Site-site VPN issue

Hi All,
Iam trying to establish a VPN tunnel between satellite office& HQ with ASA5510. Please find the attached satellite ASA config. After adding the satellite public IP , transform-set , pre-shared key info in to HQ ASA tunnel is not building. 'Show crypto isakmp sa : There are no isakmp sas.
HQ ASA already has mulitple tunnels to otehr offices.
Please advice
Thank you
MS

Hi,
I got the L2L tunnel up. But it is dropping by its own after certin time (not sude how much). I have to initiate 'ping' from my PC to bring it up.The lifetime in isakmp policy set to 86400 Sec. Any clue what else should I check...?
Myasa# sh crypto isakmp sa
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
1 IKE Peer: 8.1.1.2
Type : L2L Role : initiator
Rekey : no State : MM_ACTIVE

Similar Messages

  • Site to Site VPN issues between PIX506 and ASA5505

    Hello all, I have a PIX506 running 635, and an ASA5505 running 722. The PIX is at corporate and is setup for remote vpn access. The remote user VPN is working. I have also attempted to do a site to site vpn to the ASA, but its not working correctly. I feel like I am missing something, but I can't figure it out. Your help would be greatly appreciated. Sanitized relevant config is below
    Corporate
    PIX Version 6.3(5)
    access-list split_tunnel permit ip 192.168.119.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list nonat permit ip 192.168.119.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list nonat permit ip 192.168.119.0 255.255.255.0 172.16.2.0 255.255.255.0
    access-list outside_cryptomap_20 permit ip 192.168.119.0 255.255.255.0 172.16.2.0 255.255.255.0
    ip address outside xxx.yyy.170.160 255.255.255.0
    ip address inside 192.168.119.1 255.255.255.0
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    sysopt connection permit-ipsec
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map dynmap 10 set transform-set ESP-AES-256-SHA
    crypto map mymap 20 ipsec-isakmp
    crypto map mymap 20 match address outside_cryptomap_20
    crypto map mymap 20 set pfs group2
    crypto map mymap 20 set peer aaa.bbb.175.218
    crypto map mymap 20 set transform-set ESP-3DES-SHA
    crypto map mymap 65535 ipsec-isakmp dynamic dynmap
    crypto map mymap client authentication w2k3
    crypto map mymap interface outside
    isakmp enable outside
    isakmp key ******** address aaa.bbb.175.218 netmask 255.255.255.255 no-xauth no-config-mode
    isakmp identity address
    isakmp keepalive 10
    isakmp nat-traversal 10
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption aes-256
    isakmp policy 30 hash sha
    isakmp policy 30 group 5
    isakmp policy 30 lifetime 86400
    vpngroup vpners address-pool ippool
    vpngroup vpners dns-server 192.168.119.11
    vpngroup vpners default-domain mydomain.local
    vpngroup vpners split-tunnel split_tunnel
    vpngroup vpners idle-time 1800
    vpngroup vpners password ********
    Remote Site
    ASA Version 7.2(2)
    interface Vlan1
    nameif inside
    security-level 100
    ip address 172.16.2.1 255.255.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address aaa.bbb.175.218 255.255.128.0
    access-list outside_20_cryptomap extended permit ip 172.16.2.0 255.255.255.0 192.168.119.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.16.2.0 255.255.255.0 192.168.119.0 255.255.255.0
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map outside_map 20 match address outside_20_cryptomap
    crypto map outside_map 20 set pfs
    crypto map outside_map 20 set peer xxx.yyy.170.160
    crypto map outside_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    tunnel-group xxx.yyy.170.160 type ipsec-l2l
    tunnel-group xxx.yyy.170.160 ipsec-attributes
    pre-shared-key *

    I just figured it out. I did not issue the sysopt connection permit-ipsec on the ASA5505. Issuing that command made it work.

  • ASA 5505 Site to Site VPN issue

    I have been trying to configure a siste to site vpn for a few days now, but not able to get it to connect. The only difference between the two, is one has a dynamic ip. this vpn isn't a priority, so there isn't a need to have the dynamic moved to a static at this time. Here is my configs on both ASA's. any help would be greatly appreciated. I replaced the IP's with x.x.x.x
    ASA 1:
    Result of the command: "SHOW RUN"
    : Saved
    ASA Version 9.0(1)
    hostname ciscoasa
    enable password Yn8Esq3NcXIHL35v encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPNDHCP 10.50.50.1-10.50.50.100 mask 255.0.0.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport trunk allowed vlan 1,3
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    switchport trunk allowed vlan 1,3,13
    interface Ethernet0/4
    switchport access vlan 3
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 13
    switchport trunk allowed vlan 1,3
    switchport mode trunk
    interface Vlan1
    nameif Internal
    security-level 100
    ip address 10.0.0.1 255.0.0.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan3
    no forward interface Vlan1
    nameif Guest
    security-level 50
    ip address 192.168.1.1 255.255.255.0
    interface Vlan23
    nameif EP
    security-level 100
    ip address 192.168.20.254 255.255.255.0
    boot system disk0:/asa901-k8.bin
    boot system disk0:/asa844-1-k8.bin
    boot system disk0:/asa843-k8.bin
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network GLE-A-Network
    subnet 10.0.0.0 255.0.0.0
    object network GLE-B-Network
    subnet 192.168.2.0 255.255.255.0
    object network Web-Server
    host 10.0.61.230
    object network obj-Guest
    subnet 192.168.1.0 255.255.255.0
    description Guest Wireless
    object network Spiceworks
    host 10.0.1.2
    object network NETWORK_OBJ_10.50.50.0_25
    subnet 10.50.50.0 255.255.255.128
    object network Remote-Desktop-Services
    host 10.0.1.2
    object network Web-Server-SSL
    host 10.0.23.1
    object service RDP
    service tcp source eq 3389 destination eq 3389
    object network RemoteDesktop
    host 10.0.61.240
    object network obj-PerryCameras-1
    host 10.0.36.1
    object network obj-PerryCameras-2
    host 10.0.36.1
    object network obj-PerryCameras-3
    host 10.0.36.1
    object network DHCP-Server
    host 10.0.1.1
    object network GLE-B-Firewall
    host X.X.X.X
    object network EP-Network
    subnet 192.168.26.0 255.255.255.0
    object network EP-Firewall
    host X.X.X.X
    object network obj-BLDGa
    subnet 192.168.33.0 255.255.255.0
    object network FTP
    host 10.0.61.230
    object-group service SpiceworksPorts tcp
    description https
    port-object eq https
    object-group service RemoteDesktopServices
    service-object tcp-udp destination eq 3389
    object-group service RDS tcp
    description Remote Desktop Services
    port-object eq 3389
    port-object eq https
    object-group service Phone1 tcp
    port-object eq 5522
    object-group service Phone udp
    port-object range 10001 20000
    port-object eq 5522
    object-group service Phones tcp-udp
    port-object range 10001 20000
    port-object eq 5222
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service PerryCameras tcp-udp
    port-object eq 180
    port-object eq 181
    port-object eq 9000
    object-group service Camera1 tcp-udp
    port-object eq 9000
    object-group service Camera2 tcp-udp
    port-object eq 881
    object-group service Camera3 tcp-udp
    port-object eq 1801
    access-list outside_cryptomap extended permit ip object GLE-A-Network object GLE-B-Network
    access-list outside_access_in extended permit tcp any4 object Web-Server eq www
    access-list outside_access_in extended permit tcp any object Web-Server-SSL eq https
    access-list outside_access_in extended permit tcp any object RemoteDesktop eq 3389
    access-list outside_access_in extended permit object-group TCPUDP any object obj-PerryCameras-1 object-group Camera1
    access-list outside_access_in extended permit object-group TCPUDP any object obj-PerryCameras-2 object-group Camera2
    access-list outside_access_in extended permit object-group TCPUDP any object obj-PerryCameras-3 object-group Camera3
    access-list outside_access_in extended permit tcp any4 object FTP eq ftp
    access-list guest_in extended permit udp any4 host 208.67.222.222 eq domain
    access-list guest_in extended permit udp any4 host 208.67.220.220 eq domain
    access-list guest_in extended deny udp any4 any4 eq domain
    access-list guest_in extended permit ip any4 any4
    access-list EP_access_in extended permit object-group TCPUDP any4 any4 eq domain
    access-list EP_access_in extended permit ip any4 any4
    access-list outside_cryptomap_1 extended permit ip object GLE-A-Network object EP-Network
    pager lines 24
    logging enable
    logging asdm informational
    mtu Internal 1500
    mtu outside 1500
    mtu Guest 1500
    mtu EP 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-702.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (Internal,outside) source static any any destination static NETWORK_OBJ_10.50.50.0_25 NETWORK_OBJ_10.50.50.0_25 no-proxy-arp route-lookup
    nat (Internal,outside) source static GLE-A-Network GLE-A-Network destination static GLE-B-Network GLE-B-Network no-proxy-arp route-lookup
    nat (Internal,outside) source static GLE-A-Network GLE-A-Network destination static EP-Network EP-Network no-proxy-arp route-lookup
    nat (EP,outside) source static GLE-A-Network GLE-A-Network destination static EP-Network EP-Network no-proxy-arp route-lookup
    object network obj_any
    nat (Internal,outside) dynamic interface
    object network Web-Server
    nat (Internal,outside) static interface service tcp www www
    object network obj-Guest
    nat (Guest,outside) dynamic interface
    object network Spiceworks
    nat (Internal,outside) static interface service tcp 8080 8080
    object network Web-Server-SSL
    nat (Internal,outside) static interface service tcp https https
    object network RemoteDesktop
    nat (Internal,outside) static interface service tcp 3389 3389
    object network obj-PerryCameras-1
    nat (Internal,outside) static interface service tcp 9000 9000
    object network obj-PerryCameras-2
    nat (any,outside) static interface service tcp 881 881
    object network obj-PerryCameras-3
    nat (Internal,outside) static interface service tcp 1801 1801
    object network FTP
    nat (Internal,outside) static interface service tcp ftp ftp
    access-group outside_access_in in interface outside
    access-group guest_in in interface Guest
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 1:00:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server PolicyServer protocol radius
    aaa-server PolicyServer (Internal) host 10.0.1.1
    timeout 5
    key *****
    user-identity default-domain LOCAL
    aaa authentication enable console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 Internal
    http authentication-certificate Internal
    snmp-server host Internal 10.200.200.11 community *****
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer X.X.X.X
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 2 match address outside_cryptomap_1
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer X.X.X.X
    crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 2 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    crl configure
    crypto ca trustpoint ASDM_TrustPoint2
    crl configure
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable Internal
    crypto ikev2 enable outside
    crypto ikev1 enable Internal
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.1.5-192.168.1.229 Guest
    dhcpd dns 208.67.222.222 208.67.220.220 interface Guest
    dhcprelay server 10.0.1.1 Internal
    dhcprelay enable Guest
    dhcprelay setroute Guest
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    dynamic-filter updater-client enable
    dynamic-filter use-database
    dynamic-filter enable
    dynamic-filter enable interface Internal
    dynamic-filter enable interface outside
    dynamic-filter enable interface Guest
    dynamic-filter drop blacklist
    ntp server 10.0.1.1 source Internal prefer
    webvpn
    anyconnect-essentials
    group-policy GroupPolicy_X.X.X.X internal
    group-policy GroupPolicy_X.X.X.X attributes
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    group-policy GroupPolicy_X.X.X.X internal
    group-policy GroupPolicy_X.X.X.X attributes
    vpn-tunnel-protocol ikev1 ikev2
    group-policy VPNUSER internal
    group-policy VPNUSER attributes
    dns-server value 10.0.1.1 192.168.2.230
    vpn-tunnel-protocol ikev1
    username admin password kSXIy6qd1ZTBFL9/ encrypted
    username danpoynter password XEQ0M75K1B1E6VtM encrypted privilege 0
    username danpoynter attributes
    vpn-group-policy VPNUSER
    tunnel-group X.X.X.X type ipsec-l2l
    tunnel-group X.X.X.X general-attributes
    default-group-policy GroupPolicy_X.X.X.X
    tunnel-group X.X.X.X ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    tunnel-group X.X.X.X type ipsec-l2l
    tunnel-group X.X.X.X general-attributes
    default-group-policy GroupPolicy_X.X.X.X
    tunnel-group X.X.X.X ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:b29f5ff3b9db58467b0eb509bc068c2f
    : end
    ASA 2:
    Result of the command: "SHOW RUN"
    : Saved
    ASA Version 9.0(1)
    hostname ciscoasa
    enable password TYEBBb7SkpIC3BiW encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool remotevpnusers 192.168.12.25-192.168.12.55 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 4
    interface Ethernet0/2
    switchport access vlan 3
    switchport trunk allowed vlan 3-4
    interface Ethernet0/3
    switchport access vlan 20
    interface Ethernet0/4
    switchport access vlan 21
    interface Ethernet0/5
    switchport access vlan 22
    interface Ethernet0/6
    switchport access vlan 4
    switchport trunk allowed vlan 3-4,20-22
    switchport mode trunk
    interface Ethernet0/7
    interface Vlan1
    nameif Management
    security-level 100
    ip address 192.168.31.254 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.240
    interface Vlan3
    description EP Guest Network
    no forward interface Vlan4
    nameif Guest
    security-level 50
    ip address 192.168.27.1 255.255.255.0
    interface Vlan4
    nameif Internal
    security-level 100
    ip address 192.168.26.254 255.255.255.0
    interface Vlan20
    description BLDG-A Subnet
    nameif BLDG-A
    security-level 100
    ip address 192.168.20.254 255.255.255.0
    interface Vlan21
    nameif BLDG-B
    security-level 100
    ip address 192.168.21.254 255.255.255.0
    interface Vlan22
    nameif BLDG-C
    security-level 100
    ip address 192.168.22.254 255.255.255.0
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network NETWORK_OBJ_192.168.12.0_26
    subnet 192.168.12.0 255.255.255.192
    object network NETWORK_OBJ_192.168.26.0_24
    subnet 192.168.26.0 255.255.255.0
    object network obj-KeoweeCameras
    host 192.168.26.10
    description Keowee Street Cameras
    object network Inside
    subnet 192.168.26.0 255.255.255.0
    description Inside Network Route
    object network Guest
    subnet 192.168.27.0 255.255.255.0
    description Guest Network Route
    object network Internal
    subnet 192.168.26.0 255.255.255.0
    object network obj-HunterCameras
    host 192.168.21.20
    description Hunter Cameras
    object network obj-Spiceworks
    host 192.168.26.8
    object network Electro-Polish-Network
    subnet 192.168.26.0 255.255.255.0
    object network GLE-Firewall
    host x.x.x.x
    object network GLE-Network
    subnet 10.0.0.0 255.0.0.0
    object network BLDG-A
    subnet 192.168.20.0 255.255.255.0
    object network BLDG-B
    subnet 192.168.21.0 255.255.255.0
    object network BLDG-C
    subnet 192.168.22.0 255.255.255.0
    object network DCG-Server01
    host 192.168.26.9
    object network NETWORK_OBJ_192.168.21.0_24
    subnet 192.168.21.0 255.255.255.0
    object network VPN-POOL
    subnet 192.168.12.0 255.255.255.0
    object network EP-VPN-Network
    subnet 192.168.26.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service CameraSystem tcp-udp
    port-object eq 18004
    port-object eq 26635
    port-object eq 76
    access-list electroremote_splitTunnelAcl standard permit 192.168.26.0 255.255.255.0
    access-list electroremote_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list electroremote_splitTunnelAcl standard permit 192.168.21.0 255.255.255.0
    access-list electroremote_splitTunnelAcl standard permit 192.168.22.0 255.255.255.0
    access-list outside_access_in extended permit object-group TCPUDP any4 object obj-KeoweeCameras object-group CameraSystem
    access-list outside_access_in extended permit object-group TCPUDP any4 object obj-HunterCameras object-group CameraSystem
    access-list outside_access_in extended permit tcp any4 object obj-Spiceworks eq https
    access-list outside_access_in extended permit tcp any4 object DCG-Server01 eq https
    access-list outside_access_in extended permit tcp any4 object DCG-Server01 eq www
    access-list Guest_access_in extended permit udp any4 host 208.67.222.222 eq domain
    access-list Guest_access_in extended permit udp any4 host 208.67.220.220 eq domain
    access-list Guest_access_in extended deny udp any4 any4 eq domain
    access-list Guest_access_in extended permit ip any4 any4
    access-list inside_access_in extended permit udp any4 host 208.67.222.222 eq domain
    access-list inside_access_in extended permit udp any4 host 208.67.220.220 eq domain
    access-list inside_access_in extended deny udp any4 any4 eq domain
    access-list inside_access_in extended permit ip any4 any4
    access-list Internal_access_in extended permit udp any4 host 208.67.222.222 eq domain
    access-list Internal_access_in extended permit udp any4 host 208.67.220.220 eq domain
    access-list Internal_access_in extended deny udp any4 any4 eq domain
    access-list Internal_access_in extended permit ip any any4
    access-list ip-qos extended permit ip 192.168.27.0 255.255.255.0 any
    access-list ip-qos extended permit ip any 192.168.27.0 255.255.255.0
    access-list electroremote_splittunnelacl standard permit 192.168.20.0 255.255.255.0
    access-list electroremote_splittunnelacl standard permit 192.168.21.0 255.255.255.0
    access-list electroremote_splittunnelacl standard permit 192.168.22.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.26.0 255.255.255.0 object GLE-Network
    pager lines 24
    logging enable
    logging asdm informational
    mtu Management 1500
    mtu outside 1500
    mtu Guest 1500
    mtu Internal 1500
    mtu BLDG-A 1500
    mtu BLDG-B 1500
    mtu BLDG-C 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-702.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (BLDG-A,outside) source static BLDG-A BLDG-A destination static VPN-POOL VPN-POOL
    nat (BLDG-B,outside) source static BLDG-B BLDG-B destination static VPN-POOL VPN-POOL
    nat (BLDG-C,outside) source static BLDG-C BLDG-C destination static VPN-POOL VPN-POOL
    nat (Internal,outside) source static NETWORK_OBJ_192.168.26.0_24 NETWORK_OBJ_192.168.26.0_24 destination static NETWORK_OBJ_192.168.12.0_26 NETWORK_OBJ_192.168.12.0_26 no-proxy-arp route-lookup
    nat (Internal,outside) source static Electro-Polish-Network Electro-Polish-Network destination static GLE-Network GLE-Network no-proxy-arp route-lookup
    nat (Internal,outside) source static any any destination static NETWORK_OBJ_192.168.12.0_26 NETWORK_OBJ_192.168.12.0_26 no-proxy-arp route-lookup
    nat (outside,outside) source static any any destination static NETWORK_OBJ_192.168.12.0_26 NETWORK_OBJ_192.168.12.0_26 no-proxy-arp route-lookup
    nat (Internal,outside) source static EP-VPN-Network EP-VPN-Network destination static GLE-Network GLE-Network no-proxy-arp route-lookup
    nat (Internal,outside) source static NETWORK_OBJ_192.168.26.0_24 NETWORK_OBJ_192.168.26.0_24 destination static GLE-Network GLE-Network no-proxy-arp route-lookup
    object network obj_any
    nat (Internal,outside) dynamic interface
    object network obj-KeoweeCameras
    nat (Internal,outside) static x.x.x.x
    object network Inside
    nat (Internal,outside) dynamic interface
    object network Guest
    nat (Guest,outside) dynamic x.x.x.x
    object network Internal
    nat (Internal,outside) dynamic interface
    object network obj-HunterCameras
    nat (BLDG-B,outside) static x.x.x.x
    object network obj-Spiceworks
    nat (Internal,outside) static x.x.x.x service tcp https https
    object network BLDG-A
    nat (BLDG-A,outside) dynamic interface
    object network BLDG-B
    nat (BLDG-B,outside) dynamic interface
    object network BLDG-C
    nat (BLDG-C,outside) dynamic interface
    object network DCG-Server01
    nat (any,any) static x.x.x.x
    access-group inside_access_in in interface Management
    access-group outside_access_in in interface outside
    access-group Guest_access_in in interface Guest
    access-group Internal_access_in in interface Internal
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server IAS protocol radius
    aaa-server IAS (Internal) host 192.168.26.1
    timeout 5
    key *****
    user-identity default-domain LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 192.168.31.0 255.255.255.0 Management
    http 192.168.26.0 255.255.255.0 Internal
    http x.x.x.x 255.255.255.255 outside
    http authentication-certificate Management
    snmp-server host Internal 192.168.26.8 community ***** version 2c
    snmp-server location Building A
    snmp-server contact Dan Poynter
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer x.x.x.x
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map BLDG-B_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map BLDG-B_map interface BLDG-B
    crypto map BLDG-A_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map BLDG-A_map interface BLDG-A
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 enable Internal
    crypto ikev1 enable outside
    crypto ikev1 enable Internal
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.26.0 255.255.255.0 Internal
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access Internal
    dhcpd auto_config outside
    dhcpd address 192.168.27.50-192.168.27.100 Guest
    dhcpd dns 208.67.222.222 208.67.220.220 interface Guest
    dhcprelay server 192.168.26.1 Internal
    dhcprelay server 192.168.26.2 Internal
    dhcprelay enable Guest
    dhcprelay enable BLDG-A
    dhcprelay enable BLDG-B
    dhcprelay enable BLDG-C
    dhcprelay setroute Guest
    dhcprelay setroute BLDG-A
    dhcprelay setroute BLDG-B
    dhcprelay setroute BLDG-C
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_x.x.x.x internal
    group-policy GroupPolicy_x.x.x.x attributes
    vpn-tunnel-protocol ikev1 ikev2
    group-policy electroremote internal
    group-policy electroremote attributes
    dns-server value 192.168.26.1
    vpn-tunnel-protocol ikev1 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value electroremote_splitTunnelAcl
    default-domain value electropolish.local
    username epadmin password Iu2OqCfOGoYIZ5iC encrypted privilege 15
    username epadmin attributes
    service-type nas-prompt
    tunnel-group electroremote type remote-access
    tunnel-group electroremote general-attributes
    address-pool remotevpnusers
    authentication-server-group IAS
    default-group-policy electroremote
    tunnel-group electroremote ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group x.x.x.x general-attributes
    default-group-policy GroupPolicy_x.x.x.x
    tunnel-group x.x.x.x ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map icmp-class
    match default-inspection-traffic
    class-map inspection_default
    match default-inspection-traffic
    class-map qos
    description qos policy
    match access-list ip-qos
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map icmp_policy
    class icmp-class
    inspect icmp
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny
    inspect sunrpc
    inspect xdmcp
    inspect sip
    inspect netbios
    inspect tftp
    inspect ip-options
    inspect icmp
    policy-map qos
    class qos
    police output 1048500 1048576
    police input 256000 256000
    service-policy global_policy global
    service-policy icmp_policy interface outside
    service-policy qos interface Guest
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:3f2034bf1ad61529c601c097d6f60bad
    : end

