SCVMM Network Virtualization - simulate DMZ network inside network virtualization

Hi All,
Here is my question. Is the following scenario possible. HyperV 2012R2 hosts, SCVMM2012r2.
I create a new VM Network (with network isolation) and create VMs on that network (with SCVMM). I'll call this network Corpnet.
Is it possible to have a separate  network that is also virtualized that can act as the DMZ network for the Corpnet?
I'm having trouble to make this work. VM networks are working as expected. 
1. I tried creating two separete VM networks and creating a VM that has two network interfaces on both VM networks with the RRAS role and LAN routing. But I cant make the traffic be routed from one VM Network to the other one. (in this example I change the
gateway on the network cards for the VMs on the two VM Networkis to point to the VMRouter interfaces.) 
2. I tried creating two VLANs on the same VM network . I use again a VM as a router.The traffic starts behaving weird and doesn't pass through the VMRouter but goes directly between the two VLANs. (in this example I change the gateway on the network cards
for the VMs on the two VLANs to point to the VMRouter interfaces.) 

If SCVMM is in control of the network virtualization setup, it won't swallow traffic, it will forward according to its configuration rules.
If SCVMM defined the gateway as 192.168.0.1 (always the first IP in the subnet) then that is the routing that is setup.  And your router VM must have that IP on that subnet.  And, SCVMM must have provisioned that VM with that IP.
The customer routes and rules are the definitions of how the virtual network knows where to forward what.  These are the routing rules and SCVMM is in control.
If you manually edit network settings within a VM, SCVMM won't put it back, but the networking rules won't align with those edits and thus traffic will happen, but the virtual switch won't know where to send it, so it 'disappears'.
SCVMM is unaware of your different gateways.  And thus does not have them established in the routing rules in the virtual switches.
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.
Disclaimer: Attempting change is of your own free will.

Similar Messages

  • Need help with ASA 5512 and SQL port between DMZ and inside

    Hello everyone,
    Inside is on gigabitEthernet0/1 ip 192.9.200.254
    I have a dmz on gigabitEthernet2 ip 192.168.100.254
    I need to pass port 443 from outside to dmz ip 192.168.100.80 and open port 1433 from 192.168.100.80 to the inside network. 
    I believe this will work for port 443:
    object network dmz
    subnet 192.168.100.0 255.255.255.0
    object network webserver
    host 192.168.100.80
    object network webserver
    nat (dmz,outside) static interface service tcp 443 443
    access-list Outside_access_in extended permit tcp any object webserver eq 443
    access-group Outside_access_in in interface Outside
    However...How would I open only port 1433 from dmz to inside?
    At the bottom of this message is my config if it helps.
    Thanks,
    John Clausen
    Config:
    : Saved
    ASA Version 9.1(2) 
    hostname ciscoasa-gcs
    domain-name router.local
    enable password f4yhsdf.4sadf977 encrypted
    passwd f4yhsdf.4sadf977 encrypted
    names
    ip local pool vpnpool 192.168.201.10-192.168.201.50
    interface GigabitEthernet0/0
     nameif outside
     security-level 0
     ip address 123.222.222.212 255.255.255.224 
    interface GigabitEthernet0/1
     nameif inside
     security-level 100
     ip address 192.9.200.254 255.255.255.0 
    interface GigabitEthernet0/2
     nameif dmz
     security-level 100
     ip address 192.168.100.254 255.255.255.0 
    interface GigabitEthernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/4
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/5
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     management-only
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0 
    ftp mode passive
    dns server-group DefaultDNS
     domain-name router.local
    object network inside-subnet
     subnet 192.9.200.0 255.255.255.0
    object network netmotion
     host 192.9.200.6
    object network inside-network
     subnet 192.9.200.0 255.255.255.0
    object network vpnpool
     subnet 192.168.201.0 255.255.255.192
    object network NETWORK_OBJ_192.168.201.0_26
     subnet 192.168.201.0 255.255.255.192
    object network NETWORK_OBJ_192.9.200.0_24
     subnet 192.9.200.0 255.255.255.0
    access-list outside_access_in extended permit icmp any4 any4 log disable 
    access-list Outside_access_in extended permit udp any object netmotion eq 5020 
    access-list split standard permit 192.9.200.0 255.255.255.0 
    access-list VPNT_splitTunnelAcl standard permit 192.9.200.0 255.255.255.0 
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    mtu dmz 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static inside-network inside-network destination static vpnpool vpnpool
    nat (inside,outside) source static NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24 destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
    object network netmotion
     nat (inside,outside) static interface service udp 5020 5020 
    nat (inside,outside) after-auto source dynamic any interface
    access-group Outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 123.222.222.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.9.200.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac 
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev1 enable outside
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    telnet 192.9.200.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes128-sha1 3des-sha1
    webvpn
     enable outside
     anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 2 regex "Windows NT"
     anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3 regex "Intel Mac OS X"
     anyconnect enable
     tunnel-group-list enable
    group-policy SSLVPN internal
    group-policy SSLVPN attributes
     dns-server value 192.9.200.13
     vpn-tunnel-protocol ssl-client 
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value split
     default-domain value router.local
    group-policy VPNT internal
    group-policy VPNT attributes
     dns-server value 192.9.200.13
     vpn-tunnel-protocol ikev1 l2tp-ipsec 
     split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPNT_splitTunnelAcl
     default-domain value router.local
    username grimesvpn password 7.wersfhyt encrypted
    username grimesvpn attributes
     service-type remote-access
    tunnel-group SSLVPN type remote-access
    tunnel-group SSLVPN general-attributes
     address-pool vpnpool
     default-group-policy SSLVPN
    tunnel-group SSLVPN webvpn-attributes
     group-alias SSLVPN enable
    tunnel-group VPNT type remote-access
    tunnel-group VPNT general-attributes
     address-pool vpnpool
     default-group-policy VPNT
    tunnel-group VPNT ipsec-attributes
     ikev1 pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map 
      inspect ftp 
      inspect h323 h225 
      inspect h323 ras 
      inspect rsh 
      inspect rtsp 
      inspect esmtp 
      inspect sqlnet 
      inspect skinny  
      inspect sunrpc 
      inspect xdmcp 
      inspect sip  
      inspect netbios 
      inspect tftp 
      inspect ip-options 
      inspect icmp 
    service-policy global_policy global
    prompt hostname context 
    no call-home reporting anonymous
    Cryptochecksum:36271b5a1b9382621e14c3aa635e2fbb
    : end

