Site-to-Site VPN between ASA & PIX
Hi everyone,
If this has been posted before, which it probably has, I apologize in advance.
Basically, I have to configure a VPN between our NY ASA and a PIX we shipped to our LA office. The PIX is replacing an old Cisco router. The ASA is our main device which is configured for multiple VPN connections (and I have not touched this) and still has the old VPN config from that old Cisco router.
On my part, I configured the PIX with the same pre-share key, and security protocols as the old router. When I checked the log files of the ASA I see the error message: "tunnel manager has failed to establish an l2l sa all configured ike versions failed to establish the tunnel."
Since this is my first time setting up a PIX, I'm thinking there might be something the matter with my config, though I'm not exactly sure. The PIX config is as follows:
interface Ethernet0
nameif Outside
security-level 0
ip address 173.xxx.xxx.xxx 255.255.255.224
interface Ethernet1
nameif Inside
security-level 100
ip address 192.168.xxx.xxx 255.255.255.0
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
ftp mode passive
dns server-group DefaultDNS
domain-name xxxxxx.xxxxx.org
access-list acl_vpn extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.5.0 255.255.255.0
access-list acl_vpn extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.6.0 255.255.255.0
access-list acl_vpn extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.7.0 255.255.255.0
access-list acl_vpn extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.8.0 255.255.255.0
access-list acl_vpn extended permit ip 192.168.xxx.xxx 255.255.255.0 10.12.40.0 255.255.255.0
pager lines 24
mtu Outside 1500
mtu Inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any Outside
no asdm history enable
arp timeout 14400
global (Outside) 1 173.xxx.xxx.xxx netmask 255.255.255.224
nat (Inside) 2 192.168.0.0 255.0.0.0
nat (Inside) 1 0.0.0.0 0.0.0.0
route Outside 0.0.0.0 0.0.0.0 173.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ipsec df-bit clear-df Outside
crypto map mymap 1 match address acl_vpn
crypto map mymap 1 set pfs
crypto map mymap 1 set peer 69.18.xxx.xxx
crypto map mymap 1 set transform-set myset
crypto map mymap 1 set security-association lifetime seconds 28800
crypto map mymap 1 set security-association lifetime kilobytes 4608000
crypto isakmp identity address
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 5000
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 10000
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group 69.18.xxx.xxx type ipsec-l2l
tunnel-group 69.18.xxx.xxx ipsec-attributes
pre-shared-key *
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
parameters
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
Cryptochecksum:ff5fe6ea51385f0d3f6580a5fdd73d40
: end
If you need further information, please let me know. Also any feedback would be greatly appreciated.
Thanks,
-Sasha
Also,
It would seem to me that you have not configured NAT0 for the VPN traffic
This in most cases matches exactly the ACL used in the Crypto Map configurations.
I suggest that you use another ACL for this purpose though to avoid any future problems
access-list NAT0 extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.5.0 255.255.255.0
access-list NAT0 extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.6.0 255.255.255.0
access-list NAT0 extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.7.0 255.255.255.0
access-list NAT0 extended permit ip 192.168.xxx.xxx 255.255.255.0 192.168.8.0 255.255.255.0
access-list NAT0 extended permit ip 192.168.xxx.xxx 255.255.255.0 10.12.40.0 255.255.255.0
nat (inside) 0 access-list NAT0
The below command seems to be useless since it doesnt have a match "global" configuration for ID 2
nat (Inside) 2 192.168.0.0 255.0.0.0
- Jouni
Similar Messages
-
Change MTU for just one Site-to-Site VPN between ASAs?
Hi -
I'm setting up a Site-to-Site Cisco VPN between ASAs. I'm being told by the remote site engineer to set the maximum MTU at 1362.
Is it possible to set the MTU for one specific site-to-site VPN on my ASA 5510 Security Plus to MTU 1362? I see my interfeces are all set at 1500.
If not, would you recommend I setup a subinterface on my inside network router and a subinterface on the ASA with an MTU of 1362 to get around this issue? Then use this subinterface for traffic from my inside network to transverse through prior to hitting the VPN.
Thank you.I would not worry too much about UDP traffics. I rather concentrate on TCP traffics because almost all of the issues will be TCP.
Therefore, I would set the MSS value to 1362 or may be like 1300: sysopt connection tcp-mss 1300
That will solve most of your issues. -
Remote site redundancy IPSEC VPN between 2911 and ASA
We already have IPSEC VPN connectivity established between sites but would like to introduce some resilience/redundancy at a remote site.
Site A has an ASA with one internet circuit.
Site B has a Cisco 2911 with one internet circuit and we have established site-to-site IPSEC VPN connectivity between the 2911 and the ASA.
Prior to getting the new internet circuit, Site B had a Cisco 877 with an ADSL line which are still available but aren’t currently in use.
The internet circuit at Site B has dropped a few times recently so we would like to make use of the ADSL circuit (and potentially the 877 router too) as a backup.
What is the best way of achieving this?
We thought about running HSRP between the 877 and 2911 routers at Site B and, in the event of a failure of the router or internet circuit, traffic would failover to the 877 and ADSL.
However, how would Site A detect the failure? Can we simply rely on Dead Peer Detection and list the public IP address of the internet circuit at Site B first with the public IP address used on the ADSL line second in the list on the ASA? What would happen in a failover scenario and, just as important, when service was restored – I’m not sure DPD would handle that aspect correctly?
I’ve read briefly elsewhere that GRE might be best to use in this scenario – but I can’t use GRE on the ASA. I have an L3 switch behind the ASA which I may be able to make use of? But I don’t want to disrupt the existing IPSEC VPN connectivity already established between the ASA and the 2911. Can I keep IPSEC between the ASA and 2911 but then run GRE between the L3 switch and the 2911? If so, how would this best be achieved? And how could I also introduce the 877 and ADSL line into things to achieve the neccessary redundancy?
Any help/advice would be appreciated!Hello,
I don't think GRE tunnel that you could set up on the switch behind ASA would be really helpfull. Still site-2-site tunnel you want to establish between ASA and some routers, but still it is ASA which needs to make decision about which peer to connect to.
Possible solution would be to do HSRP between both routers on LAN side and with two independent tunnels/crypto maps (one on each of them). On ASA you would need to set up two hosts in set peer. Problem of this solution is that if one router at side B is going to go down and second ADSL line will take over ASA will not do preempt after you main Internet connection is up again. This would happen after ADSL Internet connection will be down.
Solution to that would be to assign two different public IP addressess on two different interfaces of ASA. Then you attach two crypto maps to both interfaces and by using sla monitor (let's say icmp to main router, if it does not respond then you change routing for remote LAN to second interface) you are selecting which crypto map (with one peer this time) should be used.
I hope what I wrote makes some sense. -
Site to Site VPN between ASA 5505 and Cisco 800 router
Evening all,
Hoping that someboy can see the error of my ways. It seems very like the problem that i read here: https://supportforums.cisco.com/thread/2016300
We have a cisco 800 in a remote site which we wanted to use for a site to site vpn. Went through the steps on the ASA 5505 and the 800 and have got to the stage were the tunnel is up and connected. Getting traffic through it is another matter. Remote network is 172.20.224.0/20 and the server network behind the ASA is 192.168.168.0/24. The tunnel does intiate when you send traffic from 172 ......to 192....... Both the ASA and 800 report the tunnel is up. If i look at the stats using ccp on the 800 i can see the encapsulation packets graph shooting up but nothing cominbg back. I did packet captures on the 5505 and could not see anything coming from the tunnel so i dont belive its making it to the ASA. Here is the config from the 800:
Building configuration...
Current configuration : 6488 bytes
version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
hostname hhp-sty-backup
boot-start-marker
boot-end-marker
logging message-counter syslog
logging buffered 4096
enable secret 5 $1$jI1i$/kZbRk2WHD5h0HtfuQVej1
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa authorization auth-proxy default local
aaa session-id common
crypto pki trustpoint TP-self-signed-1347488939
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1347488939
revocation-check none
rsakeypair TP-self-signed-1347488939
crypto pki certificate chain TP-self-signed-1347488939
certificate self-signed 02
30820255 308201BE A0030201 02020102 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31333437 34383839 3339301E 170D3032 30333031 30313336
33375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 33343734
38383933 3930819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100E714 7B0ADB41 19F60528 A8A5C43B 5CD2D1CD DCCF2E08 8B38D444 36EAB9B7
0E93CEF7 660F979E E27915B9 E44812A5 794EA03D BA66752B FD0F7EBF D6342513
D6410E4E 098CE838 C3BADD0A 5F3505FE 22CA776F 89B19510 F0852225 3600F046
4D57D2E2 FE4AAD1E 8BE4BF80 7B27369E BFA65160 BC769BC9 00A13741 E336D0EA
8A810203 010001A3 7D307B30 0F060355 1D130101 FF040530 030101FF 30280603
551D1104 21301F82 1D686870 2D737479 2D626163 6B75702E 796F7572 646F6D61
696E2E63 6F6D301F 0603551D 23041830 168014FA 4A8C4DF6 629638DE 87D7B60A
0F5BB40F EA6AED30 1D060355 1D0E0416 0414FA4A 8C4DF662 9638DE87 D7B60A0F
5BB40FEA 6AED300D 06092A86 4886F70D 01010405 00038181 00BBE577 6EF63FE7
789766D5 37841812 298D4885 1CD06D07 4C625369 C3403106 89EE1398 73495432
66C49CB1 36A5B2F8 D77A8C46 5AFE4112 EA5917D9 81542640 80EF2D36 54A85CC6
C3FFFFB8 39A648DD 2ABA2B13 4137BE07 760E46C0 74401DA7 482E3FA2 A64B70FF
447AA1B2 52E37240 29987085 532BBE3B C2E2E54A 54CA1D13 0E
quit
dot11 syslog
ip source-route
ip dhcp excluded-address 10.10.10.1
ip dhcp pool inside
ip dhcp pool lan_network
network 172.20.224.0 255.255.240.0
dns-server 8.8.8.8 8.8.4.4
default-router 172.20.224.1
lease 7
ip cef
no ip domain lookup
ip domain name yourdomain.com
password encryption aes
username pix privilege 15 secret 5 $1$Z.wA$lBmj36AJx/cbK1RjmfGJh1
username admin privilege 15 password 0 434Zaty
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key password address 217.36.32.222
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel to217.36.32.222
set peer 217.36.32.222
set transform-set ESP-3DES-SHA
match address 100
archive
log config
hidekeys
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
dsl operating-mode auto
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 172.20.224.1 255.255.240.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
interface Dialer0
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
no cdp enable
ppp authentication chap callin
ppp chap hostname B6*******.btclick.com
ppp chap password 0 H*******
crypto map SDM_CMAP_1
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
access-list 1 remark CCP_ACL Category=16
access-list 1 permit 172.4.0.0 0.240.255.255
access-list 10 permit 195.12.1.35
access-list 10 permit 172.4.0.0 0.240.255.255
access-list 100 remark CCP_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 172.20.224.0 0.0.15.255 192.168.168.0 0.0.0.255
access-list 101 remark CCP_ACL Category=2
access-list 101 remark IPSec Rule
access-list 101 deny ip 172.20.224.0 0.0.15.255 192.168.168.0 0.0.0.255
access-list 101 permit ip 172.4.0.0 0.240.255.255 any
route-map SDM_RMAP_1 permit 1
match ip address 101
control-plane
banner exec ^C
% Password expiration warning.
Cisco Configuration Professional (Cisco CP) is installed on this device
and it provides the default username "cisco" for one-time use. If you have
already used the username "cisco" to login to the router and your IOS image
supports the "one-time" user option, then this username has already expired.
You will not be able to login to the router with this username after you exit
this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you
want to use.
^C
banner login ^C
Cisco Configuration Professional (Cisco CP) is installed on this device.
This feature requires the one-time use of the username "cisco" with the
password "cisco". These default credentials have a privilege level of 15.
YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE
PUBLICLY-KNOWN CREDENTIALS
Here are the Cisco IOS commands.
username <myuser> privilege 15 secret 0 <mypassword>
no username cisco
Replace <myuser> and <mypassword> with the username and password you want
to use.
IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL
NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.