    Hi,
    Are you saying that all traffic is working from central site to remote site when remote sites devices are in the "inside" Vlan? All but the phones even if they are in the "inside" Vlan?
    Are you sure you have the NAT configurations correctly on the remote site for the other LAN interface?
    Are you seing any connections from the phones when they are in the original "inside" interface of the remote ASA? Dont they usually get the Call Manager IPs from the DHCP server and then connect with TFTP to the Call Manager after which they form a TCP/2000 port connection to the Call Manager? I'm not really familiar with Cisco Phones other than what I see on the firewalls from time to time.
    Are you sure you remote ASA and Switch are configure correctly when you add the second Vlan to the switch? Can you see the phones on the remote ASA with "show arp" command when they are powered on?
    There should not be identical security-levels on the interfaces of the remote ASA unless the phones need to connect to the other local "inside" network. Then it would be logical for the interfaces both to be security-level 100. Interface "outside" is usually set to 0.
    Guess we would need to see the configurations for the ASAs to confirm that everything is in order.
    - Jouni

  • Configuring Cisco ASA for site to site VPN ( Issue with setting up local network)

    OK, so our primary firewall is a checkpoint gateway. Behind that we have a cisco ASA for vpn users. I have a project at the moment where we need to connect to another company using site to site VPN through the cisco ASA, as the checkpoint gateway is unable to establish a permanent tunnel with the other companies Cisco ASA.
    What would be the best practise for setting up the local network on my side? Create the network on the ASA and then use a L2 vlan to connect to the Core switch? 
    Setup a L3 interface on the core switch and point it towards the checkpoint gateway which would then point to the ASA?
    When you have to select your local network through the site to site wizard do you have to put the inside network address of the ASA?
    Our network is setup like this: Access layer switch > Core 6500 Switch > Checkpoint-Firewall > Internet
    The ASA is connected to a checkpoint sub interface
    Any help would be beneficial as im new to cisco ASAs 
    Thanks
    Mark

    Mark
    If we understood more about your environment we might be able to give you better answers. My initial reaction was similar to the suggestion from Michael to use a L2 vlan. But as I think a bit more my attention is drawn to something that you mention in the original post. The ASA is there for VPN users. If the VPN users need to access your internal network then you probably already have something configured on the ASA that allows access to the internal network. Perhaps that same thing might provide access for your site to site VPN?
    HTH
    Rick

  • Cisco site to site vpn issue,

    HI, i am trying to configure site to site VPN on a cisco 2911 router. 
    I am unable to get the tunnel up, after some research i have narrowed down the cause to NAT or default route.
    Can someone help me 
    I have posted mt config below 
    Router Config
    Router#s
    *Jun  3 20:05:05.474: %SYS-5-CONFIG_I: Configured from console by consoleh run
    Building configuration...
    Current configuration : 5499 bytes
    ! Last configuration change at 15:05:05 PCTime Tue Jun 3 2014
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname Router
    boot-start-marker
    boot-end-marker
    no logging buffered
    enable password XXXXX
    no aaa new-model
    clock timezone PCTime -5 0
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    ip cef
    ip dhcp pool TEST
     network 192.168.x.x 255.255.255.0
     default-router 192.168.x.x
     dns-server 64.71.255.198 64.71.255.204 4.2.2.2
    ip dhcp pool 10
     network 192.168.xxx.xx 255.255.255.0
     default-router 192.168.xxx.xx
     dns-server 64.71.255.198 64.71.255.204 4.2.2.2
    ip dhcp pool 1
     network 10.100.xx.xx 255.255.255.0
     default-router 10.100.xx.xx
     dns-server 64.71.255.198 64.71.255.204 4.2.2.2
    ip dhcp pool 2
     network 10.100.xxx.xx 255.255.255.0
     default-router 10.100.xxx.xx
     dns-server 64.71.255.198 64.71.255.204 8.8.8.8
    no ip domain lookup
    no ipv6 cef
    multilink bundle-name authenticated
    crypto pki trustpoint TP-self-signed-1282495617
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-1282495617
     revocation-check none
     rsakeypair TP-self-signed-1282495617
    crypto pki certificate chain TP-self-signed-1282495617
     certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31323832 34393536 3137301E 170D3133 31303031 31393032
      32345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32383234
      39353631 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100C2E9 568B0B30 1BE35F55 BAF6F8C5 2525E808 23930CD9 81602A70 DAFAE355
      35C7D946 DA8CB688 C1844F02 7AE8864D 80EE3355 27A7B1DC FA5329A0 2B44E434
      478EFC47 7D92D8E7 46D6DA4B 5D477D90 E81AC837 3F62DE48 0D0937A0 286FE963
      6D2F5DC8 0A2B70EC 5A9F5E3F 47D2A08F EC0A10BC 713507AD F24E042E 94CFB70D
      47B30203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 14735FD7 7A1F7322 CE6A9645 7C73633D D8ED8915 77301D06
      03551D0E 04160414 735FD77A 1F7322CE 6A96457C 73633DD8 ED891577 300D0609
      2A864886 F70D0101 05050003 81810095 433FC9D1 464A9129 6C02E492 19963992
      8A9C1549 A71F3E96 F89F4FE9 AAC3A748 1393CED4 8CEC5D99 71C5455F 5DE834D7
      CB4B08A2 276C9DA5 012FAEE2 7EB921E9 4B42DCEA FCD1D04E 2C2C6633 D20D1BDB
      133F7B0F ADEB7212 95C88B50 EB3D2854 C1BA8DD1 43B6BD3C C96C3E12 CF7025D1
      12E1ACE9 D76791A5 96E88A28 CDCF3B
            quit
    license udi pid CISCO2911/K9 sn FGL173011EB
    username admin privilege 15 password 0 XXXXXX
    username rahul privilege 15 password 0 XXXXXXX
    username xxxx privilege 15 secret 4 VWq946KBE6gESOmM2hYcakgfruaB4GfVtlGBulc8F7k
    redundancy
    class-map match-any CCP-Transactional-1
     match dscp af21
     match dscp af22
     match dscp af23
    class-map match-any CCP-Voice-1
     match dscp ef
    class-map match-any CCP-Routing-1
     match dscp cs6
    class-map match-any CCP-Signaling-1
     match dscp cs3
     match dscp af31
    class-map match-any CCP-Management-1
     match dscp cs2
    policy-map sdm-qos-test-123
     class class-default
    policy-map CCP-QoS-Policy-1
     class CCP-Voice-1
      priority percent 55
     class CCP-Signaling-1
      bandwidth percent 5
     class CCP-Routing-1
      bandwidth percent 5
     class CCP-Management-1
      bandwidth percent 5
     class CCP-Transactional-1
      bandwidth percent 5
     class class-default
      fair-queue
      random-detect
    crypto isakmp policy 1
     encr aes 256
     authentication pre-share
     group 2
    crypto isakmp key xxxxxxxxxxx address 198.161.xxx.xxx
    crypto ipsec security-association lifetime seconds 86400
    crypto ipsec transform-set OES esp-aes 256 esp-sha-hmac
     mode tunnel
    crypto ipsec transform-set vpnset esp-aes esp-sha-hmac
     mode tunnel
    crypto map tunnel 100 ipsec-isakmp
     set peer 198.161.xxx.xxx
     set transform-set OES
     match address 101
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0
     ip address 69.17.xxx.xxx 255.255.255.252
     ip nat outside
     ip virtual-reassembly in
     duplex full
     speed 100
     crypto map tunnel
    interface GigabitEthernet0/1
     description WEEE.LOCAL
     ip address 10.100.xx.xx 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
     service-policy output CCP-QoS-Policy-1
    interface GigabitEthernet0/2
     description voip
     ip address 10.100.xxx.xxx 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip nat inside source list 1 interface GigabitEthernet0/0 overload
    ip nat inside source list 2 interface GigabitEthernet0/0 overload
    ip nat inside source list 10 interface GigabitEthernet0/0 overload
    ip nat inside source list 99 interface GigabitEthernet0/0 overload
    ip route 0.0.0.0 0.0.0.0 69.17.xxx.xxx
    access-list 1 permit 10.100.xx.xx 0.0.0.255
    access-list 2 permit 10.100.xxx.xxx 0.0.0.255
    access-list 10 permit 192.168.xxx.xx 0.0.0.255
    access-list 99 permit 192.168.x.x 0.0.0.255
    access-list 101 permit ip 10.100.xxx.xxx 0.0.0.255 10.252.xxx.xxx 0.0.0.255
    control-plane
    line con 0
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport input all
     transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
     stopbits 1
    line vty 0 4
     password XXXX
     login
     transport input all
    scheduler allocate 20000 1000
    End
    Router#sh crypto isakmp policy
    Global IKE policy
    Protection suite of priority 1
            encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
            hash algorithm:         Secure Hash Standard
            authentication method:  Pre-Shared Key
            Diffie-Hellman group:   #2 (1024 bit)
            lifetime:               86400 seconds, no volume limit
    Router#sh crypto map
    Crypto Map IPv4 "tunnel" 100 ipsec-isakmp
            Peer = 198.161.xxx.xxx
            Extended IP access list 101
                access-list 101 permit ip 10.100.xxx.xxx 0.0.0.255 10.252.xxx.xxx 0.0.0.255
            Current peer: 198.161.xxx.xxx
            Security association lifetime: 4608000 kilobytes/86400 seconds
            Responder-Only (Y/N): N
            PFS (Y/N): N
            Transform sets={
                    OES:  { esp-aes 256 esp-sha-hmac  } ,
            Interfaces using crypto map tunnel:
                    GigabitEthernet0/0
    Router#show crypto ipsec sa
    interface: GigabitEthernet0/0
        Crypto map tag: tunnel, local addr 69.17.xxx.xxx
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (10.100.xxx.xxx/255.255.255.0/0/0)
       remote ident (addr/mask/prot/port): (10.252.xxx.xxx/255.255.255.0/0/0)
       current_peer 198.161.xxx.xxx port 500
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
        #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: 69.17.xxx.xxx, remote crypto endpt.: 198.161.xxx.xxx
         path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
         current outbound spi: 0x0(0)
         PFS (Y/N): N, DH group: none
         inbound esp sas:
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
         outbound ah sas:
         outbound pcp sas:

