx eq smtp log
    access-list cap1 extended permit tcp host 192.168.1.11 any eq smtp
    access-list SRV_ZONE_nat_outbound extended permit tcp 192.168.1.0 255.255.255.0 any eq smtp
    access-list SRV_ZONE_nat_outbound extended permit ip host 192.168.1.11 any
    access-list TRUST_ZONE_access_in extended permit ip host 172.17.88.108 any
    access-list TRUST_ZONE_access_in extended permit object-group DM_INLINE_PROTOCOL_2 10.10.3.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit object-group DM_INLINE_PROTOCOL_3 10.10.50.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit ip 172.17.8.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit ip 172.17.200.0 255.255.255.0 any
    access-list TRUST_ZONE_access_in extended permit ip 172.17.0.0 255.255.0.0 host 192.168.1.12
    access-list TRUST_ZONE_cryptomap extended permit ip xxx.xxx.xxx.xxx 255.255.255.248 any
    access-list outside_access_in extended permit tcp any host 192.168.1.11 eq smtp
    access-list outside_access_in extended permit tcp any host 172.17.8.8 eq www
    access-list outside_access_in extended permit tcp any host 192.168.1.12 object-group web
    access-list outside_access_in extended permit tcp any host 172.17.8.8 eq pop3
    access-list outside_access_in extended permit ip 172.17.16.0 255.255.255.0 any inactive
    access-list vpn remark vpn
    access-list vpn standard permit 172.17.16.0 255.255.255.0
    pager lines 24
    logging enable
    logging trap informational
    logging asdm informational
    logging host TRUST_ZONE 172.17.8.100
    mtu INT_ZONE 1500
    mtu SRV_ZONE 1500
    mtu TRUST_ZONE 1500
    mtu MGMT 1500
    ip local pool VPN_POOL 172.17.16.100-172.17.16.254 mask 255.255.255.0
    ip verify reverse-path interface INT_ZONE
    ip verify reverse-path interface SRV_ZONE
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any SRV_ZONE
    icmp permit any TRUST_ZONE
    asdm image disk0:/asdm-635.bin
    no asdm history enable
    arp timeout 14400
    nat (SRV_ZONE,INT_ZONE) source static obj-192.168.1.11 obj-xxx.xxx.xxx.xxx service any obj-tcp-source-eq-25
    nat (SRV_ZONE,INT_ZONE) source static obj-192.168.1.12 obj-xxx.xxx.xxx.xxx
    nat (SRV_ZONE,INT_ZONE) source dynamic obj-192.168.1.0 interface service obj-tcp-eq-25 obj-tcp-eq-25
    nat (INT_ZONE,SRV_ZONE) source static any any destination static 192.168.1.11 obj-172.17.8.8 service obj-tcp-source-eq-25 obj-tcp-source-eq-25
    nat (TRUST_ZONE,INT_ZONE) source static VPN_PoOL VPN_PoOL destination static VPN_PoOL VPN_PoOL
    object network obj_any
    nat (SRV_ZONE,INT_ZONE) dynamic obj-0.0.0.0
    object network obj_any-01
    nat (SRV_ZONE,MGMT) dynamic obj-0.0.0.0
    object network obj-172.17.8.8
    nat (TRUST_ZONE,INT_ZONE) static xxx.xxx.xxx.xxx service tcp www www
    object network obj-172.17.0.0
    nat (TRUST_ZONE,SRV_ZONE) static 172.17.0.0
    object network obj_any-02
    nat (TRUST_ZONE,INT_ZONE) dynamic interface
    object network obj_any-03
    nat (TRUST_ZONE,SRV_ZONE) dynamic interface
    object network obj_any-04
    nat (TRUST_ZONE,INT_ZONE) dynamic obj-0.0.0.0
    object network obj_any-05
    nat (TRUST_ZONE,SRV_ZONE) dynamic obj-0.0.0.0
    object network obj_any-06
    nat (TRUST_ZONE,MGMT) dynamic obj-0.0.0.0
    object network obj.172.17.8.115
    nat (TRUST_ZONE,INT_ZONE) static obj.xxx.xxx.xxx.xxx service tcp www www
    object network mail
    nat (TRUST_ZONE,INT_ZONE) static obj-xxx.xxx.xxx.xxx service tcp pop3 pop3
    nat (TRUST_ZONE,INT_ZONE) after-auto source static obj-172.17.8.8 obj-xxx.xxx.xxx.xxx service https https
    access-group outside_access_in in interface INT_ZONE
    access-group DMZ_access_in in interface SRV_ZONE
    access-group TRUST_ZONE_access_in in interface TRUST_ZONE
