Reinitiate L2L VPN tunnel

Hi,
I have cisco ASA 5520 and two L2L VPN are configured in that box.Now if any time I want to reinitiate or reestablished the tunnel what command I have to give.I want to reestablish the IKE and IPSec SA.
Please guide wht command i have to give to reestablish all the L2L tunnel or a single tunnel.
Regards,
som

1. ASA5510# clear crypto ipsec sa ?
counters Clear IPsec SA counters
entry Clear IPsec SAs by entry
map Clear IPsec SAs by map
peer Clear IPsec SA by peer
2. ASA5510# clear crypto isakmp sa

Similar Messages

  • Cisco ASA 5505 L2L VPN Tunnel with one Dynamic IP

    Hi Rizwan,
    Thanks for your response.  I updated the configuration per your response below... It still doesn't work.  please see my new config files below.  Please help.  Thanks in advance for your help....
    Hi Pinesh,
    Please make follow changes on host: officeasa
    remove this line below highlighted.
    crypto dynamic-map L2LMap 1 match address Crypto_L2L
    It is only because group1 is weak, so please change it to group2
    crypto dynamic-map L2LMap 1 set pfs group1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117
    Please make follow changes on host: homeasa
    It is only because group1 is weak, so please change it to group2
    crypto map L2Lmap 1 set pfs group1
    route outside 10.10.5.0 255.255.255.0 xxx.xxx.xxx.xxx default gateway on homeasa.
    Hope that helps, if not please open a new thread.
    Thanks
    Rizwan Rafeek
    New config files..
    Site-A:   (Office):
    Hostname: asaoffice
    Inside: 10.10.5.0/254
    Outside e0/0: Static IP 96.xxx.xxx.118/30
    Site-B:   (Home):
    Hostname: asahome
    Inside: 10.10.6.0/254
    Outside e0/0: Dynamic IP (DG: 66.xxx.xxx.1)
    SIte-A:
    officeasa(config)# sh config
    : Saved
    : Written by enable_15 at 15:34:23.899 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname officeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address 96.xxx.xxx.118 255.255.255.252
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.5.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 192.168.100.0 255.2
    access-list NONAT extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255.255.2
    access-list ormtST standard permit 10.10.5.0 255.255.255.0
    access-list OCrypto_L2L extended permit ip 10.10.5.0 255.255.255.0 10.10.6.0 255
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool ormtIPP 192.168.100.100-192.168.100.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 96.xxx.xxx.117 1
    route outside 10.10.6.0 255.255.255.0 96.xxx.xxx.117 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.5.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set OSite2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map OL2LMap 1 set pfs
    crypto dynamic-map OL2LMap 1 set transform-set OSite2Site
    crypto dynamic-map OL2LMap 1 set reverse-route
    crypto map out_L2lMap 65535 ipsec-isakmp dynamic OL2LMap
    crypto map out_L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.5.101-10.10.5.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy ormtGP internal
    group-policy ormtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value ormtST
    address-pools value ormtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type remote-access
    tunnel-group ormtProfile type remote-access
    tunnel-group ormtProfile general-attributes
    default-group-policy ormtGP
    tunnel-group ormtProfile webvpn-attributes
    group-alias OFFICE enable
    tunnel-group defaultL2LGroup type ipsec-l2l
    tunnel-group defaultL2LGroup ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:46d5c2e1ac91d73293f2fb1a0045180c
    officeasa(config)#
    Site-B:
    Home ASA Configuration:
    homeasa# sh config
    : Saved
    : Written by enable_15 at 15:48:42.479 UTC Sat Mar 3 2012
    ASA Version 8.2(5)
    hostname homeasa
    enable password xyz encrypted
    passwd xyz encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 3
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    switchport access vlan 3
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    switchport access vlan 3
    interface Ethernet0/7
    switchport access vlan 3
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    nameif inside
    security-level 100
    ip address 10.10.6.254 255.255.255.0
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 192.168.101.0 255.255.255.0
    access-list NONAT extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    access-list hrmtST standard permit 10.10.6.0 255.255.255.0
    access-list Crypto_L2L extended permit ip 10.10.6.0 255.255.255.0 10.10.5.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    ip local pool hrmtIPP 192.168.101.100-192.168.101.110 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 10.10.5.0 255.255.255.0 66.xxx.xxx.1 1   (IP address of the Dynamic IP from ISP)
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.10.6.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set Site2Site esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map L2Lmap 1 match address Crypto_L2L
    crypto map L2Lmap 1 set peer 96.xxx.xxx.118
    crypto map L2Lmap 1 set transform-set Site2Site
    crypto map L2LMap 1 set pfs
    crypto map L2LMap interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.10.6.101-10.10.6.132 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy hrmtGP internal
    group-policy hrmtGP attributes
    dns-server value 8.8.8.8
    vpn-tunnel-protocol svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value hrmtST
    address-pools value hrmtIPP
    webvpn
    svc keep-installer installed
    svc rekey time 30
    svc rekey method ssl
    svc ask enable default svc timeout 20
    username user1 password abcxyz encrypted
    username user1 attributes
    service-type admin
    tunnel-group hrmtProfile type remote-access
    tunnel-group hrmtProfile general-attributes
    default-group-policy hrmtGP
    tunnel-group hrmtProfile webvpn-attributes
    group-alias hrmtCGA enable
    tunnel-group 96.xxx.xxx.118 type ipsec-l2l
    tunnel-group 96.xxx.xxx.118 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:d16a0d49f275612dff7e404f49bcc499
    homeasa#

    Thanks Rizwan,
    Still no luck.  I can't even ping the otherside (office)..  I am not sure if i'm running the debug rightway.   Here are my results...
    homeasa(config)# ping inside 10.10.5.254............. (Office CIsco ASA5505 IP on local side.  I also tried pinging the server on other side (office) whic is @10.10.5.10 and got the same result)
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 10.10.5.254, timeout is 2 seconds:
    Success rate is 0
    homeasa(config)# debug crypto isakmp 7
    homeasa(config)# debug crypto ipsec 7
    homeasa(config)# sho crypto isakmp 7
                                       ^
    ERROR: % Invalid input detected at '^' marker.
    homeasa(config)# sho crypto isakmp
    There are no isakmp sas
    Global IKE Statistics
    Active Tunnels: 0
    Previous Tunnels: 0
    In Octets: 0
    In Packets: 0
    In Drop Packets: 0
    In Notifys: 0
    In P2 Exchanges: 0
    In P2 Exchange Invalids: 0
    In P2 Exchange Rejects: 0
    In P2 Sa Delete Requests: 0
    Out Octets: 0
    Out Packets: 0
    Out Drop Packets: 0
    Out Notifys: 0
    Out P2 Exchanges: 0
    Out P2 Exchange Invalids: 0
    Out P2 Exchange Rejects: 0
    Out P2 Sa Delete Requests: 0
    Initiator Tunnels: 0
    Initiator Fails: 0
    Responder Fails: 0
    System Capacity Fails: 0
    Auth Fails: 0
    Decrypt Fails: 0
    Hash Valid Fails: 0
    No Sa Fails: 0
    Global IPSec over TCP Statistics
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Inbound packets: 0
    Inbound dropped packets: 0
    Outbound packets: 0
    Outbound dropped packets: 0
    RST packets: 0
    Recevied ACK heart-beat packets: 0
    Bad headers: 0
    Bad trailers: 0
    Timer failures: 0
    Checksum errors: 0
    Internal errors: 0
    hjnavasa(config)# sh crypto ipsec sa peer 96.xxx.xxx.118
    There are no ipsec sas
    homeasa(config)#

  • Packet drop in L2L VPN tunnel

    Hi,
    MY ASA5540 has 40 L2L IPsec VPN tunnels to other sites. One of tunnels has packet drop often ( but the tunnel remind up ). Called ISP and confirm its not ISP issue. Is there any method to troubleshoot the issue ? what should I look at in the configuration ? any help will be appericated.
    Thanks

    Verify that ACLs and NAT configurations are Correct. Some times it may also block the traffic.
    Most Common L2L and Remote Access IPSec VPN Troubleshooting Solutions
    http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml

  • How to build 2 L2L vpn tunnels pointing to the same peer.

    I have a Cisco ASA 5505 on one side and a VMware device on the remote.  I have a vpn tunnel currently.  I need to establish a second tunnel to the same peer.  Because VMware is used on the remote side they can't have the more than one subnet on the tunnel.  I need two internal subnets to communicate to the remote peer.  Please help.
    Thanks,
    Ken

    Hi Tzy,
    Two tunnels for same traffic on a same device is not possible but you can configure a redundancy for the 2 cellular links for the same traffic.
    But if the traffic are different for both the ACLs, the the tunnels should come up but you need to define routes as to which traffic would use what interface.
    if there is a def route pointing to interface cell0/0/1 then all traffic will be taken using that interface, and you would then need to define either a static route for access-list 102 or a route-map to direct the traffic to the cell0/0/2 interface.
    On the ASA, you just need to configure the settings for a dynamic VPN tunnel.
    Hope that helps.
    Cheers,
    Abhi

  • Add a new L2L VPN tunnel URGENT

    Hi,
    I have a ASA5520 deviceand already 2 L2L VPN is running on that. I want to add a new VPN tuuel to connect other branch.
    In the configuration when i have given
    crypto map toremote 50 match address SINGAPORE this command...it's showing WARNING incomplete command !
    what is the problem for that..please help me in the issue.
    Thanks
    somnath

    Hi Somnath
    This is a normal prompt. You will get this prompt untill you complete your cryptomap.
    crypto map toremote 50 match address SINGAPORE
    crypto map toremote 50 set peer SINGAPOREIP
    crypto map toremote 50 set transform-set yoursetnamehere
    As you issue the last line above, cryptomap will be complete and you wont receive Warning anymore.
    Regards

  • Bandwidth Allocation for a specific VPN Tunnel - PIX 525 7.2(1)

    Hello,
    I have a PIX with a 10 MB internet connection. This PIX has several L2L VPN Tunnels configured: Tunnel1, Tunnel2...TunnelN. I want to be able guarentee 5Mb of the total 10Mb to a specific VPN Tunnel. Is this possible? I have read the following links, however I believe that the configuration guidelines I'm looking for are a combination of several examples shown here:
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml#tab4
    https://supportforums.cisco.com/docs/DOC-1230
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a008084de0c.shtml#cqos
    The tunnel is being defined by the following commands:
    crypto map prdmay 20 match address vpn_1
    crypto map prdmay 20 set peer 61.172.142.222
    crypto map prdmay 20 set transform-set TS
    access-list vpn_1 extended permit ip 10.14.102.0 255.255.255.0 any
    access-list vpn_1 extended permit ip 10.14.101.0 255.255.255.0 any
    tunnel-group 61.172.142.222 type ipsec-l2l
    tunnel-group 61.172.142.222 ipsec-attributes
    pre-shared-key *
    Is the following what I need to do in order to accomplish what I want:
    priority-queue outside
    class-map vpn_5Mb
    match access-list vpn_1
    match tunnel-group 61.172.142.222
    policy-map police-priority-policy
    class vpn_5Mb
    police output 5120000
    service-policy police-priority-policy interface outside
    Thank you for your help.