    Thanks, i will apply those changes today after work and see if i can get the tunnel up.
    I did some changes to the config last night, out of frustration. i decided to use Cisco configuration profession which ran performed debugging on the tunnel and added some nat rules and Access-lists. the tunnel is till not up.
    I will post the new config below
    Router#sh run
    Building configuration...
    Current configuration : 6615 bytes
    ! Last configuration change at 11:49:56 PCTime Wed Jun 4 2014 by admin
    version 15.2
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname Router
    boot-start-marker
    boot-end-marker
    no logging buffered
    enable password XXX
    no aaa new-model
    clock timezone PCTime -5 0
    clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
    ip cef
    ip dhcp pool TEST
     network 192.168.XX.XX 255.255.255.0
     default-router 192.168.AA.AA
     dns-server 64.71.255.198 64.71.255.204 4.2.2.2
    ip dhcp pool 10
     network 192.168.XXX.XXX 255.255.255.0
     default-router 192.168.XXX.XXX
     dns-server 64.71.255.198 64.71.255.204 4.2.2.2
    ip dhcp pool 1
     network 10.100.XX.XX 255.255.255.0
     default-router 10.100.XX.XX
     dns-server 64.71.255.198 64.71.255.204 4.2.2.2
    ip dhcp pool 2
     network 10.100.XXX.XXX 255.255.255.0
     default-router 10.100.XXX.XXX
     dns-server 64.71.255.198 64.71.255.204 8.8.8.8
    no ip domain lookup
    no ipv6 cef
    multilink bundle-name authenticated
    crypto pki trustpoint TP-self-signed-1282495617
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-1282495617
     revocation-check none
     rsakeypair TP-self-signed-1282495617
    crypto pki certificate chain TP-self-signed-1282495617
     certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31323832 34393536 3137301E 170D3133 31303031 31393032
      32345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32383234
      39353631 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100C2E9 568B0B30 1BE35F55 BAF6F8C5 2525E808 23930CD9 81602A70 DAFAE355
      35C7D946 DA8CB688 C1844F02 7AE8864D 80EE3355 27A7B1DC FA5329A0 2B44E434
      478EFC47 7D92D8E7 46D6DA4B 5D477D90 E81AC837 3F62DE48 0D0937A0 286FE963
      6D2F5DC8 0A2B70EC 5A9F5E3F 47D2A08F EC0A10BC 713507AD F24E042E 94CFB70D
      47B30203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 14735FD7 7A1F7322 CE6A9645 7C73633D D8ED8915 77301D06
      03551D0E 04160414 735FD77A 1F7322CE 6A96457C 73633DD8 ED891577 300D0609
      2A864886 F70D0101 05050003 81810095 433FC9D1 464A9129 6C02E492 19963992
      8A9C1549 A71F3E96 F89F4FE9 AAC3A748 1393CED4 8CEC5D99 71C5455F 5DE834D7
      CB4B08A2 276C9DA5 012FAEE2 7EB921E9 4B42DCEA FCD1D04E 2C2C6633 D20D1BDB
      133F7B0F ADEB7212 95C88B50 EB3D2854 C1BA8DD1 43B6BD3C C96C3E12 CF7025D1
      12E1ACE9 D76791A5 96E88A28 CDCF3B
            quit
    license udi pid CISCO2911/K9 sn FGL173011EB
    username admin privilege 15 password 0 XXXXXXXXX
    username rahul privilege 15 password 0 XXXXXXXXXXX
    username XXXX privilege 15 secret 4 VWq946KBE6gESOmM2hYcakgfruaB4GfVtlGBulc8F7k
    redundancy
    class-map match-any CCP-Transactional-1
     match dscp af21
     match dscp af22
     match dscp af23
    class-map match-any CCP-Voice-1
     match dscp ef
    class-map match-any CCP-Routing-1
     match dscp cs6
    class-map match-any CCP-Signaling-1
     match dscp cs3
     match dscp af31
    class-map match-any CCP-Management-1
     match dscp cs2
    policy-map sdm-qos-test-123
     class class-default
    policy-map CCP-QoS-Policy-1
     class CCP-Voice-1
      priority percent 55
     class CCP-Signaling-1
      bandwidth percent 5
     class CCP-Routing-1
      bandwidth percent 5
     class CCP-Management-1
      bandwidth percent 5
     class CCP-Transactional-1
      bandwidth percent 5
     class class-default
      fair-queue
      random-detect
    crypto isakmp policy 1
     encr aes
     authentication pre-share
     group 2
     lifetime 28800
    crypto isakmp key XXXXXXXXXXXXX address 198.161.XXX.XXX 255.255.255.248
    crypto ipsec security-association lifetime seconds 86400
    crypto ipsec transform-set OES esp-aes 256 esp-sha-hmac
     mode tunnel
    crypto ipsec transform-set vpnset esp-aes esp-sha-hmac
     mode tunnel
    crypto map tunnel 100 ipsec-isakmp
     set peer 198.161.XXX.XXX
     set transform-set OES
     match address 101
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0
     ip address 69.17.XXX.XXX 255.255.255.252
     ip nat outside
     ip virtual-reassembly in
     duplex full
     speed 100
     crypto map tunnel
    interface GigabitEthernet0/1
     description WEEE.LOCAL
     ip address 10.100.AA.AA 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
     service-policy output CCP-QoS-Policy-1
    interface GigabitEthernet0/2
     description voip
     ip address 10.100.XXX.XXX 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/0 overload
    ip nat inside source route-map SDM_RMAP_2 interface GigabitEthernet0/0 overload
    ip nat inside source route-map SDM_RMAP_3 interface GigabitEthernet0/0 overload
    ip nat inside source route-map SDM_RMAP_4 interface GigabitEthernet0/0 overload
    ip route 0.0.0.0 0.0.0.0 69.17.AAA.AAA
    access-list 1 remark CCP_ACL Category=16
    access-list 1 permit 10.100.AA.AA 0.0.0.255
    access-list 2 remark CCP_ACL Category=16
    access-list 2 permit 10.100.XXX.XXX 0.0.0.255
    access-list 10 remark CCP_ACL Category=16
    access-list 10 permit 192.168.10.0 0.0.0.255
    access-list 99 remark CCP_ACL Category=16
    access-list 99 permit 192.168.1.0 0.0.0.255
    access-list 100 remark CCP_ACL Category=2
    access-list 100 deny   ip 10.100.XXX.XXX 0.0.0.255 10.252.XX.XX 0.0.0.255
    access-list 100 permit ip 10.100.AA.AA 0.0.0.255 any
    access-list 101 permit ip 10.100.XXX.XXX 0.0.0.255 10.252.XX.XX 0.0.0.255
    access-list 102 remark CCP_ACL Category=2
    access-list 102 deny   ip 10.100.XXX.XXX 0.0.0.255 10.252.XX.XX 0.0.0.255
    access-list 102 permit ip 10.100.XXX.XXX 0.0.0.255 any
    access-list 103 remark CCP_ACL Category=2
    access-list 103 deny   ip 10.100.XXX.XXX 0.0.0.255 10.252.XX.XX 0.0.0.255
    access-list 103 permit ip 192.168.XXX.XXX 0.0.0.255 any
    access-list 104 remark CCP_ACL Category=2
    access-list 104 deny   ip 10.100.XXX.XXX 0.0.0.255 10.252.XX.XX 0.0.0.255
    access-list 104 permit ip 192.168.XX.XX 0.0.0.255 any
    route-map SDM_RMAP_4 permit 1
     match ip address 104
    route-map SDM_RMAP_1 permit 1
     match ip address 100
    route-map SDM_RMAP_2 permit 1
     match ip address 102
    route-map SDM_RMAP_3 permit 1
     match ip address 103
    control-plane
    line con 0
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport input all
     transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
     stopbits 1
    line vty 0 4
     password XXXXXX
     login
     transport input all
    scheduler allocate 20000 1000
    end

  • Cisco RV220/RV110 Site-Site VPN issues

    Hi I have a couple of sites using the RV220 at head office and a few RV110's at branch offices linked by IPSec VPN. I am finding the links to be very unstable and it appears to be the actual routers causing this.
    The issue starts when data flow stops between two sites, I can restart the RV110 at the branch office but this rarely fixes the issue. If I restart the RV220 at head office then the VPN is re-established. I find that both ends think they are connected, but I can't drop or reconnect the interface using the web interface. Traffic (Rx/Tx) across the link is usually reported as 0.
    I have three businesses I look after that have this identical issue. The remote sites are connected via various methods (bridge mode to ADSL or 4G services)
    All devices running latest firmware. Some times the links will freeze up several times a day, some times once a week.
    Any help appreciated, this has been going on for some time.

    Hi I have a couple of sites using the RV220 at head office and a few RV110's at branch offices linked by IPSec VPN. I am finding the links to be very unstable and it appears to be the actual routers causing this.
    The issue starts when data flow stops between two sites, I can restart the RV110 at the branch office but this rarely fixes the issue. If I restart the RV220 at head office then the VPN is re-established. I find that both ends think they are connected, but I can't drop or reconnect the interface using the web interface. Traffic (Rx/Tx) across the link is usually reported as 0.
    I have three businesses I look after that have this identical issue. The remote sites are connected via various methods (bridge mode to ADSL or 4G services)
    All devices running latest firmware. Some times the links will freeze up several times a day, some times once a week.
    Any help appreciated, this has been going on for some time.