    Hi Vibor. Apologies if my comment was misunderstood.  What I meant to say was that the security level of the dmz interface should probably be less than 100. 
    And therefore traffic could be controlled between DMZ and inside networks. 
    As per thr security level on the DMZ interface. ....... that command is correct. :-)

  • DMZ VMWWare server connection to inside network security risk

    Hi,
    We are thinking to connect DMZ host ( VM Servers)  directly to inside network by putting them into L2 vlan. Waht are pros and cons by doing this way? Appreciate your help.
    Thanks

    Thanks Julio and Andrew for your comments.
    Physicial connections will be as follows;
    From DMZ Host ( VM Server) -- One connection to Internal Core Switch (6509)  which will be for DMZ configured as a                                               access port on dmz vlan.
                                              --- One connection Internal Core Switch (6509) which will be for production network configured                                               on production vlan.
    Basically moving away from physical separation of DMZ host to utilize the VM servers effectively for DMZ and production. We have to maintain both firewall and network. Except the human error what are the possible risk on this?

  • AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside network

    My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.
    I have seen other people that appeared to have similar posts but none of those solutions have worked for me.  I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly.  I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.
    My configuration is included below.
    Thank you in advance for your assistance.
    Jerry
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password (removed)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f2c7362097b71bcada023c6bbfc45121
    : end