    I don't think the ASA will let you match on ACL and tunnel group at the same time.
    Just the ACL will do though. The ACL should match local ip addresses (there are usually no-natted for the VPN anyway).
    Here is a page with a QoS examples on the ASA for reference https://supportforums.cisco.com/docs/DOC-1230
    I hope it helps.
    PK

  • AAA Radius Authentication for Remote VPN With ACS Server Across L2L VPN

    Hi,
    I have an ASA running fine on the network which provide L2L tunnel to remote site and provide Remote VPN for remote access users.
    Currently, there is a need for the users to authenticate against an ACS server that located across the L2L VPN tunnel.
    The topology is just simple with 2 interfaces on the ASA, inside and outside, and a default route pointing to the ISP IP Address.
    I can ping the IP address of the ACS Server (which located at the remote site, IP addr: 10.10.10.56) from the ASA:
    ping inside 10.10.10.56
    However when I configure the ASA for the AAA group with commands:
    aaa-server ACSAuth protocol radius
    aaa-server ACSAuth host (inside) 10.10.10.56 key AcsSecret123
    Then when I do the show run, here is the result:
    aaa-server ACSAuth protocol radius
    aaa-server host 10.10.10.56
    key AcsSecret123
    From what I thought is, with this running config, traffic is not directed to the L2L VPN tunnel
    (seems to be directed to the default gateway due to the default route information) which cause failure to do the AAA authentication.
    Does anybody ever implement such this thing and whether is it possible? And if yes, how should be the config?
    Your help will be really appreciated!
    Thanks.
    Best Regards,
    Jo

    AAA is designed to enable you to dynamically configure the type of authentication and authorization you want on a per-line (per-user) or per-service (for example, IP, IPX, or VPDN) basis. You define the type of authentication and authorization you want by creating method lists, then applying those method lists to specific services or interfaces.
    http://www.cisco.com/en/US/docs/ios/12_4/secure/configuration/guide/schaaa.html

  • Cisco ASA 5505 Site to Site VPN tunnel up, but not passing traffic

    Thanks to a previous thread, I do have a 5505 up and running, and passing data....
    https://supportforums.cisco.com/message/3900751
    Now I am trying to get a IPSEC VPN tunnel working.
    I actually have it up (IKE phase 1 & 2 both passed), but it is not sending/receiving data through the tunnel.
    The networks concerned:
    name 10.0.0.0  Eventual  (HQ Site behind Firewall)
    name 1.1.1.0  CFS  (Public Network Gateway for Palo Alto Firewall - Firewall IP: 1.1.1.1)
    name 2.2.2.0  T1  (Remote site - Outside interface of 5505: 2.2.2.2)
    name 10.209.0.0  Local  (Remote Network - internal interface of 5505: 10.209.0.3)
    On a ping to the HQ network from behind the ASA, I get....
    portmap translation creation failed for icmp src inside:10.209.0.9 dst inside:10.0.0.33 (type 8, code 0)
    I am suspecting that there is a NAT error and/or a lack of a static route for the rest of the 10.0.0.0 traffic, and that I may have to exempt/route the traffic for the HQ network (10.0.0.0), but I haven't been able to get the correct entries to make it work.
    Below is the config.
    Can anyone see if there is something sticking out?
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 2.2.2.0 T1
    name 1.1.1.0 CFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object CFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    icmp permit any inside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 67.139.113.217 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:701d8da28ee256692a1e49d904e9cb04
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location CFS 255.255.255.240 inside
    asdm history enable
    Thank You.

    I'm just re-engaging on the firewall this afternoon, but right now I'm getting request timed out on the pings....
    Here's the output requested:
    Result of the command: "show crypto isakmp sa"
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 1.1.1.1
    Type : L2L Role : initiator
    Rekey : no State : AM_ACTIVE
    Result of the command: "show crypto ipsec sa"
    interface: outside
    Crypto map tag: outside_map, seq num: 1, local addr: 2.2.2.2
    access-list outside_1_cryptomap extended permit ip 10.209.0.0 255.255.255.0 10.0.0.0 255.0.0.0
    local ident (addr/mask/prot/port): (Local/255.255.255.0/0/0)
    remote ident (addr/mask/prot/port): (Eventual/255.0.0.0/0/0)
    current_peer: 1.1.1.1
    #pkts encaps: 84, #pkts encrypt: 84, #pkts digest: 84
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 84, #pkts comp failed: 0, #pkts decomp failed: 0
    #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
    #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
    #send errors: 0, #recv errors: 0
    local crypto endpt.: 2.2.2.2, remote crypto endpt.: 1.1.1.1
    path mtu 1500, ipsec overhead 58, media mtu 1500
    current outbound spi: 8FC06BD1
    current inbound spi : 42EC16F4
    inbound esp sas:
    spi: 0x42EC16F4 (1122768628)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62207/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    outbound esp sas:
    spi: 0x8FC06BD1 (2411752401)
    transform: esp-3des esp-md5-hmac no compression
    in use settings ={L2L, Tunnel, PFS Group 2, }
    slot: 0, conn_id: 4096, crypto-map: outside_map
    sa timing: remaining key lifetime (kB/sec): (62201/28464)
    IV size: 8 bytes
    replay detection support: Y
    Anti replay bitmap:
    0x00000000 0x00000001
    Here's the current config:
    : Saved
    ASA Version 8.2(5)
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 10.0.0.0 Eventual
    name 10.209.0.0 Local
    name 67.139.113.216 T1
    name 1.1.1.0 IntegraCFS
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 0
    ip address 10.209.0.3 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 2.2.2.2 255.255.255.248
    time-range Indefinite
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_1
    network-object Eventual 255.0.0.0
    network-object T1 255.255.255.248
    network-object IntegraCFS 255.255.255.240
    access-list outside_1_cryptomap extended permit ip Local 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list No_NAT extended permit ip Local 255.255.255.0 Eventual 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list No_NAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 2.2.2.0 1
    route outside Eventual 255.255.255.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http Eventual 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 1.1.1.1
    crypto map outside_map 1 set transform-set ESP-3DES-MD5
    crypto map outside_map 1 set security-association lifetime kilobytes 65535
    crypto map outside_map 1 set phase1-mode aggressive
    crypto map outside_map interface outside
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 28800
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 10.209.0.201-10.209.0.232 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd auto_config outside interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy FTMGP internal
    group-policy FTMGP attributes
    vpn-idle-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    tunnel-group 1.1.1.1 type ipsec-l2l
    tunnel-group 1.1.1.1 general-attributes
    default-group-policy FTMGP
    tunnel-group 1.1.1.1 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    service-policy global_policy global
    prompt hostname context
    call-home reporting anonymous
    Cryptochecksum:301e573544ce0f89b3c597bdfe2c414a
    : end
    asdm location Eventual 255.0.0.0 inside
    asdm location Local 255.255.255.0 inside
    asdm location T1 255.255.255.248 inside
    asdm location IntegraCFS 255.255.255.240 inside
    asdm history enable