  • Site to site VPN re-connection issue

    Hi I done site -to -site VPN between two UC 560 and I am able to make call too. Both site I am using DDNS FQDN. Now I am facing these problems,
    1. When ever any of the site gone down , it is taking around 45 minute to get reconnect the VPN. 
    2. With in 2 minute Dialer interface is getting WAN  IP address from service provider and it is updating with Dyndns also. But while checking crypto session details from my local UC I can see the peer address is not changing or showing none.
    please help me to overcome this issue
    I tested by restarting ROUTER-A  UC560
    Please find the status of remote site:
    ROUTER-B#sh crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    2.50.37.13      86.99.72.10     MM_NO_STATE       2004 ACTIVE (deleted)
    ROUTER-B#sh crypto isa saIPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    ROUTER-A#sh crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    ROUTER-B#sho crypto session detail
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Dialer0
    Session status: UP-NO-IKE
    Peer: 86.99.72.10 port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.10.0/255.255.255.0 192.168.50.0/255.255.255.0
            Active SAs: 2, origin: crypto map
            Inbound:  #pkts dec'ed 12452 drop 0 life (KB/Sec) 4477633/1050
            Outbound: #pkts enc'ed 15625 drop 228 life (KB/Sec) 4477628/1050
    ROUTER-A# sho crypto session det
    Crypto session current status
    Code: C - IKE Configuration mode, D - Dead Peer Detection
    K - Keepalives, N - NAT-traversal, T - cTCP encapsulation
    X - IKE Extended Authentication, F - IKE Fragmentation
    Interface: Virtual-Access2
    Session status: DOWN
    Peer:  port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.50.0/255.255.255.0 192.168.10.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
    Interface: Dialer0
    Session status: DOWN
    Peer:  port 500 fvrf: (none) ivrf: (none)
          Desc: (none)
          Phase1_id: (none)
      IPSEC FLOW: permit ip 192.168.50.0/255.255.255.0 192.168.10.0/255.255.255.0
            Active SAs: 0, origin: crypto map
            Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
            Outbound: #pkts enc'ed 0 drop 23 life (KB/Sec) 0/0
    **** Here I can see the peer IP is 86.99.72.10, but address had been changed to  92.98.211.242 in ROUTER-A
    Please see the debug crypto isakpm
    ROUTER-A#debug crypto isakmp
    Crypto ISAKMP debugging is on
    ROUTER-A#terminal monitor
    000103: Aug  6 18:40:48.083: ISAKMP:(0): SA request profile is (NULL)
    000104: Aug  6 18:40:48.083: ISAKMP: Created a peer struct for , peer port 500
    000105: Aug  6 18:40:48.083: ISAKMP: New peer created peer = 0x86682AAC peer_handle = 0x80000031
    000106: Aug  6 18:40:48.083: ISAKMP: Locking peer struct 0x86682AAC, refcount 1 for isakmp_initiator
    000107: Aug  6 18:40:48.083: ISAKMP: local port 500, remote port 500
    000108: Aug  6 18:40:48.083: ISAKMP: set new node 0 to QM_IDLE
    000109: Aug  6 18:40:48.083: ISAKMP:(0):insert sa successfully sa = 8B4EBE04
    000110: Aug  6 18:40:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000111: Aug  6 18:40:48.083: ISAKMP:(0):No pre-shared key with !
    000112: Aug  6 18:40:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000113: Aug  6 18:40:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000114: Aug  6 18:40:48.083: ISAKMP: Unlocking peer struct 0x86682AAC for isadb_unlock_peer_delete_sa(), count 0
    000115: Aug  6 18:40:48.083: ISAKMP: Deleting peer node by peer_reap for : 86682AAC
    000116: Aug  6 18:40:48.083: ISAKMP:(0):purging SA., sa=8B4EBE04, delme=8B4EBE04
    000117: Aug  6 18:40:48.083: ISAKMP:(0):purging node 2113438140
    000118: Aug  6 18:40:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000119: Aug  6 18:40:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000120: Aug  6 18:41:18.083: ISAKMP:(0): SA request profile is (NULL)
    000121: Aug  6 18:41:18.083: ISAKMP: Created a peer struct for , peer port 500
    000122: Aug  6 18:41:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000032
    000123: Aug  6 18:41:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000124: Aug  6 18:41:18.083: ISAKMP: local port 500, remote port 500
    000125: Aug  6 18:41:18.083: ISAKMP: set new node 0 to QM_IDLE
    000126: Aug  6 18:41:18.083: ISAKMP:(0):insert sa successfully sa = 86685DFC
    000127: Aug  6 18:41:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000128: Aug  6 18:41:18.083: ISAKMP:(0):No pre-shared key with !
    000129: Aug  6 18:41:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000130: Aug  6 18:41:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000131: Aug  6 18:41:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb_unlock_peer_delete_sa(), count 0
    000132: Aug  6 18:41:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000133: Aug  6 18:41:18.083: ISAKMP:(0):purging SA., sa=86685DFC, delme=86685DFC
    000134: Aug  6 18:41:18.083: ISAKMP:(0):purging node 379490091
    000135: Aug  6 18:41:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000136: Aug  6 18:41:18.083: ISAKMP: Error while processing KMI message 0, error 2.
    000137: Aug  6 18:42:48.083: ISAKMP:(0): SA request profile is (NULL)
    000138: Aug  6 18:42:48.083: ISAKMP: Created a peer struct for , peer port 500
    000139: Aug  6 18:42:48.083: ISAKMP: New peer created peer = 0x86691200 peer_handle = 0x80000033
    000140: Aug  6 18:42:48.083: ISAKMP: Locking peer struct 0x86691200, refcount 1for isakmp_initiator
    000141: Aug  6 18:42:48.083: ISAKMP: local port 500, remote port 500
    000142: Aug  6 18:42:48.083: ISAKMP: set new node 0 to QM_IDLE
    000143: Aug  6 18:42:48.083: ISAKMP:(0):insert sa successfully sa = 866E1758
    000144: Aug  6 18:42:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000145: Aug  6 18:42:48.083: ISAKMP:(0):No pre-shared key with !
    000146: Aug  6 18:42:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000147: Aug  6 18:42:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000148: Aug  6 18:42:48.083: ISAKMP: Unlocking peer struct 0x86691200 for isadb_unlock_peer_delete_sa(), count 0
    000149: Aug  6 18:42:48.083: ISAKMP: Deleting peer node by peer_reap for : 86691200
    000150: Aug  6 18:42:48.083: ISAKMP:(0):purging SA., sa=866E1758, delme=866E1758
    000151: Aug  6 18:42:48.083: ISAKMP:(0):purging node -309783810
    000152: Aug  6 18:42:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000153: Aug  6 18:42:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000154: Aug  6 18:43:18.083: ISAKMP:(0): SA request profile is (NULL)
    000155: Aug  6 18:43:18.083: ISAKMP: Created a peer struct for , peer port 500
    000156: Aug  6 18:43:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000034
    000157: Aug  6 18:43:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000158: Aug  6 18:43:18.083: ISAKMP: local port 500, remote port 500
    000159: Aug  6 18:43:18.083: ISAKMP: set new node 0 to QM_IDLE
    000160: Aug  6 18:43:18.083: ISAKMP:(0):insert sa successfully sa = 8B4AB780
    000161: Aug  6 18:43:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000162: Aug  6 18:43:18.083: ISAKMP:(0):No pre-shared key with !
    000163: Aug  6 18:43:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000164: Aug  6 18:43:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000165: Aug  6 18:43:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb _unlock_peer_delete_sa(), count 0
    000166: Aug  6 18:43:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000167: Aug  6 18:43:18.083: ISAKMP:(0):purging SA., sa=8B4AB780, delme=8B4AB78 0
    000168: Aug  6 18:43:18.083: ISAKMP:(0):purging node 461611358
    000169: Aug  6 18:43:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000170: Aug  6 18:43:18.083: ISAKMP: Error while processing KMI message 0, erro r 2.
    000171: Aug  6 18:44:48.083: ISAKMP:(0): SA request profile is (NULL)
    000172: Aug  6 18:44:48.083: ISAKMP: Created a peer struct for , peer port 500
    000173: Aug  6 18:44:48.083: ISAKMP: New peer created peer = 0x8B4A25C8 peer_handle = 0x80000035
    000174: Aug  6 18:44:48.083: ISAKMP: Locking peer struct 0x8B4A25C8, refcount 1 for isakmp_initiator
    000175: Aug  6 18:44:48.083: ISAKMP: local port 500, remote port 500
    000176: Aug  6 18:44:48.083: ISAKMP: set new node 0 to QM_IDLE
    000177: Aug  6 18:44:48.083: ISAKMP:(0):insert sa successfully sa = 8B4EC7E8
    000178: Aug  6 18:44:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000179: Aug  6 18:44:48.083: ISAKMP:(0):No pre-shared key with !
    000180: Aug  6 18:44:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000181: Aug  6 18:44:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000182: Aug  6 18:44:48.083: ISAKMP: Unlocking peer struct 0x8B4A25C8 for isadb_unlock_peer_delete_sa(), count 0
    000183: Aug  6 18:44:48.083: ISAKMP: Deleting peer node by peer_reap for : 8B4A25C8
    000184: Aug  6 18:44:48.083: ISAKMP:(0):purging SA., sa=8B4EC7E8, delme=8B4EC7E8
    000185: Aug  6 18:44:48.083: ISAKMP:(0):purging node -1902909277
    000186: Aug  6 18:44:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000187: Aug  6 18:44:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000188: Aug  6 18:45:18.083: ISAKMP:(0): SA request profile is (NULL)
    000189: Aug  6 18:45:18.083: ISAKMP: Created a peer struct for , peer port 500
    000190: Aug  6 18:45:18.083: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000036
    000191: Aug  6 18:45:18.083: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for isakmp_initiator
    000192: Aug  6 18:45:18.083: ISAKMP: local port 500, remote port 500
    000193: Aug  6 18:45:18.083: ISAKMP: set new node 0 to QM_IDLE
    000194: Aug  6 18:45:18.083: ISAKMP:(0):insert sa successfully sa = 86685DFC
    000195: Aug  6 18:45:18.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000196: Aug  6 18:45:18.083: ISAKMP:(0):No pre-shared key with !
    000197: Aug  6 18:45:18.083: ISAKMP:(0): No Cert or pre-shared address key.
    000198: Aug  6 18:45:18.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000199: Aug  6 18:45:18.083: ISAKMP: Unlocking peer struct 0x8668106C for isadb_unlock_peer_delete_sa(), count 0
    000200: Aug  6 18:45:18.083: ISAKMP: Deleting peer node by peer_reap for : 8668106C
    000201: Aug  6 18:45:18.083: ISAKMP:(0):purging SA., sa=86685DFC, delme=86685DFC
    000202: Aug  6 18:45:18.083: ISAKMP:(0):purging node 1093064733
    000203: Aug  6 18:45:18.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000204: Aug  6 18:45:18.083: ISAKMP: Error while processing KMI message 0, error 2.
    000205: Aug  6 18:46:48.083: ISAKMP:(0): SA request profile is (NULL)
    000206: Aug  6 18:46:48.083: ISAKMP: Created a peer struct for , peer port 500
    000207: Aug  6 18:46:48.083: ISAKMP: New peer created peer = 0x86682BE0 peer_handle = 0x80000037
    000208: Aug  6 18:46:48.083: ISAKMP: Locking peer struct 0x86682BE0, refcount 1 for isakmp_initiator
    000209: Aug  6 18:46:48.083: ISAKMP: local port 500, remote port 500
    000210: Aug  6 18:46:48.083: ISAKMP: set new node 0 to QM_IDLE
    000211: Aug  6 18:46:48.083: ISAKMP:(0):insert sa successfully sa = 866E1758
    000212: Aug  6 18:46:48.083: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
    000213: Aug  6 18:46:48.083: ISAKMP:(0):No pre-shared key with !
    000214: Aug  6 18:46:48.083: ISAKMP:(0): No Cert or pre-shared address key.
    000215: Aug  6 18:46:48.083: ISAKMP:(0): construct_initial_message: Can not start Main mode
    000216: Aug  6 18:46:48.083: ISAKMP: Unlocking peer struct 0x86682BE0 for isadb_unlock_peer_delete_sa(), count 0
    000217: Aug  6 18:46:48.083: ISAKMP: Deleting peer node by peer_reap for : 86682BE0
    000218: Aug  6 18:46:48.083: ISAKMP:(0):purging SA., sa=866E1758, delme=866E1758
    000219: Aug  6 18:46:48.083: ISAKMP:(0):purging node -1521272284
    000220: Aug  6 18:46:48.083: ISAKMP: Error while processing SA request: Failed to initialize SA
    000221: Aug  6 18:46:48.083: ISAKMP: Error while processing KMI message 0, error 2.
    000222: Aug  6 18:47:03.131: ISAKMP (0): received packet from 2.50.37.13 dport 500 sport 500 Global (N) NEW SA
    000223: Aug  6 18:47:03.131: ISAKMP: Created a peer struct for 2.50.37.13, peer port 500
    000224: Aug  6 18:47:03.131: ISAKMP: New peer created peer = 0x8668106C peer_handle = 0x80000038
    000225: Aug  6 18:47:03.131: ISAKMP: Locking peer struct 0x8668106C, refcount 1 for crypto_isakmp_process_block
    000226: Aug  6 18:47:03.131: ISAKMP: local port 500, remote port 500
    000227: Aug  6 18:47:03.131: ISAKMP:(0):insert sa successfully sa = 8B4C1924
    000228: Aug  6 18:47:03.131: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000229: Aug  6 18:47:03.131: ISAKMP:(0):Old State = IKE_READY  New State = IKE_R_MM1
    000230: Aug  6 18:47:03.131: ISAKMP:(0): processing SA payload. message ID = 0
    000231: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000232: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    000233: Aug  6 18:47:03.131: ISAKMP (0): vendor ID is NAT-T RFC 3947
    000234: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000235: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    000236: Aug  6 18:47:03.131: ISAKMP (0): vendor ID is NAT-T v7
    000237: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000238: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    000239: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID is NAT-T v3
    000240: Aug  6 18:47:03.131: ISAKMP:(0): processing vendor id payload
    000241: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    000242: Aug  6 18:47:03.131: ISAKMP:(0): vendor ID is NAT-T v2
    000243: Aug  6 18:47:03.131: ISAKMP:(0):found peer pre-shared key matching 2.50.37.13
    000244: Aug  6 18:47:03.131: ISAKMP:(0): local preshared key found
    000245: Aug  6 18:47:03.131: ISAKMP : Scanning profiles for xauth ... sdm-ike-profile-1
    000246: Aug  6 18:47:03.131: ISAKMP:(0): Authentication by xauth preshared
    000247: Aug  6 18:47:03.131: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
    000248: Aug  6 18:47:03.131: ISAKMP:      encryption 3DES-CBC
    000249: Aug  6 18:47:03.131: ISAKMP:      hash SHA
    000250: Aug  6 18:47:03.131: ISAKMP:      default group 2
    000251: Aug  6 18:47:03.131: ISAKMP:      auth pre-share
    000252: Aug  6 18:47:03.131: ISAKMP:      life type in seconds
    000253: Aug  6 18:47:03.131: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    000254: Aug  6 18:47:03.135: ISAKMP:(0):atts are acceptable. Next payload is 0
    000255: Aug  6 18:47:03.135: ISAKMP:(0):Acceptable atts:actual life: 1800
    000256: Aug  6 18:47:03.135: ISAKMP:(0):Acceptable atts:life: 0
    000257: Aug  6 18:47:03.135: ISAKMP:(0):Fill atts in sa vpi_length:4
    000258: Aug  6 18:47:03.135: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    000259: Aug  6 18:47:03.135: ISAKMP:(0):Returning Actual lifetime: 1800
    000260: Aug  6 18:47:03.135: ISAKMP:(0)::Started lifetime timer: 1800.
    000261: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000262: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
    000263: Aug  6 18:47:03.135: ISAKMP (0): vendor ID is NAT-T RFC 3947
    000264: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000265: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
    000266: Aug  6 18:47:03.135: ISAKMP (0): vendor ID is NAT-T v7
    000267: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000268: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
    000269: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID is NAT-T v3
    000270: Aug  6 18:47:03.135: ISAKMP:(0): processing vendor id payload
    000271: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    000272: Aug  6 18:47:03.135: ISAKMP:(0): vendor ID is NAT-T v2
    000273: Aug  6 18:47:03.135: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000274: Aug  6 18:47:03.135: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM1
    000275: Aug  6 18:47:03.135: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    000276: Aug  6 18:47:03.135: ISAKMP:(0): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_SA_SETUP
    000277: Aug  6 18:47:03.135: ISAKMP:(0):Sending an IKE IPv4 Packet.
    000278: Aug  6 18:47:03.135: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000279: Aug  6 18:47:03.135: ISAKMP:(0):Old State = IKE_R_MM1  New State = IKE_R_MM2
    000280: Aug  6 18:47:03.191: ISAKMP (0): received packet from 2.50.37.13 dport 500 sport 500 Global (R) MM_SA_SETUP
    000281: Aug  6 18:47:03.191: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000282: Aug  6 18:47:03.191: ISAKMP:(0):Old State = IKE_R_MM2  New State = IKE_R_MM3
    000283: Aug  6 18:47:03.191: ISAKMP:(0): processing KE payload. message ID = 0
    000284: Aug  6 18:47:03.199: ISAKMP:(0): processing NONCE payload. message ID = 0
    000285: Aug  6 18:47:03.203: ISAKMP:(0):found peer pre-shared key matching 2.50.37.13
    000286: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000287: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID is DPD
    000288: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000289: Aug  6 18:47:03.203: ISAKMP:(2001): speaking to another IOS box!
    000290: Aug  6 18:47:03.203: ISAKMP:(2001): processing vendor id payload
    000291: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID seems Unity/DPD but major 223 mismatch
    000292: Aug  6 18:47:03.203: ISAKMP:(2001): vendor ID is XAUTH
    000293: Aug  6 18:47:03.203: ISAKMP:received payload type 20
    000294: Aug  6 18:47:03.203: ISAKMP (2001): His hash no match - this node outside NAT
    000295: Aug  6 18:47:03.203: ISAKMP:received payload type 20
    000296: Aug  6 18:47:03.203: ISAKMP (2001): No NAT Found for self or peer
    000297: Aug  6 18:47:03.203: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000298: Aug  6 18:47:03.203: ISAKMP:(2001):Old State = IKE_R_MM3  New State = IKE_R_MM3
    000299: Aug  6 18:47:03.203: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000300: Aug  6 18:47:03.203: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000301: Aug  6 18:47:03.203: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000302: Aug  6 18:47:03.203: ISAKMP:(2001):Old State = IKE_R_MM3  New State = IKE_R_MM4
    000303: Aug  6 18:47:03.295: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) MM_KEY_EXCH
    000304: Aug  6 18:47:03.295: ISAKMP:(2001):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    000305: Aug  6 18:47:03.295: ISAKMP:(2001):Old State = IKE_R_MM4  New State = IKE_R_MM5
    000306: Aug  6 18:47:03.295: ISAKMP:(2001): processing ID payload. message ID = 0
    000307: Aug  6 18:47:03.295: ISAKMP (2001): ID payload
            next-payload : 8
            type         : 1
            address      : 2.50.37.13
            protocol     : 17
            port         : 500
            length       : 12
    000308: Aug  6 18:47:03.295: ISAKMP:(0):: peer matches *none* of the profiles
    000309: Aug  6 18:47:03.295: ISAKMP:(2001): processing HASH payload. message ID = 0
    000310: Aug  6 18:47:03.295: ISAKMP:(2001): processing NOTIFY INITIAL_CONTACT protocol 1
            spi 0, message ID = 0, sa = 0x8B4C1924
    000311: Aug  6 18:47:03.295: ISAKMP:(2001):SA authentication status:
            authenticated
    000312: Aug  6 18:47:03.295: ISAKMP:(2001):SA has been authenticated with 2.50.37.13
    000313: Aug  6 18:47:03.295: ISAKMP:(2001):SA authentication status:
            authenticated
    000314: Aug  6 18:47:03.295: ISAKMP:(2001): Process initial contact,
    bring down existing phase 1 and 2 SA's with local 92.98.211.242 remote 2.50.37.13 remote port 500
    000315: Aug  6 18:47:03.295: ISAKMP: Trying to insert a peer 92.98.211.242/2.50.37.13/500/,  and inserted successfully 8668106C.
    000316: Aug  6 18:47:03.295: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    000317: Aug  6 18:47:03.295: ISAKMP:(2001):Old State = IKE_R_MM5  New State = IKE_R_MM5
    000318: Aug  6 18:47:03.295: ISAKMP:(2001):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
    000319: Aug  6 18:47:03.295: ISAKMP (2001): ID payload
            next-payload : 8
            type         : 1
            address      : 92.98.211.242
            protocol     : 17
            port         : 500
            length       : 12
    000320: Aug  6 18:47:03.295: ISAKMP:(2001):Total payload length: 12
    000321: Aug  6 18:47:03.295: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000322: Aug  6 18:47:03.295: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000323: Aug  6 18:47:03.295: ISAKMP:(2001):Returning Actual lifetime: 1800
    000324: Aug  6 18:47:03.299: ISAKMP: set new node -1235582904 to QM_IDLE
    000325: Aug  6 18:47:03.299: ISAKMP:(2001):Sending NOTIFY RESPONDER_LIFETIME protocol 1
            spi 2291695856, message ID = 3059384392
    000326: Aug  6 18:47:03.299: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) MM_KEY_EXCH
    000327: Aug  6 18:47:03.299: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000328: Aug  6 18:47:03.299: ISAKMP:(2001):purging node -1235582904
    000329: Aug  6 18:47:03.299: ISAKMP: Sending phase 1 responder lifetime 1800
    000330: Aug  6 18:47:03.299: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    000331: Aug  6 18:47:03.299: ISAKMP:(2001):Old State = IKE_R_MM5  New State = IKE_P1_COMPLETE
    000332: Aug  6 18:47:03.299: ISAKMP:(2001):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    000333: Aug  6 18:47:03.299: ISAKMP:(2001):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    000334: Aug  6 18:47:03.307: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) QM_IDLE
    000335: Aug  6 18:47:03.307: ISAKMP: set new node -687536412 to QM_IDLE
    000336: Aug  6 18:47:03.307: ISAKMP:(2001): processing HASH payload. message ID = 3607430884
    000337: Aug  6 18:47:03.307: ISAKMP:(2001): processing SA payload. message ID = 3607430884
    000338: Aug  6 18:47:03.307: ISAKMP:(2001):Checking IPSec proposal 1
    000339: Aug  6 18:47:03.307: ISAKMP: transform 1, ESP_3DES
    000340: Aug  6 18:47:03.307: ISAKMP:   attributes in transform:
    000341: Aug  6 18:47:03.307: ISAKMP:      encaps is 1 (Tunnel)
    000342: Aug  6 18:47:03.307: ISAKMP:      SA life type in seconds
    000343: Aug  6 18:47:03.307: ISAKMP:      SA life duration (basic) of 3600
    000344: Aug  6 18:47:03.307: ISAKMP:      SA life type in kilobytes
    000345: Aug  6 18:47:03.307: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    000346: Aug  6 18:47:03.307: ISAKMP:      authenticator is HMAC-SHA
    000347: Aug  6 18:47:03.307: ISAKMP:(2001):atts are acceptable.
    000348: Aug  6 18:47:03.307: ISAKMP:(2001): processing NONCE payload. message ID = 3607430884
    000349: Aug  6 18:47:03.311: ISAKMP:(2001): processing ID payload. message ID = 3607430884
    000350: Aug  6 18:47:03.311: ISAKMP:(2001): processing ID payload. message ID = 3607430884
    000351: Aug  6 18:47:03.311: ISAKMP:(2001):QM Responder gets spi
    000352: Aug  6 18:47:03.311: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    000353: Aug  6 18:47:03.311: ISAKMP:(2001):Old State = IKE_QM_READY  New State = IKE_QM_SPI_STARVE
    000354: Aug  6 18:47:03.311: ISAKMP:(2001): Creating IPSec SAs
    000355: Aug  6 18:47:03.311:         inbound SA from 2.50.37.13 to 92.98.211.242 (f/i)  0/ 0
            (proxy 192.168.10.0 to 192.168.50.0)
    000356: Aug  6 18:47:03.311:         has spi 0x4C5A127C and conn_id 0
    000357: Aug  6 18:47:03.311:         lifetime of 3600 seconds
    000358: Aug  6 18:47:03.311:         lifetime of 4608000 kilobytes
    000359: Aug  6 18:47:03.311:         outbound SA from 92.98.211.242 to 2.50.37.13 (f/i) 0/0
            (proxy 192.168.50.0 to 192.168.10.0)
    000360: Aug  6 18:47:03.311:         has spi  0x1E83EC91 and conn_id 0
    000361: Aug  6 18:47:03.311:         lifetime of 3600 seconds
    000362: Aug  6 18:47:03.311:         lifetime of 4608000 kilobytes
    000363: Aug  6 18:47:03.311: ISAKMP:(2001): sending packet to 2.50.37.13 my_port 500 peer_port 500 (R) QM_IDLE
    000364: Aug  6 18:47:03.311: ISAKMP:(2001):Sending an IKE IPv4 Packet.
    000365: Aug  6 18:47:03.311: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI
    000366: Aug  6 18:47:03.311: ISAKMP:(2001):Old State = IKE_QM_SPI_STARVE  New State = IKE_QM_R_QM2
    000367: Aug  6 18:47:03.323: ISAKMP (2001): received packet from 2.50.37.13 dport 500 sport 500 Global (R) QM_IDLE
    000368: Aug  6 18:47:03.323: ISAKMP:(2001):deleting node -687536412 error FALSE reason "QM done (await)"
    000369: Aug  6 18:47:03.323: ISAKMP:(2001):Node 3607430884, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    000370: Aug  6 18:47:03.323: ISAKMP:(2001):Old State = IKE_QM_R_QM2  New State = IKE_QM_PHASE2_COMPLETE
    000371: Aug  6 18:47:53.323: ISAKMP:(2001):purging node -687536412
    ROUTER-A# sho crypto isa sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    92.98.211.242   2.50.37.13      QM_IDLE           2001 ACTIVE
    RUNNING CONFIGURATION OF ROUTER-A
    Building configuration...
    Current configuration : 29089 bytes
    ! Last configuration change at 21:31:11 PST Tue Aug 7 2012 by administrator
    version 15.1