    Hi,
    Yes, I have saved the config and did a write erase and reloaded the config, no difference. I rebuilt it once a couple of weeks ago, but that was before I had gotten this far with your assistance.  I'll include my ASA and switches configs after this. Here is a little background (took it form the Firewall section issue just because it gives a little insight for the network). I have 2 3560s, one as a L3 switch the other L2 with an etherchannel between them (one of the cables was bad so I am waiting on the replacement to have 2 - Gigabit channels between the switches).
    I think our issue with the VPN not getting to the Inside is posibly related to my DMZ issue not getting to the internet.
    I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.
    I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.
    The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet.  I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.
    E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).
    So for a simple diagram:
    PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)
    I will be back at this tomorrow morning - I've been up since 4pm yesterday and it is almost 3pm.
    Thank you for all of your assistance.
    Jerry
    Current ASA Config:
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password $$$$$$$$$$$$$$$ encrypted
    passwd $$$$$$$$$$$$$$$$ encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    switchport access vlan 20
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    object network INSIDE
    subnet 10.0.1.0 255.255.255.0
    access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222
    access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22
    access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222
    access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231
    access-list capvpn extended permit icmp host 192.168.60.20 host 10.1.10.23
    access-list capvpn extended permit icmp host 10.1.10.23 host 192.168.60.20
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0
    access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0
    access-list capins extended permit icmp host 10.1.10.23 host 10.0.1.1
    access-list capins extended permit icmp host 10.0.1.1 host 10.1.10.23
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) after-auto source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f6d9bbacca2a5c8b5af946a8ddc12550
    : end
    L3 3560 connects to ASA via port f0/3 routed port 10.0.1.0/24 network
    Connects to second 3560 via G0/3 & G0/4
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560a
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    authentication mac-move permit
    ip subnet-zero
    ip routing
    ip dhcp excluded-address 10.1.10.1 10.1.10.20
    ip dhcp excluded-address 10.1.12.1 10.1.12.20
    ip dhcp excluded-address 10.1.14.1 10.1.14.20
    ip dhcp excluded-address 10.1.16.1 10.1.16.20
    ip dhcp excluded-address 10.1.30.1 10.1.30.20
    ip dhcp excluded-address 10.1.35.1 10.1.35.20
    ip dhcp excluded-address 10.1.50.1 10.1.50.20
    ip dhcp excluded-address 10.1.80.1 10.1.80.20
    ip dhcp excluded-address 10.1.90.1 10.1.90.20
    ip dhcp excluded-address 10.1.100.1 10.1.100.20
    ip dhcp excluded-address 10.1.101.1 10.1.101.20
    ip dhcp pool VLAN10
       network 10.1.10.0 255.255.255.0
       default-router 10.1.10.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN12
       network 10.1.12.0 255.255.255.0
       default-router 10.1.12.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN14
       network 10.1.14.0 255.255.255.0
       default-router 10.1.14.1
       option 150 ip 10.1.13.1
    ip dhcp pool VLAN16
       network 10.1.16.0 255.255.255.0
       default-router 10.1.16.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN30
       network 10.1.30.0 255.255.255.0
       default-router 10.1.30.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN35
       network 10.1.35.0 255.255.255.0
       default-router 10.1.35.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN50
       network 10.1.50.0 255.255.255.0
       default-router 10.1.50.1
       option 43 hex f104.0a01.6564
    ip dhcp pool VLAN80
       network 10.1.80.0 255.255.255.0
       default-router 10.1.80.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN90
       network 10.1.90.0 255.255.255.0
       default-router 10.1.90.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN100
       network 10.1.100.0 255.255.255.0
       default-router 10.1.100.1
    ip dhcp pool VLAN101
       network 10.1.101.0 255.255.255.0
       default-router 10.1.101.1
    ip dhcp pool VLAN40
       dns-server 208.67.222.222 208.67.220.220
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree etherchannel guard misconfig
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    link state group 1 downstream
    interface FastEthernet0/1
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 100
    switchport mode trunk
    power inline never
    interface FastEthernet0/2
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/3
    description Interface to MXFW E0/1
    no switchport
    ip address 10.0.1.2 255.255.255.0
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/6
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    power inline never
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/11
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/18
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/19
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/22
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/24
    switchport access vlan 35
    switchport mode access
    power inline never
    interface FastEthernet0/25
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/26
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/27
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/34
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/35
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/38
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/42
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/43
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport mode access
    shutdown
    power inline never
    interface GigabitEthernet0/1
    description Interface to MXC2911 Port G0/0
    no switchport
    ip address 10.1.13.2 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    shutdown
    interface Vlan10
    ip address 10.1.10.1 255.255.255.0
    interface Vlan12
    ip address 10.1.12.1 255.255.255.0
    interface Vlan14
    ip address 10.1.14.1 255.255.255.0
    interface Vlan16
    ip address 10.1.16.1 255.255.255.0
    interface Vlan20
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    ip address 172.26.22.1 255.255.255.0
    interface Vlan30
    ip address 10.1.30.1 255.255.255.0
    interface Vlan35
    ip address 10.1.35.1 255.255.255.0
    interface Vlan40
    ip address 10.1.40.1 255.255.255.0
    interface Vlan50
    ip address 10.1.50.1 255.255.255.0
    interface Vlan80
    ip address 172.16.80.1 255.255.255.0
    interface Vlan86
    no ip address
    shutdown
    interface Vlan90
    ip address 10.1.90.1 255.255.255.0
    interface Vlan100
    ip address 10.1.100.1 255.255.255.0
    interface Vlan101
    ip address 10.1.101.1 255.255.255.0
    router eigrp 1
    network 10.0.0.0
    network 10.1.13.0 0.0.0.255
    network 10.1.14.0 0.0.0.255
    passive-interface default
    no passive-interface GigabitEthernet0/1
    ip classless
    ip route 0.0.0.0 0.0.0.0 FastEthernet0/3 10.0.1.1
    ip route 192.168.60.0 255.255.255.0 FastEthernet0/3 10.0.1.1 2
    ip http server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end
    L3 3560 Route Table (I added 192.168.60.0/24 instead of just using the default route just in case it wasn't routing for some reason - no change)
    mx3560a#sho ip route
    Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route
    Gateway of last resort is 10.0.1.1 to network 0.0.0.0
    S    192.168.60.0/24 [2/0] via 10.0.1.1, FastEthernet0/3
         172.16.0.0/24 is subnetted, 1 subnets
    C       172.16.80.0 is directly connected, Vlan80
         172.26.0.0/24 is subnetted, 2 subnets
    C       172.26.22.0 is directly connected, Vlan22
    C       172.26.20.0 is directly connected, Vlan20
         10.0.0.0/8 is variably subnetted, 14 subnets, 2 masks
    C       10.1.10.0/24 is directly connected, Vlan10
    D       10.1.13.5/32 [90/3072] via 10.1.13.1, 4d02h, GigabitEthernet0/1
    C       10.1.14.0/24 is directly connected, Vlan14
    C       10.1.13.0/24 is directly connected, GigabitEthernet0/1
    C       10.1.12.0/24 is directly connected, Vlan12
    C       10.0.1.0/24 is directly connected, FastEthernet0/3
    C       10.1.30.0/24 is directly connected, Vlan30
    C       10.1.16.0/24 is directly connected, Vlan16
    C       10.1.40.0/24 is directly connected, Vlan40
    C       10.1.35.0/24 is directly connected, Vlan35
    C       10.1.50.0/24 is directly connected, Vlan50
    C       10.1.90.0/24 is directly connected, Vlan90
    C       10.1.101.0/24 is directly connected, Vlan101
    C       10.1.100.0/24 is directly connected, Vlan100
    S*   0.0.0.0/0 [1/0] via 10.0.1.1, FastEthernet0/3
    I have a C2911 for CME on G0/1 - using it only for that purpose at this time.
    L2 3560 Config it connects to the ASA as a trunk on e0/5 of the ASA and port f0/3 of the switch - I am using L2 switching for the DMZ networks from the switches to the ASA and allowing the ASA to provide the DHCP and routing out of the network. DMZ networks: 172.26.20.0/24 and 172.26.22.0/24.
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560b
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    crypto pki trustpoint TP-self-signed-3877365632
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3877365632
    revocation-check none
    rsakeypair TP-self-signed-3877365632
    crypto pki certificate chain TP-self-signed-3877365632
    certificate self-signed 01
      30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 33383737 33363536 3332301E 170D3933 30333031 30303031
      30395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 38373733
      36353633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100DF81 DA515E0B 7FC760CF 2CC98400 42DCA007 215E4DDE D0C3FBF2 D974CE85
      C46A8700 6AE44C2C 79D9BD2A A9297FA0 2D9C2BE4 B3941A2F 435AC4EA 17E89DFE
      34EC8E93 63BD4CDF 784E91D7 2EE0093F 06CC97FD 83CB818B 1ED624E6 F0F5DA51
      1DE4B8A7 169EED2B 40575B81 BADDE052 85BA9D19 4C206DCB 00878FF3 89E74028
      B3F30203 010001A3 68306630 0F060355 1D130101 FF040530 030101FF 30130603
      551D1104 0C300A82 086D7833 35363062 2E301F06 03551D23 04183016 80147125
      78CE8540 DB95D852 3C0BD975 5D9C6EB7 58FC301D 0603551D 0E041604 14712578
      CE8540DB 95D8523C 0BD9755D 9C6EB758 FC300D06 092A8648 86F70D01 01040500
      03818100 94B98410 2D9CD602 4BD16181 BCB7C515 77C8F947 7C4AF5B8 281E3131
      59298655 B12FAB1D A6AAA958 8473483C E993D896 5251770B 557803C0 531DEB62
      A349C057 CB473F86 DCEBF8B8 7DDE5728 048A49D0 AB18CE8C 8257C00A C2E06A63
      B91F872C 5F169FF9 77DC523B AB1E3965 C6B67FCC 84AE11E9 02DD10F0 C45EAFEA 41D7FA6C
      quit
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    interface FastEthernet0/1
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/2
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/3
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    shutdown
    power inline never
    interface FastEthernet0/6
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/11
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/18
    shutdown
    power inline never
    interface FastEthernet0/19
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    shutdown
    power inline never
    interface FastEthernet0/22
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/24
    shutdown
    power inline never
    interface FastEthernet0/25
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/26
    shutdown
    power inline never
    interface FastEthernet0/27
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/34
    shutdown
    power inline never
    interface FastEthernet0/35
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport mode access
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    shutdown
    power inline never
    interface FastEthernet0/38
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    shutdown
    power inline never
    interface FastEthernet0/42
    shutdown
    power inline never
    interface FastEthernet0/43
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport access vlan 40
    switchport mode access
    shutdown
    interface GigabitEthernet0/1
    shutdown
    interface GigabitEthernet0/2
    switchport access vlan 40
    switchport mode access
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    ip classless
    ip http server
    ip http secure-server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end