  • VPN Tunnel setup - can't ping either endpoint

    So I was given the task to set up a new VPN tunnel for a client and even though I've basically made it open, we still cannot ping each other's endpoints. I troubleshooted for over an hour with one of their techs, still to no avail. I included the config of this router. The tunnel can build out, completes phase 1 and 2, but still doesn't allow traffic or ability to connect to either endpoint. Please help.
    Result of the command: "sh run"
    : Saved
    ASA Version 8.0(3)6
    hostname RBPASA01
    domain-name rbmc.org
    enable password *removed* encrypted
    passwd *removed* encrypted
    names
    name 10.20.10.0 OBD-DHCP-10.20.10.x description DHCP Scopes for VLAN20
    name 10.20.11.0 OBD-DHCP-10.20.11.x description DHCP Scopes for VLAN20
    name 10.20.12.0 OBD-DHCP-10.20.12.x description DHCP Scopes for VLAN20
    name 10.10.14.0 PAD-DHCP-10.10.14.X description DHCP Scopes for VLAN10
    name 128.127.0.0 Millennium-Remote
    name 10.10.0.0 Pad-10.10-network
    name 10.11.0.0 Pad-10.11-network
    name 10.12.0.0 Pad-10.12-network
    name 10.100.91.0 Pad-10.100-network
    name 10.30.13.0 Millennium-nat
    name 10.100.91.200 Maxsys-Server
    name 65.171.123.34 Maxsys-Remote description Landacorp remote access
    name 65.211.65.21 FTP-External-Address
    name 172.31.0.15 FTP-Internal-Address description FTP Server in DMZ
    name 10.100.91.201 RBPMAXYS02 description Landacorp Access
    name 10.10.10.231 c05407
    name 192.168.55.4 c05407Nat
    name 192.168.55.3 c057017Nat
    name 10.10.13.50 c05744
    name 192.168.55.5 c05744Nat
    name 151.198.253.253 VPN-External
    name 10.13.102.30 NBI20610 description Viewpoint Server SBHCS
    name 10.100.90.51 RBPASA01 description PRI ASA
    name 10.100.90.52 RBPASA02 description SECASA
    name 151.198.253.254 VPN02External
    name 10.10.7.189 RBMHIS description AergoVPN(Local)
    name 10.10.7.43 RBMHIS1 description AergoVPN(Local)
    name 10.10.7.44 RBMHIS2 description AergoVPN(Local)
    name 10.100.98.21 RBMS2 description AergoVPN(Local)
    name 10.1.6.0 AergoVPN-Remote description AergoVPN-Remote
    name 216.167.127.4 Lynx-PicisHost1 description Lynx Encryption Domain
    name 216.167.127.30 Lynx-PicisHost10 description Lynx Encryption Domain
    name 216.167.127.31 Lynx-PicisHost11 description Lynx Encryption Domain
    name 216.167.127.32 Lynx-PicisHost12 description Lynx Encryption Domain
    name 216.167.127.33 Lynx-PicisHost13 description Lynx Encryption Domain
    name 216.167.127.34 Lynx-PicisHost14 description Lynx Encryption Domain
    name 216.167.127.35 Lynx-PicisHost15 description Lynx Encryption Domain
    name 216.167.127.5 Lynx-PicisHost2 description Lynx Encryption Domain
    name 216.167.127.6 Lynx-PicisHost3 description Lynx Encryption Domain
    name 216.167.127.7 Lynx-PicisHost4 description Lynx Encryption Domain
    name 216.167.127.8 Lynx-PicisHost5 description Lynx Encryption Domain
    name 216.167.127.9 Lynx-PicisHost6 description Lynx Encryption Domain
    name 216.167.127.10 Lynx-PicisHost7 description Lynx Encryption Domain
    name 216.167.127.28 Lynx-PicisHost8 description Lynx Encryption Domain
    name 216.167.127.29 Lynx-PicisHost9 description Lynx Encryption Domain
    name 216.167.119.208 Lynx-PicisNtwk description Lynx-PicisNtwk
    name 10.10.7.152 OLSRV2RED description Picis-LynxLocal
    name 10.100.91.14 RBPPICISTST description Lynx-PicisLocal
    name 10.100.98.20 RBPAERGO1 description AERGO
    name 10.50.1.141 PACSHost1 description GE PACS Local
    name 10.50.1.149 PACSHost2 description GE PACS Local
    name 10.50.1.151 PACSHost3 description GE PACS Local
    name 10.50.1.38 PACSHost4 description GE PACS Local
    name 10.50.1.39 PACSHost5 description GE PACS Local
    name 10.50.1.41 PACSHost6 description GE PACS Local
    name 10.50.1.42 PACSHost7 description GE PACS Local
    name 10.50.1.43 PACSHost8 description GE PACS Local
    name 10.50.1.64 PACSHost10 description GE PACS Local
    name 10.50.1.67 PACSHost11 description GE PACS Local
    name 10.50.1.68 PACSHost12 description GE PACS Local
    name 10.50.1.69 PACSHost13 description GE PACS Local
    name 10.50.1.44 PACSHost9 description GE PACS Local
    name 10.50.1.70 PACSHost14 description GE PACS Local
    name 10.50.1.71 PACSHost15 description GE PACS Local
    name 10.50.1.72 PACSHost16 description GE PACS Local
    name 10.50.1.73 PACSHost17 description GE PACS Local
    name 10.50.1.74 PACSHost18 description GE PACS Local
    name 10.50.1.75 PACSHost19 description GE PACS Local
    name 10.50.1.76 PACSHost20 description GE PACS Local
    name 10.50.1.77 PACSHost21 description GE PACS Local
    name 10.50.1.91 PACSHost22 description GE PACS Local
    name 10.50.1.92 PACSHost23 description GE PACS Local
    name 10.60.1.42 PACSHost24 description GE PACS Local
    name 10.60.1.43 PACSHost25 description GE PACS Local
    name 10.60.1.44 PACSHost26 description GE PACS Local
    name 10.60.1.45 PACSHost27 description GE PACS Local
    name 10.60.1.46 PACSHost28 description GE PACS Local
    name 10.60.1.47 PACSHost29 description GE PACS Local
    name 10.60.1.48 PACSHost30 description GE PACS Local
    name 10.60.1.49 PACSHost31 description GE PACS Local
    name 10.60.1.51 PACSHost32 description GE PACS Local
    name 10.60.1.52 PACSHost33 description GE PACS Local
    name 10.60.1.53 PACSHost34 description GE PACS Local
    name 10.60.1.80 PACSHost35 description GE PACS Local
    name 10.50.1.30 PACSHost36 description GE PACS Local
    name 10.50.1.200 PACSHost37 description GE PACS Local
    name 10.50.1.137 PACSHost38 description GE PACS Local
    name 10.50.1.203 PACSHost39 description GE PACS Local
    name 10.50.1.206 PACSHost40 description GE PACS Local
    name 10.50.1.209 PACSHost41 description GE PACS Local
    name 10.60.1.215 PACSHost42 description GE PACS Local
    name 10.60.1.23 PACSHost43 description GE PACS Local
    name 10.60.1.21 PACSHost44 description GE PACS Local
    name 10.50.1.36 PACSHost45 description GE PACS Local
    name 10.50.1.34 PACSHost46 description GE PACS Local
    name 10.50.1.10 PACSHost47 description GE PACS Local
    name 150.2.0.0 GE_PACS_NET description GE PACS Remote
    name 10.50.1.19 PACSHost49 description GE PACS Local
    name 10.50.1.28 PACSHost50 description GE PACS Local
    name 10.50.1.29 PACSHost51 description GE PACS Local
    name 10.50.1.140 PACSHost52 description GE PACS Local
    name 10.60.1.161 PACSHost53 description GE PACS Local
    name 10.50.1.31 PACSHost54 description GE PACS Local
    name 10.50.1.32 PACSHost55 description GE PACS Local
    name 10.50.1.4 PACSHost56 description GE PACS Local
    name 10.50.1.35 PACSHost57 description GE PACS Local
    name 10.50.1.37 PACSHost58 description GE PACS Local
    name 10.60.1.22 PACSHost59 description GE PACS Local
    name 10.60.1.24 PACSHost60 description GE PACS Local
    name 10.60.1.218 PACSHost61 description GE PACS Local
    name 10.60.1.221 PACSHost62 description GE PACS Local
    name 10.50.1.16 PACSHost63 description GE PACS Local
    name 10.50.1.15 PACSHost64 description GE PACS Local
    name 10.50.1.106 PACSHost65 description GE PACS Local
    name 10.50.1.33 PACSHost66 description GE PACS Local
    name 10.20.7.160 PACSHost67 description GE PACS Local
    name 10.50.1.135 PACSHost68 description GE PACS Local
    name 10.60.1.141 PACSHost69 description GE PACS Local
    name 10.60.1.150 PACSHost70 description GE PACS Local
    name 10.60.1.154 PACSHost71 description GE PACS Local
    name 10.50.1.136 PACSHost72 description GE PACS Local
    name 10.50.1.147 PACSHost73 description GE PACS Local
    name 10.50.1.161 PACSHost74 description GE PACS Local
    name 10.60.1.155 PACSHost75 description GE PACS Local
    name 10.30.0.0 Throckmorton_Net1 description Internal
    name 108.58.104.208 Throckmorton_Net2 description External
    name 10.0.0.0 PAD_Internal description PAD INternal
    name 172.16.100.16 LandaCorp_Remote description LandaCorp
    name 192.168.55.6 C05817Nat description ViewPoint Computer
    name 10.10.13.71 C05817 description ViewPoint Computer
    name 10.50.1.189 RBMCCCG description GE PACS Local
    name 10.50.1.21 RBMCDAS21 description GE PACS Local
    name 10.50.1.22 RBMCDAS22 description GE PACS Local
    name 10.50.1.23 RBMCDAS23 description GE PACS Local
    name 10.50.1.24 RBMCDAS24 description GE PACS Local
    name 10.50.1.248 RBMCNAS_BACKUP description GE PACS Local
    name 10.50.1.243 RBMCNAS_STS description GE PACS Local
    name 10.50.1.186 RBMCSPS description GE PACS Local
    name 10.50.1.188 RBMCTESTCCG description GE PACS Local
    name 10.50.1.252 RBMCTESTIMS description GE PACS Local
    name 10.50.1.249 RBMICISU2 description GE PACS Local
    name 10.50.1.191 RBMC1DAS32ILO description GE PACS Local
    name 10.50.1.192 RBMC1DAS33ILO description GE PACS Local
    name 10.50.1.193 RBMC1DAS34ILO description GE PACS Local
    name 10.50.1.194 RBMC1DAS35ILO description GE PACS Local
    name 10.50.1.195 RBMC1DAS36ILO description GE PACS Local
    name 10.50.1.197 RBMC1DAS38ILO description GE PACS Local
    name 10.50.1.190 RBMC1DPS106ILO description GE PACS Local
    name 10.50.1.196 RBMCCWEBILO description GE PACS Local
    name 10.50.1.17 RBMCEACA description GE PACS Local
    name 10.50.1.247 RBMCNAS_BACKUPILO description GE PACS Local
    name 10.50.1.254 RBMICISU2ILO description GE PACS Local
    name 10.50.1.187 RBMC1DAS31_ILO description GE PACS Local
    name 10.50.1.253 RBMCTESTDAS description GE PACS Local
    name 12.145.95.0 LabCorp_Test_Remote description LabCorp VPN TEST
    name 38.107.151.110 ClearSea_Server description DeafTalk External Server
    name 10.100.90.15 DeafTalk1
    name 10.10.10.155 Dennis
    name 10.10.7.81 RBPMAM description SunQuest Lab Server
    dns-guard
    interface GigabitEthernet0/0
    description External Interface
    speed 1000
    duplex full
    nameif Verizon-ISP
    security-level 0
    ip address VPN-External 255.255.255.224 standby VPN02External
    ospf cost 10
    interface GigabitEthernet0/1
    description LAN/STATE Failover Interface
    interface GigabitEthernet0/2
    description INTERNAL-NET
    nameif Internal
    security-level 100
    ip address RBPASA01 255.255.255.0 standby RBPASA02
    ospf cost 10
    interface GigabitEthernet0/3
    description DMZ Zone
    nameif DMZ
    security-level 10
    ip address 172.31.0.51 255.255.255.0
    interface Management0/0
    shutdown
    no nameif
    no security-level
    no ip address
    time-range Vendor-Access
    periodic Monday 9:00 to Friday 16:00
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup Verizon-ISP
    dns domain-lookup Internal
    dns server-group DefaultDNS
    name-server 10.100.91.5
    name-server 10.10.7.149
    domain-name rbmc.org
    object-group service VPN_Tunnel tcp
    description Ports used for Site to Site VPN Tunnel
    port-object eq 10000
    port-object eq 2746
    port-object eq 4500
    port-object eq 50
    port-object eq 500
    port-object eq 51
    object-group network Millennium-Local-Network
    description Pad networks that connect to millennium
    network-object Pad-10.10-network 255.255.0.0
    network-object Throckmorton_Net1 255.255.0.0
    object-group icmp-type ICMP-Request-Group
    icmp-object echo
    icmp-object information-request
    icmp-object mask-request
    icmp-object timestamp-request
    object-group service DM_INLINE_TCP_2 tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq ssh
    object-group network Viewpoint
    description OB Viewpoint Clients
    network-object host 10.10.10.220
    network-object host c05407
    network-object host c05744
    network-object host 192.168.55.2
    network-object host c057017Nat
    network-object host c05407Nat
    network-object host c05744Nat
    network-object host C05817Nat
    network-object host C05817
    object-group service ConnectionPorts tcp-udp
    port-object eq 3872
    port-object eq 4890