    parser config cache interface
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    service password-encryption
    service internal
    service compress-config
    service sequence-numbers
    hostname xxxxxxxxxxXX
    boot-start-marker
    boot-end-marker
    enable secret 4 LcV6aBcc/53FoCJjXQMd7rBUDEpeevrK8V5jQVoJEhU
    aaa new-model
    aaa authentication login default local
    aaa authentication login Foxtrot_sdm_easyvpn_xauth_ml_1 local
    aaa authorization network Foxtrot_sdm_easyvpn_group_ml_1 local
    aaa session-id common
    clock timezone ZP4 4 0
    clock summer-time PST recurring
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-4070447007
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4070447007
    revocation-check none
    rsakeypair TP-self-signed-4070447007
    crypto pki certificate chain TP-self-signed-4070447007
    certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 34303730 34343730 3037301E 170D3132 30373331 30353139
      30375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 30373034
      34373030 3730819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100BBA6 F2C9A163 B7EAB25D 6C538A5B 29832F58 6B95D2C0 1FBE0E72 BD4E9585
      6230CAD1 8DA4E337 5A11332C 36EAFF86 02D8C977 6CD2AA50 D76FB97F 52AE73AD
      E777194B 011C95EB E2A588B4 3A7D618E F1D03E3F EF1A60FB 26372B63 9395002D
      38126CC5 EA79E23C 40E0F331 76E7731E D03E2CE8 F1A0B5E9 B83AA780 D566A679
      599F0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 14C8BC47 90602FB0 18A8821A 85A3444F 874E2292 27301D06
      03551D0E 04160414 C8BC4790 602FB018 A8821A85 A3444F87 4E229227 300D0609
      2A864886 F70D0101 05050003 8181001B D0EA74FE 7EDD03FE 68733D87 6434D20B
      80481807 DD4A488E FFEFA631 245F396F 5CADF523 1438A70B CA113994 9798483D
      F59221EA 09EDB8FC 6D1DBBAE FE7FE4B9 E79F064F E930F347 B1CAD19B 01F5989A
      8BCFDB1D 906163A4 C467E809 E988B610 FE613177 A815DFB0 97839F92 4A682E8F
      43F08787 E08CBE70 E98DEBE7 BCD8B8
                quit
    dot11 syslog
    ip source-route
    ip cef
    ip dhcp relay information trust-all
    ip dhcp excluded-address 10.1.1.1 10.1.1.9
    ip dhcp excluded-address 10.1.1.241 10.1.1.255
    ip dhcp excluded-address 192.168.50.1 192.168.50.9
    ip dhcp excluded-address 192.168.50.241 192.168.50.255
    ip dhcp pool phone
    network 10.1.1.0 255.255.255.0
    default-router 10.1.1.1
    option 150 ip 10.1.1.1
    ip dhcp pool data
    import all
    network 192.168.50.0 255.255.255.0
    default-router 192.168.50.1
    ip inspect WAAS flush-timeout 10
    ip inspect name SDM_LOW dns
    ip inspect name SDM_LOW ftp
    ip inspect name SDM_LOW h323
    ip inspect name SDM_LOW https
    ip inspect name SDM_LOW icmp
    ip inspect name SDM_LOW imap
    ip inspect name SDM_LOW pop3
    ip inspect name SDM_LOW netshow
    ip inspect name SDM_LOW rcmd
    ip inspect name SDM_LOW realaudio
    ip inspect name SDM_LOW rtsp
    ip inspect name SDM_LOW esmtp
    ip inspect name SDM_LOW sqlnet
    ip inspect name SDM_LOW streamworks
    ip inspect name SDM_LOW tftp
    ip inspect name SDM_LOW tcp router-traffic
    ip inspect name SDM_LOW udp router-traffic
    ip inspect name SDM_LOW vdolive
    ip ddns update method sdm_ddns1
    HTTP
      add http://xxxxxxxs:[email protected]/nic/update?system=dyndns&[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
      remove http://xxxxxxx:[email protected]/nic/update?system=dyndns&[email protected]/nic/update?system=dyndns&hostname=<h>&myip=<a>
    interval maximum 2 0 0 0
    interval minimum 1 0 0 0
    no ipv6 cef
    multilink bundle-name authenticated
    stcapp ccm-group 1
    stcapp
    trunk group ALL_FXO
    max-retry 5
    voice-class cause-code 1
    hunt-scheme longest-idle
    voice call send-alert
    voice rtp send-recv
    voice service voip
    allow-connections h323 to h323
    allow-connections h323 to sip
    allow-connections sip to h323
    allow-connections sip to sip
    no supplementary-service h450.2
    no supplementary-service h450.3
    supplementary-service h450.12
    sip
      no update-callerid
    voice class codec 1
    codec preference 1 g711ulaw
    codec preference 2 g729r8
    voice class h323 1
      call start slow
    voice class cause-code 1
    no-circuit
    voice register global
    mode cme
    source-address 10.1.1.1 port 5060
    load 9971 sip9971.9-2-2
    load 9951 sip9951.9-2-2
    load 8961 sip8961.9-2-2
    voice translation-rule 1000
    rule 1 /.*/ //
    voice translation-rule 1112
    rule 1 /^9/ //
    voice translation-rule 1113
    rule 1 /^82\(...\)/ /\1/
    voice translation-rule 1114
    rule 1 /\(^...$\)/ /82\1/
    voice translation-rule 2002
    rule 1 /^6/ //
    voice translation-rule 2222
    rule 1 /^91900......./ //
    rule 2 /^91976......./ //
    voice translation-profile CALLER_ID_TRANSLATION_PROFILE
    translate calling 1111
    voice translation-profile CallBlocking
    translate called 2222
    voice translation-profile OUTGOING_TRANSLATION_PROFILE
    translate called 1112
    voice translation-profile XFER_TO_VM_PROFILE
    translate redirect-called 2002
    voice translation-profile multisiteInbound
    translate called 1113
    voice translation-profile multisiteOutbound
    translate calling 1114
    voice translation-profile nondialable
    translate called 1000
    voice-card 0
    dspfarm
    dsp services dspfarm
    fax interface-type fax-mail
    license udi pid UC560-FXO-K9 sn FHK1445F43M
    archive
    log config
      logging enable
      logging size 600
      hidekeys
    username administrator privilege 15 secret 4 LcV6aBcc/53FoCJjXQMd7rBUDEpeevrK8V5jQVoJEhU
    username pingerID password 7 06505D771B185F
    ip tftp source-interface Vlan90
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    lifetime 1800
    crypto isakmp key xxxxxxx address 0.0.0.0 0.0.0.0
    crypto isakmp client configuration group EZVPN_GROUP_1
    key xxxxxxx
    dns 213.42.20.20
    pool SDM_POOL_1
    save-password
    max-users 20
    crypto isakmp profile sdm-ike-profile-1
       match identity group EZVPN_GROUP_1
       client authentication list Foxtrot_sdm_easyvpn_xauth_ml_1
       isakmp authorization list Foxtrot_sdm_easyvpn_group_ml_1
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile SDM_Profile1
    set transform-set ESP-3DES-SHA
    set isakmp-profile sdm-ike-profile-1
    crypto map multisite 1 ipsec-isakmp
    description XXXXXXX
    set peer xxxxxxxxxx.dyndns.biz dynamic
    set transform-set ESP-3DES-SHA
    match address 105
    qos pre-classify
    interface GigabitEthernet0/0
    description $ETH-WAN$
    no ip address
    ip virtual-reassembly in
    load-interval 30
    duplex auto
    speed auto
    pppoe enable group global
    pppoe-client dial-pool-number 1
    interface Integrated-Service-Engine0/0
    description Interface used to manage integrated application modulecue is initialized with default IMAP group
    ip unnumbered Vlan90
    ip nat inside
    ip virtual-reassembly in
    service-module ip address 10.1.10.1 255.255.255.252
    service-module ip default-gateway 10.1.10.2
    interface GigabitEthernet0/1/0
    switchport mode trunk
    switchport voice vlan 100
    no ip address
    macro description cisco-switch
    interface GigabitEthernet0/1/1
    switchport voice vlan 100
    no ip address
    macro description cisco-phone
    spanning-tree portfast
    interface GigabitEthernet0/1/2
    no ip address
    macro description cisco-desktop
    spanning-tree portfast
    interface GigabitEthernet0/1/3
    description Interface used to communicate with integrated service module
    switchport access vlan 90
    no ip address
    service-module ip address 10.1.10.1 255.255.255.252
    service-module ip default-gateway 10.1.10.2
    interface Virtual-Template1 type tunnel
    ip unnumbered Vlan1
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile SDM_Profile1
    interface Vlan1
    description $FW_INSIDE$
    ip address 192.168.50.1 255.255.255.0
    ip access-group 101 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    h323-gateway voip bind srcaddr 192.168.50.1
    interface Vlan90
    description $FW_INSIDE$
    ip address 10.1.10.2 255.255.255.252
    ip access-group 103 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    interface Vlan100
    description $FW_INSIDE$
    ip address 10.1.1.1 255.255.255.0
    ip access-group 102 in
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1412
    interface Dialer0
    description $FW_OUTSIDE$
    mtu 1492
    ip ddns update hostname xxxxxxxxxx.dyndns.biz
    ip ddns update sdm_ddns1
    ip address negotiated
    ip access-group 104 in
    ip mtu 1452
    ip nat outside
    ip inspect SDM_LOW out
    ip virtual-reassembly in
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname CCCCCC
    ppp chap password 7 071739545611015445
    ppp pap sent-username CCCCC password 7 122356324SDFDBDB
    ppp ipcp dns request
    ppp ipcp route default
    crypto map multisite
    ip local pool SDM_POOL_1 192.168.50.150 192.168.50.160
    ip forward-protocol nd
    ip http server
    ip http authentication local
    ip http secure-server
    ip http path flash:/gui
    ip dns server
    ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip route 10.1.10.1 255.255.255.255 Vlan90
    access-list 100 remark auto generated by SDM firewall configuration
    access-list 100 remark SDM_ACL Category=1
    access-list 100 permit ip 192.168.10.0 0.0.0.255 any
    access-list 100 permit ip host 255.255.255.255 any
    access-list 100 permit ip 127.0.0.0 0.255.255.255 any
    access-list 100 permit ip any any
    access-list 101 remark auto generated by SDM firewall configuration##NO_ACES_5##
    access-list 101 remark SDM_ACL Category=1
    access-list 101 permit udp any host 192.168.50.1 eq non500-isakmp
    access-list 101 permit udp any host 192.168.50.1 eq isakmp
    access-list 101 permit esp any host 192.168.50.1
    access-list 101 permit ahp any host 192.168.50.1
    access-list 101 permit ip 192.168.10.0 0.0.0.255 any
    access-list 101 permit ip any any
    access-list 101 permit ip 10.1.10.0 0.0.0.3 any
    access-list 101 permit ip 10.1.1.0 0.0.0.255 any
    access-list 101 permit ip host 255.255.255.255 any
    access-list 101 permit ip 127.0.0.0 0.255.255.255 any
    access-list 102 remark auto generated by SDM firewall configuration##NO_ACES_7##
    access-list 102 remark SDM_ACL Category=1
    access-list 102 permit udp any host 10.1.1.1 eq non500-isakmp
    access-list 102 permit udp any host 10.1.1.1 eq isakmp
    access-list 102 permit esp any host 10.1.1.1
    access-list 102 permit ahp any host 10.1.1.1
    access-list 102 permit ip any any
    access-list 102 permit tcp 10.1.10.0 0.0.0.3 any eq 2000
    access-list 102 permit udp 10.1.10.0 0.0.0.3 any eq 2000
    access-list 102 permit ip 192.168.50.0 0.0.0.255 any
    access-list 102 permit ip 10.1.10.0 0.0.0.3 any
    access-list 102 permit ip host 255.255.255.255 any
    access-list 102 permit ip 127.0.0.0 0.255.255.255 any
    access-list 103 remark auto generated by SDM firewall configuration##NO_ACES_7##
    access-list 103 remark SDM_ACL Category=1
    access-list 103 permit udp any host 10.1.10.2 eq non500-isakmp
    access-list 103 permit udp any host 10.1.10.2 eq isakmp
    access-list 103 permit esp any host 10.1.10.2
    access-list 103 permit ahp any host 10.1.10.2
    access-list 103 permit tcp 10.1.1.0 0.0.0.255 eq 2000 any
    access-list 103 permit udp 10.1.1.0 0.0.0.255 eq 2000 any
    access-list 103 permit ip 192.168.50.0 0.0.0.255 any
    access-list 103 permit ip 10.1.1.0 0.0.0.255 any
    access-list 103 permit ip host 255.255.255.255 any
    access-list 103 permit ip 127.0.0.0 0.255.255.255 any
    access-list 103 permit ip any any
    access-list 104 remark auto generated by SDM firewall configuration##NO_ACES_13##
    access-list 104 remark SDM_ACL Category=1
    access-list 104 permit ip 192.168.10.0 0.0.0.255 192.168.50.0 0.0.0.255
    access-list 104 permit udp any any eq non500-isakmp
    access-list 104 permit udp any any eq isakmp
    access-list 104 permit esp any any
    access-list 104 permit ahp any any
    access-list 104 permit ip any any
    access-list 104 permit ip 192.168.50.0 0.0.0.255 any
    access-list 104 permit ip 10.1.10.0 0.0.0.3 any
    access-list 104 permit ip 10.1.1.0 0.0.0.255 any
    access-list 104 permit icmp any any echo-reply
    access-list 104 permit icmp any any time-exceeded
    access-list 104 permit icmp any any unreachable
    access-list 104 permit ip 10.0.0.0 0.255.255.255 any
    access-list 104 permit ip 172.16.0.0 0.15.255.255 any
    access-list 104 permit ip 192.168.0.0 0.0.255.255 any
    access-list 104 permit ip 127.0.0.0 0.255.255.255 any
    access-list 104 permit ip host 255.255.255.255 any
    access-list 104 permit ip host 0.0.0.0 any
    access-list 105 remark CryptoACL for xxxxxxxxxx
    access-list 105 remark SDM_ACL Category=4
    access-list 105 permit ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 106 remark SDM_ACL Category=2
    access-list 106 deny   ip 192.168.50.0 0.0.0.255 192.168.10.0 0.0.0.255
    access-list 106 permit ip 10.1.10.0 0.0.0.3 any
    access-list 106 permit ip 192.168.50.0 0.0.0.255 any
    access-list 106 permit ip 10.1.1.0 0.0.0.255 any
    dialer-list 1 protocol ip permit
    route-map SDM_RMAP_1 permit 1
    match ip address 106
    snmp-server community public RO
    tftp-server flash:/phones/521_524/cp524g-8-1-17.bin alias cp524g-8-1-17.bin
    tftp-server flash:/ringtones/Analog1.raw alias Analog1.raw
    tftp-server flash:/ringtones/Analog2.raw alias Analog2.raw
    tftp-server flash:/ringtones/AreYouThere.raw alias AreYouThere.raw
    tftp-server flash:/ringtones/DistinctiveRingList.xml alias DistinctiveRingList.xml
    tftp-server flash:/ringtones/RingList.xml alias RingList.xml
    tftp-server flash:/ringtones/AreYouThereF.raw alias AreYouThereF.raw
    tftp-server flash:/ringtones/Bass.raw alias Bass.raw
    tftp-server flash:/ringtones/CallBack.raw alias CallBack.raw
    tftp-server flash:/ringtones/Chime.raw alias Chime.raw
    tftp-server flash:/ringtones/Classic1.raw alias Classic1.raw
    tftp-server flash:/ringtones/Classic2.raw alias Classic2.raw
    tftp-server flash:/ringtones/ClockShop.raw alias ClockShop.raw
    tftp-server flash:/ringtones/Drums1.raw alias Drums1.raw
    tftp-server flash:/ringtones/Drums2.raw alias Drums2.raw
    tftp-server flash:/ringtones/FilmScore.raw alias FilmScore.raw
    tftp-server flash:/ringtones/HarpSynth.raw alias HarpSynth.raw
    tftp-server flash:/ringtones/Jamaica.raw alias Jamaica.raw
    tftp-server flash:/ringtones/KotoEffect.raw alias KotoEffect.raw
    tftp-server flash:/ringtones/MusicBox.raw alias MusicBox.raw
    tftp-server flash:/ringtones/Piano1.raw alias Piano1.raw
    tftp-server flash:/ringtones/Piano2.raw alias Piano2.raw
    tftp-server flash:/ringtones/Pop.raw alias Pop.raw
    tftp-server flash:/ringtones/Pulse1.raw alias Pulse1.raw
    tftp-server flash:/ringtones/Ring1.raw alias Ring1.raw
    tftp-server flash:/ringtones/Ring2.raw alias Ring2.raw
    tftp-server flash:/ringtones/Ring3.raw alias Ring3.raw
    tftp-server flash:/ringtones/Ring4.raw alias Ring4.raw
    tftp-server flash:/ringtones/Ring5.raw alias Ring5.raw
    tftp-server flash:/ringtones/Ring6.raw alias Ring6.raw
    tftp-server flash:/ringtones/Ring7.raw alias Ring7.raw
    tftp-server flash:/ringtones/Sax1.raw alias Sax1.raw
    tftp-server flash:/ringtones/Sax2.raw alias Sax2.raw
    tftp-server flash:/ringtones/Vibe.raw alias Vibe.raw
    tftp-server flash:/Desktops/CampusNight.png
    tftp-server flash:/Desktops/TN-CampusNight.png
    tftp-server flash:/Desktops/CiscoFountain.png
    tftp-server flash:/Desktops/TN-CiscoFountain.png
    tftp-server flash:/Desktops/CiscoLogo.png
    tftp-server flash:/Desktops/TN-CiscoLogo.png
    tftp-server flash:/Desktops/Fountain.png
    tftp-server flash:/Desktops/TN-Fountain.png
    tftp-server flash:/Desktops/MorroRock.png
    tftp-server flash:/Desktops/TN-MorroRock.png
    tftp-server flash:/Desktops/NantucketFlowers.png
    tftp-server flash:/Desktops/TN-NantucketFlowers.png
    tftp-server flash:Desktops/320x212x16/List.xml
    tftp-server flash:Desktops/320x212x12/List.xml
    tftp-server flash:Desktops/320x216x16/List.xml
    tftp-server flash:/bacdprompts/en_bacd_allagentsbusy.au alias en_bacd_allagentsbusy.au
    tftp-server flash:/bacdprompts/en_bacd_disconnect.au alias en_bacd_disconnect.au
    tftp-server flash:/bacdprompts/en_bacd_enter_dest.au alias en_bacd_enter_dest.au
    tftp-server flash:/bacdprompts/en_bacd_invalidoption.au alias en_bacd_invalidoption.au
    tftp-server flash:/bacdprompts/en_bacd_music_on_hold.au alias en_bacd_music_on_hold.au
    tftp-server flash:/bacdprompts/en_bacd_options_menu.au alias en_bacd_options_menu.au
    tftp-server flash:/bacdprompts/en_bacd_welcome.au alias en_bacd_welcome.au
    tftp-server flash:/bacdprompts/en_bacd_xferto_operator.au alias en_bacd_xferto_operator.au
    radius-server attribute 31 send nas-port-detail
    control-plane
    voice-port 0/0/0
    station-id number 401
    caller-id enable
    voice-port 0/0/1
    station-id number 402
    caller-id enable
    voice-port 0/0/2
    station-id number 403
    caller-id enable
    voice-port 0/0/3
    station-id number 404
    caller-id enable
    voice-port 0/1/0
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/0-OP
    caller-id enable
    voice-port 0/1/1
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/1-OP
    caller-id enable
    voice-port 0/1/2
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/2-OP
    caller-id enable
    voice-port 0/1/3
    trunk-group ALL_FXO 64
    connection plar opx 201
    description Configured by CCA 4 FXO-0/1/3-OP
    caller-id enable
    voice-port 0/4/0
    auto-cut-through
    signal immediate
    input gain auto-control -15
    description Music On Hold Port
    sccp local Vlan90
    sccp ccm 10.1.1.1 identifier 1 version 4.0
    sccp
    sccp ccm group 1
    associate ccm 1 priority 1
    associate profile 2 register mtpd0d0fd057a40
    dspfarm profile 2 transcode 
    description CCA transcoding for SIP Trunk Multisite Only
    codec g729abr8
    codec g729ar8
    codec g711alaw
    codec g711ulaw
    maximum sessions 10
    associate application SCCP
    dial-peer cor custom
    name internal
    name local
    name local-plus
    name international
    name national
    name national-plus
    name emergency
    name toll-free
    dial-peer cor list call-internal
    member internal
    dial-peer cor list call-local
    member local
    dial-peer cor list call-local-plus
    member local-plus
    dial-peer cor list call-national
    member national
    dial-peer cor list call-national-plus
    member national-plus
    dial-peer cor list call-international
    member international
    dial-peer cor list call-emergency
    member emergency
    dial-peer cor list call-toll-free
    member toll-free
    dial-peer cor list user-internal
    member internal
    member emergency
    dial-peer cor list user-local
    member internal
    member local
    member emergency
    member toll-free
    dial-peer cor list user-local-plus
    member internal
    member local
    member local-plus
    member emergency
    member toll-free
    dial-peer cor list user-national
    member internal
    member local
    member local-plus
    member national
    member emergency
    member toll-free
    dial-peer cor list user-national-plus
    member internal
    member local
    member local-plus
    member national
    member national-plus
    member emergency
    member toll-free
    dial-peer cor list user-international
    member internal
    member local
    member local-plus
    member international
    member national
    member national-plus
    member emergency
    member toll-free
    dial-peer voice 1 pots
    destination-pattern 401
    port 0/0/0
    no sip-register
    dial-peer voice 2 pots
    destination-pattern 402
    port 0/0/1
    no sip-register
    dial-peer voice 3 pots
    destination-pattern 403
    port 0/0/2
    no sip-register
    dial-peer voice 4 pots
    destination-pattern 404
    port 0/0/3
    no sip-register
    dial-peer voice 5 pots
    description ** MOH Port **
    destination-pattern ABC
    port 0/4/0
    no sip-register
    dial-peer voice 6 pots
    description ôcatch all dial peer for BRI/PRIö
    translation-profile incoming nondialable
    incoming called-number .%
    direct-inward-dial
    dial-peer voice 50 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/0
    dial-peer voice 51 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/1
    dial-peer voice 52 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/2
    dial-peer voice 53 pots
    description ** incoming dial peer **
    incoming called-number .%
    port 0/1/3
    dial-peer voice 54 pots
    description ** FXO pots dial-peer **
    destination-pattern A0
    port 0/1/0
    no sip-register
    dial-peer voice 55 pots
    description ** FXO pots dial-peer **
    destination-pattern A1
    port 0/1/1
    no sip-register
    dial-peer voice 56 pots
    description ** FXO pots dial-peer **
    destination-pattern A2
    port 0/1/2
    no sip-register
    dial-peer voice 57 pots
    description ** FXO pots dial-peer **
    destination-pattern A3
    port 0/1/3
    no sip-register
    dial-peer voice 2000 voip
    description ** cue voicemail pilot number **
    translation-profile outgoing XFER_TO_VM_PROFILE
    destination-pattern 399
    b2bua
    session protocol sipv2
    session target ipv4:10.1.10.1
    voice-class sip outbound-proxy ipv4:10.1.10.1 
    dtmf-relay rtp-nte
    codec g711ulaw
    no vad
    dial-peer voice 58 pots
    trunkgroup ALL_FXO
    corlist outgoing call-emergency
    description **CCA*North American-7-Digit*Emergency**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9911
    forward-digits all
    no sip-register
    dial-peer voice 59 pots
    trunkgroup ALL_FXO
    corlist outgoing call-emergency
    description **CCA*North American-7-Digit*Emergency**
    preference 5
    destination-pattern 911
    forward-digits all
    no sip-register
    dial-peer voice 60 pots
    trunkgroup ALL_FXO
    corlist outgoing call-local
    description **CCA*North American-7-Digit*7-Digit Local**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9[2-9]......
    forward-digits all
    no sip-register
    dial-peer voice 61 pots
    trunkgroup ALL_FXO
    corlist outgoing call-local
    description **CCA*North American-7-Digit*Service Numbers**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9[2-9]11
    forward-digits all
    no sip-register
    dial-peer voice 62 pots
    trunkgroup ALL_FXO
    corlist outgoing call-national
    description **CCA*North American-7-Digit*Long Distance**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91[2-9]..[2-9]......
    forward-digits all
    no sip-register
    dial-peer voice 63 pots
    trunkgroup ALL_FXO
    corlist outgoing call-international
    description **CCA*North American-7-Digit*International**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 9011T
    forward-digits all
    no sip-register
    dial-peer voice 64 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91800.......
    forward-digits all
    no sip-register
    dial-peer voice 65 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91888.......
    forward-digits all
    no sip-register
    dial-peer voice 66 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91877.......
    forward-digits all
    no sip-register
    dial-peer voice 67 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91866.......
    forward-digits all
    no sip-register
    dial-peer voice 68 pots
    trunkgroup ALL_FXO
    corlist outgoing call-toll-free
    description **CCA*North American-7-Digit*Toll-Free**
    translation-profile outgoing OUTGOING_TRANSLATION_PROFILE
    preference 5
    destination-pattern 91855.......
    forward-digits all
    no sip-register
    dial-peer voice 2100 voip
    corlist incoming call-internal
    description **CCA*INTERSITE inbound call to xxxxxxxxxx
    translation-profile incoming multisiteInbound
    incoming called-number 82...
    voice-class h323 1
    dtmf-relay h245-alphanumeric
    fax protocol cisco
    no vad
    dial-peer voice 2101 voip
    corlist incoming call-internal
    description **CCA*INTERSITE outbound calls to xxxxxxxxxx
    translation-profile outgoing multisiteOutbound
    destination-pattern 81...
    session target ipv4:192.168.10.1
    voice-class h323 1
    dtmf-relay h245-alphanumeric
    fax protocol cisco
    no vad
    no dial-peer outbound status-check pots
    telephony-service
    sdspfarm units 5
    sdspfarm transcode sessions 10
    sdspfarm tag 2 mtpd0d0fd057a40
    video
    fxo hook-flash
    max-ephones 138
    max-dn 600
    ip source-address 10.1.1.1 port 2000
    auto assign 1 to 1 type bri
    calling-number initiator
    service phone videoCapability 1
    service phone ehookenable 1
    service dnis overlay
    service dnis dir-lookup
    service dss
    timeouts interdigit 5
    system message Cisco Small Business
    url services http://10.1.10.1/voiceview/common/login.do
    url authentication http://10.1.10.1/voiceview/authentication/authenticate