For more information about Cisco CP please follow the instructions in the
QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp
^C
line con 0
no modem enable
stopbits 1
line aux 0
line vty 0 4
access-class 10 in
privilege level 15
password 434Zaty
transport input telnet ssh
scheduler max-task-time 5000
end
Any help will be most gratefully recieved.Rick,
Thanks for replying. Here is the output from the 800 Show Crypto command:
interface: Dialer0
Crypto map tag: SDM_CMAP_1, local addr 81.136.160.237
protected vrf: (none)
local ident (addr/mask/prot/port): (172.20.224.0/255.255.240.0/0/0)
remote ident (addr/mask/prot/port): (192.168.168.0/255.255.255.0/0/0)
current_peer 217.36.32.222 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 10928, #pkts encrypt: 10928, #pkts digest: 10928
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 2, #recv errors 0
local crypto endpt.: 81.136.160.237, remote crypto endpt.: 217.36.32.222
path mtu 1500, ip mtu 1500, ip mtu idb Virtual-Access2
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
interface: Virtual-Access2
Crypto map tag: SDM_CMAP_1, local addr 81.136.160.237
protected vrf: (none)
local ident (addr/mask/prot/port): (172.20.224.0/255.255.240.0/0/0)
remote ident (addr/mask/prot/port): (192.168.168.0/255.255.255.0/0/0)
current_peer 217.36.32.222 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 10928, #pkts encrypt: 10928, #pkts digest: 10928
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 2, #recv errors 0
local crypto endpt.: 81.136.160.237, remote crypto endpt.: 217.36.32.222
path mtu 1500, ip mtu 1500, ip mtu idb Virtual-Access2
current outbound spi: 0x0(0)
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
and this is the running config frm our ASA at HQ:
Result of the command: "sh run"
: Saved
ASA Version 8.2(1)
hostname secure-access
domain-name hhp.com
enable password UWWykvGjAPmxufUo encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
interface Vlan1
nameif inside
security-level 100
ip address 192.168.168.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group BT
ip address 217.36.32.222 255.255.255.255 pppoe
interface Vlan12
nameif DMZ
security-level 50
ip address 192.168.169.1 255.255.255.0
interface Vlan22
nameif Wireless_HHP
security-level 100
ip address 172.16.36.1 255.255.254.0
interface Vlan32
nameif CNES
security-level 100
ip address 187.187.168.1 255.255.0.0
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
switchport access vlan 12
interface Ethernet0/3
switchport access vlan 22
interface Ethernet0/4
switchport access vlan 32
interface Ethernet0/5
switchport access vlan 12
interface Ethernet0/6
switchport access vlan 12
interface Ethernet0/7
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns domain-lookup DMZ
dns domain-lookup Wireless_HHP
dns domain-lookup CNES
dns server-group DefaultDNS
name-server 192.168.168.2
domain-name hhp.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network NET-cnes_HHP-Sty
network-object 172.20.224.0 255.255.240.0
object-group network NET-cnes_HHP-Balivanich
network-object 172.20.192.0 255.255.240.0
object-group network Oak-DC1
network-object 192.168.168.2 255.255.255.255
object-group network Maple-DC2
network-object 192.168.168.3 255.255.255.255
object-group network HHP_Domain_Controllers
group-object Oak-DC1
group-object Maple-DC2
object-group network PC-Support
network-object 187.187.60.1 255.255.255.255
network-object 187.187.60.2 255.255.255.254
network-object 187.187.60.4 255.255.255.254
network-object 187.187.60.6 255.255.255.255
object-group network ELM-ActiveH
network-object 192.168.168.6 255.255.255.255
object-group network Pine-GP
network-object 192.168.168.12 255.255.255.255
object-group network HHP_Application_Servers
group-object ELM-ActiveH
group-object Pine-GP
object-group network Fern-TS1
network-object 192.168.168.4 255.255.255.255
object-group network Fir-TS2
network-object 192.168.168.5 255.255.255.255
object-group network HHP_Terminal_Servers
group-object Fern-TS1
group-object Fir-TS2
object-group service Global_Catalog_LDAP
description (Generated by Cisco SM from Object "Global Catalog LDAP")
service-object tcp eq 3268
object-group service Global_Catalog_LDAP_SSL
description (Generated by Cisco SM from Object "Global Catalog LDAP SSL")
service-object tcp eq 3269
object-group service UDP-389
description UDP port for LDAP
service-object udp eq 389
object-group service TCP-88
description TCP Port 88
service-object tcp eq 88
object-group service TCP-445
description SMB
service-object tcp eq 445
object-group network John_-_Laptop
description John's Laptop
network-object 187.187.10.65 255.255.255.255
object-group network Graham_-_PC
description Graham Morrison's PC
network-object 187.187.10.90 255.255.255.255
object-group network john_test
network-object 187.187.40.7 255.255.255.255
object-group network Iain_PC
description Iain Macaulay IT
network-object 187.187.10.19 255.255.255.255
object-group network John_-_PC
description John MacPhail's PC
network-object 187.187.10.7 255.255.255.255
object-group network it-alahen-lap
network-object 187.187.10.230 255.255.255.255
object-group network Catriona_-_Laptop
description Catriona's Laptop
network-object 187.187.10.60 255.255.255.255
object-group network Graham_-_Laptop
network-object 187.186.10.120 255.255.255.255
object-group network it-innive-xp
description Innes MacIver's PC
network-object 187.187.10.14 255.255.255.255
object-group network it-alahen-xp
description Desktop
network-object 187.187.10.229 255.255.255.255
object-group network Cat_-_PC
description Catriona Macmillan's PC
network-object 187.187.10.4 255.255.255.255
object-group network it-davdon-xp
description Desktop
network-object 187.187.160.7 255.255.255.255
object-group network cat-laptop
description Catriona's Laptop addresses
network-object 187.187.77.81 255.255.255.255
network-object 187.187.77.82 255.255.255.255
object-group network Catriona_old_pc
network-object 187.187.10.44 255.255.255.255
object-group network cat-tablet
description Catriona's Tablet ip address's
network-object 187.187.77.78 255.255.255.254
object-group network DSO-SQLServer
description Task Database Server
network-object 187.187.1.33 255.255.255.255
object-group network it-finfernew-xp
description Findlay Ferguson PC
network-object 187.187.10.153 255.255.255.255
object-group network PC_Support
group-object John_-_Laptop
group-object Graham_-_PC
group-object john_test
group-object Iain_PC
group-object John_-_PC
group-object it-alahen-lap
group-object Catriona_-_Laptop
group-object Graham_-_Laptop
group-object it-alahen-xp
group-object Cat_-_PC
group-object it-davdon-xp
group-object cat-laptop
group-object Catriona_old_pc
group-object cat-tablet
group-object it-innive-xp
network-object 187.187.1.128 255.255.255.255
network-object 187.187.10.76 255.255.255.255
group-object DSO-SQLServer
network-object 187.187.15.234 255.255.255.255
network-object 187.187.4.60 255.255.255.255
network-object 187.187.10.134 255.255.255.255
network-object 172.18.194.22 255.255.255.255
group-object it-finfernew-xp
object-group network Entire_CNE
description Entire CNE range
network-object 187.0.0.0 255.0.0.0
object-group network NET-cnes_HHP-Sty-Staff
network-object 172.20.225.0 255.255.255.0
object-group network NET-cnes_HHP-Balivanich-staff
network-object 172.20.193.0 255.255.255.0
object-group network Alder-Intranet
network-object 192.168.168.13 255.255.255.255
object-group network Aspen-ISA
network-object 192.168.168.10 255.255.255.255
object-group service tcp-8080
description TCP Port 8080
service-object tcp eq 8080
object-group network Beech-External
network-object 217.36.32.210 255.255.255.255
object-group network it-csm
description cisco security manager
network-object 187.187.1.72 255.255.255.255
object-group network Juniper-External
description Internet Server
network-object 217.36.32.211 255.255.255.255
object-group network HHP_Server_Network
network-object 192.168.168.0 255.255.255.0
object-group network Messagelabs_Incoming_HHP
network-object 67.219.240.0 255.255.240.0
network-object 95.131.104.0 255.255.248.0
network-object 193.109.254.0 255.255.254.0
network-object 195.245.230.0 255.255.254.0
network-object 216.82.240.0 255.255.240.0
network-object 85.158.136.0 255.255.248.0
network-object 117.120.16.0 255.255.248.0
network-object 194.106.220.0 255.255.254.0
object-group network Angus-Maclean-PC
network-object 187.187.10.250 255.255.255.255
object-group service RDP
service-object tcp eq 3389
object-group network it-dbserver
description Database Server (Live)
network-object 187.187.1.65 255.255.255.255
object-group network it-sql-test
description Test SQL / database server
network-object 187.187.1.81 255.255.255.255
object-group service DNS-Resolving
description Domain Name Server
service-object tcp eq domain
service-object udp eq domain
object-group network Beech-Exchange
network-object 192.168.168.91 255.255.255.255
object-group network Messagelabs_-_Incoming
description List of MessageLab addresses that SMTP connections are accepted from
network-object 212.125.75.0 255.255.255.224
network-object 216.82.240.0 255.255.240.0
network-object 195.216.16.211 255.255.255.255
network-object 194.205.110.128 255.255.255.224
network-object 194.106.220.0 255.255.254.0
network-object 193.109.254.0 255.255.254.0
network-object 62.231.131.0 255.255.255.0
network-object 62.173.108.208 255.255.255.240
network-object 62.173.108.16 255.255.255.240
network-object 212.125.74.44 255.255.255.255
network-object 195.245.230.0 255.255.254.0
network-object 85.158.136.0 255.255.248.0
object-group network MIS_Support
network-object 192.168.168.250 255.255.255.254
object-group network it-donadon-xp
description Donald Macdonald's PC
network-object 187.187.10.13 255.255.255.255
object-group network Angela_PC
network-object 187.187.10.155 255.255.255.255
object-group network Katie_PC
network-object 187.187.10.151 255.255.255.255
object-group network Pauline_PC
network-object 187.187.10.12 255.255.255.255
object-group network it-paye-net
network-object 187.187.1.92 255.255.255.255
object-group network MessageLabs-Towers
description Message Labs IP Address ranges
network-object 216.82.240.0 255.255.240.0
network-object 67.219.240.0 255.255.240.0
network-object 85.158.136.0 255.255.248.0
network-object 95.131.104.0 255.255.248.0
network-object 117.120.16.0 255.255.248.0
network-object 193.109.254.0 255.255.254.0
network-object 194.106.220.0 255.255.254.0
network-object 195.245.230.0 255.255.254.0
network-object 62.231.131.0 255.255.255.0
network-object 212.125.75.16 255.255.255.240
object-group network NET_cnes-castlebay-staff
network-object 172.19.17.0 255.255.255.0
object-group network NET_cnes_tarbert_staff
description NET_cnes_tarbert_staff
network-object 172.19.33.0 255.255.255.0
object-group network Juniper
network-object 192.168.169.5 255.255.255.255
object-group network HHP_DMZ_Network
network-object 192.168.169.0 255.255.255.0
object-group network Ash
network-object 192.168.168.100 255.255.255.255
object-group service UDP-445
service-object udp eq 445
object-group service tcp-udp-135-139
service-object tcp-udp range 135 139
object-group network HHP-ELM
description HHP's ELM ActiveH server
network-object 187.187.1.203 255.255.255.255
object-group network CNES-Ext-GW
description CNES External Address
network-object 194.83.245.242 255.255.255.255
object-group service IPSEC
description IPSEC
service-object 57
service-object ah
service-object esp
service-object udp eq isakmp
object-group network Alamur-PC
network-object 187.187.10.15 255.255.255.255
object-group network Iain-Nicolson-PC
network-object 187.187.10.159 255.255.255.255
object-group network HHP_Remote_Access_Pool
network-object 192.168.168.200 255.255.255.248
network-object 192.168.168.208 255.255.255.240
network-object 192.168.168.224 255.255.255.252
network-object 192.168.168.228 255.255.255.254
object-group network Holly-AV
network-object 192.168.168.9 255.255.255.255
object-group service AVG_Ports
description For AVG server to HHP PCs
service-object tcp-udp eq 6150
service-object tcp-udp eq 6051
service-object tcp-udp eq 445
service-object tcp-udp eq 138
service-object tcp-udp eq 135
service-object tcp-udp eq 6054
service-object tcp-udp eq 4158
service-object tcp-udp eq 139
service-object tcp-udp eq 137
object-group network CNES_Access
network-object 192.168.168.230 255.255.255.254
network-object 192.168.168.232 255.255.255.248
network-object 192.168.168.240 255.255.255.248
network-object 192.168.168.248 255.255.255.254
object-group network HHP-068
description BACS PC
network-object 172.20.225.6 255.255.255.255
object-group network Banyan
network-object 192.168.168.105 255.255.255.255
object-group service TCP81
description TCP Port 81
service-object tcp eq 81
object-group network Gavin_-_new_PC
network-object 187.187.10.150 255.255.255.255
object-group network Secudoors
network-object 172.20.224.4 255.255.255.255
access-list outside_access_in remark Time sync to external ntp server