    port-object eq 4898
    object-group service TCP tcp
    port-object eq 3389
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_TCP_1 tcp
    group-object ConnectionPorts
    port-object eq 3389
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object icmp
    protocol-object tcp
    object-group network AergoVPN-Local
    description Aergo VPN Local HIS Servers
    network-object host RBMHIS
    network-object host RBMHIS1
    network-object host RBMHIS2
    network-object host RBMS2
    network-object host RBPAERGO1
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object icmp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_4
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group network Lynx-PicisRemote
    description Lynx-Picis Remote Encryption Domain
    network-object Lynx-PicisNtwk 255.255.255.240
    network-object host Lynx-PicisHost7
    network-object host Lynx-PicisHost8
    network-object host Lynx-PicisHost9
    network-object host Lynx-PicisHost10
    network-object host Lynx-PicisHost11
    network-object host Lynx-PicisHost12
    network-object host Lynx-PicisHost13
    network-object host Lynx-PicisHost14
    network-object host Lynx-PicisHost15
    network-object host Lynx-PicisHost1
    network-object host Lynx-PicisHost2
    network-object host Lynx-PicisHost3
    network-object host Lynx-PicisHost4
    network-object host Lynx-PicisHost5
    network-object host Lynx-PicisHost6
    object-group network DM_INLINE_NETWORK_1
    network-object host OLSRV2RED
    network-object host RBPPICISTST
    object-group network DM_INLINE_NETWORK_2
    network-object host OLSRV2RED
    network-object host RBPPICISTST
    object-group protocol DM_INLINE_PROTOCOL_5
    protocol-object icmp
    protocol-object tcp
    object-group network DM_INLINE_NETWORK_3
    network-object host OLSRV2RED
    network-object host RBPPICISTST
    object-group service DM_INLINE_SERVICE_1
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group protocol DM_INLINE_PROTOCOL_6
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_7
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object icmp
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_TCP_3 tcp
    group-object ConnectionPorts
    port-object eq 3389
    object-group network GE_PACS_Local
    description GE PACS Local Hosts
    network-object host PACSHost67
    network-object host PACSHost65
    network-object host PACSHost47
    network-object host PACSHost68
    network-object host PACSHost72
    network-object host PACSHost38
    network-object host PACSHost52
    network-object host PACSHost1
    network-object host PACSHost73
    network-object host PACSHost2
    network-object host PACSHost3
    network-object host PACSHost64
    network-object host PACSHost74
    network-object host PACSHost63
    network-object host PACSHost49
    network-object host PACSHost37
    network-object host PACSHost39
    network-object host PACSHost40
    network-object host PACSHost41
    network-object host PACSHost50
    network-object host PACSHost51
    network-object host PACSHost36
    network-object host PACSHost54
    network-object host PACSHost55
    network-object host PACSHost66
    network-object host PACSHost46
    network-object host PACSHost57
    network-object host PACSHost45
    network-object host PACSHost58
    network-object host PACSHost4
    network-object host PACSHost5
    network-object host PACSHost6
    network-object host PACSHost7
    network-object host PACSHost8
    network-object host PACSHost9
    network-object host PACSHost56
    network-object host PACSHost10
    network-object host PACSHost11
    network-object host PACSHost12
    network-object host PACSHost13
    network-object host PACSHost14
    network-object host PACSHost15
    network-object host PACSHost16
    network-object host PACSHost17
    network-object host PACSHost18
    network-object host PACSHost19
    network-object host PACSHost20
    network-object host PACSHost21
    network-object host PACSHost22
    network-object host PACSHost23
    network-object host PACSHost69
    network-object host PACSHost70
    network-object host PACSHost71
    network-object host PACSHost75
    network-object host PACSHost53
    network-object host PACSHost42
    network-object host PACSHost61
    network-object host PACSHost44
    network-object host PACSHost62
    network-object host PACSHost59
    network-object host PACSHost43
    network-object host PACSHost60
    network-object host PACSHost24
    network-object host PACSHost25
    network-object host PACSHost26
    network-object host PACSHost27
    network-object host PACSHost28
    network-object host PACSHost29
    network-object host PACSHost30
    network-object host PACSHost31
    network-object host PACSHost32
    network-object host PACSHost33
    network-object host PACSHost34
    network-object host PACSHost35
    network-object host RBMCSPS
    network-object host RBMCTESTCCG
    network-object host RBMCCCG
    network-object host RBMCDAS21
    network-object host RBMCDAS22
    network-object host RBMCDAS23
    network-object host RBMCNAS_STS
    network-object host RBMCNAS_BACKUP
    network-object host RBMICISU2
    network-object host RBMCDAS24
    network-object host RBMCTESTIMS
    network-object host RBMCEACA
    network-object host RBMC1DAS31_ILO
    network-object host RBMC1DPS106ILO
    network-object host RBMC1DAS32ILO
    network-object host RBMC1DAS33ILO
    network-object host RBMC1DAS34ILO
    network-object host RBMC1DAS35ILO
    network-object host RBMC1DAS36ILO
    network-object host RBMCCWEBILO
    network-object host RBMC1DAS38ILO
    network-object host RBMCNAS_BACKUPILO
    network-object host RBMCTESTDAS
    network-object host RBMICISU2ILO
    object-group service DM_INLINE_SERVICE_2
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group service DM_INLINE_SERVICE_3
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group network DM_INLINE_NETWORK_4
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_5
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_6
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_7
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group network DM_INLINE_NETWORK_8
    network-object Throckmorton_Net1 255.255.0.0
    network-object Throckmorton_Net2 255.255.255.248
    object-group service DM_INLINE_SERVICE_4
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group service DM_INLINE_SERVICE_5
    service-object icmp
    service-object udp
    service-object tcp
    service-object tcp eq ftp
    object-group network DM_INLINE_NETWORK_9
    network-object host RBMCEACA
    group-object GE_PACS_Local
    object-group protocol DM_INLINE_PROTOCOL_9
    protocol-object ip
    protocol-object icmp
    object-group service ClearSea tcp-udp
    description DeafTalk
    port-object range 10000 19999
    port-object eq 35060
    object-group service ClearSeaUDP udp
    description DeafTalk
    port-object range 10000 19999
    object-group service DM_INLINE_TCP_4 tcp
    group-object ClearSea
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_11
    network-object 0.0.0.0 0.0.0.0
    network-object host DeafTalk1
    object-group protocol DM_INLINE_PROTOCOL_10
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_11
    protocol-object ip
    protocol-object icmp
    access-list RBMCVPNCL_splitTunnelAcl standard permit Pad-10.100-network 255.255.255.0
    access-list Verizon-ISP_Internal extended permit tcp any host FTP-External-Address eq ftp
    access-list dmz_internal extended permit tcp host FTP-Internal-Address any eq ftp
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_4 object-group AergoVPN-Local AergoVPN-Remote 255.255.255.0
    access-list Internal_access_in extended permit object-group DM_INLINE_SERVICE_1 object-group DM_INLINE_NETWORK_3 object-group Lynx-PicisRemote
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_6 object-group Viewpoint host NBI20610
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_7 host RBPMAXYS02 host LandaCorp_Remote
    access-list Internal_access_in extended permit tcp host RBPMAXYS02 host LandaCorp_Remote object-group DM_INLINE_TCP_3
    access-list Internal_access_in extended permit object-group DM_INLINE_SERVICE_2 object-group GE_PACS_Local GE_PACS_NET 255.255.0.0
    access-list Internal_access_in extended permit object-group DM_INLINE_SERVICE_4 Pad-10.10-network 255.255.0.0 object-group DM_INLINE_NETWORK_7
    access-list Internal_access_in remark Permit to connect to DeafTalk Server
    access-list Internal_access_in extended permit tcp object-group DM_INLINE_NETWORK_11 host ClearSea_Server object-group DM_INLINE_TCP_4
    access-list Internal_access_in extended permit object-group DM_INLINE_PROTOCOL_10 any LabCorp_Test_Remote 255.255.255.0
    access-list Verizon-ISP_cryptomap_1 extended permit object-group DM_INLINE_PROTOCOL_11 host RBPMAM LabCorp_Test_Remote 255.255.255.0
    access-list Verizon-ISP_2_cryptomap extended permit tcp host Maxsys-Server host Maxsys-Remote object-group VPN_Tunnel
    access-list Internal_nat0_outbound extended permit tcp Pad-10.100-network 255.255.255.0 host Maxsys-Remote object-group VPN_Tunnel
    access-list DMZ_access_in extended permit ip Pad-10.10-network 255.255.0.0 172.31.0.0 255.255.255.0
    access-list Verizon-ISP_access_in extended permit tcp any host FTP-External-Address object-group DM_INLINE_TCP_2
    access-list Verizon-ISP_access_in extended permit tcp host LandaCorp_Remote host RBPMAXYS02 object-group DM_INLINE_TCP_1
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_1 host NBI20610 object-group Viewpoint
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_3 AergoVPN-Remote 255.255.255.0 object-group AergoVPN-Local
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_5 object-group Lynx-PicisRemote object-group DM_INLINE_NETWORK_2
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_2 host LandaCorp_Remote host RBPMAXYS02
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_SERVICE_3 GE_PACS_NET 255.255.0.0 object-group DM_INLINE_NETWORK_9
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_PROTOCOL_9 LabCorp_Test_Remote 255.255.255.0 any
    access-list Verizon-ISP_access_in extended permit object-group DM_INLINE_SERVICE_5 object-group DM_INLINE_NETWORK_8 Pad-10.10-network 255.255.0.0
    access-list Verizon-ISP_3_cryptomap extended permit ip host Maxsys-Server host Maxsys-Remote
    access-list Internal_nat0_outbound_1 extended permit ip host RBPMAXYS02 host LandaCorp_Remote
    access-list Internal_nat0_outbound_1 extended permit ip object-group AergoVPN-Local AergoVPN-Remote 255.255.255.0
    access-list Internal_nat0_outbound_1 extended permit ip host OLSRV2RED object-group Lynx-PicisRemote
    access-list Internal_nat0_outbound_1 extended permit ip object-group DM_INLINE_NETWORK_1 object-group Lynx-PicisRemote
    access-list Internal_nat0_outbound_1 extended permit ip any 10.100.99.0 255.255.255.0
    access-list Internal_nat0_outbound_1 extended permit ip object-group GE_PACS_Local GE_PACS_NET 255.255.0.0
    access-list Internal_nat0_outbound_1 extended permit ip Pad-10.10-network 255.255.0.0 object-group DM_INLINE_NETWORK_4
    access-list Internal_nat0_outbound_1 extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_5
    access-list Internal_nat0_outbound_1 extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_6
    access-list Internal_nat0_outbound_1 extended permit ip object-group Millennium-Local-Network Millennium-Remote 255.255.0.0
    access-list Internal_nat0_outbound_1 extended deny ip any LabCorp_Test_Remote 255.255.255.0 inactive
    access-list Verizon-ISP_5_cryptomap extended permit ip host RBPMAXYS02 host LandaCorp_Remote
    access-list Verizon-ISP_6_cryptomap extended permit ip object-group Viewpoint host NBI20610
    access-list Verizon-ISP_4_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object-group Lynx-PicisRemote
    access-list Verizon-ISP_7_cryptomap extended permit ip object-group GE_PACS_Local GE_PACS_NET 255.255.0.0