    On 12/01/12 12:06, JebediahShapnacker wrote:
    >
    > Hello.
    >
    > I would like to setup a site to site VPN between 2 of our site. We have
    > Bordermanager .7 on one end and IPCop on the other.
    i'm not familiar with Bordermanager version but be sure you're using 3.9
    with sp2 and sp2_it1 applied.
    There are not specific documents that i'm aware that explains conf
    between ipcop and bm but if ipcop behaves as standard ipsec device, you
    can use as a guideline some of the docs that explains how to configure
    bm with third party firewalls.
    - AppNote: CISCO IOS 12.2(11) T with NBM 3.8 Server
    Novell Cool Solutions: AppNote
    By Upendra Gopu
    - BorderManager and Novell Security Manager Site-to-Site VPN
    Novell Cool Solutions: Feature
    By Jenn Bitondo
    - Setting Up an IPSec VPN Tunnel between Nortel and an NBM 3.8.4 Server
    Author Info
    8 November 2006 - 7:37pm
    Submitted by: kchendil
    - AppNote: NBM to Openswan: Site-to-site VPN Made Easy
    Novell Cool Solutions: AppNote
    By Gaurav Vaidya
    - AppNote: Interoperability of Cisco PIX 500 and NBM 3.8 VPN
    Novell Cool Solutions: AppNote
    By Sreekanth Settipalli
    Digg This - Slashdot This
    Posted: 28 Oct 2004
    etc

  • Setting up site to site vpn with cisco asa 5505

    I have a cisco asa 5505 that needs to be set up for site to site vpn to a cisco asa 5500. The 5505 is the remote office and the 5500 is the main office.
    IP of remote office router is 71.37.178.142
    IP of the main office firewall is 209.117.141.82
    Can someone tell me if my config is correct, this is the first time I am setting this up and it can not be tested until I set it up at the remote office. I would rather know its correct before I go.
    ciscoasa# show run
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password TMACBloMlcBsq1kp encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip host 71.37.178.142 host 209.117.141.82
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group5
    crypto map outside_map 1 set peer 209.117.141.82
    crypto map outside_map 1 set transform-set ESP-AES-256-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn username [email protected] password ********* store-local
    dhcpd auto_config outside
    dhcpd address 192.168.1.2-192.168.1.129 inside
    dhcpd enable inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:7e338fb2bf32a9ceb89560b314a5ef6c
    : end
    ciscoasa#
    Thanks!