access-list outside_access_in extended permit udp host 192.108.114.23 object-group HHP_Domain_Controllers eq ntp
access-list outside_access_in extended permit tcp object-group MessageLabs-Towers object-group Beech-External eq smtp
access-list outside_access_in extended permit ip host 81.136.160.237 object-group HHP_Server_Network
access-list outside_access_in extended permit ip object-group CNES_Access object-group HHP_Server_Network
access-list outside_access_in extended permit ip object-group MIS_Support object-group HHP_Server_Network
access-list outside_access_in extended permit ip object-group HHP_Remote_Access_Pool object-group HHP_Server_Network
access-list outside_access_in extended permit tcp any object-group Juniper-External eq www
access-list outside_access_in extended permit tcp any object-group Juniper-External eq https
access-list outside_access_in extended deny ip any any
access-list outside_access_in_1 extended permit ip any any
access-list CSM_FW_ACL_Wireless_HHP extended permit ip object-group NET-cnes_HHP-Balivanich object-group HHP_Server_Network
access-list CSM_FW_ACL_Wireless_HHP extended permit ip object-group NET-cnes_HHP-Sty object-group HHP_Server_Network
access-list CSM_FW_ACL_Wireless_HHP extended permit tcp object-group HHP-068 any eq www
access-list CSM_FW_ACL_Wireless_HHP extended permit tcp object-group HHP-068 any eq domain
access-list CSM_FW_ACL_Wireless_HHP extended permit udp object-group HHP-068 any eq domain
access-list CSM_FW_ACL_Wireless_HHP extended permit tcp object-group HHP-068 any eq https
access-list CSM_FW_ACL_Wireless_HHP extended permit object-group DNS-Resolving object-group HHP-068 any
access-list CSM_FW_ACL_Wireless_HHP extended permit object-group tcp-8080 object-group HHP-068 any
access-list CSM_FW_ACL_Wireless_HHP extended permit ip host 172.20.193.53 object-group CNES-Ext-GW
access-list CSM_FW_ACL_Wireless_HHP extended permit ip object-group Secudoors any
access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Server_Network object-group NET-cnes_HHP-Balivanich
access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Server_Network object-group NET-cnes_HHP-Sty
access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Application_Servers object-group PC_Support
access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Domain_Controllers object-group PC_Support
access-list CSM_FW_ACL_inside extended permit ip object-group HHP_Terminal_Servers object-group PC_Support
access-list CSM_FW_ACL_inside extended permit tcp object-group Oak-DC1 any eq domain
access-list CSM_FW_ACL_inside extended permit udp object-group Oak-DC1 any eq domain
access-list CSM_FW_ACL_inside extended permit object-group DNS-Resolving object-group Oak-DC1 any
access-list CSM_FW_ACL_inside extended permit tcp object-group Maple-DC2 any eq domain
access-list CSM_FW_ACL_inside extended permit udp object-group Maple-DC2 any eq domain
access-list CSM_FW_ACL_inside extended permit object-group DNS-Resolving object-group Maple-DC2 any
access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA any eq www
access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA any eq domain
access-list CSM_FW_ACL_inside extended permit udp object-group Aspen-ISA any eq domain
access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA any eq https
access-list CSM_FW_ACL_inside extended permit object-group DNS-Resolving object-group Aspen-ISA any
access-list CSM_FW_ACL_inside extended permit object-group tcp-8080 object-group Aspen-ISA any
access-list CSM_FW_ACL_inside remark For Symantec Liveupdates
access-list CSM_FW_ACL_inside extended permit tcp object-group Banyan any eq ftp
access-list CSM_FW_ACL_inside extended permit tcp object-group Banyan any eq www
access-list CSM_FW_ACL_inside extended permit tcp object-group Banyan any eq https
access-list CSM_FW_ACL_inside remark IPSec VPN access from ELm to CNES
access-list CSM_FW_ACL_inside extended permit object-group IPSEC object-group ELM-ActiveH object-group CNES-Ext-GW
access-list CSM_FW_ACL_inside extended permit udp object-group ELM-ActiveH object-group CNES-Ext-GW eq 4500
access-list CSM_FW_ACL_inside extended permit tcp object-group ELM-ActiveH object-group CNES-Ext-GW eq 4500
access-list CSM_FW_ACL_inside extended permit icmp object-group HHP_Server_Network object-group HHP_DMZ_Network
access-list CSM_FW_ACL_inside remark Time sync to external ntp server
access-list CSM_FW_ACL_inside extended permit udp object-group HHP_Domain_Controllers host 192.108.114.23 eq ntp
access-list CSM_FW_ACL_inside extended permit tcp object-group Beech-Exchange object-group Messagelabs_-_Incoming eq smtp
access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA object-group Juniper eq www
access-list CSM_FW_ACL_inside extended permit tcp object-group Aspen-ISA object-group Juniper eq https
access-list CSM_FW_ACL_inside extended permit ip object-group Holly-AV object-group Juniper
access-list CSM_FW_ACL_inside extended deny ip any any
access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group HHP_Server_Network
access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group HHP_DMZ_Network
access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group NET-cnes_HHP-Balivanich
access-list CSM_FW_ACL_CNES extended permit ip object-group PC_Support object-group NET-cnes_HHP-Sty
access-list CSM_FW_ACL_CNES extended permit tcp object-group it-csm any eq ssh
access-list CSM_FW_ACL_CNES extended permit tcp object-group it-csm any eq www
access-list CSM_FW_ACL_CNES extended permit tcp object-group it-csm any eq https
access-list CSM_FW_ACL_CNES remark Aim's access to Active H server: DSO SQL
access-list CSM_FW_ACL_CNES remark server's access (Task)
access-list CSM_FW_ACL_CNES remark IT Ops - mapped drive for FTP transfer to and from E450/Elm of Entitlement Adjustments
access-list CSM_FW_ACL_CNES remark and Tenancy Changes
access-list CSM_FW_ACL_CNES extended permit ip object-group it-sql-test object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit ip object-group DSO-SQLServer object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit ip object-group it-paye-net object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit ip object-group Angela_PC object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit ip object-group Katie_PC object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit ip object-group Pauline_PC object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES remark donald and Findlay RDP access to Active H
access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-donadon-xp object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-donadon-xp object-group HHP_Terminal_Servers
access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-finfernew-xp object-group ELM-ActiveH
access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group it-finfernew-xp object-group HHP_Terminal_Servers
access-list CSM_FW_ACL_CNES extended permit ip object-group Angus-Maclean-PC object-group Alder-Intranet
access-list CSM_FW_ACL_CNES extended permit ip object-group Angus-Maclean-PC host 192.168.168.17
access-list CSM_FW_ACL_CNES extended permit ip object-group Angus-Maclean-PC object-group Juniper
access-list CSM_FW_ACL_CNES extended permit ip object-group Iain-Nicolson-PC object-group Alder-Intranet
access-list CSM_FW_ACL_CNES extended permit ip object-group Iain-Nicolson-PC host 192.168.168.17
access-list CSM_FW_ACL_CNES extended permit ip object-group Iain-Nicolson-PC object-group Juniper
access-list CSM_FW_ACL_CNES extended permit ip object-group it-davdon-xp object-group Alder-Intranet
access-list CSM_FW_ACL_CNES extended permit ip object-group it-davdon-xp host 192.168.168.17
access-list CSM_FW_ACL_CNES extended permit ip object-group it-davdon-xp object-group Juniper
access-list CSM_FW_ACL_CNES extended permit ip object-group Alamur-PC object-group Alder-Intranet
access-list CSM_FW_ACL_CNES extended permit ip object-group Alamur-PC host 192.168.168.17
access-list CSM_FW_ACL_CNES extended permit ip object-group Alamur-PC object-group Juniper
access-list CSM_FW_ACL_CNES extended permit ip object-group Gavin_-_new_PC object-group Alder-Intranet
access-list CSM_FW_ACL_CNES extended permit ip object-group Gavin_-_new_PC host 192.168.168.17
access-list CSM_FW_ACL_CNES extended permit ip object-group Gavin_-_new_PC object-group Juniper
access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group NET_cnes-castlebay-staff object-group HHP_Server_Network
access-list CSM_FW_ACL_CNES extended permit object-group RDP object-group NET_cnes_tarbert_staff object-group HHP_Server_Network
access-list MIS_splitTunnelAcl standard permit 192.168.168.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip object-group HHP_Server_Network 192.168.168.250 255.255.255.254
access-list inside_nat0_outbound extended permit ip object-group HHP_Server_Network 192.168.168.224 255.255.255.224
access-list CSM_FW_ACL_DMZ extended permit ip object-group HHP_DMZ_Network object-group PC_Support
access-list CSM_FW_ACL_DMZ extended permit icmp object-group HHP_DMZ_Network object-group HHP_Server_Network
access-list CSM_FW_ACL_DMZ extended permit ip object-group Juniper object-group Angus-Maclean-PC
access-list CSM_FW_ACL_DMZ extended permit ip object-group Juniper object-group Holly-AV
access-list CSM_FW_ACL_DMZ extended permit tcp object-group Juniper object-group Beech-Exchange eq smtp
access-list CSM_FW_ACL_DMZ extended permit tcp object-group Juniper object-group HHP_Domain_Controllers eq domain
access-list CSM_FW_ACL_DMZ extended permit udp object-group Juniper object-group HHP_Domain_Controllers eq domain
access-list CSM_FW_ACL_DMZ remark for backups to USB drive on ASH
access-list CSM_FW_ACL_DMZ extended permit object-group TCP-445 object-group Juniper object-group Ash
access-list CSM_FW_ACL_DMZ extended permit object-group UDP-445 object-group Juniper object-group Ash
access-list CSM_FW_ACL_DMZ extended permit object-group tcp-udp-135-139 object-group Juniper object-group Ash
access-list CSM_FW_ACL_DMZ extended deny ip any any
access-list CNES_Support_splitTunnelAcl standard permit 192.168.168.0 255.255.255.0
access-list RemoteAccess_splitTunnelAcl standard permit 192.168.168.0 255.255.255.0
access-list outside_cryptomap extended permit ip object-group HHP_Server_Network object-group NET-cnes_HHP-Sty
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1492
mtu DMZ 1500
mtu Wireless_HHP 1500
mtu CNES 1500
ip local pool CNES_Access 192.168.168.230-192.168.168.249
ip local pool MIS_Support 192.168.168.250-192.168.168.251
ip local pool OLM-VPN-Pool 192.168.168.252
ip local pool HHP_Remote_Access_Pool 192.168.168.200-192.168.168.229
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
nat (Wireless_HHP) 1 172.20.193.53 255.255.255.255
nat (Wireless_HHP) 1 172.20.225.0 255.255.255.0
static (inside,CNES) 192.168.168.0 192.168.168.0 netmask 255.255.255.0
static (CNES,inside) 187.187.0.0 255.255.0.0 netmask 255.255.0.0
static (Wireless_HHP,inside) 172.20.224.0 172.20.224.0 netmask 255.255.240.0
static (inside,Wireless_HHP) 192.168.168.0 192.168.168.0 netmask 255.255.255.0
static (CNES,Wireless_HHP) 187.187.0.0 187.187.0.0 netmask 255.255.0.0
static (inside,outside) 217.36.32.210 192.168.168.91 netmask 255.255.255.255
static (DMZ,outside) 217.36.32.211 192.168.169.5 netmask 255.255.255.255
static (inside,DMZ) 192.168.168.0 192.168.168.0 netmask 255.255.255.0
static (CNES,DMZ) 187.0.0.0 187.0.0.0 netmask 255.0.0.0
access-group CSM_FW_ACL_inside in interface inside
access-group outside_access_in_1 in interface outside control-plane
access-group outside_access_in in interface outside
access-group CSM_FW_ACL_DMZ in interface DMZ
access-group CSM_FW_ACL_Wireless_HHP in interface Wireless_HHP
access-group CSM_FW_ACL_CNES in interface CNES
route outside 0.0.0.0 0.0.0.0 81.148.0.157 1
route Wireless_HHP 172.20.192.0 255.255.240.0 172.16.36.3 1
route Wireless_HHP 172.20.224.0 255.255.240.0 172.16.36.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server HHP protocol ldap
aaa-server HHP (inside) host 192.168.168.2
timeout 5
ldap-base-dn dc=hhp,dc=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn cn=gramor,cn=users,dc=hhp,dc=com
server-type microsoft
aaa-server HHP_1 protocol ldap
aaa-server HHP_1 (inside) host 192.168.168.2
timeout 5
ldap-base-dn dc=hhp,dc=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn cn=administrator,cn=users,dc=hhp,dc=com
server-type microsoft
aaa-server HHP_3 protocol ldap
aaa-server HHP_3 (inside) host 192.168.168.2
timeout 5
ldap-base-dn dc=hhp,dc=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn cn=administrator,cn=users,dc=hhp,dc=com
server-type microsoft
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.168.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
http 194.83.245.242 255.255.255.255 outside
http 187.187.1.72 255.255.255.255 CNES
http 187.187.10.90 255.255.255.255 CNES
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map outside_map_dynamic 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 81.136.160.237