  • VPN clients cannot access inside network

    I have a ASA 5505 that I am using as a VPN appliance. The outside interface is connected to the DMZ (172.16.2.10) and the inside to our internal network (10.27.1.12). VPN clients are assigned an address in the range 10.27.2.2-10.27.2.20. A 1841 is the router and firewall for the network. Recently the ASA lost power when a UPS went down and now VPN clients can no longer access anything on the inside network. Config is attached. Help.

    I realized after I posted that I should have a connection active when running this command. Here is the results:
    Result of the command: "show crypto ipsec sa"
    interface: outside
    Crypto map tag: outside_dyn_map, seq num: 20, local addr: 172.16.2.10
    local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
    remote ident (addr/mask/prot/port): (10.27.2.2/255.255.255.255/0/0)
    current_peer: 169.130.14.253, username: kenz
    dynamic allocated peer ip: 10.27.2.2
    #pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 5, #pkts comp failed: 0, #pkts decomp failed: 0
    #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
    #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
    #send errors: 0, #recv errors: 0
    local crypto endpt.: 172.16.2.10, remote crypto endpt.: 169.130.14.253
    path mtu 1500, ipsec overhead 58, media mtu 1500
    current outbound spi: 208F45F5
    inbound esp sas:
    spi: 0x2026D973 (539416947)
    transform: esp-3des esp-sha-hmac none
    in use settings ={RA, Tunnel, }
    slot: 0, conn_id: 4096, crypto-map: outside_dyn_map
    sa timing: remaining key lifetime (sec): 28406
    IV size: 8 bytes
    replay detection support: Y
    outbound esp sas:
    spi: 0x208F45F5 (546260469)
    transform: esp-3des esp-sha-hmac none
    in use settings ={RA, Tunnel, }
    slot: 0, conn_id: 4096, crypto-map: outside_dyn_map
    sa timing: remaining key lifetime (sec): 28406
    IV size: 8 bytes
    replay detection support: Y
    So it looks like there are encrypts but no decrypts. What should I do now?

  • Assign management ip address with SCVMM 2012 R2 for hyper-v converged network?

    Hi,
    I am setting up a converged network for our Hyper-V clusters using vNICs for the different network traffic including management, live migration, cluster-csv, hyper-v etc.
    Problem is, how do I assign the hyper-v hosts a management IP address? They need a network connection on the management network for scvmm to manage them in the first place. How do I take the existing management IP address that is directly assigned to the
    host and transfer it directly to the new vNIC so scvmm has management of it? Kind of in a chicken and egg situation here. I thought about assigning a temp ip address to the host initially but am worried that assigning the address will cause problems as then
    the host would then have 2 default gateways configured. How have others managed this scenario?
    Thanks
    Microsoft Partner

    Rule of thumb: Use one connected network for your Fabric networks (read the whitepaper), and use VLAN based networks for your tenant VMs when you want to associate VM Networks with each VLAN.
    -kn
    Kristian (Virtualization and some coffee: http://kristiannese.blogspot.com )
    We don't have tenants as such due to this being an environment on a private company LAN for sole use of the company virtual machines.
    What I have so far:
    I created "one connected network" for Hyper-V-Virtual-Machine traffic.
    Unchecked "Allow new VM networks created on this logical switch to use network virtualization"
    Checked "Create a VM network with the same name to allow vms to access this logical network directly"
    This logical network has one site called UK.
    Within this site I have defined all of the different VLANS for this site.
    Created IP pools for each VLAN subnet range.
    I hope I understand this correctly. Started reading the whitepaper from cover to cover now.
    Microsoft Partner

  • ASA 5505 VPN no access to inside network

    Trying to set up ipsec/l2tp vpn to provide full access to internal network for remote users with only Windows built-in vpn client.
    The vpn client can connect successfully, but can't see anything on the inside network.
    The ASA is not the gateway for hosts on the internal network
    name x.y.z.129 isp-gateway
    name 172.16.1.0 vpn-address-pool
    name 10.11.10.0 inside-network
    name x.y.z.128 outside-network
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list vpn extended permit ip inside-network 255.255.254.0 vpn-address-pool 255.255.255.0
    access-list outside_access_in extended permit ip any any
    global (outside) 1 interface
    nat (outside) 1 vpn-address-pool 255.255.255.0
    nat (inside) 0 access-list vpn
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 isp-gateway 1
    ciscoasa# show route
    Gateway of last resort is cic-gateway to network 0.0.0.0
    C    outside-network 255.255.255.128 is directly connected, outside
    S    172.16.1.5 255.255.255.255 [1/0] via isp-gateway, outside
    C    inside-network 255.255.254.0 is directly connected, inside
    S*   0.0.0.0 0.0.0.0 [1/0] via isp-gateway, outside

    Do you configure split tunnel or no split tunnel policy?
    Also when you are connected and try to access internal network, can you pls share the output of :
    show cry isa sa
    show cry ipsec sa

  • Problem with nat / access rule for webserver in inside network asa 5505 7.2

    Hello,
    i have trouble setting up nat and access rule for webserver located in inside network.
    I have asa 5505 version 7.2 and it has to active interfaces, inside 192.168.123.0 and outside x.x.x.213
    Webserver has ip 192.168.123.11 and it needs to be accessed from outside, ip x.x.x.213.
    I have created an static nat rule with pat (as an appendix) and access rules from outside network to inside interface ip 192.168.123.11 (tcp 80) but no luck.
    What am i doing wrong?