    Hi Mandy,
    By using following access list define Peer IP as source and destination
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    you are not defining the interesting traffic / subnets from both ends.
    Make some number ACL 101 as you do not have to write the extended keyword then if you like as follows, or else NAME aCL will also work:
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=4 access-list 101 remark IPSEC Rule
    !.1..source subnet(called local encryption domain) at your end  192.168.200.0
    !..2.and destination subnet(called remote encryption domain)at other end 192.168.100.0 !.3..I mean you have to define what subnets you need to communicate between which are behind these firewalls
    !..4...Local Subnets behind IP of the main office firewall is 209.117.141.82 say
    !...at your end  192.168.200.0
    !..5.Remote Subnets behind IP of remote office router is 71.37.178.142 say
    !...at other end 192.168.100.0
    Please use Baisc Steps as follows:
    A. Configuration in your MAIN office  having IP = 209.117.141.82  (follow step 1 to 6)
    Step 1.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    Step 2.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 3.
    Define Preshared key or PKI which you will use with other side Peer address 71.37.178.142, either key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 2 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 71.37.178.142
    or , but not both
    crypto isakmp key 6 CISCO123 address71.37.178.142
    step 4.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 5.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 6.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Configure the same but just change ACL on other end in step one  by reversing source and destination
    and also set the peer IP of this router in other end.
    So other side config should look as follows:
    B.  Configuration in oyur Remote PEER IP having IP = 71.37.178.142 (follow step 7 to 12)
    Step 7.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
    Step 8.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 9.
    Define Preshared key or PKI which you will use with other side Peer address key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 8 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 209.117.141.82
    or , but not both
    crypto isakmp key 6 CISCO123 address 209.117.141.82
    step 10.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 11.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map    ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set, only one is permissible
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 12.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Now initite a ping
    Here is for your summary:
    IPSec: Site to Site - Routers
    Configuration Steps
    Phase 1
    Step 1: Configure Mirrored ACL/Crypto ACL       for Interesting Traffic
    Step 2: Configure ISAKMP Policy
    Step 3: Configure ISAKMP Key
    Phase 2
    Step 4: Configure Transform Set
    Step 5: Configure Crypto Map
    Step 6: Apply Crypto Map to an Interface
    To debug for Phase 1 and Phase 2. Store it in buffer without displaying logs on terminal.
    Router#debug crpyto isakmp
    Router#debug crpyto ipsec
    Router(config)# logging buffer 7
    Router(config)# logging buffer 99999
    Router(config)# logging console 6
    Router# clear logging
    Configuration
    In R1:
    (config)# access-list 101 permit ipo host 10.1.1.1 host      10.1.2.1
    (config)# crypto isakmp policy 10
    (config-policy)# encryption 3des
    (config-policy)# authentication pre-share
    (config-policy)# group 2
    (config-policy)# hash sha1
    (config)# crypto isakmp key 0 cisco address 2.2.2.1
    (config)# crypto ipsec transform-set TSET esp-3des      sha-aes-hmac
    (config)# crypto map CMAP 10 ipsec-isakmp
    (config-crypto-map)# set peer 2.2.2.1
    (config-crypto-map)# match address 101
    (config-crypto-map)# set transform-set TSET
    (config)# int f0/0
    (config-if)# crypto map CMAP
    Similarly in R2
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Change to Transport Mode, add the following command in Step 4:
    (config-tranform-set)# mode transport
    Even after  doing this change, the ipsec negotiation will still be done through  tunnel mode if pinged from Loopback to Loopback. To overcome this we  make changes to ACL.
    Change to Aggressive Mode, replace the Step 3 command with these commands in R1:
    (config)# crypto isakmp peer address 2.2.2.1
    (config-peer)# set aggressive-mode password cisco
    (config-peer)# set aggressive-mode clien-endpoint       ipv4-address 2.2.2.1
    Similarly on R2.
    The below process is for the negotiation using RSA-SIG (PKI) as authentication type
    Debug Process:
    After  we debug, we can see the negotiation between the two peers. The first  packet of the interesting traffic triggers the ISAKMP (Phase1)  negotiation. Important messages are marked in BOLD and explanation in  RED
    R2(config)#do ping 10.1.1.1 so lo0 // Interesting Traffic
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
    Packet sent with a source address of 2.2.2.2
    Mar  2 16:18:42.939: ISAKMP:(0): SA request profile is (NULL) //  Router tried to find any IPSec SA matching the outgoing connection but  no valid SA has been found in Security Association Database (SADB)
    Mar  2 16:18:42.939: ISAKMP: Created a peer struct for 20.1.1.10, peer port 500
    Mar  2 16:18:42.939: ISAKMP: New peer created peer = 0x46519678 peer_handle = 0x8000000D
    Mar  2 16:18:42.939: ISAKMP: Locking peer struct 0x46519678, refcount 1 for isakmp_initiator
    Mar  2 16:18:42.939: ISAKMP: local port 500, remote port 500
    Mar  2 16:18:42.939: ISAKMP: set new node 0 to QM_IDLE    
    Mar  2 16:18:42.939: ISAKMP:(0):insert sa successfully sa = 4542B818
    Mar  2 16:18:42.939: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. // Not an error. By default it is configured for Main Mode
    Mar  2 16:18:42.939: ISAKMP:(0):No pre-shared key with 20.1.1.10! // Since we are using RSA Signature, this message. If we use pre-share, this is where it would indicate so!
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-07 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-03 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-02 ID
    Mar  2 16:18:42.939: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    Mar  2 16:18:42.939: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    Mar  2 16:18:42.943: ISAKMP:(0): beginning Main Mode exchange
    Mar  2 16:18:42.943: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.943: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.947: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.947: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    Mar  2 16:18:42.947: ISAKMP:(0): processing SA payload. message ID = 0
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch // Do not worry about this! Not an ERROR!
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947:.!!!!
    Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
    R2(config)# ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.947: ISAKMP : Scanning profiles for xauth ...
    Mar  2 16:18:42.947: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    Mar  2 16:18:42.947: ISAKMP:      encryption 3DES-CBC
    Mar  2 16:18:42.947: ISAKMP:      hash SHA
    Mar  2 16:18:42.947: ISAKMP:      default group 2
    Mar  2 16:18:42.947: ISAKMP:      auth RSA sig
    Mar  2 16:18:42.947: ISAKMP:      life type in seconds
    Mar  2 16:18:42.947: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    Mar  2 16:18:42.947: ISAKMP:(0):atts are acceptable. Next payload is 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:actual life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa vpi_length:4
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    Mar  2 16:18:42.947: ISAKMP:(0):Returning Actual lifetime: 86400
    Mar  2 16:18:42.947: ISAKMP:(0)::Started lifetime timer: 86400.
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Mar  2 16:18:42.951: ISAKMP (0): constructing CERT_REQ for issuer cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:42.951: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_SA_SETUP // Sending Key Exchange Information to peer
    Mar  2 16:18:42.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Mar  2 16:18:42.955: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_SA_SETUP // Receive key exchange information from peer
    Mar  2 16:18:42.955: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.955: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Mar  2 16:18:42.959: ISAKMP:(0): processing KE payload. message ID = 0
    Mar  2 16:18:43.003: ISAKMP:(0): processing NONCE payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): processing CERT_REQ payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants cert issued by cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:43.007:  Choosing trustpoint CA_Server as issuer
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is Unity
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID seems Unity/DPD but major 180 mismatch
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is XAUTH
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): speaking to another IOS box!
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008):vendor ID seems Unity/DPD but hash mismatch
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): His hash no match - this node outside NAT
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): No NAT Found for self or peer
    Mar  2 16:18:43.007: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.007: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Mar  2 16:18:43.011: ISAKMP:(1008):Send initial contact
    Mar  2 16:18:43.011: ISAKMP:(1008):My ID configured as IPv4 Addr, but Addr not in Cert!
    Mar  2 16:18:43.011: ISAKMP:(1008):Using FQDN as My ID
    Mar  2 16:18:43.011: ISAKMP:(1008):SA is doing RSA signature authentication using id type ID_FQDN
    Mar  2 16:18:43.011: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : R2
              protocol     : 17
              port         : 500
              length       : 10
    Mar  2 16:18:43.011: ISAKMP:(1008):Total payload length: 10
    Mar  2 16:18:43.019: ISAKMP (1008): constructing CERT payload for hostname=R2+serialNumber=FHK1502F2H8
    Mar  2 16:18:43.019: ISAKMP:(1008): using the CA_Server trustpoint's keypair to sign
    Mar  2 16:18:43.035: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Mar  2 16:18:43.035: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.035: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.035: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Mar  2 16:18:43.047: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_KEY_EXCH
    // "MM_KEY_EXCH" indicates that the peers have exchanged DH Public keys and generated a shared secret!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing ID payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : ASA1
              protocol     : 0
              port         : 0
              length       : 12
    Mar  2 16:18:43.047: ISAKMP:(0):: peer matches *none* of the profiles // Normal Message! Not an error!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing CERT payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP:(1008): processing a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.051: ISAKMP:(1008): peer's pubkey isn't cached
    Mar  2 16:18:43.059: ISAKMP:(1008): Unable to get DN from certificate!
    Mar  2 16:18:43.059: ISAKMP:(1008): Cert presented by peer contains no OU field.
    Mar  2 16:18:43.059: ISAKMP:(0):: peer matches *none* of the profiles
    Mar  2 16:18:43.063: ISAKMP:(1008): processing SIG payload. message ID = 0
    Mar  2 16:18:43.067: ISAKMP:received payload type 17
    Mar  2 16:18:43.067: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.067: ISAKMP:(1008): vendor ID is DPD
    Mar  2 16:18:43.067: ISAKMP:(1008):SA authentication status:
              authenticated
    Mar  2 16:18:43.067: ISAKMP:(1008):SA has been authenticated with 20.1.1.10
    Mar  2 16:18:43.067: ISAKMP: Trying to insert a peer 40.1.1.1/20.1.1.10/500/,  and inserted successfully 46519678. // SA inserted into SADB
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM5  New State = IKE_I_MM6
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_I_MM6
    Mar  2 16:18:43.071: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):beginning Quick Mode exchange, M-ID of -1523793378
    Mar  2 16:18:43.071: ISAKMP:(1008):QM Initiator gets spi
    Mar  2 16:18:43.075: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.075: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.075: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
    Mar  2 16:18:43.075: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.079: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) QM_IDLE // IPSec Policies
    Mar  2 16:18:43.079: ISAKMP:(1008): processing HASH payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing SA payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008):Checking IPSec proposal 1
    Mar  2 16:18:43.079: ISAKMP: transform 1, ESP_3DES
    Mar  2 16:18:43.079: ISAKMP:   attributes in transform:
    Mar  2 16:18:43.079: ISAKMP:      SA life type in seconds
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (basic) of 3600
    Mar  2 16:18:43.079: ISAKMP:      SA life type in kilobytes
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    Mar  2 16:18:43.079: ISAKMP:      encaps is 1 (Tunnel)
    Mar  2 16:18:43.079: ISAKMP:      authenticator is HMAC-SHA
    Mar  2 16:18:43.079: ISAKMP:(1008):atts are acceptable. // IPSec attributes are acceptable!
    Mar  2 16:18:43.079: ISAKMP:(1008): processing NONCE payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.083: ISAKMP:(1008): Creating IPSec SAs
    Mar  2 16:18:43.083:         inbound SA from 20.1.1.10 to 40.1.1.1 (f/i)  0/ 0
              (proxy 1.1.1.1 to 2.2.2.2)
    Mar  2 16:18:43.083:         has spi 0xA9A66D46 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083:         outbound SA from 40.1.1.1 to 20.1.1.10 (f/i) 0/0
              (proxy 2.2.2.2 to 1.1.1.1)
    Mar  2 16:18:43.083:         has spi  0x2B367FB4 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.083: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.083: ISAKMP:(1008):deleting node -1523793378 error FALSE reason "No Error"
    Mar  2 16:18:43.083: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    Mar  2 16:18:43.083: ISAKMP:(1008):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE // At this point tunnels are up and ready to pass traffic!
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Kindly rate if you find the explanation useful !!
    Best Regards
    Sachin Garg

  • Cisco ASA 5505 Site to Site VPN

    Hello All,
    First time posting to the forums. I've been working with Cisco ASA 5505 for a number of months and recently I purchased a 2nd ASA with the goal of setting up Site to Site VPN tunnel. It look so simple from the number of videos that I have watched on the internet. But when I have done it suprise suprise it didn't work for me ... I have deleted the tunnels a number of times and attempted to recreate them. I am using the VPN wizard in the ADM to create the tunnel. Both the asa are 5505 and have the same same firmware etc.
    I would appreciate any help that can be directed towards this issue please.  Slowly losing my mind
    Please see details below:
    Both ADM are 7.1
    IOS
    ASA 1
    aved
    ASA Version 9.0(1)
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address 92.51.193.158 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network CIX_Subnet
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network NETWORK_OBJ_84.39.233.50
    host 84.39.233.50
    object network NETWORK_OBJ_92.51.193.158
    host 92.51.193.158
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address
    [email protected]
    logging recipient-address
    [email protected]
    level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    http 192.168.40.0 255.255.255.0 wireless
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 84.39.233.50
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 192.168.10.0 255.255.255.0 inside
    ssh 192.168.40.0 255.255.255.0 wireless
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password uYePLcrFadO9pBZx encrypted
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1
    ASA 2
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address 84.39.233.50 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network Eiresoft
    host 146.66.160.70
    description DBA Contractor
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_3
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_7
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in remark Access for Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark This is allowing access from Eiresoft to the OLTP Failover server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 192.168.10.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 92.51.193.156 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 92.51.193.158
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 92.51.193.156 255.255.255.252 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
    : end

    Hi,
    Thanks for the help to date
    I now have the Site to Site working but there is one little issue I have. If I try to RD to a server through the tunnel it will not allow connection on the first attempt however if I ping that host and then attempt to RD it will allow the connection. It looks like the host is asleep until it receives traffic through the tunnel. Is this thje correct behaviour.
    See below the details:
    ASA1:
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address XX.XX.XX.XX 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    description Wireless network
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    service-object object SQL_Server
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address [email protected]
    logging recipient-address [email protected] level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (wireless,outside) source static Wireless Wireless destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Servers Servers destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer XX.XX.XX.XX
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map servers_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map servers_map interface servers
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable inside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    crypto ikev1 enable servers
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.10.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username niamh password MlFlIlEiy8vismE0 encrypted
    username niamh attributes
    service-type admin
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password yQeVtvLLKqapoUje encrypted privilege 0
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:83fa7ce1d93375645205f6e79b526381
    ASA2:
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address X.X.X.X 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock timezone GMT 0
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network LAN
    subnet 192.168.100.0 255.255.255.0
    object network REMOTE-LAN
    subnet 192.168.10.0 255.255.255.0
    object network TargetMC
    host 83.71.194.145
    description This is Target Location that will be accessing the Webserver
    object network Rackspace_OLTP
    host 162.13.34.56
    description This is the IP address of production OLTP
    object service DB
    service tcp destination eq 5022
    object network Topaz_Target_VM
    host 82.198.151.168
    description This is Topaz IP that will be accessing Targets VM
    object service DB_2
    service tcp destination eq 5023
    object network EireSoft_NEW_IP
    host 146.66.161.3
    description Eiresoft latest IP form ISP DHCP
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    service-object icmp echo
    service-object icmp echo-reply
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object tcp destination eq www
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_12
    service-object object MSQL
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    service-object object DB_2
    object-group service DM_INLINE_SERVICE_13
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_14
    service-object object MSQL
    service-object object RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_access_in remark Access rules from Traget to CIX for testing
    access-list outside_access_in extended permit tcp object TargetMC object TMC_Webserver eq www
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_12 object Rackspace_OLTP object OLTP_Failover
    access-list outside_access_in remark Topaz access to Target VM
    access-list outside_access_in extended permit tcp object Topaz_Target_VM object TMC_Webserver eq www
    access-list outside_access_in remark Opened up for Target for the weekend. Closing on Monday 20th
    access-list outside_access_in extended permit tcp any object TMC_Webserver eq www
    access-list outside_access_in remark Access for Eiresoft after their ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_13 object EireSoft_NEW_IP object Development_OLTP
    access-list outside_access_in remark Eiresoft Access after ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_14 object EireSoft_NEW_IP object OLTP_Failover
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 object-group Payback_Intrernal
    pager lines 24
    logging enable
    logging console debugging
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static Payback_Intrernal Payback_Intrernal no-proxy-arp route-lookup
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source dynamic LAN interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http X.X.X.X 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer X.X.X.X
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh X.X.X.X  255.255.255.240 outside
    ssh X.X.X.X 255.255.255.252 outside
    ssh 192.168.40.0 255.255.255.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:78a7b9ccec2fa048306092eb29a2b769

  • Cisco ASA 5505 Site to site VPN IPSEC tunnel to an Clavister Firewall

    Hi,
    I have weird problem with a Site to site VPN tunnel from a Cisco ASA 5505 to an Clavister Firewall.
    When I restart the Cisco ASA 5505 the tunnel is up and down,up, down, down, and I get all strange messages when I see if the tunnel is up or down with the syntax: show crypto isakmp sa
    After a while like 5-10 min the vpn site to site tunnel is up and here is the strange thing happening I have all accesslists and tunnel accesslists right I can only access one remote network (Main site Clavister Firewall) trought the vpn tunnel behind the Cisco ASA 5505, and I have 5 more remote networks that I want to access but only one remote network is working trought the vpn tunnel behind the Cisco ASA. I see that when I do this syntax in ASA: show crypto ipsec sa.
    They had a Clavister Firewall before on that site before and now they have a Cisco ASA 5505 and all the rules on the main site thats have the big Clavister Firewall is intact so the problems are in the Cisco ASA 5505.
    Here is some logs that ASDM give me about the tunnel issue, but like I said, the tunnel is up and only one remote network is reachable in that tunnel.....
    3
    Nov 21 2012
    07:11:09
    713902
    Group = 195.149.180.254, IP = 195.149.169.254, Removing peer from correlator table failed, no match!
    3
    Nov 21 2012
    07:11:09
    713902
    Group = 195.149.180.254, IP = 195.149.169.254, QM FSM error (P2 struct &0xc92462d0, mess id 0x1c6bf927)!
    3
    Nov 21 2012
    07:11:09
    713061
    Group = 195.149.180.254, IP = 195.149.169.254, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 0.0.0.0/0.0.0.0/0/0 local proxy 0.0.0.0/0.0.0.0/0/0 on interface outside
    5
    Nov 21 2012
    07:11:09
    713119
    Group = 195.149.180.254, IP = 195.149.169.254, PHASE 1 COMPLETED
    Here is from the syntax: show crypto isakmp sa
    Result of the command: "show crypto isakmp sa"
       Active SA: 1
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 1
    1   IKE Peer: 195.149.180.254
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    Result of the command: "show crypto ipsec sa"
    interface: outside
        Crypto map tag: CustomerCryptoMap, seq num: 10, local addr: 213.180.90.29
          access-list arvika_garnisonen permit ip 172.22.65.0 255.255.255.0 192.168.123.0 255.255.255.0
          local ident (addr/mask/prot/port): (172.22.65.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.123.0/255.255.255.0/0/0)
          current_peer:195.149.180.254
          #pkts encaps: 2188, #pkts encrypt: 2188, #pkts digest: 2188
          #pkts decaps: 2082, #pkts decrypt: 2082, #pkts verify: 2082
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 2188, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 213.180.67.29, remote crypto endpt.: 195.149.180.254
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: E715B315
        inbound esp sas:
          spi: 0xFAC769EB (4207372779)
             transform: esp-aes-256 esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 5, }
             slot: 0, conn_id: 2879488, crypto-map: CustomerCryptoMap
             sa timing: remaining key lifetime (kB/sec): (38738/2061)
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0xE715B315 (3876958997)
             transform: esp-aes-256 esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 5, }
             slot: 0, conn_id: 2879488, crypto-map: CustomerCryptoMap
             sa timing: remaining key lifetime (kB/sec): (38673/2061)
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
    And here are my Accesslists and vpn site to site config:
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 84600
    crypto isakmp nat-traversal 40
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map CustomerCryptoMap 10 match address VPN_Tunnel
    crypto map CustomerCryptoMap 10 set pfs group5
    crypto map CustomerCryptoMap 10 set peer 195.149.180.254
    crypto map CustomerCryptoMap 10 set transform-set ESP-AES-256-SHA
    crypto map CustomerCryptoMap interface outside
    access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 192.168.123.0 255.255.255.0 -------> This is the only remote network I can reach behind the Cisco ASA and the other remote networks dont work..
    access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 host 10.1.34.5
    access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 host 10.1.20.76
    access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 host 62.88.129.221
    access-list VPN_Tunnel extended permit ip 172.22.65.0 255.255.255.0 172.22.71.0 255.255.255.0
    access-list nonat extended permit ip 172.22.65.0 255.255.255.0 192.168.123.0 255.255.255.0
    access-list nonat extended permit ip 172.22.65.0 255.255.255.0 host 10.1.34.5
    access-list nonat extended permit ip 172.22.65.0 255.255.255.0 host 10.1.20.76
    access-list nonat extended permit ip 172.22.65.0 255.255.255.0 host 62.88.129.221
    access-list nonat extended permit ip 172.22.65.0 255.255.255.0 172.22.71.0 255.255.255.0
    nat (inside) 0 access-list nonat
    All these remote networks are at the Main Site Clavister Firewall.
    Best Regards
    Michael