    route INT_ZONE 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    route TRUST_ZONE 10.10.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 10.11.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 10.12.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 10.13.0.0 255.255.0.0 172.17.200.254 1
    route TRUST_ZONE 172.17.0.0 255.255.0.0 172.17.200.254 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 172.17.8.0 255.255.255.0 TRUST_ZONE
    http 172.17.8.155 255.255.255.255 TRUST_ZONE
    http 172.17.8.45 255.255.255.255 TRUST_ZONE
    http 10.10.10.2 255.255.255.255 MGMT
    http 192.168.1.12 255.255.255.255 SRV_ZONE
    http 0.0.0.0 0.0.0.0 INT_ZONE
    http 172.17.200.0 255.255.255.0 TRUST_ZONE
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map pol 1 match address TRUST_ZONE_cryptomap
    crypto dynamic-map pol 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map INT_ZONE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map TRUST_ZONE_map0 1 ipsec-isakmp dynamic pol
    crypto map TRUST_ZONE_map0 interface TRUST_ZONE
    crypto map INT_ZONE_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map INT_ZONE_map0 interface INT_ZONE
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn SEC-xxx-FW1
    subject-name CN=SEC-xxx-FW1
    no client-types
    proxy-ldc-issuer
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment self
    subject-name CN=SEC-xxx-FW1
    keypair sslvpnkeypair
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 31
        57f4e52e 6b851966 77515d62 c209a0df 1c32ce94 bb90cbce 497cfd04 6745ea85
        efb75f85 2ae1ad35 344d94ab 915e01ab d3292626 ac697a52 b4ed6632 d3ed2332 ae
      quit
    crypto ca certificate chain ASDM_TrustPoint1
    certificate e6054352
        c64f3661 30f14c3d 06b5f039 9f14560d 3b154fd1 42782268 7531689e 8e547d91
        85e88415 e326f653 74733a6c a3f5c935 f7e83f56 f6
      quit
    crypto isakmp enable INT_ZONE
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 INT_ZONE
    ssh 172.17.8.0 255.255.255.0 TRUST_ZONE
    ssh 10.10.10.2 255.255.255.255 MGMT
    ssh timeout 5
    console timeout 0
    management-access TRUST_ZONE
    vpn load-balancing
    interface lbpublic INT_ZONE
    interface lbprivate INT_ZONE
    priority-queue INT_ZONE
      tx-ring-limit 256
    threat-detection basic-threat
    threat-detection scanning-threat
    threat-detection statistics host number-of-rate 3
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint1 INT_ZONE
    webvpn
    enable INT_ZONE
    svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy xxx-VPN internal
    group-policy xxx-VPN attributes
    dns-server value xx.xx.xx.xx xx.xx.xx.xx
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value xxx-VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol webvpn
    group-policy GPNEW internal
    group-policy GPNEW attributes
    dns-server value 172.17.8.41
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    default-domain value xxx.xxx.xxx
    address-pools value VPN_POOL
    username VPNAM password xxx encrypted
    username VPNAM attributes
    service-type remote-access
    vpn-group-policy xxx-VPN
    tunnel-group xxx-VPN type remote-access
    tunnel-group xxx-VPN general-attributes
    dhcp-server 172.17.8.41
    tunnel-group xxx-VPN ipsec-attributes
    pre-shared-key *****
    tunnel-group pol type ipsec-l2l
    tunnel-group pol ipsec-attributes
    pre-shared-key *****
    trust-point ASDM_TrustPoint0
    tunnel-group SSLClientProfile type remote-access
    tunnel-group SSLClientProfile general-attributes
    address-pool VPN_POOL
    default-group-policy GPNEW
    tunnel-group SSLClientProfile webvpn-attributes
    group-alias SSLVPNClient enable
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect ip-options
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:78a941e3f509dec8f3570c60061eedaa
    : end