    Command:
    packet-tracer input outside tcp 188.x.x.213 www 192.168.123.11 www detailed
    Phase: 1
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 2
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.123.0   255.255.255.0   inside
    Phase: 3
    Type: ACCESS-LIST
    Subtype:
    Result: DROP
    Config:
    Implicit Rule
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x35418d8, priority=500, domain=permit, deny=true
        hits=1, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip=188.x.x.213, mask=255.255.255.255, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0
    Result:
    input-interface: outside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule

  • How to manage c877(outside) in RFC1483 mode through ASA5505 from (inside)network

    Hi All
    Here is a quick summary of my network setup.
    ISP ADSL2 -- C877 Router(RFC1483) -- ASA5505(PPPoE) -- Internal network(s).
    I am trying to figure out how to correctly configure my C877 & my ASA so I can telnet and manage the C877 from one of the inside networks on the ASA5505.
    With the current configuration I can ping the C877 but only from the outside (PPPoE) interface of my ASA5505. I cannot connect to it from any other inside network.
    Interface connectivity is as follows:
    ISP <-> C877 PoTS
    C877 FA/0 <-> ASA Eth0/0[outside_public] [Zone SEC=0]
    ASA Eth0/1[inside_private][Zone SEC=100] <-> HP L2 Switch
    HP L2 Switch <-> Home PC.
    Device IPs:
    Cisco ASA [inside_private] gateway IP = 192.168.50.1 / 24
    Home PC = 192.168.50.81 / 24
    Router C877 IP = 192.168.50.2 / 24
    Everything is working as expected, except I want to be able to manage the C877 from the Home PC, but currently I am not able to establish any connectivity to the C877 from the [inside_private] network.
    Here is what I have tried so far but without luck:
    Connected (a 2nd) network cable from the C877 to the L2 switch. No connectivity from the Home PC.
    Connected (a 2nd) network cable from the C877 to ASA on another interface added to the [inside_private] network. No connectivity from the Home PC.
    Any help much appreciated!
    C877 config below:
    Current configuration : 1422 bytes
    version 15.1
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname c877
    boot-start-marker
    boot-end-marker
    no aaa new-model
    clock timezone UTC 11 0
    crypto pki token default removal timeout 0
    dot11 syslog
    ip source-route
    ip cef
    ip domain name --CUT--
    no ipv6 cef
    multilink bundle-name authenticated
    username --CUT-- privilege 15 password 7 --CUT--
    bridge irb
    interface ATM0
     no ip address
     no atm ilmi-keepalive
     bridge-group 1
     pvc 8/35
      encapsulation aal5snap
    interface FastEthernet0
     no ip address
    interface FastEthernet1
     no ip address
    interface FastEthernet2
     no ip address
    interface FastEthernet3
     no ip address
    interface Dot11Radio0
     no ip address
     shutdown
     speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
     station-role root
    interface Vlan1
     no ip address
     bridge-group 1
    interface BVI1
     ip address 192.168.50.2 255.255.255.0
    ip default-gateway 192.168.50.1
    ip forward-protocol nd
    no ip http server
    no ip http secure-server
    snmp-server community public RO
    snmp-server ifindex persist
    control-plane
    bridge 1 protocol ieee
    line con 0
     exec-timeout 0 0
     logging synchronous
     no modem enable
    line aux 0
    line vty 0 4
     exec-timeout 0 0
     logging synchronous
     login local
     transport input all
    end
    ASA5505 config below:
    ASA Version 9.1(3)
    hostname asa5505
    enable password --CUT-- encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd --CUT-- encrypted
    names
    interface Ethernet0/0
     switchport access vlan 10
    interface Ethernet0/1
    interface Ethernet0/2
     switchport access vlan 20
    interface Ethernet0/3
     switchport access vlan 30
    interface Ethernet0/4
     switchport access vlan 40
    interface Ethernet0/5
    interface Ethernet0/6
     switchport access vlan 70
    interface Ethernet0/7
     switchport access vlan 70
    interface Vlan1
     nameif inside_private
     security-level 100
     ip address 192.168.50.1 255.255.255.0
    interface Vlan10
     nameif outside_public
     security-level 0
     pppoe client vpdn group ADSL2
     ip address pppoe setroute
    interface Vlan20
     nameif inside_dmz
     security-level 70
     ip address 192.168.60.1 255.255.255.0
    interface Vlan30
     nameif inside_guest
     security-level 50
     ip address 192.168.70.1 255.255.255.0
    interface Vlan40
     nameif inside_experimental
     security-level 60
     ip address 10.0.0.1 255.255.0.0
    interface Vlan70
     nameif inside_phone
     security-level 10
     ip address 192.168.80.1 255.255.255.192
    boot system disk0:/asa913-k8.bin
    ftp mode passive
    clock timezone EST 10
    clock summer-time EDT recurring last Sun Oct 2:00 last Sun Mar 3:00
    dns domain-lookup inside_dmz
    dns server-group DefaultDNS
     name-server 192.168.60.2
    same-security-traffic permit intra-interface
    object network LAN_private
     subnet 192.168.50.0 255.255.255.0
    object network LAN_dmz
     subnet 192.168.60.0 255.255.255.0
    object network LAN_guest
     subnet 192.168.70.0 255.255.255.0
    object network LAN_experimental
     subnet 10.0.0.0 255.255.0.0
    object network QNAP_host
     host 192.168.50.9
    object network INTELNUC_host
     host 192.168.60.2
    object network INTELNUC_prtgservice
     host 192.168.60.2
    object network INTELNUC_webservice
     host 192.168.60.2
    object network QNAP_management
     host 192.168.50.9
    object network QNAP_transmission
     host 192.168.50.9
    object network LAN_guest_wireless
     range 192.168.70.31 192.168.70.50
    object network QNAP_t51413
     host 192.168.50.9
    object network QNAP_u51413
     host 192.168.50.9
    object service 9000-9049
     service udp destination range 9000 9049
    object network C7940_u10000-20000
     host 192.168.80.11
    object network C7940_t5060
     host 192.168.80.11
    object network LAN_phone
     subnet 192.168.80.0 255.255.255.192
    object network SPINTEL_host
     host --CUT--
    object service 16384-32766
     service udp source range 16384 32766
    object network C7940_host
     host 192.168.80.11
    object service 10000-20000
     service udp destination range 10000 20000
    object network C7940_u5060
     host 192.168.80.11
    object-group network LAN_all
     network-object object LAN_dmz
     network-object object LAN_experimental
     network-object object LAN_guest
     network-object object LAN_private
     network-object object LAN_phone
    object-group protocol TCPUDP
     protocol-object udp
     protocol-object tcp
    object-group service 5060 tcp-udp