    access-list Verizon-ISP_8_cryptomap extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_5
    access-list Verizon-ISP_9_cryptomap extended permit ip PAD_Internal 255.0.0.0 object-group DM_INLINE_NETWORK_6
    access-list Verizon-ISP_cryptomap extended permit ip object-group AergoVPN-Local AergoVPN-Remote 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 32000
    logging buffered debugging
    logging asdm debugging
    mtu Verizon-ISP 1500
    mtu Internal 1500
    mtu DMZ 1500
    ip local pool CiscoClient-IPPool-192.168.55.x 192.168.45.1-192.168.45.25 mask 255.255.255.0
    ip local pool VLAN99VPNUsers 10.100.99.6-10.100.99.255 mask 255.255.255.0
    failover
    failover lan unit primary
    failover lan interface Failover GigabitEthernet0/1
    failover key *****
    failover replication http
    failover link Failover GigabitEthernet0/1
    failover interface ip Failover 172.16.90.17 255.255.255.248 standby 172.16.90.18
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit host 173.72.107.26 Verizon-ISP
    icmp deny any Verizon-ISP
    icmp permit host 192.168.10.2 Internal
    icmp permit host 192.168.10.3 Internal
    icmp permit host 192.168.10.4 Internal
    icmp permit host 192.168.10.5 Internal
    icmp permit host 10.10.10.96 Internal
    icmp permit host 10.10.13.20 Internal
    icmp permit host 10.10.12.162 Internal
    icmp deny any Internal
    icmp permit host Dennis Internal
    asdm image disk0:/asdm-603.bin
    asdm history enable
    arp timeout 14400
    global (Verizon-ISP) 1 65.211.65.6-65.211.65.29 netmask 255.255.255.224
    global (Verizon-ISP) 101 interface
    nat (Internal) 0 access-list Internal_nat0_outbound_1
    nat (Internal) 101 0.0.0.0 0.0.0.0
    static (Internal,DMZ) Pad-10.10-network Pad-10.10-network netmask 255.255.0.0
    static (Verizon-ISP,DMZ) FTP-Internal-Address FTP-External-Address netmask 255.255.255.255
    static (DMZ,Verizon-ISP) FTP-External-Address FTP-Internal-Address netmask 255.255.255.255
    static (Internal,Verizon-ISP) c05407Nat c05407 netmask 255.255.255.255
    static (Internal,Verizon-ISP) c057017Nat 10.10.10.220 netmask 255.255.255.255
    static (Internal,Verizon-ISP) c05744Nat c05744 netmask 255.255.255.255
    static (Verizon-ISP,Internal) Maxsys-Server VPN-External netmask 255.255.255.255
    static (Internal,Verizon-ISP) C05817Nat C05817 netmask 255.255.255.255
    access-group Verizon-ISP_access_in in interface Verizon-ISP
    access-group Internal_access_in in interface Internal
    access-group dmz_internal in interface DMZ
    route Verizon-ISP 0.0.0.0 0.0.0.0 65.211.65.2 1
    route Internal Pad-10.10-network 255.255.0.0 10.10.0.1 1
    route Internal 10.20.0.0 255.255.0.0 10.10.0.1 1
    route Internal Throckmorton_Net1 255.255.0.0 10.10.0.1 1
    route Internal 10.50.0.0 255.255.0.0 10.10.0.1 1
    route Internal 10.60.0.0 255.255.0.0 10.10.0.1 1
    route Internal 10.70.0.0 255.255.0.0 10.10.0.1 1
    route Internal 10.100.0.0 255.255.0.0 10.10.0.1 1
    route Internal 64.46.192.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.193.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.194.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.195.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.196.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.201.0 255.255.255.0 10.10.0.1 1
    route Internal 64.46.246.0 255.255.255.0 10.10.0.1 1
    route Verizon-ISP 65.51.206.130 255.255.255.255 65.211.65.2 255
    route Verizon-ISP Millennium-Remote 255.255.0.0 65.211.65.2 1
    route Internal Millennium-Remote 255.255.0.0 10.10.0.1 255
    route Internal 172.31.1.0 255.255.255.0 10.10.0.1 1
    route Internal 192.168.55.0 255.255.255.0 10.10.0.1 1
    route Internal 195.21.26.0 255.255.255.0 10.10.0.1 1
    route Internal 199.21.26.0 255.255.255.0 10.10.0.1 1
    route Internal 199.21.27.0 255.255.255.0 10.10.0.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server RadiusServer protocol radius
    aaa-server RadiusServer (Internal) host 10.10.7.240
    timeout 5
    key r8mcvpngr0up!
    radius-common-pw r8mcvpngr0up!
    aaa-server SafeNetOTP protocol radius
    max-failed-attempts 1
    aaa-server SafeNetOTP (Internal) host 10.100.91.13
    key test
    radius-common-pw test
    aaa-server VPN-FW protocol radius
    aaa-server VPN-FW (Internal) host 10.10.7.240
    timeout 5
    key r8mcvpngr0up!
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication enable console LOCAL
    aaa local authentication attempts max-fail 16
    http server enable
    http Dennis 255.255.255.255 Internal
    http 10.10.11.108 255.255.255.255 Internal
    http 10.10.10.194 255.255.255.255 Internal
    http 10.10.10.195 255.255.255.255 Internal
    http 10.10.12.162 255.255.255.255 Internal
    http 10.10.13.20 255.255.255.255 Internal
    snmp-server location BRN2 Data Center
    snmp-server contact Crystal Holmes
    snmp-server community r8mc0rg
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    snmp-server enable traps entity config-change
    auth-prompt prompt Your credentials have been verified
    auth-prompt accept Your credentials have been accepted
    auth-prompt reject Your credentials have been rejected. Contact your system administrator
    service resetoutside
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Verizon-ISP_map 1 match address Verizon-ISP_cryptomap
    crypto map Verizon-ISP_map 1 set peer 65.51.154.66
    crypto map Verizon-ISP_map 1 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 2 match address Verizon-ISP_2_cryptomap
    crypto map Verizon-ISP_map 2 set peer Maxsys-Remote
    crypto map Verizon-ISP_map 2 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 2 set nat-t-disable
    crypto map Verizon-ISP_map 3 match address Verizon-ISP_3_cryptomap
    crypto map Verizon-ISP_map 3 set peer Maxsys-Remote
    crypto map Verizon-ISP_map 3 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 3 set nat-t-disable
    crypto map Verizon-ISP_map 4 match address Verizon-ISP_4_cryptomap
    crypto map Verizon-ISP_map 4 set peer 198.65.114.68
    crypto map Verizon-ISP_map 4 set transform-set ESP-AES-256-SHA
    crypto map Verizon-ISP_map 4 set nat-t-disable
    crypto map Verizon-ISP_map 5 match address Verizon-ISP_5_cryptomap
    crypto map Verizon-ISP_map 5 set peer 12.195.130.2
    crypto map Verizon-ISP_map 5 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 5 set nat-t-disable
    crypto map Verizon-ISP_map 6 match address Verizon-ISP_6_cryptomap
    crypto map Verizon-ISP_map 6 set peer 208.68.22.250
    crypto map Verizon-ISP_map 6 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 6 set nat-t-disable
    crypto map Verizon-ISP_map 7 match address Verizon-ISP_7_cryptomap
    crypto map Verizon-ISP_map 7 set peer 208.51.30.227
    crypto map Verizon-ISP_map 7 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 8 match address Verizon-ISP_8_cryptomap
    crypto map Verizon-ISP_map 8 set peer Throckmorton_Net2
    crypto map Verizon-ISP_map 8 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 9 match address Verizon-ISP_9_cryptomap
    crypto map Verizon-ISP_map 9 set peer 108.58.104.210
    crypto map Verizon-ISP_map 9 set transform-set ESP-3DES-MD5
    crypto map Verizon-ISP_map 10 match address Verizon-ISP_cryptomap_1
    crypto map Verizon-ISP_map 10 set peer 162.134.70.20
    crypto map Verizon-ISP_map 10 set transform-set ESP-3DES-SHA
    crypto map Verizon-ISP_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Verizon-ISP_map interface Verizon-ISP
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn vpn.rbmc.org
    subject-name CN=vpn.rbmc.org
    keypair sslvpnkeypair
    no client-types
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 31
        308201dc 30820145 a0030201 02020131 300d0609 2a864886 f70d0101 04050030
        34311530 13060355 0403130c 76706e2e 72626d63 2e6f7267 311b3019 06092a86
        4886f70d 01090216 0c76706e 2e72626d 632e6f72 67301e17 0d303830 38323030
        34313134 345a170d 31383038 31383034 31313434 5a303431 15301306 03550403
        130c7670 6e2e7262 6d632e6f 7267311b 30190609 2a864886 f70d0109 02160c76
        706e2e72 626d632e 6f726730 819f300d 06092a86 4886f70d 01010105 0003818d
        00308189 02818100 a1664806 3a378c37 a55b2cd7 86c1fb5a de884ec3 6d5652e3
        953e9c01 37f4593c a6b61c31 80f87a51 c0ccfe65 e5ca3d33 216dea84 0eeeecf3
        394505ea 231b0a5f 3c0b59d9 b7c9ba4e 1da130fc cf0159bf 537282e4 e34c2442
        beffc258 a8d8edf9 59412e87 c5f819d0 2d233ecc 214cea8b 3a3922e5 2718ef6a
        87c340a3 d3a0ae21 02030100 01300d06 092a8648 86f70d01 01040500 03818100
        33902c9e 54dc8574 13084948 a21390a2 7000648a a9c7ad0b 3ffaeae6 c0fc4e6c
        60b6a60a ac89c3da 869d103d af409a8a e2d43387 a4fa2278 5a105773 a8d6b5c3
        c13a743c 8a42c34a e6859f6e 760a81c7 5116f42d b3d81b83 11fafae7 b541fad1
        f9bc1cb0 5ed77033 6cab9c90 0a14a841 fc30d8e4 9c85c0e0 d2cca126 fd449e39
      quit
    crypto isakmp identity address
    crypto isakmp enable Verizon-ISP
    crypto isakmp enable Internal
    crypto isakmp policy 50
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 28800
    crypto isakmp ipsec-over-tcp port 10000
    telnet timeout 5
    ssh 173.72.107.26 255.255.255.255 Verizon-ISP
    ssh 10.10.12.162 255.255.255.255 Internal
    ssh 10.100.91.53 255.255.255.255 Internal
    ssh Dennis 255.255.255.255 Internal
    ssh timeout 60
    console timeout 2
    management-access Internal
    vpn load-balancing
    interface lbpublic Verizon-ISP
    interface lbprivate Internal
    cluster key r8mcl0adbalanc3
    cluster encryption
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    ntp server 207.5.137.133 source Verizon-ISP prefer
    ntp server 10.100.91.5 source Internal prefer
    ssl trust-point ASDM_TrustPoint0
    ssl trust-point ASDM_TrustPoint0 Verizon-ISP
    webvpn
    enable Verizon-ISP
    svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.1.0148-k9.pkg 2
    svc image disk0:/anyconnect-linux-2.1.0148-k9.pkg 3
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    wins-server value 10.100.91.5
    dns-server value 10.100.91.5
    vpn-simultaneous-logins 1
    vpn-idle-timeout 15
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    webvpn
      svc ask none default webvpn
    group-policy VPNUsers internal
    group-policy VPNUsers attributes
    dns-server value 10.100.91.6 10.100.91.5
    vpn-tunnel-protocol IPSec
    default-domain value RBMC
    tunnel-group DefaultL2LGroup ipsec-attributes
    peer-id-validate nocheck
    tunnel-group 65.51.154.66 type ipsec-l2l
    tunnel-group 65.51.154.66 ipsec-attributes
    pre-shared-key *
    tunnel-group 65.171.123.34 type ipsec-l2l
    tunnel-group 65.171.123.34 ipsec-attributes
    pre-shared-key *
    peer-id-validate nocheck
    tunnel-group 12.195.130.2 type ipsec-l2l
    tunnel-group 12.195.130.2 ipsec-attributes
    pre-shared-key *
    tunnel-group 208.68.22.250 type ipsec-l2l
    tunnel-group 208.68.22.250 ipsec-attributes
    pre-shared-key *
    tunnel-group 198.65.114.68 type ipsec-l2l
    tunnel-group 198.65.114.68 ipsec-attributes
    pre-shared-key *
    tunnel-group VPNUsers type remote-access
    tunnel-group VPNUsers general-attributes
    address-pool VLAN99VPNUsers
    authentication-server-group VPN-FW
    default-group-policy VPNUsers
    tunnel-group VPNUsers ipsec-attributes
    trust-point ASDM_TrustPoint0
    tunnel-group 208.51.30.227 type ipsec-l2l
    tunnel-group 208.51.30.227 ipsec-attributes
    pre-shared-key *
    tunnel-group 108.58.104.210 type ipsec-l2l
    tunnel-group 108.58.104.210 ipsec-attributes
    pre-shared-key *
    tunnel-group 162.134.70.20 type ipsec-l2l
    tunnel-group 162.134.70.20 ipsec-attributes
    pre-shared-key *
    tunnel-group-map default-group DefaultL2LGroup
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect sunrpc
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:9d17ad8684073cb9f3707547e684007f
    : end
    Message was edited by: Dennis Farrell