    thanks god
    i solve the problem
    the problem is in NAT
    i creat an object with the ip address host from VPN pool and name it vpn
    then i do the nat from inside to that host as the following picture...
    trust zone is the inside zone
    vpn is the outside vpn host...
    thanks and hope it helps anyone else...

  • Connect to VPN but can't ping past inside interface

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

  • ASA 5505 - Cannot ping outside natted interface

    Hello,
    I have a Cisco ASA 5505, the problem is I am not able to ping to outside natted interface (ip: 172.88.188.123 and 124 and 125) from inside network
    Could someone help me to resolve this? I have looked for ASA documentation through the internet and still got nothing.
    Thank you in advance
    the config are:
    : Saved
    ASA Version 8.2(1)
    hostname ciscoasa
    domain-name domain
    enable password ********** encrypted
    passwd ************ encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 172.88.188.122 255.255.255.248
    interface Vlan3
    no forward interface Vlan2
    nameif backup
    security-level 0
    no ip address
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name domain
    same-security-traffic permit intra-interface
    access-list outside_in extended permit tcp any host 172.88.188.123 eq smtp
    access-list outside_in extended permit tcp any host 172.88.188.123 eq pop3
    access-list outside_in extended permit tcp any host 172.88.188.123 eq www
    access-list outside_in extended permit icmp any any
    access-list outside_in extended permit icmp any any echo-reply
    access-list inside_out extended permit tcp 192.168.1.0 255.255.255.0 any
    access-list inside_out extended permit udp 192.168.1.0 255.255.255.0 any
    access-list inside_out extended permit icmp any any
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu backup 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    global (outside) 1 172.88.188.128
    nat (inside) 1 192.168.1.0 255.255.255.0
    static (inside,outside) 172.88.188.123 192.168.1.253 netmask 255.255.255.255
    static (inside,outside) 172.88.188.124 192.168.1.251 netmask 255.255.255.255
    static (inside,outside) 172.88.188.125 192.168.1.5 netmask 255.255.255.255
    route outside 0.0.0.0 0.0.0.0 172.88.188.121 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd lease 1048575
    dhcpd auto_config outside
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 8.8.8.8 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:865943aa325eb75812628fec3b1e7249
    : end

    You are looking for this. 2 options, dns doctoring, or hairpinning (2nd part of document.) Post back if you need help setting it up.
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807968d1.shtml
    Hairpinning would look like this in your scenario.
    same-security-traffic permit intra-interface
    global (inside) 1 interface
    static (inside,inside) 172.88.188.123 192.168.1.253 netmask 255.255.255.255
    static (inside,inside) 172.88.188.124 192.168.1.251 netmask 255.255.255.255
    static (inside,inside) 172.88.188.125 192.168.1.5 netmask 255.255.255.255

  • How to measure the number of ping over a interface

    Hello
    I need to setup a measurement of the number of ping that goes throug an ethernet interface over a duration of 3min
    How can I do that ?
    thanks for help

    Hello
    thanks for help
    I have an application which sent pings to hundred of routers to test connectivity for pro-active monitoring purpose. there are some strange performance problem on this application and I want to measure the number of pings sent during a time interval

  • WRVS4400N responds to pings but web interface fails

    Hello.
    I have a WRVS4400N router in a remote office.  I have connectivity to the office and computers there.  But the web interface for the router is failing to come up.  This happens once every few days or so.  Is there any utility or something that I can use to remotely reset the router without making use of the webinterface or having physical access to the router?
    It's a version 2 router with the latest firmware.
    Thanks.