crypto map outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 30001 ipsec-isakmp dynamic outside_map_dynamic
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment terminal
fqdn none
subject-name O=Hebridean Housing Partnership Limited,CN=secure-access.hebrideanhousing.co.uk,L=Isle of Lewis,ST=Scotland,C=GB
keypair SSL_Certificate
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
fqdn none
crl configure
crypto ca certificate chain ASDM_TrustPoint0
certificate 0100000000012790a5c005
30820530 30820418 a0030201 02020b01 00000000 012790a5 c005300d 06092a86
4886f70d 01010505 00306a31 23302106 0355040b 131a4f72 67616e69 7a617469
6f6e2056 616c6964 6174696f 6e204341 31133011 06035504 0a130a47 6c6f6261
6c536967 6e312e30 2c060355 04031325 476c6f62 616c5369 676e204f 7267616e
697a6174 696f6e20 56616c69 64617469 6f6e2043 41301e17 0d313030 33323431
34313835 385a170d 31333033 32343134 31383534 5a308197 310b3009 06035504
06130247 42311130 0f060355 04081308 53636f74 6c616e64 31163014 06035504
07130d49 736c6520 6f66204c 65776973 312e302c 06035504 0a132548 65627269
6465616e 20486f75 73696e67 20506172 746e6572 73686970 204c696d 69746564
312d302b 06035504 03132473 65637572 652d6163 63657373 2e686562 72696465
616e686f 7573696e 672e636f 2e756b30 82012230 0d06092a 864886f7 0d010101
05000382 010f0030 82010a02 82010100 def181d9 c34c58a8 9abcc849 7d8ad0a9
3c64c77f f3126c81 30911f41 5903a92c 81fb374b 2fe2680e 10b26dce 81ca0c23
af2c9f9a 52295e8c d2223fa6 7c4c386d 51c6fb16 a47688e6 e47e2410 b0283503
fd72abd3 e59d3b02 cd47706e babf948c 4e0282a3 5f789ff7 8041b2db ceac64eb
3e163b38 3a8ecc25 0c4802a8 d17fecd9 f1a36288 29202df4 b20ae891 f95ce055
6e670559 3d075024 7f3ac7ef 26218154 a7f6a399 34c43c4a 97c2c88c c4588ee4
77cc2ad8 b1bd868d d55c2b9b 727e9904 66d0fb52 c212abd7 a06f28f1 ad2aa04b
3d7b3094 c59c00d4 cf51fefb d8bfa101 8ba9c4ba 5cf629ff c50716d3 71019a98
8fa55b83 6b158b6d 1043f092 646ef07d 02030100 01a38201 a7308201 a3301f06
03551d23 04183016 80147d6d 2aec66ab a75136ab 0269f170 8fc4590b 9a1f3049
06082b06 01050507 0101043d 303b3039 06082b06 01050507 3002862d 68747470
3a2f2f73 65637572 652e676c 6f62616c 7369676e 2e6e6574 2f636163 6572742f
6f726776 312e6372 74303f06 03551d1f 04383036 3034a032 a030862e 68747470
3a2f2f63 726c2e67 6c6f6261 6c736967 6e2e6e65 742f4f72 67616e69 7a617469
6f6e5661 6c312e63 726c301d 0603551d 0e041604 14d398d5 ddf29355 15b04750
baccc6b3 0f97a6c9 94302f06 03551d11 04283026 82247365 63757265 2d616363
6573732e 68656272 69646561 6e686f75 73696e67 2e636f2e 756b3009 0603551d
13040230 00300e06 03551d0f 0101ff04 04030205 a0302906 03551d25 04223020
06082b06 01050507 03010608 2b060105 05070302 060a2b06 01040182 370a0303
304b0603 551d2004 44304230 4006092b 06010401 a0320114 30333031 06082b06
01050507 02011625 68747470 3a2f2f77 77772e67 6c6f6261 6c736967 6e2e6e65
742f7265 706f7369 746f7279 2f301106 09608648 0186f842 01010404 030206c0
300d0609 2a864886 f70d0101 05050003 82010100 8af3be01 c4830d83 9b347355
de7496ef bd76b86c ee92f32f 1157ef11 6ad949b6 611537ad 81f06408 73ec6fe2
6466675c cf31a80f bead422d ec574f95 55fe0b7a 97e271e7 0220c7b1 53376843
ff7f7280 f9bfdee6 3584e123 00c37d9f 5004b766 9469ead5 f002744c fd50271c
6bcdb54c e5db85aa 9760a330 d72464a2 bc8ecdff d80bbc27 7551e97c ee9b7078
9207f9d6 b969a47a 6df722b6 14ce803d 8d4bb9e9 4695e8e6 d453950e 06506594
ec7652ea 365cdf94 90e2f7ee 855dadb5 c0459d73 bb6d01a8 3c076718 7f80de40
c5eb9e0e 17c93087 fd5c5fc1 fd6401fe 7e5038b1 3da1d250 01ccd8be 964d5557
b320c4c1 0015d1b7 daad7527 930b0c90 7711704f
quit
crypto ca certificate chain ASDM_TrustPoint1
certificate ca 0400000000011e44a5f52a
30820467 3082034f a0030201 02020b04 00000000 011e44a5 f52a300d 06092a86
4886f70d 01010505 00305731 0b300906 03550406 13024245 31193017 06035504
0a131047 6c6f6261 6c536967 6e206e76 2d736131 10300e06 0355040b 1307526f
6f742043 41311b30 19060355 04031312 476c6f62 616c5369 676e2052 6f6f7420
4341301e 170d3037 30343131 31323030 30305a17 0d313730 34313131 32303030
305a306a 31233021 06035504 0b131a4f 7267616e 697a6174 696f6e20 56616c69
64617469 6f6e2043 41311330 11060355 040a130a 476c6f62 616c5369 676e312e
302c0603 55040313 25476c6f 62616c53 69676e20 4f726761 6e697a61 74696f6e
2056616c 69646174 696f6e20 43413082 0122300d 06092a86 4886f70d 01010105
00038201 0f003082 010a0282 010100a1 2fc4bcce 8703e967 c189c8e5 93fc7db4
ad9ef663 4e6ae89c 2c7389a2 01f48f21 f8fd259d 58166d86 f6ee4957 757e75ea
22117e3d fbc74241 dcfcc50c 9155807b eb64331d 9bf9ca38 e9abc625 43512540
f4e47e18 556aa98f 103a401e d65783ef 7f2f342f 2dd2f653 c2190db7 edc981f5
462cb423 425e9d13 0375ecea 6afc577c c936973b 98dc1313 ecec41fa 5d34eab9
93e71016 65cc9c92 fdf5c59d 3e4ab909 fce45f1e 695f4df4 567244b1 1d2303c8
36f66588 c8bf3916 458e1e26 6c5116c5 2a0038c5 a4136995 7dab013b a8c414b4
80daac1a 4420d5fe a9067b14 27afe030 21dd90f4 a9d52319 2e1e03e6 c1df9529
e4c19443 dd3e90aa cb4bc9be 8ad33902 03010001 a382011f 3082011b 300e0603
551d0f01 01ff0404 03020106 30120603 551d1301 01ff0408 30060101 ff020100
301d0603 551d0e04 1604147d 6d2aec66 aba75136 ab0269f1 708fc459 0b9a1f30
4b060355 1d200444 30423040 06092b06 010401a0 32011430 33303106 082b0601
05050702 01162568 7474703a 2f2f7777 772e676c 6f62616c 7369676e 2e6e6574
2f726570 6f736974 6f72792f 30330603 551d1f04 2c302a30 28a026a0 24862268
7474703a 2f2f6372 6c2e676c 6f62616c 7369676e 2e6e6574 2f726f6f 742e6372
6c301106 09608648 0186f842 01010404 03020204 30200603 551d2504 19301706
0a2b0601 04018237 0a030306 09608648 0186f842 0401301f 0603551d 23041830
16801460 7b661a45 0d97ca89 502f7d04 cd34a8ff fcfd4b30 0d06092a 864886f7
0d010105 05000382 01010079 47fc15d7 4c79df0f 7a9eced4 7c4b63c9 89b57b3f
9912e89c 8c9a492f e04e954a edc7bcbe f1a2db8e 931dba71 54aa4bd9 89222487
c504a8ac 8252a052 f8b8e14f a1276663 214a39e7 c7c54e5f b2d61d13 6d30e9ce
d7a21cbc 290a733c 5b2349fe d6ffcab0 4ff5f267 98c04711 f8b748a6 9009d642
beeab1b9 5342c39c 20c9fba1 5bb5566d 8781c860 acc4b972 270a8e1e a8b12ecd
32a27857 b09cf895 bb438e8c 31866e53 0dc61205 ba416ea8 35300918 1d0261ff
fdee35de 6ac33bd0 4d4b4e50 b256360c 445dda1a 652ae698 56a96333 2e04e7ae
e8f48eb7 b2da7dc0 c8e2aea6 282fe3c9 73bdfc07 4134b7aa 6eeea7db d1933ced
90ec3292 88d9c823 6c7421
quit
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 187.187.1.41 255.255.255.255 inside
ssh 187.187.1.72 255.255.255.255 inside
ssh 187.187.77.81 255.255.255.255 inside
ssh 187.187.10.19 255.255.255.255 inside
ssh 187.187.10.229 255.255.255.255 inside
ssh 187.187.160.7 255.255.255.255 inside
ssh 187.187.1.41 255.255.255.255 outside
ssh 187.187.1.72 255.255.255.255 outside
ssh 187.187.77.81 255.255.255.255 outside
ssh 187.187.10.19 255.255.255.255 outside
ssh 187.187.10.229 255.255.255.255 outside
ssh 187.187.160.7 255.255.255.255 outside
ssh timeout 15
console timeout 0
vpdn group BT request dialout pppoe
vpdn group BT localname B*******.btclick.com
vpdn group BT ppp authentication chap
vpdn username B*******@hg39.btclick.com password *********
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
ssl trust-point ASDM_TrustPoint0 outside vpnlb-ip
webvpn
enable inside
enable outside
group-policy HHP_Remote_Access_1 internal
group-policy HHP_Remote_Access_1 attributes
wins-server value 192.168.168.2 192.168.168.2
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CNES_Support_splitTunnelAcl
group-policy HHP_Remote_Access internal
group-policy HHP_Remote_Access attributes
wins-server value 192.168.168.2 192.168.168.2
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CNES_Support_splitTunnelAcl
group-policy Omfax internal
group-policy Omfax attributes
wins-server value 192.168.168.2 192.168.168.3
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec webvpn
webvpn
svc ask none default webvpn
group-policy MIS_1 internal
group-policy MIS_1 attributes
wins-server value 192.168.168.2 192.168.168.3
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value MIS_splitTunnelAcl
default-domain value hhp.com
group-policy RemoteAccess internal
group-policy RemoteAccess attributes
wins-server value 192.168.168.2 192.168.168.3
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value RemoteAccess_splitTunnelAcl
group-policy CNES_Access internal
group-policy CNES_Access attributes
wins-server value 192.168.168.2 192.168.168.3
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CNES_Support_splitTunnelAcl
group-policy HHP internal
group-policy HHP attributes
dhcp-network-scope none
vpn-access-hours none
vpn-idle-timeout none
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec webvpn
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp disable
split-tunnel-policy tunnelall
split-tunnel-network-list none
split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout none
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
client-firewall none
webvpn
url-list value Severs
filter none
homepage none
port-forward disable
http-proxy disable
sso-server none
svc dtls none
svc keep-installer none
svc rekey time none
svc rekey method none
svc dpd-interval client none
svc dpd-interval gateway none
svc compression none
svc modules none
svc profiles none
svc ask none default webvpn
customization none
http-comp none
user-storage none
storage-key none
hidden-shares none
smart-tunnel disable
activex-relay disable
file-entry disable
file-browsing disable
url-entry disable
deny-message none
group-policy MIS internal
group-policy MIS attributes
wins-server value 192.168.168.2 192.168.168.3
dns-server value 192.168.168.2 192.168.168.3
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value MIS_splitTunnelAcl
username test password Kg/Rgy23do7gPGTv encrypted privilege 0
username test attributes
vpn-group-policy HHP_Remote_Access
username catneil password yOgiHCGobUNIkjcN encrypted privilege 0
username omfax password pvUaCLwilGmQVifd encrypted privilege 0
username backup password IHQbl.JAoESlM9Jv encrypted privilege 0
username misadmin password 8IZXmHa67HIJYHK1 encrypted
username misadmin attributes
service-type remote-access
username gramor password ne829U0rGFVEedhY encrypted privilege 15
username gramor attributes
vpn-group-policy HHP_Remote_Access
webvpn
url-list value Severs
username aim_user password 5OQaWCdB18qiHlOn encrypted privilege 0
username aim_user attributes
vpn-group-policy CNES_Support
username katask password 2WsX.HoqKXuiqkDk encrypted privilege 0
username katask attributes
vpn-group-policy CNES_Support
username janboyd password ZEUyykwzME6hII2i encrypted privilege 0
username marmor password C5n48AiRLXwxAeBQ encrypted privilege 0
username marste password amwTL584WdiT87Tb encrypted privilege 0
username helmah password RvU8c.3w0H3/MJz4 encrypted privilege 0
username anglea password wGlUJDBrmJI.uz./ encrypted privilege 0
username anglea attributes
vpn-group-policy CNES_Support
username fiobuc password 5Uispw90wqvDYerQ encrypted privilege 0
tunnel-group DefaultRAGroup general-attributes
authentication-server-group HHP_1
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group HHP_1
default-group-policy HHP
tunnel-group DefaultWEBVPNGroup webvpn-attributes
nbns-server 192.168.168.2 timeout 2 retry 2
nbns-server 192.168.168.3 timeout 2 retry 2
tunnel-group WebVPN type remote-access
tunnel-group WebVPN general-attributes
authentication-server-group HHP_3
default-group-policy HHP
username-from-certificate UID
tunnel-group CNES_Access -
Site to Site VPN between ASA 5505 and Juniper SSG140 no traffic
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
switchport access vlan 3
interface Ethernet0/2
switchport trunk allowed vlan 20-21,24,28,212-214,227,232-236,254-256
switchport mode trunk
interface Ethernet0/3
switchport trunk allowed vlan 20-21,24,28,212-214,227,232-236,254-256
switchport mode trunk
interface Ethernet0/4
switchport trunk allowed vlan 20-21,24,28,212-214,227,232-236,254-256
switchport mode trunk
interface Ethernet0/5
switchport trunk allowed vlan 20-21,24,28,212-214,227,232-236,254-256
switchport mode trunk
interface Ethernet0/6
switchport trunk allowed vlan 20-21,24,28,212-214,227,232-236,254-256
switchport mode trunk
interface Ethernet0/7
switchport access vlan 250
interface Vlan2
nameif outside
security-level 0
ip address 81.XXX.XXX.XXX 255.255.255.252
interface Vlan3
nameif OUTSIDE_BACK
security-level 0
ip address 41.XXX.XXX.XXX 255.255.255.248
interface Vlan20
nameif XXX
security-level 80
ip address 10.143.0.1 255.255.255.0 standby 10.143.0.2
interface Vlan21
nameif XXX
security-level 90
ip address 10.143.1.1 255.255.255.0 standby 10.143.1.2
interface Vlan24
nameif XXX
security-level 80
ip address 10.143.4.1 255.255.255.0 standby 10.143.4.2
interface Vlan28
nameif XXX
security-level 80
ip address 10.143.8.1 255.255.255.0 standby 10.143.8.2
interface Vlan212
nameif SELF
security-level 80
ip address 10.143.12.1 255.255.255.0 standby 10.143.12.2
interface Vlan213
nameif XXX
security-level 80
ip address 10.143.13.1 255.255.255.0 standby 10.143.13.2
interface Vlan214
nameif BIOFR
security-level 80
ip address 10.143.14.1 255.255.255.0 standby 10.143.14.2
interface Vlan232
nameif MNGT
security-level 80
ip address 10.143.32.1 255.255.255.0 standby 10.143.32.2