     port-object eq sip
    object-group service 53 tcp-udp
     port-object eq domain
    access-list public_ACL extended permit tcp any object QNAP_host eq 8080
    access-list public_ACL extended permit tcp any object QNAP_host eq 51413
    access-list public_ACL extended permit udp any object QNAP_host eq 51413
    access-list public_ACL extended permit tcp any object QNAP_host eq 9091
    access-list public_ACL extended permit tcp any object INTELNUC_host eq 444
    access-list public_ACL extended permit tcp any object INTELNUC_host eq www
    access-list public_ACL extended permit object-group TCPUDP any object C7940_host eq domain inactive
    access-list public_ACL extended permit tcp object SPINTEL_host object C7940_host eq sip
    access-list public_ACL extended permit udp object SPINTEL_host object C7940_host eq sip
    access-list public_ACL extended permit icmp object SPINTEL_host object C7940_host
    access-list public_ACL extended permit object 10000-20000 object SPINTEL_host object C7940_host
    access-list public_ACL extended permit ip object SPINTEL_host object C7940_host
    access-list dmz_ACL extended permit icmp any any echo
    access-list dmz_ACL extended permit udp any any eq snmp
    access-list dmz_ACL extended permit ip object INTELNUC_host object-group LAN_all
    access-list dmz_ACL extended deny ip any object LAN_private
    access-list dmz_ACL extended deny ip any object LAN_guest
    access-list dmz_ACL extended deny ip any object LAN_experimental
    access-list dmz_ACL extended deny ip any object LAN_phone
    access-list dmz_ACL extended permit ip any any
    access-list guest_ACL extended permit icmp any any echo
    access-list guest_ACL extended permit udp any any eq snmp
    access-list guest_ACL extended permit object-group TCPUDP object LAN_guest_wireless object INTELNUC_host eq domain
    access-list guest_ACL extended deny ip object LAN_guest_wireless object INTELNUC_host
    access-list guest_ACL extended deny ip object LAN_guest_wireless object QNAP_host
    access-list guest_ACL extended permit ip any object INTELNUC_host
    access-list guest_ACL extended permit ip any object QNAP_host
    access-list guest_ACL extended deny ip any object LAN_private
    access-list guest_ACL extended deny ip any object LAN_dmz
    access-list guest_ACL extended deny ip any object LAN_experimental
    access-list guest_ACL extended deny ip any object LAN_phone
    access-list guest_ACL extended permit ip any any
    access-list phone_ACL extended permit udp object C7940_host object INTELNUC_host eq tftp
    access-list phone_ACL extended permit icmp object C7940_host object SPINTEL_host
    access-list phone_ACL extended permit object 16384-32766 object C7940_host object SPINTEL_host
    access-list phone_ACL extended permit object-group TCPUDP object C7940_host any eq domain
    access-list phone_ACL extended permit udp object C7940_host any eq ntp
    access-list phone_ACL extended permit tcp object C7940_host any eq sip
    access-list phone_ACL extended permit udp object C7940_host any eq sip
    access-list phone_ACL extended permit ip object C7940_host any inactive
    access-list phone_ACL extended permit ip object LAN_phone any inactive
    pager lines 24
    logging enable
    logging asdm notifications
    mtu inside_private 1500
    mtu outside_public 1492
    mtu inside_dmz 1500
    mtu inside_guest 1500
    mtu inside_experimental 1500
    mtu inside_phone 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-714.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside_private,outside_public) source static C7940_u10000-20000 interface service 10000-20000 10000-20000
    object network LAN_private
     nat (inside_private,outside_public) dynamic interface
    object network LAN_dmz
     nat (inside_dmz,outside_public) dynamic interface
    object network LAN_guest
     nat (inside_guest,outside_public) dynamic interface
    object network LAN_experimental
     nat (inside_experimental,outside_public) dynamic interface
    object network INTELNUC_prtgservice
     nat (inside_dmz,outside_public) static interface service tcp 444 444
    object network INTELNUC_webservice
     nat (inside_dmz,outside_public) static interface service tcp www www
    object network QNAP_management
     nat (inside_private,outside_public) static interface service tcp 8080 8080
    object network QNAP_transmission
     nat (inside_private,outside_public) static interface service tcp 9091 9091
    object network QNAP_t51413
     nat (inside_private,outside_public) static interface service tcp 51413 51413
    object network QNAP_u51413
     nat (inside_private,outside_public) static interface service udp 51413 51413
    object network C7940_t5060
     nat (inside_private,outside_public) static interface service tcp sip sip
    object network LAN_phone
     nat (inside_phone,outside_public) dynamic interface
    object network C7940_u5060
     nat (inside_private,outside_public) static interface service udp sip sip
    access-group public_ACL in interface outside_public
    access-group dmz_ACL in interface inside_dmz
    access-group guest_ACL in interface inside_guest
    access-group phone_ACL in interface inside_phone
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.50.0 255.255.255.0 inside_private
    snmp-server host inside_dmz 192.168.60.2 community *****
    snmp-server location inside_dmz
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec security-association pmtu-aging infinite
    crypto ca trustpoint localtrust
     enrollment self
     fqdn asa5505.--CUT--
     subject-name CN=sasa5505.--CUT--
     keypair sslvpnkey
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain localtrust
     certificate --CUT--
    telnet 192.168.50.0 255.255.255.0 inside_private
    telnet timeout 60
    ssh timeout 60
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    vpdn group ADSL2 request dialout pppoe
    vpdn group ADSL2 localname --CUT--
    vpdn group ADSL2 ppp authentication pap
    vpdn username --CUT-- password --CUT-- store-local
    dhcpd auto_config outside_public
    dhcprelay server 192.168.60.2 inside_dmz
    dhcprelay enable inside_private
    dhcprelay enable inside_guest
    dhcprelay enable inside_experimental
    dhcprelay enable inside_phone
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics host number-of-rate 3
    threat-detection statistics port number-of-rate 3
    threat-detection statistics protocol number-of-rate 3
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server --CUT-- source inside_private
    ssl encryption aes256-sha1 aes128-sha1 3des-sha1 rc4-sha1
    ssl trust-point localtrust outside_public
    webvpn
     anyconnect-essentials
    username --CUT-- password --CUT-- encrypted privilege 15
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp
      inspect pptp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    hpm topN enable
    Cryptochecksum:--CUT--