    I gain access via LogMeIn.  QuickVPN has not been enabled on this router.  And the hardware VPN between it and a like-router in a second office is down and will not come back up.
    I know the interface does not come up when I'm physically there because I tried it last time I traveled to the office during the last outage.  I am using it's LAN IP 192.168.148.1.  I also tried 192.168.148.2.  Both IPs respond to pings but no web interface will connect.
    The web browser (Chrome, Firefox, and IE) just says "unable to connect" or "cannot display the page"

  • Unable to ping from mz to virtual interface of asa

    Dear All,
    one of my SNMP server 10.242.103.42 sits in MZ zone,and ACE 4710 is connected to core switch,coreswitch is connected to firewall asa.
    Now iam trying to ping from MZ zone SNMP server to loadbalancer ip 10.242.105.1,iam unable to ping my LB interface to discover SLB on my SNMP server.
    plese help me
    srinivas

    Is your device seeing the mac-address of the ASA in order to send the packets? What do the logs show on the firewall itself? Can you see the ARP entry on the ASA firewall for that host?
    Mike

  • EzVPN sometimes ping only in one direction or only one interface

    Guys, I have lots of 857's routers in the field with mostly the latest OS - 12.4(15)T17 making ezVPN connections to a 2951 with 15.1(4)M5.
    All the 857's have lookback and vlan interfaces similar to :
    interface Loopback0
    ip address 50.43.8.1 255.255.255.255
    ip tcp adjust-mss 1452
    end
    interface Vlan1
    ip address 40.43.8.1 255.255.255.128
    ip tcp adjust-mss 1452
    crypto ipsec client ezvpn SMS_VPN inside
    end
    This is my Dialer interface :
    interface Dialer0
    ip ddns update hostname my_custom_host_name
    ip ddns update SMS_DynDNS
    ip address negotiated
    ip access-group 102 in
    ip access-group 101 out
    ip mtu 1492
    ip virtual-reassembly
    encapsulation ppp
    dialer pool 1
    dialer idle-timeout 0
    dialer persistent
    ppp authentication chap pap callin
    ppp chap hostname my_hostname
    ppp chap password 0 my_password
    ppp pap sent-username my_hostname password 0 my_password
    ppp ipcp dns request accept
    crypto ipsec client ezvpn SMS_VPN
    And their crypto's are defined as :
    crypto ipsec client ezvpn SMS_VPN
    connect auto
    group HW_Client key my_client_key
    mode network-extension
    peer my_peer_ip
    acl 100
    username my_username password my_password
    xauth userid mode local
    Now lately for some or other reason we have instances where I can ping either the VLAN or the LOOPBACK interface, but not both. Or I have instances where the 2951 can ping all the interfaces on the 857, but the 857 can not ping the 2951. Or I have instances where the 2951 can not ping the 857, but the 857 can ping the 2951.
    The way I have been fixing this is either to add crypto ipsec client ezvpn SMS_VPN inside to the loopback interface, or if it is there already to remove it. This usually works for a few days, but then suddenly I have to reverse this again. If that does not work then I usually do lots of clear crypt sess and/or clear crypt ipsec client ezvpn on the 857, or clear crypt sess remote 857_ip_address from the 2951 and then suddenly it starts working again.
    Surely there must be something wrong, but I just can not figure out what. Any ideas ?!

    Bump ... Anyone please ...

  • Ability to ping redundant interface IP address

    Hi,
    I have this setup for our content switches.
    Primary F/W --> Primary CSS --> Local Switches
    | |
    | |
    Secondary F/W --> Secondary CSS --> Local Switches
    This is the relevant configuration.
    Primary CSS
    circuit VLAN4
    ip address 192.168.76.4 255.255.255.0
    ip virtual-router 4 priority 101 preempt
    ip redundant-interface 4 192.168.76.254
    Secondary CSS
    circuit VLAN4
    ip address 192.168.76.5 255.255.255.0
    ip virtual-router 4 priority 90
    ip redundant-interface 4 192.168.76.254
    The problem is that the Secondary F/W can not ping the redundant interface IP address via the secondary path when all devices are in normal mode.
    Is this normal?
    The ping is occuring for firewall failover checking.
    Thanks,
    Ben

    it should work.
    Your diagram does not display very well, so I don't know where are the | links.
    What should be the path of traffic from secondary firewall redundant-interface ?
    Is the traffic going to 1 CSS and being bridge to the 2nd CSS ?
    If that's the case, you need the command 'ip uncond-bridging' on both CSS to force CSS to bridge first and then route.
    Regards,
    Gilles.