interface Vlan233
nameif XXX
security-level 80
ip address 10.143.33.1 255.255.255.0 standby 10.143.33.2
interface Vlan234
nameif XXX
security-level 80
ip address 10.143.34.1 255.255.255.0 standby 10.143.34.2
interface Vlan235
nameif XX
security-level 80
ip address 10.143.35.1 255.255.255.0 standby 10.143.35.2
interface Vlan236
nameif XXX
security-level 80
ip address 10.143.36.1 255.255.255.0 standby 10.143.36.2
interface Vlan250
description LAN Failover Interface
interface Vlan254
nameif TEST
security-level 80
ip address 10.143.254.1 255.255.255.0 standby 10.143.254.2
interface Vlan255
nameif XXX
security-level 100
ip address 10.143.255.1 255.255.255.0 standby 10.143.255.2
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network XXX
subnet 10.143.14.0 255.255.255.0
object network XXX
subnet 10.143.35.0 255.255.255.0
object network XXX
subnet 10.143.1.0 255.255.255.0
object network MGMT
subnet 10.143.32.0 255.255.255.0
object network XXX
subnet 10.143.36.0 255.255.255.0
object network XXX
subnet 10.143.4.0 255.255.252.0
object network XXX
subnet 10.143.33.0 255.255.255.0
object network ACCT
subnet 10.143.34.0 255.255.255.0
object network XXX
subnet 10.143.0.0 255.255.255.0
object network XXX
subnet 10.143.8.0 255.255.255.0
object network XXX
subnet 10.143.12.0 255.255.255.0
object network XXX
subnet 10.143.37.0 255.255.255.0
object network TEST
subnet 10.143.254.0 255.255.255.0
object network XXX
subnet 10.143.255.0 255.255.255.0
object network NETWORK_OBJ_10.143.0.0_16
subnet 10.143.0.0 255.255.0.0
object network NETWORK_OBJ_10.91.0.0_16
subnet 10.91.0.0 255.255.0.0
object-group network vpn-local-network
network-object 10.143.14.0 255.255.255.0
network-object 10.143.35.0 255.255.255.0
network-object 10.143.1.0 255.255.255.0
network-object 10.143.32.0 255.255.255.0
network-object 10.143.36.0 255.255.255.0
network-object 10.143.4.0 255.255.255.0
network-object 10.143.33.0 255.255.255.0
network-object 10.143.34.0 255.255.255.0
object-group network vpn-remote-network
network-object 10.112.0.0 255.255.0.0
access-list ACL_VPN extended permit ip 10.143.0.0 255.255.0.0 10.112.0.0 255.255.0.0
access-list ACL_INSIDE_NONAT extended permit ip 10.143.0.0 255.255.0.0 10.112.0.0 255.255.0.0
access-list PING extended permit icmp any any
access-list PING extended permit icmp any any object-group ALLOW_PING
pager lines 24
logging asdm informational
mtu outside 1500
failover
failover lan unit primary
failover lan interface FAILOVER Vlan250
failover interface ip FAILOVER 10.143.250.1 255.255.255.0 standby 10.143.250.2
no monitor-interface outside
no monitor-interface OUTSIDE_BACK
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-721.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (XXX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XXX interface
nat (XX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XXX interface
nat (XXX,outside) source dynamic XX interface
nat(IT,outside) source dynamic IT interface
nat (TEST,outside) source dynamic TEST interface
nat ( IT,outside) source dynamic IT interface
nat (TEST,outside) source static vpn-local-network vpn-local-network destination static vpn-remote-network vpn-remote-network no-proxy-arp route-lookup
access-group PING in interface outside
access-group PING in interface OUTSIDE_BACK
route outside 0.0.0.0 0.0.0.0 81.XXX.XXX.XXX.XXX 1 track 1
route OUTSIDE_BACK 0.0.0.0 0.0.0.0 41.XXXX
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
sysopt connection preserve-vpn-flows
sla monitor 123
type echo protocol ipIcmpEcho 41.xxx.xxx.xxx interface outside
frequency 10
sla monitor schedule 123 life forever start-time now
crypto ipsec ikev1 transform-set ESP-3DES-ESP-MD5-HMAC esp-3des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto map TEST 1 match address ACL_VPN
crypto map TEST 1 set peer 194.XXX.XXX.XXX
crypto map TEST 1 set ikev1 transform-set ESP-3DES-ESP-MD5-HMAC
crypto map TEST 1 set security-association lifetime seconds 86400
crypto map TEST 1 set security-association lifetime kilobytes 2147483647
crypto map TEST interface outside
crypto ca trustpool policy
no crypto isakmp nat-traversal
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
track 1 rtr 123 reachability
telnet timeout 5
ssh stricthostkeycheck
ssh 10.143.255.0 255.255.255.0 IT
ssh timeout 10
ssh key-exchange group dh-group1-sha1
console timeout 60
management-access IT
dhcpd lease 60000
dhcpd ping_timeout 20
dhcpd domain tls.ad
dhcpd auto_config outside
dhcpd address 10.143.4.10-10.143.4.200 XXX
dhcpd dns 10.91.0.34 8.8.8.8 interface XXX
dhcpd option 3 ip 10.143.4.1 interface XXX
dhcpd enable XXX
dhcpd address 10.143.12.10-10.143.12.200 XXX
dhcpd option 3 ip 10.143.12.1 interface XXX
dhcpd enable XXX
dhcpd address 10.143.14.10-10.143.14.200 XXX
dhcpd option 3 ip 10.143.14.1 interface XXX
dhcpd enable XXX
dhcpd address 10.143.32.10-10.143.32.100 MNGT
dhcpd option 3 ip 10.143.32.1 interface MNGT
dhcpd enable MNGT
dhcpd address 10.143.33.10-10.143.33.100 XXX
dhcpd option 3 ip 10.143.32.1 interface XXX
dhcpd enable XXX
dhcpd address 10.143.34.10-10.143.34.100 XXX
dhcpd option 3 ip 10.143.32.1 interface XXX
dhcpd enable XXX
dhcpd address 10.143.36.10-10.143.36.100 XXX
dhcpd option 3 ip 10.143.32.1 interface XXX
dhcpd enable XXX
dhcpd address 10.143.255.10-10.143.255.200 XXX
dhcpd option 3 ip 10.143.255.1 interface XXX
dhcpd enable IT
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp authenticate
ntp server 10.90.0.34
ntp server 10.91.0.34
ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
group-policy DfltGrpPolicy attributes
vpn-idle-timeout none
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
username tlsnimda password OW03yrp6/wvkyg6E encrypted
tunnel-group 194.XXX.XXX.XXX type ipsec-l2l
tunnel-group 194.XXX.XXX.XXX ipsec-attributes
ikev1 pre-shared-key *****
class-map icmp
match default-inspection-traffic
policy-map icmppolicy
class icmp
inspect icmp
service-policy icmppolicy interface outside
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:e820e629c3cbaf67478c065440ac8138
VPN is up but not passing any traffing
Crypto map tag: TEST, seq num: 1, local addr: 81.xxx.xxx.xxx
access-list ACL_VPN extended permit ip 10.143.0.0 255.255.0.0 10.112.0.0 255.255.0.0
local ident (addr/mask/prot/port): (10.143.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (10.112.0.0/255.255.0.0/0/0)
current_peer: 194.xxx.xxx.xxx
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 10, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 10
local crypto endpt.: 81.xxx.xxx.xxx/0, remote crypto endpt.: 194.xxx.xxx.xx/0
path mtu 1500, ipsec overhead 58(36), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: CC4FACB7
current inbound spi : D8C0AC76
inbound esp sas:
spi: 0xD8C0AC76 (3636505718)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 9367552, crypto-map: TEST
sa timing: remaining key lifetime (kB/sec): (1824522239/3507)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0xCC4FACB7 (3427773623)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 9367552, crypto-map: TEST
sa timing: remaining key lifetime (kB/sec): (1824522239/3507)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
VPN is unstable
Connection terminated for peer 194.XXX.XXX.XX. Reason: Peer Terminate Remote Proxy 10.112.0.0, Local Proxy 10.143.0.0
I cannot pass any traffic through the vpn when it's UP, or ping the other side.
ASA VERSION 9.2I do not think that'll be any problem. Here at work we also use Cisco ADSL 800 Series with vpn between customers' sites without any issues. The ASA should vpn for sure.
-
Unable to establish site to site vpn between asa 5505 an 5510
Hi ALL expert
We are now plan to form a site to site IPSec VPN tunnel between ASA 5505 (ASA Version 8.4) and ASA 5510 (ASA Version 8.0) but failure, would you please teach me how to establish it? Any reference guide?
HugoHere are the links to the cisco config-guides:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/site2sit.html
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/vpn_site2site.html
In addition to VPN you need to look into NAT exemption:
http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cfgnat.html#wp1043541
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_overview.html#wpxref25608
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_rules.html#wp1232160
And lots of examples:
http://www.cisco.com/en/US/products/ps6120/prod_configuration_examples_list.html
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni -
Routable VPN Between ASA and Windows RRAS
Hi all,
I'm trying to figure out the best way to create a routable VPN between my production network and a small DR server that I have colo'd offsite.
On the production side I have an ASA 5515-X (10.1.0.0/23) and on the DR side I have a Windows Server 2012 R2 server running RRAS, DHCP, NAT, and Hyper-V. The DR server has a virtual environment with a subnet of 10.5.0.0/24 behind NAT (diagram attached for a visual). I've seen some tutorials online for how to create a routable VPN between the two, some utilizing the Windows Advanced Firwall to create an IPSec tunnel. So far, I've not been able to get the tunnel to come up.
Before I spend even more time trying to troubleshoot this, I was wondering what the best way to create a secure connection between these two subnets is and if anybody has done something similar successfully.
Thanks,
JasonNone yet, I've been stuck on this for a while now. My latest attempt caused the DR site to go offline and required hands-on at the colo site to get it back online due to a bad ipsec policy, so I've backed off a bit on trying things.
-
S-S VPN between ASA and ASR1001
Hello
we have 2 ASR routers at HQ connected to ISP and there are new remote sites that needs to be connected to HQ via site to site VPN. Each remote branch will have ASA, The outside IPs of both ASRs are in same subnet.
1. Is it possible to acheive redudancy in HQ side in this design ?
2. Can i create L2L tunnels to both ASRs ? If yes how can i make 1 tunnel active and other secondary ?
|ASR1
Users--------L3SW--------ASA---------------ISP----------CPE---------------|
|ASR2
Any suggestions are welcome
ThanksThere are two ways:
Stateful Failover for IPsec
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/15-mt/sec-vpn-availability-15-mt-book/sec-state-fail-ipsec.html
http://packetlife.net/blog/2009/aug/17/fun-ipsec-stateful-failover/
VPN-config with two peers an the ASA.
Here you have two individual gateways on the HQ and the ASA has two tunnel-groups fr both gateways but only one sequence in the crypto-map. The peer-statement has both HQ-IPs configured. -
Issue bringing up VPN between ASA and Checkpoint - HELP
Hi all
We are having major issues bringing up a vpn between our ASA and third party checkpoint, it seems if the checkpoint initiates the connection it works, but if we initiate it from the ASA it doesnt come up.
on the ASA I see the following
any ideas what this is ?
7
Jan 30 2014
11:52:03
715065
IP = 159.50.93.1, IKE MM Initiator FSM error history (struct &0x79c4bb68) , : MM_DONE, EV_ERROR-->MM_WAIT_MSG2, EV_RETRY-->MM_WAIT_MSG2, EV_TIMEOUT-->MM_WAIT_MSG2, NullEvent-->MM_SND_MSG1, EV_SND_MSG-->MM_SND_MSG1, EV_START_TMR-->MM_SND_MSG1, EV_RESEND_MSG-->MM_WAIT_MSG2, EV_RETRYPhase 2 failures means several things:
Encryption domain (interesting traffics) fail to match. Checkpoint tends to supper net network together, by design,
Phase 2 parameters such as ESP, PFS and seconds timeouts do not match.
Why don't you put in relevance configuration on the ASA and if possible, ask the checkpoint firewall guy to do the following on the firewall:
- output of "uname -a" and "fw ver"
- is this Nokia, Windows or Secureplatform Checkpoint?
- run the following commands on the firewall: "debug ike off", "debug ike trunc" and send you the ike.elg file. That file can be decoded with the IKEView.exe and it will tell you exactly where things are wrong.
Disable/turn OFF kilobytes timeouts is not the solution. -
VPN between ASA and IOS router
We have established a VPN tunnel between IOS router and ASA, however it i working only from the latter. What are the common dissimilarities whcih occur between these two devices when setting up VPN?
Do a search for the following on cisco.com- "Most Common L2L and Remote Access IPSec VPN Troubleshooting Solutions"
It should help fix any problems.
HTH and please rate. -
L2l vpn between cisco pix and vpn concentrator 3030
l2l completes phase 1 but cannot seem to complete phase 2. A portion of the debug from the Pix is attached. Anyone got any ideas?
possible transform set mismatch on phase 2.
in the pix, this will be the command's related to something like:
crypto map VPN 20 set transform-set 3desSHA
in the concentrator, it will be found on the main config page for a L2L setup under:
Encryption and Authentication (not the IKE Proposal setting)
or, in the concentrator
configuration--> policy mgmt -->traffic mgmt - SA's--> find the IPSEC SA for this connection and modify -
VPN between ASA 5500 and Cisco 871
Hello.