    Ansar,
    A source group or "group" is what you need to configure on the CSS in order for the backend servers to initiate a connection outbound on the CSS. It would be helpful if you could email me directly a piece of your config. Specifically I would need the "service" section in terms of which servers need outbound access as well as the content rules you have configured and the ACL section to confirm you are not blocking anything.
    As an example.
    If you had
    service pete
    ip address 1.1.1.1
    active
    content pete
    add service pete
    protocol tcp
    port 80
    vip address 2.2.2.2
    active
    group pete_out
    vip address 2.2.2.2
    add service pete
    active
    So what happens is when the service makes an outbound connection, the source ip address is now the vip address. When the return packet comes back, the CSS recognizes it and gets it back to the backend server.
    You can also apply a source group via an acl as another option.
    Regards
    Pete..
    [email protected]

  • Using LDAP group to autenticate users from inside network to Internet

    Hi team, I got an asa 5510 version 7.2.3 and i need to autenticate my users from inside network to internet using a security group in the Active Directory, anyone can help me with these?

    This might not be complete for your needs but it may give you enough of what you need without having to purchase full url filtering etc.
    Authenticate with LDAP as shown earlier in this thread, then use this aaa ldap with cut-through proxy -
    PIX/ASA : Cut-through Proxy for Network Access using TACACS+ and RADIUS Server Configuration Example
    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807349e7.shtml
    then do some filtering -
    ASA/PIX 8.x: Block Certain Websites (URLs) Using Regular Expressions With MPF Configuration Example
    http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080940e04.shtml

  • The inside network is accessable only through IPsec, do I need enable ios FW?

    I'm building a remote site, and the only traffic in or out of their inside network is via IPsec tunnels.  There is no unecrypted access to the internet.  Should I still configure the ISR firewall?  If so , why?

    If I get your set correctly imagined (haha)
    Anyway, it really depends on you:
    However, for full-tunnel setup, w/c i think you have set-up there, you can enable it for better QoS and basic site blocking as well
    for split-tunnel, then configure it in your remote site.
    Stateless firewall configuration in IOS really is handly, though reporting wise, its not that friendly. 
    Best part of stateless firewall is it can be content based.
    EX: 
    class-map match-any FILTER
      match protocol http host *yahoo* 
      match protocol facebook 
      match protocol youtube
    #class-map type urlfilter match-any CONTENT_DROP
      #match url category Adult-Mature-Content
    There are more protocols as well, and (i think) even p2p protocol can be blocked (utorrent, bitorrent etc)
    Content filtering however is a subscription license and needs to be registered/enabled
    SEE: http://www.cisco.com/c/en/us/products/collateral/security/ios-content-filtering/white_paper_c89-492776.html

  • Inside network can't access webpage via domian name hosted on inside network web server

    I've just deployed Cisco 1900 series router.
    Configured network with NAT Overload. Everything seems to work fine just one thing that bothers me.. i have web server inside network.. and i can't webpage hosted on that server using www.domainname.com. I can only connect to it via internal IP.
    For now i've sovled this by adding domain name and internal IP of server into hosts file in Windows.
    But I'd like to know if there is any better way to solve this?

    found a solution
    http://tech.jocke.no/2010/09/24/cisco-ios-nat-virtual-interface/

  • My wi-fi connection is enabled, however Safari is telling me the server stopped responding.  My laptop is working fine on the same wi-fi network.  I have reset the network settings and still Safari will not open any web pages.  Help!

    My wi-fi connection is enabled, however Safari is telling me the server stopped responding.  My laptop is working fine on the same wi-fe network.  I have reset the network settings and still Safari will not open any web pages.  Help!

    Ralph..........Did as you suggested and I am still getting the message "Safari could not open the page because the server stopped responding".  I am not able to connect with anything on the Internet.  Frustrating since I am able to connect with my laptop.  Thanks for the suggestion.