  • Can't telnet on WAN interface, ping is ok

    Hi all,
    I'm not able to telnet to cisco1841 on WAN interface...( Connection timed out; remote host not responding )
    telnet from inside network to LAN interface is fine
    I can ping the WAN interface
    port 23 appears to be closed ( nmap )
    Does anyone have an idea why telnet is not working??
    part of my config ( 2 wan links for redundancy, can't telnet to none of them):
    interface FastEthernet0/0
    description ##### LINE TO LAN #####
    ip address 192.168.8.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    ip tcp adjust-mss 1412
    duplex auto
    speed auto
    interface FastEthernet0/1
    description ##### TO CABLE MODEM #####
    ip address dhcp client-id FastEthernet0/1
    duplex auto
    speed auto
    no cdp enable
    interface ATM0/0/0
    no ip address
    load-interval 30
    atm restart timer 300
    no atm ilmi-keepalive
    dsl operating-mode auto
    pvc 8/48
      encapsulation aal5mux ppp dialer
      dialer pool-member 1
    interface Virtual-PPP1
    ip address negotiated
    ip mtu 1452
    ip nat outside
    ip virtual-reassembly
    no cdp enable
    no ppp chap wait
    ppp pap sent-username user password pass
    pseudowire 212.25.127.15 1 pw-class dialer_to_bezeqint
    interface Dialer0
    ip address negotiated
    ip mtu 1452
    ip nat outside
    ip virtual-reassembly
    encapsulation ppp
    load-interval 30
    dialer pool 1
    dialer idle-timeout 200000
    no cdp enable
    ppp pap sent-username user password pass
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 Virtual-PPP1
    ip route 0.0.0.0 0.0.0.0 Dialer0 50
    ip route 212.25.127.15 255.255.255.255 FastEthernet0/1 dhcp
    no ip http server
    no ip http secure-server
    ip nat inside source route-map ADSL_NAT interface Dialer0 overload
    ip nat inside source route-map CABLE_NAT interface Virtual-PPP1 overload
    route-map ADSL_NAT permit 10
    match interface Dialer0
    route-map CABLE_NAT permit 10
    match interface Virtual-PPP1
    control-plane
    line con 0
    login local
    line aux 0
    line vty 0 4
    privilege level 15
    logging synchronous
    login local
    transport input telnet
    end

    Friend, I recommend you use the settings below, I'm doing like this below I have no problem, look no free access telnet use SSH,
    An ace
    access-list 10 permit you ip
    access-list 10 deny   any
    line con 0
    password you password
    login local
    length 0
    line aux 0
    password you password
    login local
    line vty 0 4
    access-class 10 in
    exec-timeout 0 0
    privilege level 15
    password you password
    login local
    length 0
    transport input telnet ssh
    line vty 5 15
    access-class 10 in
    privilege level 15
    password you password
    login local
    length 0
    transport input telnet ssh

  • PING TO ACE VLAN INTERFACES

    Hi,
    I am not able to ping the VLAN interfaces defined on the ACE devices unless directly connected to the subnet.
    I tried options - defining Access-list,service-policy.I can ping the servers behind the ACE but i cannt ping the ACE vlan interface.
    I captured the traffic on the ACE.I cannt see any traffic on the interfaces if i ping the VLAN ip address.I can see the traffic if i am pinging the host behind the ACE.
    Is there any option available to enable icmp on the interfaces.

    In order to ping the Vlan Interface you just need management policy applied to the vlan interface.
    Class-maps used in the management-policy
    defines the source addresses from where these management accesses are allowed.
    If you can ping the interfaces from locally connected subnets but not from the remote subnets then there could be 2 reasons.
    1. Some routing issues
    2. Source IPs in Management class maps are not defined.
    Following is an example of typical management policy
    #Allow telnet & SSH from these ip addresses
    #Allow ICMP from any source
    class-map type management match-any MGMT-CLASS
    10 match protocol telnet
    20 match protocol ssh
    30 match protocol icmp any
    policy-map type management first-match MGMT-POLICY
    class MGMT-CLASS
    permit
    interface vlan 10
    ip address x.x.x.x 255.255.255.0
    service-policy input MGMT-POLICY
    no shutdown
    interface vlan 20
    ip address y.y.y.y 255.255.255.0
    service-policy input MGMT-POLICY
    no shutdown
    Syed Iftekhar Ahmed