I recently bought a Cisco 871 and an ASA 5500 device. I would like to configure a VPN connection (LAN-to-LAN), and I would like some help about the ports that need to be opened into both firewalls, ASA and 871.
Thank you.Thank you. The routers where not syncronized.
I have installed on my CA server also an NTP server and everything works now.
I have one more question: how can I connect the CA server to separate zone on my ASA device? Let's say a DMZ zone?
I have 2 public IPs and I want to use one (let's say PRIMARY_IP) for the VPN tunnels, and the other one (let's call it SECONDARY_IP) for the CA server...In other words I want the SECONDARY_IP to be ?assigned? to the CA server; if someone wants to make requests for NTP, or SCEP, or ...let's say TFTP to the SECONDARY_IP, those requests to be forwarded behind the ASA, to the CA.
Can you help me? -
IP-sec site-to-site problem ASA ver 9.1 vs IOS
Hi all,
I'm trying to set up site-to-site vpn between ASA and IOS router, but unsuccessful,
logs are :
1) this end is not behind a nat device
2) Received encrypted packet with no matching SA
the networks are:
172.25.0.0 (inside of ASA) A.A.A.A (outside of ASA) is needed to connect to IOS Router B.B.B.B address with 192.168.1.0 inside network
Below are configs:
ASA:
ASA-5505# sh run
: Saved
ASA Version 9.0(1)
hostname ASA-5505
domain-name 1.kz
names
ip local pool vpn_pool_ASA-5505 192.168.172.2-192.168.172.100 mask 255.255.255.0
ip local pool SAME_NET_ALA 172.25.66.200-172.25.66.210 mask 255.255.255.0
interface Ethernet0/0
switchport access vlan 2
speed 10
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 172.25.66.15 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address A.A.A.A 255.255.255.252
ftp mode passive
clock timezone ALMST 6
clock summer-time ALMDT recurring last Sun Mar 0:00 last Sun Oct 0:00
dns server-group DefaultDNS
domain-name 1.kz
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_172.25.66.0_24
subnet 172.25.66.0 255.255.255.0
object network NETWORK_OBJ_192.168.172.0_25
subnet 192.168.172.0 255.255.255.128
object network NETWORK_OBJ_172.25.66.192_27
subnet 172.25.66.192 255.255.255.224
object network ALA_office
subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_172.25.0.0_16
subnet 172.25.0.0 255.255.0.0
access-list SAME_NET_ALA_splitTunnelAcl standard permit 172.25.66.0 255.255.255.0
access-list SAME_NET_ALA_splitTunnelAcl standard permit 10.0.0.0 255.0.0.0
access-list SAME_NET_ALA_splitTunnelAcl standard permit 172.0.0.0 255.0.0.0
access-list VPN-OUT-INS extended permit ip 192.168.172.0 255.255.255.0 any log
access-list VPN-IN-INS extended permit ip any any log
access-list VPN-OUT-OUT extended permit ip any 192.168.172.0 255.255.255.0 log
access-list VPN-OUT-ALL standard permit any4
access-list net172 standard permit 172.25.0.0 255.255.0.0
access-list net10 standard permit 10.0.0.0 255.0.0.0
access-list outside_cryptomap extended permit ip object NETWORK_OBJ_172.25.66.0_24 object ALA_office
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static NETWORK_OBJ_172.25.66.0_24 NETWORK_OBJ_172.25.66.0_24 destination static NETWORK_OBJ_192.168.172.0_25 NETWORK_OBJ_192.168.172.0_25 no-proxy-arp route-lookup
nat (inside,outside) source static obj_any obj_any destination static NETWORK_OBJ_172.25.66.192_27 NETWORK_OBJ_172.25.66.192_27 no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_172.25.66.0_24 NETWORK_OBJ_172.25.66.0_24 destination static ALA_office ALA_office no-proxy-arp route-lookup
object network obj_any
nat (inside,outside) dynamic interface
nat (inside,outside) after-auto source dynamic any interface
access-group VPN-IN-INS in interface inside
access-group VPN-IN-INS out interface inside
route outside 0.0.0.0 0.0.0.0 88.204.136.165 1
route inside 10.0.0.0 255.0.0.0 172.25.66.1 2
route inside 172.0.0.0 255.0.0.0 172.25.66.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 172.25.66.16 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set Alma-set esp-aes esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer B.B.B.B
crypto map outside_map 1 set ikev1 transform-set Alma-set
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto ca trustpool policy
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto ikev1 policy 5
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
no anyconnect-essentials
group-policy web_access internal
group-policy web_access attributes
vpn-tunnel-protocol ssl-clientless
webvpn
url-list value PRTG
group-policy SAME_NET_ALA internal
group-policy SAME_NET_ALA attributes
dns-server value 8.8.8.8
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SAME_NET_ALA_splitTunnelAcl
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
vpn-tunnel-protocol ikev1
group-policy GroupPolicy_to_ALA internal
tunnel-group SAME_NET_ALA type remote-access
tunnel-group SAME_NET_ALA general-attributes
address-pool SAME_NET_ALA
default-group-policy SAME_NET_ALA
tunnel-group SAME_NET_ALA ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group web_access type remote-access
tunnel-group web_access general-attributes
default-group-policy web_access
tunnel-group B.B.B.B type ipsec-l2l
tunnel-group B.B.B.B general-attributes
default-group-policy GroupPolicy1
tunnel-group B.B.B.B ipsec-attributes
ikev1 pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect http
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:932099620805dc22d9e48a5e04314887
: end
and IOS Router:
R1921_center#sh run
Building configuration...
Current configuration : 6881 bytes
! Last configuration change at 12:22:45 UTC Fri Aug 29 2014 by yerzhan
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname R1921_center
boot-start-marker
boot-end-marker
logging buffered 51200 warnings
aaa new-model
aaa authentication login userauthen local
aaa authorization network groupauthor local
aaa session-id common
ip cef
ip domain name yourdomain.com
no ipv6 cef
multilink bundle-name authenticated
crypto pki trustpoint TP-self-signed-260502430
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-260502430
revocation-check none
rsakeypair TP-self-signed-260502430
crypto pki certificate chain TP-self-signed-260502430
certificate self-signed 01
30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32363035 30323433 30301E17 0D313331 31323630 35343131
355A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3236 30353032
34333030 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
C178A16C 26637A32 E2FE6EB2 DE63FC5D 2F4096D2 1A223CAF 52A122A1 F152F0E0
D2305008 FA312D36 E055D09C 730111B6 487A01D5 629F8DE4 42FF0444 4B3B107A
F6439BA2 970EFE71 C9127F72 F93603E0 11B3F622 73DB1D7C 1889D57C 88C3B141
ED39B0EA 377CE1F7 610F9C76 FC9C843F A81AEFFE 07917A4B 2946032B 207160B9
02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D
23041830 1680146B B9F671FA BDD822DF 76802EEA 161D18D6 9B8C4030 1D060355
1D0E0416 04146BB9 F671FABD D822DF76 802EEA16 1D18D69B 8C40300D 06092A86
4886F70D 01010505 00038181 00B0C56F F1F4F85C 5FE7BF24 27D1DF41 7E9BB9CE
0447910A 07209827 E780FA0D 3A969CD0 12929830 14AAA496 0D17F684 7F841261
56365D9C AA15019C ABC74D0A 3CD4E002 F63AA181 B3CC4461 4E56E58D C8237899
29F48CFA 67C4B84B 95D456C3 F0CF858D 43C758C3 C285FEF1 C002E2C5 DCFB9A8A
6A1DF7E3 EE675EAF 7A608FB7 88
quit
license udi pid CISCO1921/K9 sn FCZ1748C14U
redundancy
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp policy 3
encr 3des
authentication pre-share
group 2
crypto isakmp policy 5
encr aes 256
authentication pre-share
group 2
crypto isakmp key PSK-KEY address A.A.A.A
crypto isakmp key 6 PSK-KEY address 0.0.0.0
crypto isakmp client configuration group ALA-EMP-VPN
key *.*.*.*
dns 8.8.8.8
domain cisco.com
pool ippool
acl 101
netmask 255.255.255.0
crypto ipsec transform-set dmvpn_alad esp-3des esp-md5-hmac
mode transport
crypto ipsec transform-set myset esp-3des esp-md5-hmac
mode tunnel
crypto ipsec transform-set TRIPSECMAX esp-3des esp-md5-hmac
mode transport
crypto ipsec transform-set AES-SHA esp-aes esp-sha-hmac
mode tunnel
crypto ipsec profile MAXPROFILE
set transform-set TRIPSECMAX
crypto ipsec profile dmvpn_profile
set transform-set dmvpn_alad
crypto dynamic-map dynmap 10
set transform-set myset
reverse-route
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 20 ipsec-isakmp
set peer A.A.A.A
set transform-set AES-SHA
match address VPN_ASA_PAV
interface Loopback1
ip address 10.10.10.10 255.255.255.255
interface Tunnel2
ip address 192.168.101.1 255.255.255.240
no ip redirects
ip nhrp authentication NHRPMAX
ip nhrp map multicast dynamic
ip nhrp network-id 4679
ip ospf network broadcast
ip ospf hello-interval 30
ip ospf priority 10
tunnel source GigabitEthernet0/1
tunnel mode gre multipoint
tunnel key 4679
interface Embedded-Service-Engine0/0
no ip address
shutdown
interface GigabitEthernet0/0
description to_LAN
ip address 192.168.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
interface GigabitEthernet0/1
description to_ISP
ip address B.B.B.B 255.255.255.252
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map clientmap
router ospf 100
auto-cost reference-bandwidth 1000
area 0 authentication message-digest
area 192.168.1.0 authentication message-digest
redistribute static subnets
passive-interface default
no passive-interface Tunnel1
network 10.10.10.10 0.0.0.0 area 192.168.1.0
network 192.168.1.0 0.0.0.255 area 192.168.1.0
network 192.168.222.0 0.0.0.15 area 0
router ospf 1
router-id 1.1.1.1
redistribute static subnets
passive-interface default
no passive-interface Tunnel2
network 10.10.10.10 0.0.0.0 area 192.168.1.0
network 192.168.1.0 0.0.0.255 area 192.168.1.0
network 192.168.101.0 0.0.0.15 area 0
ip local pool ippool 192.168.33.1 192.168.33.20
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 111 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 192.168.1.11 22 B.B.B.B 8022 extendable
ip route 0.0.0.0 0.0.0.0 B.B.B.C
ip access-list extended ACL-NAT
deny ip 192.168.1.0 0.0.0.255 172.25.0.0 0.0.255.255
permit ip any any
ip access-list extended ACL-VPN
permit ip 192.168.1.0 0.0.0.255 172.25.0.0 0.0.255.255
ip access-list extended VPN_ASA_PAV
permit ip 192.168.1.0 0.0.0.255 172.25.66.0 0.0.0.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.33.0 0.0.0.255
access-list 111 deny ip 192.168.1.0 0.0.0.255 192.168.33.0 0.0.0.255
access-list 111 permit ip any any
control-plane
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
exec-timeout 0 0
privilege level 15
transport input telnet ssh
line vty 5 15
exec-timeout 0 0
privilege level 15
transport input telnet ssh
scheduler allocate 20000 1000
endDear Richard,
they are mirrorly matches from both sides.
ASA:
access-list outside_cryptomap extended permit ip object NETWORK_OBJ_172.25.66.0_24 object ALA_office
object network NETWORK_OBJ_172.25.66.0_24
subnet 172.25.66.0 255.255.255.0
object network ALA_office
subnet 192.168.1.0 255.255.255.0
IOS:
ip access-list extended VPN_ASA_PAV
permit ip 192.168.1.0 0.0.0.255 172.25.66.0 0.0.0.255 -
Not able to estabislt phase1 of site-to-site VPN
Hi Experts,
Site-B(router)------Modem------Internet--------Site-A(router)
I'm trying to create a Ipsec Site-to-stie VPN between cisco2900 & cisco 861 and below is the scenario. kindly find the connectivity diagram in attached files.
The issue is there is a modem provided by ISP on Site-B and cisco 861 router is connected back to that modem and the connection is given through RJ11 and there is no ADSL port available on Site-B router.
Based on above mentioned scenario here is config
Site B:-
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key CITDENjan2014 address 80.227.xx.xx
crypto ipsec transform-set ETH-to-Dxb esp-3des esp-md5-hmac
mode tunnel
crypto map VPN 1 ipsec-isakmp
set peer 80.227.xx.xx
set transform-set ETH-to-Dxb
match address 110
interface fa 4
ip address 192.168.1.254 255.255.255.0
crypto map VPN
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip access-list ext 110
permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255
Kindly find screenshots of ADSL modem for below information
Configuration on LAN interface of ADSL modem with dual ip address
i have done port forwarding on modem, though i haven't done port forwarding before so i'm not sure it's correct or not.