    Hi Dennis,
    Your tunnel to "12.145.95.0 LabCorp_Test_Remote" segment can only be initiated from host: RBPMAM is due to your crytp-acl below.
    access-list Verizon-ISP_cryptomap_1 extended permit object-group DM_INLINE_PROTOCOL_11 host RBPMAM LabCorp_Test_Remote 255.255.255.0
    Secondly your no-nat on internal interface is denying the traffic that must enter into crytp engine, therefore your tunnel never going to come up.
    Therefore please turn it to a "permit" instead.
    access-list Internal_nat0_outbound_1 extended deny ip any LabCorp_Test_Remote 255.255.255.0 inactive
    Please update,
    thanks
    Rizwan Rafeek
    Message was edited by: Rizwan Mohamed

  • Public-to-Public L2L VPN no return traffic

    Hello all,
    I'm hoping someone can give me a little help. I've researched the web and have read many forums, but I still can't get this to work. One of our vendors requires using a public ip address to setup a site-to-site IPSEC vpn. We only have one public ip address and that will be used for the vpn endpoint and for internet access for the local network. I've setup policy NAT from our local network to the outside interface. I'm also using the outside ip address for the crypto map. The tunnel setups successfully and the Tx count increases anytime I try to ping the remote network, but the ping fails and the Rx count does not increase. According to our vendor, we should be able to ping the remote network and connect using port 443. When trying to connect using port 443, I see a SYN timeout in the logs. I'm not sure if the problem is on their end and they're rejecting our traffic, or if something is misconfigured on our end. I'd like to make sure that I have everything configured correctly before I go and point fingers at them. Any help would be appreciated. Thanks.
    Local Network - 10.10.9.0/24
    Remote Network - 20.20.41.0/24
    Remote Peer - 20.20.60.193
    ASA Version 8.2(5)
    hostname ciscoasa
    domain-name
    names
    name 10.10.9.3 VPN description VPN Server
    name 10.10.9.4 IntranetMySQL description MySQL For Webserver
    name 192.168.0.100 IIS_Webserver
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.10.9.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 71.***.***.162 255.255.255.0
    interface Vlan3
    nameif dmz
    security-level 50
    ip address 192.168.0.254 255.255.255.0
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 10.10.9.1
      domain-name
    same-security-traffic permit inter-interface
    object-group service VPN_TCP
    description VPN TCP Connection
    service-object tcp eq 1195
    object-group service VPN_UDP
    description VPN UDP Port
    service-object udp eq 1194
    object-group service VPN_HTTPS
    description VPN HTTPS Web Server
    service-object tcp eq 943
    service-object udp eq 943
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service WebServer
    service-object tcp eq 8001
    object-group service DM_INLINE_SERVICE_1
    service-object tcp-udp eq www
    service-object tcp eq https
    object-group service VPN_HTTPS_UDP udp
    port-object eq 943
    object-group service WCF_WebService tcp
    port-object eq 808
    object-group service RDP tcp
    port-object eq 3389
    object-group service RDP_UDP udp
    port-object eq 3389
    object-group service DM_INLINE_SERVICE_2
    service-object tcp-udp eq www
    service-object tcp eq https
    object-group service *_Apache tcp
    port-object eq 8001
    object-group service *_ApacheUDP udp
    port-object eq 8001
    object-group service IIS_SQL_Server tcp
    port-object eq 1433
    object-group service DM_INLINE_TCP_1 tcp
    port-object eq www
    port-object eq https
    object-group service File_Sharing tcp
    port-object eq 445
    object-group service File_Sharing_UDP udp
    port-object eq 445
    object-group service MySQL tcp
    port-object eq 3306
    object-group service Http_Claims_Portal tcp
    port-object eq 8080
    object-group service Http_Claims_PortalUDP udp
    port-object eq 8080
    object-group service RTR_Portal tcp
      description Real Time Rating Portal
    port-object eq 8081
    object-group service RTR_PortalUDP udp
    port-object eq 8081
    object-group service DM_INLINE_SERVICE_3
    service-object tcp-udp eq www
    service-object tcp eq https
    access-list outside_access_in extended permit udp any 70.***.***.0 255.255.255.0 eq 1194
    access-list outside_access_in extended permit tcp any any eq 1195
    access-list outside_access_in extended permit object-group VPN_HTTPS any any
    access-list outside_access_in extended permit tcp any interface outside eq 943
    access-list outside_access_in extended permit tcp any any eq 8001
    access-list inside_access_in extended permit tcp any any
    access-list outside_access_in_1 extended permit tcp any interface outside eq 943
    access-list outside_access_in_2 extended permit object-group DM_INLINE_SERVICE_1 host 71.***.***.165 host 71.***.***.162
    access-list outside_access_in_2 extended permit object-group TCPUDP any any inactive
    access-list outside_access_in_2 extended permit icmp any any
    access-list outside_access_in_2 extended permit object-group VPN_HTTPS any host 71.***.***.162
    access-list outside_access_in_2 remark VPN TCP Ports
    access-list outside_access_in_2 extended permit tcp any host 71.***.***.162 eq 1195
    access-list outside_access_in_2 extended permit udp any host 71.***.***.162 eq 1194
    access-list outside_access_in_2 remark Palm Insure Apache Server
    access-list outside_access_in_2 extended permit tcp any host 71.***.***.164 object-group *_Apache inactive
    access-list outside_access_in_2 extended permit udp any host 71.***.***.164 object-group *_ApacheUDP inactive
    access-list outside_access_in_2 extended permit tcp any host 71.***.***.164 object-group MySQL inactive
    access-list outside_access_in_2 extended permit tcp any host 71.***.***.164 object-group Http_Claims_Portal inactive
    access-list outside_access_in_2 extended permit udp any host 71.***.***.164 object-group Http_Claims_PortalUDP inactive
    access-list outside_access_in_2 extended permit tcp any host 71.***.***.164 object-group RTR_Portal inactive
    access-list outside_access_in_2 extended permit udp any host 71.***.***.164 object-group RTR_PortalUDP inactive
    access-list outside_access_in_2 extended permit object-group DM_INLINE_SERVICE_3 any host 71.***.***.164 inactive
    access-list outside_access_in_2 remark RTR Access Rule for Internal VM's
    access-list outside_access_in_2 extended permit tcp any host 71.***.***.162 object-group Http_Claims_Portal
    access-list outside_access_in_2 remark RTR Access rule for internal VMs
    access-list outside_access_in_2 extended permit udp any host 71.***.***.162 object-group Http_Claims_PortalUDP
    access-list inside_access_in_1 extended permit object-group TCPUDP any any
    access-list inside_access_in_1 extended permit icmp any any
    access-list inside_access_in_1 extended permit esp any any
    access-list inside_access_in_1 extended permit udp any any eq isakmp
    access-list dmz_access_in extended permit ip any any
    access-list dmz_access_in extended permit object-group DM_INLINE_SERVICE_2 any host 70.***.***.252
    access-list dmz_access_in extended permit tcp any host 70.***.***.252 eq www
    access-list dmz_access_in_1 extended permit tcp host IIS_Webserver host 10.10.9.5 object-group DM_INLINE_TCP_1 inactive
    access-list dmz_access_in_1 extended permit object-group TCPUDP any host IIS_Webserver eq www inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver eq https inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver object-group *_Apache inactive
    access-list dmz_access_in_1 extended permit udp any host IIS_Webserver object-group *_ApacheUDP inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver eq 3389 inactive
    access-list dmz_access_in_1 extended permit udp any host IIS_Webserver eq 3389 inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver object-group IIS_SQL_Server inactive
    access-list dmz_access_in_1 extended permit object-group TCPUDP any any inactive
    access-list dmz_access_in_1 extended permit tcp host 10.10.9.5 host IIS_Webserver eq ftp inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver object-group MySQL inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver object-group Http_Claims_Portal inactive
    access-list dmz_access_in_1 extended permit udp any host IIS_Webserver object-group Http_Claims_PortalUDP inactive
    access-list dmz_access_in_1 extended permit tcp any host IIS_Webserver object-group RTR_Portal inactive
    access-list dmz_access_in_1 extended permit udp any host IIS_Webserver object-group RTR_PortalUDP inactive
    access-list inside_nat_static extended permit ip host 10.10.9.1 20.20.41.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip host 71.***.***.162 20.20.41.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    global (dmz) 1 interface
    nat (inside) 1 10.10.9.0 255.255.255.0
    static (inside,outside) tcp interface 943 VPN 943 netmask 255.255.255.255
    static (inside,outside) tcp interface 1195 VPN 1195 netmask 255.255.255.255
    static (inside,outside) tcp interface 1194 VPN 1194 netmask 255.255.255.255
    static (inside,outside) udp interface 1194 VPN 1194 netmask 255.255.255.255
    static (inside,outside) udp interface 1195 VPN 1195 netmask 255.255.255.255
    static (inside,outside) tcp interface ssh IntranetMySQL ssh netmask 255.255.255.255
    static (inside,outside) tcp interface ftp IntranetMySQL ftp netmask 255.255.255.255
    static (dmz,inside) tcp IIS_Webserver 3389 IIS_Webserver 3389 netmask 255.255.255.255
    static (inside,outside) tcp interface www 10.10.9.5 www netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 3389 IIS_Webserver 3389 netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 8001 IIS_Webserver 8001 netmask 255.255.255.255
    static (dmz,outside) udp 71.***.***.164 8001 IIS_Webserver 8001 netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 www IIS_Webserver www netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 https IIS_Webserver https netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 ftp IIS_Webserver ftp netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 3306 IIS_Webserver 3306 netmask 255.255.255.255
    static (dmz,inside) tcp IIS_Webserver 3306 IIS_Webserver 3306 netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 8080 IIS_Webserver 8080 netmask 255.255.255.255
    static (dmz,outside) udp 71.***.***.164 8080 IIS_Webserver 8080 netmask 255.255.255.255
    static (dmz,inside) tcp IIS_Webserver 8080 IIS_Webserver 8080 netmask 255.255.255.255
    static (dmz,outside) tcp 71.***.***.164 8081 IIS_Webserver 8081 netmask 255.255.255.255
    static (dmz,outside) udp 71.***.***.164 8081 IIS_Webserver 8081 netmask 255.255.255.255
    static (dmz,inside) tcp IIS_Webserver 8081 IIS_Webserver 8081 netmask 255.255.255.255
    static (inside,outside) tcp interface 8080 10.10.9.15 8080 netmask 255.255.255.255
    static (inside,outside) udp interface 8080 10.10.9.15 8080 netmask 255.255.255.255
    static (dmz,outside) 71.***.***.164 IIS_Webserver netmask 255.255.255.255
    static (dmz,inside) IIS_Webserver IIS_Webserver netmask 255.255.255.255
    static (inside,dmz) 10.10.9.5 10.10.9.5 netmask 255.255.255.255
    static (inside,outside) interface  access-list inside_nat_static
    access-group inside_access_in_1 in interface inside
    access-group outside_access_in_2 in interface outside
    access-group dmz_access_in_1 in interface dmz
    route outside 0.0.0.0 0.0.0.0 71.***.***.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 10.10.9.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set peer 20.20.60.193
    crypto map outside_map 1 set transform-set ESP-AES-256-SHA
    crypto map outside_map 1 set reverse-route
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    telnet timeout 5
    ssh 10.10.9.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    tunnel-group 20.20.60.193 type ipsec-l2l
    tunnel-group 20.20.60.193 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
      class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous

    Hi,
    If you are using the public IP address of your ASA (that is used as the PAT address for all outbound traffic) as the only source IP address for the L2L VPN you dont really have to build any additional NAT configurations for the L2L VPN connection. So you shouldnt need the "static" configuration you have made.
    static (inside,outside) interface  access-list inside_nat_static
    This is because any traffic from your local LAN will be PATed to the "outside" IP address and when the ASA also sees that the destination network for the connection is part of the L2L VPN configurations, then the traffic should be forwarded to the L2L VPN connection just fine.
    Did you try the connectivity without the "static" configuration?
    For ICMP testing I would add the command
    fixup protocol icmp
    or
    policy-map global_policy
      class inspection_default
       inspect icmp
    Should do the same thing
    - Jouni

  • L2L VPN not coming up

    I am using GNS3 to build a tunnel between an ASA and a router.
    Below are my configurations but the tunnel is not coming, can anyone spot what's wrong with my configs? Or could it be because of bugs on GNS3?
    ciscoasa# sho running-config crypto
    crypto ipsec transform-set MySET esp-aes esp-sha-hmac
    access-list VPN_Traffic extended permit ip 12.123.15.0 255.255.255.0 192.168.10.0 255.255.255.0
    crypto map SampleVPN 100 match address VPN_Traffic
    crypto map SampleVPN 100 set peer 10.123.5.2
    crypto map SampleVPN 100 set transform-set MySET
    crypto map SampleVPN interface outside
    crypto isakmp enable outside
    crypto isakmp policy 100
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group VPN type ipsec-l2l
    tunnel-group VPN ipsec-attributes
    pre-shared-key 1234
    R1#sho run | sec crypto
    crypto isakmp policy 100
    encr 3des
    hash md5
    authentication pre-share
    group 2
    crypto isakmp key 1234 address 12.152.45.2 no-xauth
    crypto ipsec transform-set MySET esp-aes esp-sha-hmac
    ip access-list extended VPN_Traffic
    permit ip 192.168.10.0 0.0.0.255 12.123.15.0 0.0.0.255
    crypto map VPN 100 ipsec-isakmp
    set peer 12.152.45.2
    set transform-set MySET
    match address VPN_Traffic
    interface f0/0
    crypto map VPN
    Here are the debugs from the router...
    *Feb 18 15:59:03.971: ISAKMP:(0): SA request profile is (NULL)
    *Feb 18 15:59:03.971: ISAKMP: Created a peer struct for 12.152.45.2, peer port 500
    *Feb 18 15:59:03.971: ISAKMP: New peer created peer = 0x65C73CCC peer_handle = 0x80000004
    *Feb 18 15:59:03.975: ISAKMP: Locking peer struct 0x65C73CCC, refcount 1 for isakmp_initiator
    *Feb 18 15:59:03.975: ISAKMP: local port 500, remote port 500
    *Feb 18 15:59:03.975: ISAKMP: set new node 0 to QM_IDLE
    *Feb 18 15:59:03.975: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 6568F26C
    *Feb 18 15:59:03.979: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    *Feb 18 15:59:03.979: ISAKMP:(0):found peer pre-shared key matching 12.152.45.2
    *Feb 18 15:59:03.983: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    *Feb 18 15:59:03.983: ISAKMP:(0): constructed NAT-T vendor-07 ID
    *Feb 18 15:59:03.983: ISAKMP:(0): constructed NAT-T vendor-03 ID
    *Feb 18 15:59:03.987: ISAKMP:(0): constructed NAT-T vendor-02 ID
    *Feb 18 15:59:03.987: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    *Feb 18 15:59:03.987: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    *Feb 18 15:59:03.987: ISAKMP:(0): beginning Main Mode exchange
    *Feb 18 15:59:03.991: ISAKMP:(0): sending packet to 12.152.45.2 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Feb 18 15:59:03.991: ISAKMP:(0):Sending an IKE IPv4 Packet......
    Success rate is 0 percent (0/5)
    R1#
    *Feb 18 15:59:13.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE...
    *Feb 18 15:59:13.991: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    *Feb 18 15:59:13.991: ISAKMP:(0): retransmitting phase 1 MM_NO_STATE
    *Feb 18 15:59:13.995: ISAKMP:(0): sending packet to 12.152.45.2 my_port 500 peer_port 500 (I) MM_NO_STATE
    *Feb 18 15:59:13.995: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Feb 18 15:59:14.043: ISAKMP (0:0): received packet from 12.152.45.2 dport 500 sport 500 Global (I) MM_NO_STATE
    *Feb 18 15:59:14.047: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    *Feb 18 15:59:14.047: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    *Feb 18 15:59:14.051: ISAKMP:(0): processing SA payload. message ID = 0
    *Feb 18 15:59:14.055: ISAKMP:(0): processing vendor id payload
    *Feb 18 15:59:14.055: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    *Feb 18 15:59:14.055: ISAKMP:(0): vendor ID is NAT-T v2
    *Feb 18 15:59:14.055: ISAKMP:(0)
    R1#: processing vendor id payload
    *Feb 18 15:59:14.059: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
    *Feb 18 15:59:14.059: ISAKMP:(0):found peer pre-shared key matching 12.152.45.2
    *Feb 18 15:59:14.059: ISAKMP:(0): local preshared key found
    *Feb 18 15:59:14.059: ISAKMP : Scanning profiles for xauth ...
    *Feb 18 15:59:14.063: ISAKMP:(0):Checking ISAKMP transform 1 against priority 100 policy
    *Feb 18 15:59:14.063: ISAKMP:      encryption 3DES-CBC
    *Feb 18 15:59:14.063: ISAKMP:      hash MD5
    *Feb 18 15:59:14.063: ISAKMP:      default group 2
    *Feb 18 15:59:14.063: ISAKMP:      auth pre-share
    *Feb 18 15:59:14.063: ISAKMP:      life type in seconds
    *Feb 18 15:59:14.067: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    *Feb 18 15:59:14.067: ISAKMP:(0):atts are acceptable. Next payload is 0
    *Feb 18 15:59:14.071: ISAKMP:(0): processing vendor id payload
    *Feb 18 15:59:14.071: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    *Feb 18 15:59:14.071: ISAK
    R1#
    R1#MP:(0): vendor ID is NAT-T v2
    *Feb 18 15:59:14.071: ISAKMP:(0): processing vendor id payload
    *Feb 18 15:59:14.075: ISAKMP:(0): vendor ID seems Unity/DPD but major 194 mismatch
    *Feb 18 15:59:14.075: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    *Feb 18 15:59:14.075: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    *Feb 18 15:59:14.079: ISAKMP:(0): sending packet to 12.152.45.2 my_port 500 peer_port 500 (I) MM_SA_SETUP
    *Feb 18 15:59:14.079: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Feb 18 15:59:14.079: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    *Feb 18 15:59:14.079: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    R1#
    *Feb 18 15:59:23.291: ISAKMP:(0):purging node -49064826
    *Feb 18 15:59:23.291: ISAKMP:(0):purging node -330154301
    *Feb 18 15:59:24.079: ISAKMP:(0): retransmitting phase 1 MM_SA_SETUP...
    *Feb 18 15:59:24.079: ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
    *Feb 18 15:59:24.079: ISAKMP:(0): retransmitting phase 1 MM_SA_SETUP
    *Feb 18 15:59:24.083: ISAKMP:(0): sending packet to 12.152.45.2 my_port 500 peer_port 500 (I) MM_SA_SETUP
    *Feb 18 15:59:24.083: ISAKMP:(0):Sending an IKE IPv4 Packet.
    *Feb 18 15:59:24.111: ISAKMP (0:0): received packet from 12.152.45.2 dport 500 sport 500 Global (I) MM_SA_SETUP
    *Feb 18 15:59:24.111: ISAKMP:(0):Notify has no hash. Rejected.
    *Feb 18 15:59:24.111: ISAKMP (0:0): Unknown Input IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY:  state = IKE_I_MM3
    *Feb 18 15:59:24.115: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY
    *Feb 18 15:59:24.115: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM3
    R1#ping ip 12.123.15.2 source loo0
    *Feb 18 15:59:24.115: %CRYPTO-6-IKMP_MODE_FAILURE: Processing of Informational mode failed with peer at 12.152.45.2
    R1#ping ip 12.123.15.2 source loo0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 12.123.15.2, timeout is 2 seconds:
    Packet sent with a source address of 192.168.10.1
    *Feb 18 15:59:33.295: ISAKMP:(0):purging SA., sa=6568EB18, delme=6568EB18
    *Feb 18 15:59:33.967: ISAKMP: set new node 0 to QM_IDLE
    *Feb 18 15:59:33.971: ISAKMP:(0):SA is still budding. Attached new ipsec request to it. (local 10.123.5.2, remote 12.152.45.2)
    *Feb 18 15:59:33.971: ISAKMP: Error while processing SA request: Failed to initialize SA
    *Feb 18 15:59:33.975: ISAKMP: Error while processing KMI message 0, error 2..
    Success rate is 0 percent (0/5)
    R1#
    *Feb 18 16:00:18.975: ISAKMP: quick mode timer expired.
    *Feb 18 16:00:18.975: ISAKMP:(0):src 10.123.5.2 dst 12.152.45.2, SA is not authenticated
    *Feb 18 16:00:18.975: ISAKMP:(0):peer does not do paranoid keepalives.
    *Feb 18 16:00:18.979: ISAKMP:(0):deleting SA reason "QM_TIMER expired" state (I) MM_SA_SETUP (peer 12.152.45.2)
    *Feb 18 16:00:18.983: ISAKMP:(0):deleting SA reason "QM_TIMER expired" state (I) MM_SA_SETUP (peer 12.152.45.2)
    *Feb 18 16:00:18.983: ISAKMP: Unlocking peer struct 0x65C73CCC for isadb_mark_sa_deleted(), count 0
    *Feb 18 16:00:18.987: ISAKMP: Deleting peer node by peer_reap for 12.152.45.2: 65C73CCC
    R1#
    *Feb 18 16:00:18.987: ISAKMP:(0):deleting node 1582877960 error FALSE reason "IKE deleted"
    *Feb 18 16:00:18.987: ISAKMP:(0):deleting node 814986207 error FALSE reason "IKE deleted"
    *Feb 18 16:00:18.991: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
    *Feb 18 16:00:18.991: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_DEST_SA
    R1#
    *Feb 18 16:01:08.987: ISAKMP:(0):purging node 1582877960
    *Feb 18 16:01:08.987: ISAKMP:(0):purging node 814986207
    R1#
    *Feb 18 16:01:18.991: ISAKMP:(0):purging SA., sa=6568F26C, delme=6568F26C