  • CSS redundant-interface ping response

    Hi,
    I just wan't to make a simple question:
    Should the css11151 respond to ping requests made to a redundant-interface?
    If yes, what can be the reason for the redundant interface, not being responding to ping requests?
    Thanks in advance,
    Regards,
    LR

    Hi,
    Did you ever find solution to the issue.
    I have 11503 and I have same problem, I cannot ping the redundant-interface address from the directly connected switch.
    It works for first few seconds when the CSS reboots or interface bounces then stops.
    Any ideas?
    Thanks

  • Wireless lan Controller 4402 / ping dynamic interface failed

    hi,
    i've a problem with a Wireless Lan Controller 4402.
    When i configure the dynamic interface on the my network , with wired lan
    i don't reach (i use the ping command) the ip address of the WLC.
    In my case (wired):
    On my pc i've a ip 10.1.78.1 255.255.0.0 and dgw 10.1.1.1 (vlan721)
    The lan WLC have a ip of management 10.12.2.4 /24 (vlan799) [dgw 10.12.2.1]
    dynamic vlan 792 ip add 10.12.78.100 / 22 (vlan792) [dgw 10.12.68.1]
    i ping these interfaces (10.12.2.4 and 10.12.78.100) and the ping is ok.
    When i create a dynamic interface vlan 721 starting the problem:
    dynamic vlan 791 ip address 10.1.1.240 / 16 (vlan721)
    After this ......the ping on 10.12.2.4 and 10.12.78.100 don't respond very well
    and i lose the 80-90% of the ping packages.
    through the wi-fi instead I do not have problems.
    the problem exist only via wired (cable).
    Can you help me?
    Thanks
    FCostalunga

    Hello,
    Pinging the dynamic interface is officially not supported. The reason why is because the controller places a very low priority on ICMP traffic. Typically, you will not have an issue with doing so on your wireless network because this interface is basically a gateway for the client. However, from the wired network - the only interface designed to respond to pings 100% of the time is the management interface. Hope this helps!
    -Mark

  • MSFC - cannot ping vlan interface

    Hi,
    We have several vlans defined on the mfsc. On the msfc we could ping all the vlans interface except 1 vlan. The interface is up and just recently we weren't able to ping it. Any help is much appreciated.
    TIA.
    PF

    Hi PF,
    AFAIK, When you are pinging a particular interface stting on the MSFC the source IP would be of any other available interfaces. If you are pinging vlan 110 it will take source ip of any other available vlan interface and the destination is Vlan 110, but ACL defined on the interface doesnot have any ACE for the same so that packets will be dropped.
    Removing the ACL worked as explained above.
    regards,
    -amit singh

  • Can't SSH to inside interface on ASA

    Hi there
    I have generated the key and can ssh to outside interface. I have allowed access on inside interface. I can telnet but not ssh. I captured packets and can see incoming only. Any ideas?
    TIA
    Sent from Cisco Technical Support iPhone App

    Hi there,
    Here it is -
    asa01(config)# sh cap capin
    4 packets captured
       1: 21:59:03.583343 802.1Q vlan#240 P0 192.168.1.2.56686 > 192.168.1.1.22: S 2251599477:2251599477(0) win 4128
       2: 21:59:05.586990 802.1Q vlan#240 P0 192.168.1.2.56686 > 192.168.1.1.22: S 2251599477:2251599477(0) win 4128
       3: 21:59:09.588577 802.1Q vlan#240 P0 192.168.1.2.56686 > 192.168.1.1.22: S 2251599477:2251599477(0) win 4128
       4: 21:59:17.591659 802.1Q vlan#240 P0 192.168.1.2.56686 > 192.168.1.1.22: S 2251599477:2251599477(0) win 4128
    4 packets shown
    asa01(config)#
    asa01(config)# sh cap asp
    0 packet captured
    0 packet shown
    asa01(config)#
    Can you ping the Switch interface from the ASA?          - Yes
    Can you ping the ASA from the switch? - Yes

Maybe you are looking for