Site-A router Config:-
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key CITDENjan2014 address 197.156.xx.xx
crypto ipsec transform-set Dxb-to-ETH esp-3des esp-md5-hmac
mode tunnel
crypto map Dxb-to-Nigeria 20 ipsec-isakmp
set peer 197.156.xx.xx
set transform-set Dxb-to-ETH
match address 120
interface GigabitEthernet0/1
ip address 80.227.xx.xx 255.255.255.252
crypto map Dxb-to-Nigeria
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1
access-list 120 permit ip 192.168.10.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 deny ip 192.168.10.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 101 permit ip 192.168.10.0 0.0.0.255 any
ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/1 overload
route-map SDM_RMAP_1 permit 1
match ip address 101
Logs on Site-B router:-
*Apr 16 13:02:06.735: ISAKMP (0): received packet from 80.227.xx.xx dport 500 sport 1 Global (N) NEW SA
*Apr 16 13:02:06.735: ISAKMP: Created a peer struct for 80.227.xx.xx, peer port 1
*Apr 16 13:02:06.735: ISAKMP: New peer created peer = 0x886B0310 peer_handle = 0x8000001D
*Apr 16 13:02:06.735: ISAKMP: Locking peer struct 0x886B0310, refcount 1 for crypto_isakmp_process_block
*Apr 16 13:02:06.735: ISAKMP: local port 500, remote port 1
*Apr 16 13:02:06.735: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 88776A88
*Apr 16 13:02:06.735: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr 16 13:02:06.735: ISAKMP:(0):Old State = IKE_READY New State = IKE_R_MM1
*Apr 16 13:02:06.735: ISAKMP:(0): processing SA payload. message ID = 0
*Apr 16 13:02:06.735: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.735: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
*Apr 16 13:02:06.735: ISAKMP (0): vendor ID is NAT-T RFC 3947
*Apr 16
ETH-CIT# 13:02:06.735: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.735: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
*Apr 16 13:02:06.739: ISAKMP (0): vendor ID is NAT-T v7
*Apr 16 13:02:06.739: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID is NAT-T v3
*Apr 16 13:02:06.739: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID is NAT-T v2
*Apr 16 13:02:06.739: ISAKMP:(0):found peer pre-shared key matching 80.227.xx.xx
*Apr 16 13:02:06.739: ISAKMP:(0): local preshared key found
*Apr 16 13:02:06.739: ISAKMP : Scanning profiles for xauth ...
*Apr 16 13:02:06.739: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
*Apr 16 13:02:06.739: ISAKMP: encryption 3DES-CBC
*Apr 16 13:02:06.739: ISAKMP: hash MD5
*Apr 16 13:02:06.739: ISAKMP: default group 2
*Apr 16 13:02:06.739: ISAKMP: auth pre-share
*Apr 16 13:02:06.739: ISAKMP: life type in seconds
*Apr 16 13:02:06.739: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
*Apr 16 13:02:06.739: ISAKMP:(0):atts are acceptable. Next payload is 0
*Apr 16 13:02:06.739: ISAKMP:(0):Acceptable atts:actual life: 0
*Apr 16 13:02:06.739: ISAKMP:(0):Acceptable atts:life: 0
*Apr 16 13:02:06.739: ISAKMP:(0):Fill atts in sa vpi_length:4
*Apr 16 13:02:06.739: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
*Apr 16 13:02:06.739: ISAKMP:(0):Returning Actual lifetime: 86400
*Apr 16 13:02:06.739: ISAKMP:(0)::Started lifetime timer: 86400.
*Apr 16 13:02:06.739: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
*Apr 16 13:02:06.739: ISAKMP (0): vendor ID is NAT-T RFC 3947
*Apr 16 13:02:06.739: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID seems Unity/DPD but major 245 mismatch
*Apr 16 13:02:06.739: ISAKMP (0): vendor ID is NAT-T v7
*Apr 16 13:02:06.739: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID seems Unity/DPD but major 157 mismatch
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID is NAT-T v3
*Apr 16 13:02:06.739: ISAKMP:(0): processing vendor id payload
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
*Apr 16 13:02:06.739: ISAKMP:(0): vendor ID is NAT-T v2
*Apr 16 13:02:06.739: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr 16 13:02:06.739: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM1
*Apr 16 13:02:06.739: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
*Apr 16 13:02:06.739: ISAKMP:(0): sending packet to 80.227.xx.xx my_port 500 peer_port 1 (R) MM_SA_SETUP
*Apr 16 13:02:06.739: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Apr 16 13:02:06.739: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr 16 13:02:06.739: ISAKMP:(0):Old State = IKE_R_MM1 New State = IKE_R_MM2
*Apr 16 13:02:06.995: ISAKMP (0): received packet from 80.227.xx.xx dport 500 sport 1 Global (R) MM_SA_SETUP
*Apr 16 13:02:06.995: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr 16 13:02:06.999: ISAKMP:(0):Old State = IKE_R_MM2 New State = IKE_R_MM3
*Apr 16 13:02:06.999: ISAKMP:(0): processing KE payload. message ID = 0
*Apr 16 13:02:07.027: ISAKMP:(0): processing NONCE payload. message ID = 0
*Apr 16 13:02:07.027: ISAKMP:(0):found peer pre-shared key matching 80.227.xx.xx
*Apr 16 13:02:07.027: ISAKMP:(2028): processing vendor id payload
*Apr 16 13:02:07.027: ISAKMP:(2028): vendor ID is DPD
*Apr 16 13:02:07.027: ISAKMP:(2028): processing vendor id payload
*Apr 16 13:02:07.027: ISAKMP:(2028): speaking to another IOS box!
*Apr 16 13:02:07.027: ISAKMP:(2028): processing vendor id payload
*Apr 16 13:02:07.027: ISAKMP:(2028): vendor ID seems Unity/DPD but major 241 mismatch
*Apr 16 13:02:07.027: ISAKMP:(2028): vendor ID is XAUTH
*Apr 16 13:02:07.027: ISAKMP:received payload type 20
*Apr 16 13:02:07.027: ISAKMP (2028): NAT found, both nodes inside NAT
*Apr 16 13:02:07.027: ISAKMP:received payload type 20
*Apr 16 13:02:07.027: ISAKMP (2028): NAT found, both nodes inside NAT
*Apr 16 13:02:07.027: ISAKMP:(2028):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr 16 13:02:07.027: ISAKMP:(2028):Old State = IKE_R_MM3 New State = IKE_R_MM3
*Apr 16 13:02:07.027: ISAKMP:(2028): sending packet to 80.227.xx.xx my_port 500 peer_port 1 (R) MM_KEY_EXCH
*Apr 16 13:02:07.027: ISAKMP:(2028):Sending an IKE IPv4 Packet.
*Apr 16 13:02:07.027: ISAKMP:(2028):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr 16 13:02:07.027: ISAKMP:(2028):Old State = IKE_R_MM3 New State = IKE_R_MM4
ETH-CIT#
ETH-CIT#
*Apr 16 13:02:17.027: ISAKMP:(2028): retransmitting phase 1 MM_KEY_EXCH...
*Apr 16 13:02:17.027: ISAKMP (2028): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
*Apr 16 13:02:17.027: ISAKMP:(2028): retransmitting phase 1 MM_KEY_EXCH
*Apr 16 13:02:17.027: ISAKMP:(2028): sending packet to 80.227.xx.xx my_port 500 peer_port 1 (R) MM_KEY_EXCH
*Apr 16 13:02:17.027: ISAKMP:(2028):Sending an IKE IPv4 Packet.
Logs on Site-A router:-
*Apr 16 13:15:28.109: ISAKMP (1263): received packet from 197.156.xx.xx dport 500 sport 500 Global (I) MM_KEY_EXCH
*Apr 16 13:15:28.109: ISAKMP:(1263): phase 1 packet is a duplicate of a previous packet.
*Apr 16 13:15:28.109: ISAKMP:(1263): retransmitting due to retransmit phase 1
*Apr 16 13:15:28.609: ISAKMP:(1263): retransmitting phase 1 MM_KEY_EXCH...
*Apr 16 13:15:28.609: ISAKMP (1263): incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
*Apr 16 13:15:28.609: ISAKMP:(1263): retransmitting phase 1 MM_KEY_EXCH
*Apr 16 13:15:28.609: ISAKMP:(1263): sending packet to 197.156.xx.xx my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
*Apr 16 13:15:28.609: ISAKMP:(1263):Sending an IKE IPv4 Packet.
DXB-CIT#
*Apr 16 13:15:38.109: ISAKMP (1263): received packet from 197.156.xx.xx dport 500 sport 500 Global (I) MM_KEY_EXCH
*Apr 16 13:15:38.109: ISAKMP:(1263): phase 1 packet is a duplicate of a previous packet.
*Apr 16 13:15:38.109: ISAKMP:(1263): retransmitting due to retransmit phase 1
*Apr 16 13:15:38.609: ISAKMP:(1263): retransmitting phase 1 MM_KEY_EXCH...
*Apr 16 13:15:38.609: ISAKMP (1263): incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
*Apr 16 13:15:38.609: ISAKMP:(1263): retransmitting phase 1 MM_KEY_EXCH
*Apr 16 13:15:38.609: ISAKMP:(1263): sending packet to 197.156.xx.xx my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
*Apr 16 13:15:38.609: ISAKMP:(1263):Sending an IKE IPv4 Packet.
DXB-CIT#
*Apr 16 13:15:47.593: ISAKMP: set new node 0 to QM_IDLE
*Apr 16 13:15:47.593: ISAKMP:(1263):SA is still budding. Attached new ipsec request to it. (local 80.227.xx.xx, remote 197.156.xx.xx)
*Apr 16 13:15:47.593: ISAKMP: Error while processing SA request: Failed to initialize SA
*Apr 16 13:15:47.593: ISAKMP: Error while processing KMI message 0, error 2.
*Apr 16 13:15:48.609: ISAKMP:(1263): retransmitting phase 1 MM_KEY_EXCH...
*Apr 16 13:15:48.609: ISAKMP:(1263):peer does not do paranoid keepalives.
*Apr 16 13:15:48.609: ISAKMP:(1263):deleting SA reason "Death by retransmission P1" state (I) MM_KEY_EXCH (peer 197.156.xx.xx)
*Apr 16 13:15:48.609: ISAKMP:(1263):deleting SA reason "Death by retransmission P1" state (I) MM_KEY_EXCH (peer 197.156.xx.xx)
*Apr 16 13:15:48.609: ISAKMP: Unlocking peer struct 0x23193AD4 for isadb_mark_sa_deleted(), count 0
*Apr 16 13:15:48.609: ISAKMP: Deleting peer node by peer_reap for 197.156.xx.xx: 23193AD4
DXB-CIT#
DXB-CIT#
*Apr 16 13:15:48.609: ISAKMP:(1263):deleting node 1134682361 error FALSE reason "IKE deleted"
*Apr 16 13:15:48.609: ISAKMP:(1263):deleting node 680913363 error FALSE reason "IKE deleted"
*Apr 16 13:15:48.609: ISAKMP:(1263):deleting node 1740991762 error FALSE reason "IKE deleted"
*Apr 16 13:15:48.609: ISAKMP:(1263):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
*Apr 16 13:15:48.609: ISAKMP:(1263):Old State = IKE_I_MM5 New State = IKE_DEST_SA
DXB-CIT#
DXB-CIT#shoc cry
DXB-CIT#sho cry isa sa
IPv4 Crypto ISAKMP SA
dst src state conn-id status
197.156.xx.xx 80.227.xx.xx MM_NO_STATE 1263 ACTIVE (deleted)
IPv6 Crypto ISAKMP SA
*Apr 16 13:16:17.593: IPSEC(key_engine): request timer fired: count = 2,
(identity) local= 80.227.xx.xx:0, remote= 197.156.xx.xx:0,
local_proxy= 192.168.10.0/255.255.255.0/256/0,
remote_proxy= 192.168.1.0/255.255.255.0/256/0
*Apr 16 13:16:17.609: IPSEC(sa_request): ,
(key eng. msg.) OUTBOUND local= 80.227.xx.xx:500, remote= 197.156.xx.xx:500,
local_proxy= 192.168.10.0/255.255.255.0/256/0,
remote_proxy= 192.168.1.0/255.255.255.0/256/0,
protocol= ESP, transform= esp-3des esp-md5-hmac (Tunnel),
lifedur= 3600s and 4608000kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
*Apr 16 13:16:17.609: ISAKMP:(0): SA request profile is (NULL)
*Apr 16 13:16:17.609: ISAKMP: Created a peer struct for 197.156.xx.xx, peer port 500
*Apr 16 13:16:17.609: ISAKMP: New peer created peer = 0x23193AD4 peer_handle = 0x80001862
*Apr 16 13:16:17.609: ISAKMP: Locking peer struct 0x23193AD4, refcount 1 for isakmp_initiator
*Apr 16 13:16:17.609: ISAKMP: local port 500, remote port 500
*Apr 16 13:16:17.609: ISAKMP: set new node 0 to QM_IDLE
*Apr 16 13:16:17.609: ISAKMP: Find a dup sa in the avl tree during calling isadb_insert sa = 270A2FD0
*Apr 16 13:16:17.609: ISAKMP:(0):Can not start Aggressive mode, trying Main mode.