    Hi,
    when you applied the tunnel-group VPN, you should have seen a warning telling that tunnel-group can have name only if it's for remote-access VPN, or certificate authentication is used. so, L2L vpn with pre-shared keys can only have tunnel-groups named as the peer IP address.
    Mashal

  • Multiple Site-Site VPN Tunnel on a Single PiX Firewall

    I cureently have a site to site VPN tunnel (VPN1) between HK (Pix ver 6.1(2) & Leeds (ASA version 7.2(2). I am in the process of migrating the VPN tunnel to a newly deployed 10 Mb internet link in Leeds which has a Pix 506E Ver 7.0(2). I have decided to create a 2nd VPN tunnel to HK (VPN2) and will shutdown VPN1 when VPN2 is up.
    On the HK PIX I am using the same isakmp policy, transform-set and have created another crypto map for the the new VPN (VPN2).
    On passing intersting traffic to establish the new tunnel for the Leeds end, I am gettting the following debugging errors.
    Feb 04 15:06:42 [IKEv1]: QM FSM error (P2 struct &0x1b24150, mess id 0x47595d7)!
    Feb 04 15:06:42 [IKEv1]: Group = 192.168.0.1, IP = 192.168.0.1, Removing peer from correlator table failed, no match!
    Feb 04 15:06:42 [IKEv1]: QM FSM error (P2 struct &0x1b24860, mess id 0x9cafcd4d)!
    Feb 04 15:06:42 [IKEv1]: Group = 192.168.0.1, IP = 192.168.0.1, Removing peer from correlator table failed, no match!
    sh Feb 04 15:06:47 [IKEv1]: QM FSM error (P2 struct &0x1d085d0, mess id 0x458d4091)!
    Feb 04 15:06:47 [IKEv1]: Group = 192.168.0.1, IP = 192.168.0.1, Removing peer from correlator table failed, no match!
    sh crypto isakmp sa
    Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1 IKE Peer: 192.168.0.1
    Type : L2L Role : initiator
    Rekey : no State : MM_ACTIVE
    Site HK - PIX1(192.168.0.1)
    crypto ipsec transform-set chevvie esp-des esp-md5-hmac
    (crypto map for existing VPN (VPN1)
    crypto map transam 1 ipsec-isakmp
    crypto map transam 1 match address 101
    crypto map transam 1 set peer 192.168.0.2
    crypto map transam 1 set transform-set chevvie
    (New Crpto Map for new VPN (VPN2)
    crypto map transam 2 ipsec-isakmp
    crypto map transam 2 match address 101
    crypto map transam 2 set peer 192.168.0.3
    crypto map transam 2 set transform-set chevvie
    crypto map transam interface outside
    isakmp enable outside
    isakmp key ****** address 192.168.0.2 netmask 255.255.255.255
    isakmp key ev0lut10n address 192.168.0.3 netmask 255.255.255.255
    isakmp identity address
    isakmp policy 1 authentication pre-share
    isakmp policy 1 encryption des
    isakmp policy 1 hash md5
    isakmp policy 1 group 1
    isakmp policy 1 lifetime 1000
    isakmp am-disable
    floodguard enable
    sysopt connection permit-ipsec
    no sysopt route dnat
    Site - Leeds PIX2 (192.168.0.3)
    crypto ipsec transform-set ford esp-des esp-md5-hmac
    crypto map VPNHK 2 match address outside_crypto_acl
    crypto map VPNHK 2 set peer 192.168.0.1
    crypto map VPNHK 2 set transform-set ford
    crypto map VPNHK interface outside
    isakmp identity address
    isakmp enable outside
    isakmp policy 1 authentication pre-share
    isakmp policy 1 encryption des
    isakmp policy 1 hash md5
    isakmp policy 1 group 1
    isakmp policy 1 lifetime 1000
    isakmp am-disable
    tunnel-group 192.168.0.1 type ipsec-l2l
    tunnel-group 192.168.0.1 ipsec-attributes
    pre-shared-key ev0lut10n
    sysopt connection permit-ipsec
    Your assistance will be grately appreciated.

    How could the HK PIX decide which tunnel to use if you apply the same ACL to both? You have to choose a different subnet to Leeds2.
    Peter

  • Can not access ASAs inside interface via VPN tunnels

    Hi there,
    I have a funny problem.
    I build up a hub and spoke VPN, with RAS Client VPN access for the central location.
    All tunnels and the RAS VPN access are working fine.
    I use the tunnels for Voip, terminal server access and a few other services.
    The only problem I have is, that I could not access the inside IP address of any of my ASAs, neither via tunnels nor via RAS VPN access. No telnet access and no ping reach the inside interfaces.
    No problem when I connect to the interface via a host inside the network.
    All telnet statments in the config are ending with the INSIDE command.
    On most of the ASAs the 8.2 IOS is running on one or two ASAs the 8.0(4).
    For the RAS client access I use the Cisco 5.1 VPN client.
    Did anybody have any suggestions?
    Regards
    Marcel

    Marcel,
    Simply add on the asas you want to administer through the tunnels
    management-access
    http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/m.html#wp2027985
    for asa5505
    management-access inside
    for all others if you have management interface management0/0 defined then:
    management-access management
    then you may need to allow the source , for example if RA VPN pool network is 10.20.20.0/24 then you tell asa that network cann administer asa and point access to inside, but sounds you have this part already.
    telnet 10.20.20.0 255.255.255.0 inside
    http 10.20.20.0 255.255.255.0 inside
    same principle for l2l vpns
    Regards

  • MAPI latency/slowness over L2L VPN

    We recently implented an email archiving solution (Symantec Enterprise Vault) that sends the archives to a vendor across a L2L VPN on an ASA 5510.  EV apparently uses MAPI during the archive process.
    We're experencing slowness during the archive process, and the slowness seems to originate with the VPN tunnel.
    I'm reaching out to see if anyone has had any experience with MAPI over VPN or if anyone has seen a similar issue.
    The vendor is saying it's a "network issue", which I seriously doubt.
    Thanks.

    We recently implented an email archiving solution (Symantec Enterprise Vault) that sends the archives to a vendor across a L2L VPN on an ASA 5510.  EV apparently uses MAPI during the archive process.
    We're experencing slowness during the archive process, and the slowness seems to originate with the VPN tunnel.
    I'm reaching out to see if anyone has had any experience with MAPI over VPN or if anyone has seen a similar issue.
    The vendor is saying it's a "network issue", which I seriously doubt.
    Thanks.

  • 2811:connecting two ASA5505 l2l VPN's

    Hello,
    We have an HQ site with a 2811 (w/ADVSECURITYK9-M) acting as the firewall. We currently have 1 ASA5505 that has an established ipsec l2l VPN.
    I'm trying to connect a 2nd ASA, but I've noticed I can only add 1 cryptomap to the outside interface.
    A show ver shows 1 Virtual Private Network Module... Surely that doesn't mean only 1 VPN?
    Do I use one crypto map, and add a second 'set peer' & 'match address' inside the crypto map itself?
    Thanks,
    Jason

    Ok, I'm getting closer, but still failing. I was close enough that a VOIP phone registered with the phone system at some point, but not sure why it wont stay connected.
    The original, VPN1 is still connected though.
    I've varified the preshared keys on both ends match.
    Here's an error from the debug of the second ASA, VPN2
    Aug 24 10:49:45 [IKEv1]: Group = 64.X.X.X, IP = 64.X.X.X, QM FSM error (P2 struct &0x42436b0, mess id 0x374e49ed)!
    Aug 24 10:49:45 [IKEv1]: Group = 64.X.X.X, IP = 64.X.X.X, Removing peer from correlator table failed, no match!
    Aug 24 10:49:45 [IKEv1]: Group = 64.X.X.X, IP = 64.X.X.X, QM FSM error (P2 struct &0x42436b0, mess id 0x374e49ed)!
    Aug 24 10:49:45 [IKEv1]: Group = 64.X.X.X, IP = 64.X.X.X, Removing peer from correlator table failed, no match!
    As far as the ASA configs, everything is the exactly the same, except;
    NEW ASA VPN2 -both asa have object groups 1&2, containing other ip's of the HQ site. these ip's listed here are of VPN1's local lan.
    I imagine I will need to add VPN2's local ip to VPN1's config for objectgroup 1&2, but I don't think that is the reason this wont connect to HQ
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.26.0 255.255.255.0
    object-group network DM_INLINE_NETWORK_2
    network-object 192.168.26.0 255.255.255.0
    object-group network DM_INLINE_NETWORK_3
    network-object 192.168.27.0 255.255.255.0
    network-object 192.168.1.0 255.255.255.0
    Working ASA VPN1  - not sure exactly how the bolded line works
    no crypto isakmp nat-traversal
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    HQ 2811 -----------------------------------------------------------------------
    Hope I included enough of the router config. Again, VPN1 is working.
    crypto isakmp key VPN1PW address 99.x.x.x
    crypto isakmp key VPN2PW address 108.x.x.x
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec df-bit clear
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to 99.x.x.x VPN1
    set peer 99.x.x.x
    set transform-set ESP-AES-128-SHA
    match address 103
    crypto map SDM_CMAP_1 2 ipsec-isakmp
    description Tunnel to 108.x.x.x VPN2
    set peer 108.x.x.x
    set transform-set ESP-AES-128-SHA
    match address 105
    ****** This next section I dont recall typing in, but it refers to access group 105, but 105 was newly created for the new VPN2.  I didn't not find a corresponding command for access-group 103, which 105 is a copy of 103, except each one includes the others local lan too.
    class-map type inspect match-all sdm-nat-user-protocol--2-1
    match access-group 105
    match protocol user-protocol--2
    interface FastEthernet0/1
    description T1 to  Internet$FW_OUTSIDE$
    ip address 64.x.x.x 255.255.255.248
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map SDM_CMAP_1

Maybe you are looking for