  • Make sure your network settings are correct and your network connection is active, or try again later; Have been trying to fix for ages.

    Hi Everyone, been struggling all day to restore my settings on my ipod, as my little brother has put a restriction password in place and made me not able to get into Safari, iTunes, Camera which I really need. I have tried everything, resetting my proxy settings, turning off the firewall, changing my network location, ran diagnostics. Everything seems fine on that, I post below my results. I also tried restoring from the device, but with the restrictions code in place I can not do so. And everytime I am dowloading the software update before the restore it comes up with 'Make sure your network settings are correct and your network connection is active, or try again later'. I have been using google for ages and am not sure what I have missed.
    I am using Windows 7 with an Acer Notebook.
    DIAGNOSTICS:
    Microsoft Windows 7 Enterprise Edition Service Pack 1 (Build 7601)
    Acer Aspire One 753
    iTunes 11.0.2.26
    QuickTime 7.7.3
    FairPlay 2.3.31
    Apple Application Support 2.3.3
    iPod Updater Library 10.0d2
    CD Driver 2.2.3.0
    CD Driver DLL 2.1.3.1
    Apple Mobile Device 6.1.0.13
    Apple Mobile Device Driver 1.64.0.0
    Bonjour 3.0.0.10 (333.10)
    Gracenote SDK 1.9.6.502
    Gracenote MusicID 1.9.6.115
    Gracenote Submit 1.9.6.143
    Gracenote DSP 1.9.6.45
    iTunes Serial Number 00BCBEE0093E4EF0
    Current user is not an administrator.
    The current local date and time is 2013-04-05 19:32:36.
    iTunes is not running in safe mode.
    WebKit accelerated compositing is enabled.
    HDCP is supported.
    Core Media is supported.
    Video Display Information
    Intel Corporation, Intel(R) HD Graphics
    **** External Plug-ins Information ****
    No external plug-ins installed.
    **** Network Connectivity Tests ****
    Network Adapter Information
    Adapter Name:     {E1CB97AA-CDFF-4C43-8F63-658D7E70A39F}
    Description:     Intel(R) Centrino(R) Advanced-N 6205
    IP Address:     172.16.42.14
    Subnet Mask:     255.255.255.0
    Default Gateway:     172.16.42.1
    DHCP Enabled:     Yes
    DHCP Server:     172.16.42.1
    Lease Obtained:     Fri Apr 05 19:01:59 2013
    Lease Expires:     Fri Apr 05 20:01:59 2013
    DNS Servers:     172.16.42.1
    Adapter Name:     {44D6CC7B-1F1E-4F26-BBB8-18F98A868E2B}
    Description:     Atheros AR8151 PCI-E Gigabit Ethernet Controller (NDIS 6.20)
    IP Address:     0.0.0.0
    Subnet Mask:     0.0.0.0
    Default Gateway:     0.0.0.0
    DHCP Enabled:     Yes
    DHCP Server:
    Lease Obtained:     Thu Jan 01 11:00:00 1970
    Lease Expires:     Thu Jan 01 11:00:00 1970
    DNS Servers:
    Active Connection:     LAN Connection
    Connected:     Yes
    Online:          Yes
    Using Modem:     No
    Using LAN:     Yes
    Using Proxy:     No
    Firewall Information
    Windows Firewall is on.
    iTunes is enabled in Windows Firewall.
    Connection attempt to Apple web site was successful.
    Connection attempt to browsing iTunes Store was successful.
    Connection attempt to purchasing from iTunes Store was successful.
    Connection attempt to iPhone activation server was successful.
    Connection attempt to firmware update server was successful.
    Connection attempt to Gracenote server was successful.
    Last successful iTunes Store access was 2013-02-14 17:34:33.
    **** Device Connectivity Tests ****
    iPodService 11.0.2.26 is currently running.
    iTunesHelper 11.0.2.26 is currently running.
    Apple Mobile Device service 3.3.0.0 is currently running.
    Universal Serial Bus Controllers:
    Intel(R) 5 Series/3400 Series Chipset Family USB Enhanced Host Controller - 3B34.  Device is working properly.
    Intel(R) 5 Series/3400 Series Chipset Family USB Enhanced Host Controller - 3B3C.  Device is working properly.
    No FireWire (IEEE 1394) Host Controller found.
    Connected Device Information:
    Daniel Pugh's Ipod, iPod touch (4th generation) running firmware version 6.1.3
    Serial Number:     C3XDN3C5DCP7
    Most Recent Devices Not Currently Connected:
    iPhone 4S running firmware version 5.0.1
    Serial Number:     C38GKQWZDT9Y
    **** Device Sync Tests ****
    Sync tests completed successfully.
    Kindest Regards
    Daniel (Puggy858)

    Hi Diesel vdub,
    Did that and I tried again, download stops halfway through and comes up with same message I have already quoted. Wifi Signal is 5/5, network is working, just not letting me download via iTunes.

  • My ipad mini is not connecting to the wifi network. I have the correct network and password chosen, but the message I get is that "unable to join". I have reset my ipad and it still says the same thing.  What can I do about this.

    My ipad mini is not connecting to the wifi network. I have the correct network and password chosen, but the message I get is that "unable to join". I have reset my ipad and it still says the same thing.  What can I do about this?

    Hey Dr kris,
    Thanks for the question, and welcome to Apple Support Communities.
    I understand that you are having issues connecting to Wi-Fi networks with your iPad mini. The following troubleshooting assistant may lead to a resolution:
    Apple - Support - iPhone - Join a network Assistant
    http://www.apple.com/support/iphone/assistant/wifi/
    For more in-depth troubleshooting, refer to the following article (refer to the "Unable to connect to a Wi-Fi network):
    iOS: Troubleshooting Wi-Fi networks and connections
    http://support.apple.com/kb/TS1398
    Thanks,
    Matt M.

Maybe you are looking for