*Apr 16 13:16:17.609: ISAKMP:(0):found peer pre-shared key matching 197.156.xx.xx
*Apr 16 13:16:17.609: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
*Apr 16 13:16:17.609: ISAKMP:(0): constructed NAT-T vendor-07 ID
*Apr 16 13:16:17.609: ISAKMP:(0): constructed NAT-T vendor-03 ID
*Apr 16 13:16:17.609: ISAKMP:(0): constructed NAT-T vendor-02 ID
*Apr 16 13:16:17.609: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
*Apr 16 13:16:17.609: ISAKMP:(0):Old State = IKE_READY New State = IKE_I_MM1
*Apr 16 13:16:17.609: ISAKMP:(0): beginning Main Mode exchange
*Apr 16 13:16:17.609: ISAKMP:(0): sending packet to 197.156.xx.xx my_port 500 peer_port 500 (I) MM_NO_STATE
*Apr 16 13:16:17.609: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Apr 16 13:16:17.865: ISAKMP (0): received packet from 197.156.xx.xx dport 500 sport 500 Global (I) MM_NO_STATE
*Apr 16 13:16:17.865: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr 16 13:16:17.865: ISAKMP:(0):Old State = IKE_I_MM1 New State = IKE_I_MM2
*Apr 16 13:16:17.865: ISAKMP:(0): processing SA payload. message ID = 0
*Apr 16 13:16:17.869: ISAKMP:(0): processing vendor id payload
*Apr 16 13:16:17.869: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
*Apr 16 13:16:17.869: ISAKMP (0): vendor ID is NAT-T RFC 3947
*Apr 16 13:16:17.869: ISAKMP:(0):found peer pre-shared key matching 197.156.xx.xx
*Apr 16 13:16:17.869: ISAKMP:(0): local preshared key found
*Apr 16 13:16:17.869: ISAKMP : Scanning profiles for xauth ... ciscocp-ike-profile-1
*Apr 16 13:16:17.869: ISAKMP:(0): Authentication by xauth preshared
*Apr 16 13:16:17.869: ISAKMP:(0):Checking ISAKMP transform 1 against priority 1 policy
*Apr 16 13:16:17.869: ISAKMP: encryption 3DES-CBC
*Apr 16 13:16:17.869: ISAKMP: hash MD5
*Apr 16 13:16:17.869: ISAKMP: default group 2
*Apr 16 13:16:17.869: ISAKMP: auth pre-share
*Apr 16 13:16:17.869: ISAKMP: life type in seconds
*Apr 16 13:16:17.869: ISAKMP: life duration (VPI) of 0x0 0x1 0x51 0x80
*Apr 16 13:16:17.869: ISAKMP:(0):atts are acceptable. Next payload is 0
*Apr 16 13:16:17.869: ISAKMP:(0):Acceptable atts:actual life: 0
*Apr 16 13:16:17.869: ISAKMP:(0):Acceptable atts:life: 0
*Apr 16 13:16:17.869: ISAKMP:(0):Fill atts in sa vpi_length:4
*Apr 16 13:16:17.869: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
*Apr 16 13:16:17.869: ISAKMP:(0):Returning Actual lifetime: 86400
*Apr 16 13:16:17.869: ISAKMP:(0)::Started lifetime timer: 86400.
*Apr 16 13:16:17.869: ISAKMP:(0): processing vendor id payload
*Apr 16 13:16:17.869: ISAKMP:(0): vendor ID seems Unity/DPD but major 69 mismatch
*Apr 16 13:16:17.869: ISAKMP (0): vendor ID is NAT-T RFC 3947
*Apr 16 13:16:17.869: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr 16 13:16:17.869: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM2
*Apr 16 13:16:17.869: ISAKMP:(0): sending packet to 197.156.xx.xx my_port 500 peer_port 500 (I) MM_SA_SETUP
*Apr 16 13:16:17.869: ISAKMP:(0):Sending an IKE IPv4 Packet.
*Apr 16 13:16:17.869: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr 16 13:16:17.869: ISAKMP:(0):Old State = IKE_I_MM2 New State = IKE_I_MM3
*Apr 16 13:16:18.157: ISAKMP (0): received packet from 197.156.xx.xx dport 500 sport 500 Global (I) MM_SA_SETUP
*Apr 16 13:16:18.157: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
*Apr 16 13:16:18.157: ISAKMP:(0):Old State = IKE_I_MM3 New State = IKE_I_MM4
*Apr 16 13:16:18.157: ISAKMP:(0): processing KE payload. message ID = 0
*Apr 16 13:16:18.181: ISAKMP:(0): processing NONCE payload. message ID = 0
*Apr 16 13:16:18.181: ISAKMP:(0):found peer pre-shared key matching 197.156.xx.xx
*Apr 16 13:16:18.181: ISAKMP:(1264): processing vendor id payload
*Apr 16 13:16:18.181: ISAKMP:(1264): vendor ID is Unity
*Apr 16 13:16:18.181: ISAKMP:(1264): processing vendor id payload
*Apr 16 13:16:18.181: ISAKMP:(1264): vendor ID is DPD
*Apr 16 13:16:18.181: ISAKMP:(1264): processing vendor id payload
*Apr 16 13:16:18.185: ISAKMP:(1264): speaking to another IOS box!
*Apr 16 13:16:18.185: ISAKMP:received payload type 20
*Apr 16 13:16:18.185: ISAKMP (1264): NAT found, both nodes inside NAT
*Apr 16 13:16:18.185: ISAKMP:received payload type 20
*Apr 16 13:16:18.185: ISAKMP (1264): NAT found, both nodes inside NAT
*Apr 16 13:16:18.185: ISAKMP:(1264):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
*Apr 16 13:16:18.185: ISAKMP:(1264):Old State = IKE_I_MM4 New State = IKE_I_MM4
*Apr 16 13:16:18.185: ISAKMP:(1264):Send initial contact
*Apr 16 13:16:18.185: ISAKMP:(1264):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
*Apr 16 13:16:18.185: ISAKMP (1264): ID payload
next-payload : 8
type : 1
address : 80.227.xx.xx
protocol : 17
port : 0
length : 12
*Apr 16 13:16:18.185: ISAKMP:(1264):Total payload length: 12
*Apr 16 13:16:18.185: ISAKMP:(1264): sending packet to 197.156.xx.xx my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
*Apr 16 13:16:18.185: ISAKMP:(1264):Sending an IKE IPv4 Packet.
*Apr 16 13:16:18.185: ISAKMP:(1264):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
*Apr 16 13:16:18.185: ISAKMP:(1264):Old State = IKE_I_MM4 New State = IKE_I_MM5
DXB-CIT#
*Apr 16 13:16:28.157: ISAKMP (1264): received packet from 197.156.xx.xx dport 500 sport 500 Global (I) MM_KEY_EXCH
*Apr 16 13:16:28.157: ISAKMP:(1264): phase 1 packet is a duplicate of a previous packet.
*Apr 16 13:16:28.157: ISAKMP:(1264): retransmitting due to retransmit phase 1
*Apr 16 13:16:28.657: ISAKMP:(1264): retransmitting phase 1 MM_KEY_EXCH...
*Apr 16 13:16:28.657: ISAKMP (1264): incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
*Apr 16 13:16:28.657: ISAKMP:(1264): retransmitting phase 1 MM_KEY_EXCH
*Apr 16 13:16:28.657: ISAKMP:(1264): sending packet to 197.156.xx.xx my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
DXB-CIT#
*Apr 16 13:16:28.657: ISAKMP:(1264):Sending an IKE IPv4 Packet.
DXB-CIT#
DXB-CIT#
DXB-CIT#
DXB-CIT#
DXB-CIT#
DXB-CIT#
DXB-CIT#u all
All possible debugging has been turned off
DXB-CIT#
DXB-CIT#
*Apr 16 13:16:38.157: ISAKMP (1264): received packet from 197.156.xx.xx dport 500 sport 500 Global (I) MM_KEY_EXCH
*Apr 16 13:16:38.157: ISAKMP:(1264): phase 1 packet is a duplicate of a previous packet.
*Apr 16 13:16:38.157: ISAKMP:(1264): retransmitting due to retransmit phase 1
*Apr 16 13:16:38.609: ISAKMP:(1263):purging node 1134682361
*Apr 16 13:16:38.609: ISAKMP:(1263):purging node 680913363
*Apr 16 13:16:38.609: ISAKMP:(1263):purging node 1740991762
*Apr 16 13:16:38.657: ISAKMP:(1264): retransmitting phase 1 MM_KEY_EXCH...
*Apr 16 13:16:38.657: ISAKMP (1264): incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
DXB-CIT#
DXB-CIT#
DXB-CIT#
DXB-CIT#
*Apr 16 13:16:38.657: ISAKMP:(1264): retransmitting phase 1 MM_KEY_EXCH
*Apr 16 13:16:38.657: ISAKMP:(1264): sending packet to 197.156.xx.xx my_port 4500 peer_port 4500 (I) MM_KEY_EXCH
*Apr 16 13:16:38.657: ISAKMP:(1264):Sending an IKE IPv4 Packet.Hello salman.abid,
its hard to troubleshoot if there is some 3th party device in way. I tried your config in my lab and I established IPSec successfuly.
So it seems that modem would do some problems during IPSec establishment.
Basically if you are configuring L2L IPSec VPN so there is few things what have to match
1. check cryptomap, transform sets etc. if they match on both sides. Especially preshared keys.
2. permit protocol ESP, ISAKMP (UDP 500), and NAT-T (UDP 4500) if applicable.
3. check default GW is configured properly
4. check NAT configuration
Regarding crypto ipsec nat-transparency udp-encapsulation it could help you but also enable UDP/4500 port.
HTH
Jan -
VPN between PIX 515 Version 6.3(3) and CheckPoint NGX R70.10
I'm trying to setup a simple VPN between a PIX 515 running version 6.3(3) and a Checkpoint running NGX R70.10 and I'm unable to get the tunnel created fully.
What makes it puzzling is that the ACL defining the interesting traffic on the PIX side (which is always the inbound side of the traffic) is registering hits on it's rule. "access-list 130 line 1 permit ip host B.B.B.B D.D.D.0 255.255.255.0 (hitcnt=54)" but the D.D.D.0 address isn't showing up in the debug output below.
Turning the PIX VPN debugging on "debug crypto ipsec" and "debug crypto isakmp" I'm receiving the following output which results in an error and which appears to also have an unexpected ip network (10.27.0.0) being displayed. As displayed below nowhere is the "D.D.D.0" address showing up.
I know this may be confusing to read, but I tried to hide the ip addresses by replacing them with letters. Whatever assistance is appreciated.
crypto_isakmp_process_block:src:A.A.A.A, dest:B.B.B.A spt:500 dpt:500
OAK_QM exchange
oakley_process_quick_mode:
OAK_QM_IDLE
ISAKMP (0): processing SA payload. message ID = 649100472
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_AES
ISAKMP: attributes in transform:
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (VPI) of 0x0 0x0 0xe 0x10
ISAKMP: authenticator is HMAC-SHA
ISAKMP: encaps is 1
ISAKMP: key length is 256
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) dest= B.B.B.A, src= A.A.A.A,
dest_proxy= B.B.B.B/255.255.255.255/0/0 (type=1),
src_proxy= C.C.0.0/255.255.0.0/0/0 (type=4),
protocol= ESP, transform= esp-aes-256 esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x4
IPSEC(validate_transform_proposal): proxy identities not supported
IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) dest= B.B.B.A, src= A.A.A.A,
dest_proxy= C.C.0.0/255.255.0.0/0/0 (type=4),
src_proxy= B.B.B.B/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-aes-256 esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x4
IPSEC(validate_transform_proposal): proxy identities not supported
ISAKMP : Checking IPSec proposal 1
ISAKMP: transform 1, ESP_AES
ISAKMP: attributes in transform:
ISAKMP: SA life type in seconds
ISAKMP: SA life duration (VPI) of 0x0 0x0 0xe 0x10
ISAKMP: authenticator is HMAC-SHA
ISAKMP: encaps is 1
ISAKMP: key length is 256
ISAKMP (0): atts are acceptable.IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) dest= B.B.B.A, src= A.A.A.A,
dest_proxy= B.B.B.B/255.255.255.255/0/0 (type=1),
src_proxy= C.C.0.0/255.255.0.0/0/0 (type=4),
protocol= ESP, transform= esp-aes-256 esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x4
IPSEC(validate_transform_proposal): proxy identities not supported
IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) dest= B.B.B.A, src= A.A.A.A,
dest_proxy= C.C.0.0/255.255.0.0/0/0 (type=4),
src_proxy= B.B.B.B/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-aes-256 esp-sha-hmac ,
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 256, flags= 0x4I just found out that in version 6.x, traffic cannot pass through when the security level are the same.
For VPN Client, user traffic came from outside interface.
If split-tunneling is disabled and user want to access Internet, it has to go out from outside interface as well.
As "same-security-traffic permit inter-interface" is not available in 6.x, it become impossilbe for VPN client to access Internet, when split-tunneling is disabled.
Am I correct?
Maybe you are looking for
-
Dispatcher stops after starting SAP and turning from green to grey
After starting SAP on the SAP Console, the dispatcher turns from green to grey and logging on to SAP is not possible. Below is the developer trace file for the process: SAPPRD\saploc\PRD\DVEBMGS00\work\dev_disp trc file: "dev_disp", trc level: 1, rel
-
Since I changed my laptop to the new version of Firefox it crashes EVERY time the college internet tries to sign on for authorization. It never did this with the previous version. What is supposed to happen is it opens a page that asks me to click "I
-
Text messages do not send or takes too long to send
When i try to send a text they wont send at all or they will take forever to send. i'll also receive texts 30 minutes after they were originally sent.
-
Add Memo Functionality not working in UWL
Hi All, We have added the code in custom UWL to activate the "Add memo" functionality under "You can also:" in portal inbox for the tasks as per suggested in help.sap.com. Now when I enter the value and title, then click on submit under Add Memo, i g
-
Question about "Enhanced for loop"
public class NewLoopTest{ public NewLoopTest(){ int result=0; int[] a=new int[20]; for(int i=0;i<a.length;i++){ a=i++; for(int i:a){ System.out.println("i=