    Hi,
    I'd start by getting the configuration of the remote site related to Local/Remote network configurations and go through them. Even though no changes have been made.
    If they are mirror images of eachother already I'd say its probably some problem related to Cisco/Clavister setup
    Seems especially wierd to me that one of the error messages includes 0.0.0.0 lines.
    I have run into some problems with L2L VPN configurations when our Cisco device just doesnt want to work with the remote end device. In some cases we have confirmed that our networks defined for the L2L VPN are exactly the same and yet when checking debugs on the ASA side we can see the remote end device using totally wrong network masks for the VPN negotiaton and therefore it failed. That problem we corrected with changing the network masks a bit.
    Maybe you could try to change the Encryption Domain configurations a bit and test it then.
    You could also maybe take some debugs on the Phase2 and see if you get anymore  hints as to what could be the problem when only one network is working for the L2L VPN.
    - Jouni

  • Can't ping from DC1 behind TMG1 to DC2 behind TMG2 on a site-to-site VPN connection

    Hi,
    I have a weird problem. I have two TMG servers on each site in a hyper-v lab environment. I have been able to establish the site-to-site VPN successfully however when I ping from DC1 behind TMG1(on site 1) to TMG2, DC2, i am able to ping. However the opposite
    doesn't work. After some trial and error, I figured out that the one initiating the demand-dial request is able to ping the other site, not vice-versa..very strange. I would like to know whether ICMP requests could be achieved bi-directionally..
    Secondly, I am able to ping from TMG1 to all the clients sitting behind TMG2 (including the TMG host), however the clients sitting behind TMG1 can't ping TMG2 neither any of the clients behind it. I tried every possible combination under the firewall policies
    but of complete vain. hell, I am starting to develop a very bad feeling about this product because of making such simple tasks overly complex. I mean, if it were a Cisco or Sonicwall, we could have done this so easily. 
    What my final motive is to send LDAP requests from DC1 to DC2 and vice-versa over a site-to-site VPN so that I could set up 2 different sites in AD on different subnets and then proceed with configuring DAG. But if this simple thing turns out to be such
    major roadblock, dunno how am I gonna pass DAG traffic over it.
    Can someone PLEASE help me!! I am completely exhausted researching on this issue.
    Regards,
    Dman

    Hi，
    For site2site VPN, you must create proper network rule and network set and you need to create proper access rule to allow or deny the traffic between VPN network and any other network.
    http://technet.microsoft.com/en-us/library/bb838949.aspx
    Best Regards
    Quan Gu

  • Question in asa site-site vpn about "ident" ??

    hi all ,
    i have a topology as
    (192.168.0.0/24)LAN1----------------asa1---------------internet-----------------------asa2------------------LAN2(192.168.2.0/24)
    now , lan 1 can reach lan 2 by site to site vpn
    but i have a question :
    when i have
    #sh crypto ipsec sa
    ====================================================================
    interface: outside
        Crypto map tag: Azure_IPSecCryptoMap, seq num: 2, local addr: xxxx
          access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 any
          local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: xxxxx
          #pkts encaps: 294823, #pkts encrypt: 294823, #pkts digest: 294823
          #pkts decaps: 208795, #pkts decrypt: 208795, #pkts verify: 208795
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 294823, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: xxxxxxxxxx/0, remote crypto endpt.: xxxxxxxx/0
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 81F3ABF6
          current inbound spi : FAE91312
        inbound esp sas:
          spi: 0xFAE91312 (4209578770)
             transform: esp-aes esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 10670080, crypto-map: Azure_IPSecCryptoMap
             sa timing: remaining key lifetime (kB/sec): (4373327/621)
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0xFFFFFFFF 0xFFFFFFFF
        outbound esp sas:
          spi: 0x81F3ABF6 (2180230134)
             transform: esp-aes esp-sha-hmac no compression
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 10670080, crypto-map: Azure_IPSecCryptoMap
             sa timing: remaining key lifetime (kB/sec): (4370375/621)
             IV size: 16 bytes
             replay detection support: Y
             Anti replay bitmap:
              0x00000000 0x00000001
    ================================================================================
    my problem is ,
    that my asa1 lan1  only reach asa2 if its destination was to subnet 192.168.2.0/24 , i mean if  requested internet i cant reach it !!!
    note that the crypto_map acl says destination "any" will go to asa2 , but why  when i requested the destioantion of lan2 it responce , and if i requested 8.8.8.8 it dont reach asa2 ??
    i used packet tracer to investigate  , it seems as a stuck !!!
    how to change the remote idnet as in the red line above ??? i think it is the issue that preventing mefrom reaching internet by asa2
    agian ,
    what issue in the asa has relation to the remote idnet and how i can change it ?
    any help ?
    regards

    CSCO,
    The lines below, match the interesting traffic for this VPN. You will not see a specific host address unless, you configure that within you crypto ACL. Basically you have some host in network 192.168.0.0/24(LOCAL) going to 192.168.2.0/24(REMOTE). The REMOTE IDENT is the remote network where the remote host relies, which matches your interesting traffic.
    So lon story short, you have some local host in the 192.168.1.0/24 range going to some host in the 192.168.2.0/24 range.
    This ACL has to do with the address you map to the match address line of you crypto map.
          access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 any
          local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

  • ASA 5520 site-to-site VPN question

    Hello,
    We have a Cisco 5520 ASA 8.2(1) connected to a Cisco RVS4000 router via an IPsec Site-to-Site VPN. The RVS4000 is located at a branch office. The tunnel works beautifully. When computers at the remote site are turned on the tunnel is established, and data is transferred back and forth.
    The only issue I'm having is being able to Remote Desktop to the branch office computers, or ping for that matter. I can ping and Remote Desktop from the branch office computers to computers at the main site where the ASA is located.
    After doing some research, I came across the this command;
    sysopt connection permit-vpn
    I haven't tried entering the command yet, but was wondering if this is something that I can try initially to see it it resolves the problem.
    Thanks,
    John

    What are your configs and network diagrams at each location?  What are you doing for DNS?  I can help quicker with that info.  Also, here are some basic site to site VPN examples if it helps.
    hostname cisco
    domain-name cisco.com
    enable password XXXXXXXX encrypted
    passwd XXXXXXXXXXX encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address XXX.XXX.XXX.XXX 255.255.255.248
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 10.0.0.2 255.255.255.0
    interface Ethernet0/2
    nameif backup
    security-level 0
    no ip address
    interface Ethernet0/3
    nameif outsidetwo
    security-level 0
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    dns server-group DefaultDNS
    domain-name cisco.com
    same-security-traffic permit intra-interface
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.10.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.2.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.4.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list XXX extended permit ip 10.90.238.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list XXX extended permit ip 10.0.0.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list XXX extended permit ip 10.90.238.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.4.0 255.255.255.0
    access-list nonat extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list nonat extended permit ip 10.0.10.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.2.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list nonat extended permit ip 10.0.4.0 255.255.255.0 10.90.238.0 255.255.255.0
    access-list split standard permit 10.0.0.0 255.255.255.0
    access-list split standard permit 10.90.238.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 1048576
    logging buffered errors
    logging trap notifications
    logging asdm informational
    logging class vpn buffered debugging
    mtu outside 1500
    mtu inside 1500
    mtu backup 1500
    mtu outsidetwo 1500
    mtu management 1500
    ip local pool vpnpool 10.0.10.100-10.0.10.200
    ip audit name Inbound-Attack attack action alarm drop
    ip audit name Inbound-Info info action alarm
    ip audit interface outside Inbound-Info
    ip audit interface outside Inbound-Attack
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list nonat
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inbound in interface outside
    route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set myset esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map dynmap 10 set transform-set myset
    crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
    crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address XXX
    crypto map outside_map 1 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 1 set transform-set myset
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto map outside_map 2 match address XXX2
    crypto map outside_map 2 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 2 set transform-set myset
    crypto map outside_map 2 set security-association lifetime seconds 28800
    crypto map outside_map 2 set security-association lifetime kilobytes 4608000
    crypto map outside_map 3 match address XXX3
    crypto map outside_map 3 set pfs
    crypto map outside_map 3 set peer XXX.XXX.XXX.XXX
    crypto map outside_map 3 set transform-set myset
    crypto map outside_map 3 set security-association lifetime seconds 28800
    crypto map outside_map 3 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic dynmap
    crypto map outside_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 60
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy XXXgroup internal
    group-policy XXXgroup attributes
    dns-server value XXX.XXX.XXX.XXX
    vpn-idle-timeout 30
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split
    default-domain value domain.local
    username XXX24 password XXXX encrypted privilege 15
    username admin password XXXX encrypted
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    tunnel-group XXXgroup type remote-access
    tunnel-group XXXgroup general-attributes
    address-pool vpnpool
    default-group-policy rccgroup
    tunnel-group XXXgroup ipsec-attributes
    pre-shared-key XXXXXXXXXX
    isakmp ikev1-user-authentication none
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    tunnel-group XXX.XXX.XXX.XXX type ipsec-l2l
    tunnel-group XXX.XXX.XXX.XXX ipsec-attributes
    pre-shared-key XXXXXXXXXX
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily

  • Azure multiple site-to-site VPNs (dynamic gateway) with Cisco ASA devices

    Hello
    I've been experimenting with moving certain on-premise servers to Azure however they would need a site-to-site VPN link to our many branch sites e.g. monitoring of nodes.
    The documentation says I need to configure a dynamic gateway to have multiple site-to-site VPNs. This is not a problem for our typical Cisco ISR's. However three of our key sites use Cisco ASA devices which are listed as 'Not Compatible' with dynamic routing.
    So I am stuck...
    What options are available to me? Is there any sort of tweak-configuration to make a Cisco ASA work with Azure and dynamic routing?
    I was hoping Azure's VPN solution would be very flexible.
    Thanks

    Hello RTF_Admin,
    1. Which is the Series of CISCO ASA device you are using?
    Thank you for your interest in Windows Azure. The Dynamic routing is not supported for the Cisco ASA family of devices.
    Unfortunately, a dynamic routing VPN gateway is required for Multi-Site VPN, VNet to VNet, and Point-to-Site.
    However, you should be able to setup a site-to-site VPN with Cisco ASA 5505 series security appliance as demonstrated in this blog:
    Step-By-Step: Create a Site-to-Site VPN between your network and Azure
    http://blogs.technet.com/b/canitpro/archive/2013/10/09/step-by-step-create-a-site-to-site-vpn-between-your-network-and-azure.aspx
    You can refer to this article for Cisco ASA templates for Static routing:
    http://msdn.microsoft.com/en-us/library/azure/dn133793.aspx
    If your requirement is only for Multi-Site VPN then there is no option but to upgrade the device as Multisite VPN requires dyanmic routing and unfortunately there is no tweak or workaround due to hardware compatibility issue.
    I hope that this information is helpful
    Thanks,
    Syed Irfan Hussain

  • Cisco ASA 5505 Site to Site VPN Problem

    Hi All,
    We have a site to site VPN with a cisco asa 5505 on one end and a Checkpoint firewall on the other end.
    We can establish the vpn tunnel and all users in the remote office are working great. However at a random point during the day or it may even be after 2 weeks of working, the tunnel between the sites automatically fails.
    When I dial into the modem which is connected to the firewall I see the following messages in the logs:
    Sep 14 2011 16:40:02: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, QM FSM error (P2 struct &0x42314d8, mess id 0xa18dcb12)!
    Sep 14 2011 16:40:02: %ASA-1-713900: Group = *.*.*.*, IP = *.*.*.*, construct_ipsec_delete(): No SPI to identify Phase 2 SA!
    Sep 14 2011 16:40:02: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, Removing peer from correlator table failed, no match!
    Sep 14 2011 16:40:14: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, QM FSM error (P2 struct &0x426b988, mess id 0xf0160f94)!
    Sep 14 2011 16:40:14: %ASA-1-713900: Group = *.*.*.*, IP = *.*.*.*, construct_ipsec_delete(): No SPI to identify Phase 2 SA!
    Sep 14 2011 16:40:14: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, Removing peer from correlator table failed, no match!
    Sep 14 2011 16:40:02: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, QM FSM error (P2 struct &0x42314d8, mess id 0xa18dcb12)!
    Sep 14 2011 16:40:02: %ASA-1-713900: Group = *.*.*.*, IP = *.*.*.*, construct_ipsec_delete(): No SPI to identify Phase 2 SA!
    Sep 14 2011 16:40:02: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, Removing peer from correlator table failed, no match!
    Sep 14 2011 16:40:14: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, QM FSM error (P2 struct &0x426b988, mess id 0xf0160f94)!
    Sep 14 2011 16:40:14: %ASA-1-713900: Group = *.*.*.*, IP = *.*.*.*, construct_ipsec_delete(): No SPI to identify Phase 2 SA!
    Sep 14 2011 16:40:14: %ASA-3-713902: Group = *.*.*.*, IP = *.*.*.*, Removing peer from correlator table failed, no match!
    There is nothing in the Checkpoint logs. To solve the issue I have to reload the firewall.
    I have checked both firewalls for any mis-matched parameters and do not see any.
    Any help is very much appreciated as it is very frustrating for myself and the users in the remote office.
    Thanks!

    Also to note, PFS is enabled on both firewalls. Config on Cisco ASA firewall as follows:
    hostname
    domain-name
    enable passwordpasswd names
    interface Vlan701
    nameif inside
    security-level 100
    ip address 10.65.0.69 255.255.255.252
    interface Vlan999
    nameif outside
    security-level 0
    ip address ******  255.255.255.248
    interface Ethernet0/0
    description Link to Internet
    switchport access vlan 999
    interface Ethernet0/1
    description
    switchport access vlan 701
    interface range Ethernet0/2 - 0/7
    switchport access vlan 2
    shutdown
    ftp mode passive
    dns server-group DefaultDNS
    domain-name******
    access-list 101 extended permit ip host ****** 172.25.0.0 255.255.0.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 172.25.0.0 255.255.0.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 172.28.0.0 255.255.0.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 172.26.0.0 255.255.0.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 172.16.0.0 255.248.0.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 10.72.0.0 255.255.0.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.224 10.68.2.0 255.255.255.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 10.151.10.0 255.255.255.0
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 host ******
    access-list 101 extended permit ip 10.65.0.64 255.255.255.192 ******* 255.255.255.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 172.25.0.0 255.255.0.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 172.28.0.0 255.255.0.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 172.26.0.0 255.255.0.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 172.16.0.0 255.248.0.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 10.72.0.0 255.255.0.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.224 10.68.2.0 255.255.255.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 10.151.10.0 255.255.255.0
    access-list nonat extended permit ip 10.65.0.64 255.255.255.192 ******** 255.255.255.0
    pager lines 24
    logging enable
    logging timestamp
    logging buffered warnings
    logging trap warnings
    logging asdm informational
    logging host outside *****
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm history enable
    arp timeout 14400
    nat (inside) 0 access-list nonat
    route inside ******
    route outside 0.0.0.0 0.0.0.0 ********
    timeout xlate 0:05:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    snmp-server location **:
    snmp-server contact **
    snmp-server community shortkey
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    snmp-server enable traps syslog
    crypto ipsec transform-set 3desmd5 esp-3des esp-md5-hmac
    crypto map CASGMAP 50 match address 101
    crypto map CASGMAP 50 set pfs group1
    crypto map CASGMAP 50 set peer ********
    crypto map CASGMAP 50 set transform-set 3desmd5
    crypto map CASGMAP 50 set security-association lifetime seconds 3600
    crypto map CASGMAP interface outside
    crypto isakmp enable outside
    crypto isakmp policy 20
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet **** inside
    telnet timeout 5
    ssh **** inside
    ssh **** outside
    ssh timeout 5
    console timeout 30
    management-access inside
    dhcpd ping_timeout 750
    priority-queue outside
    ntp server **
    username ***
    tunnel-group ******** type ipsec-l2l
    tunnel-group ******** ipsec-attributes
    pre-shared-key ***
    class-map VoIP
    match dscp ef
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map General-purpose
    class VoIP
    priority
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect http
    service-policy General-purpose interface outside
    prompt hostname context

Maybe you are looking for

  • Imp db into 8.1.5 from 9.1.0 dmp file

    Hi, all, I have exported data from 9.1.0. When I tried to import it into 8.1.7, the following error occured: IMP-00017: following statement failed with ORACLE error 6550: "BEGIN " "sys.dbms_logrep_imp.instantiate_schema(schema_name=>'B1', export_db_n

  • How to create a "Selection Conditions" table similar to that found in se11?

    Hi, My team is trying to develop a SAP data migration tool (DMT) using ABAP. One of the functionalities in the DMT is to validate the data imported to the staging area tables against some reference tables (e.g. SAP tables). To do this, I would need t

  • RMAN-04025 when performing automated TSPITR in Oracle 11g R2 (Enterprise)

    Hi guys, I'm sort of new to Oracle, so here is the problem I'm encountering: I have a database ('foo'), in which I have created a tablespace ('blue') (not as sysdba, but as user01 with dba privileges). I also created a table in tablespace's datafile

  • Error - Logical file is not part of database. Use RESTORE FILELISTONLY to list the logical file names

    I made a script to restore .bak or backup files. It works for some databases, but not for one. How do I make it work for any type of .bak file ? This is in sql server 2008. The error message is - Msg 3234, Level 16, State 1, Line 1 Logical file 'Nort

  • SCDO - Change Document

    Hye, Facing problem with the change document with update status. The tables CDHDR & CDPOS are getting updated , however my custom table ZEMPTABL is not getting updated with new values. The steps for creation i followed is as: 1) Custom table : ZEMPTA