Split Farm - by domain

Please help me here:  Has anyone had experience with a SharePoint farm where members of the farm are in different domains?  For example FE1 is in Domain A and FE2 is in Domain B.  A ONE-WAY trust exists from Domain B to Domain A.  I
don't think that is a supported architecture.  I can't find it anywhere that says it is (or isn't)

I wouldn't advise such an architecture. The domain accounts used for services would have to be in the trusted domain.
What are the benefits the client hopes to have with such an architecture? This is much more complex then it needs to be.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Similar Messages

  • LDOM 1.1 and split I/O domains

    Anyone tried out LDOMs 1.1 yet? Looks like it went GA on December 23th or there about...
    We're setting up a test platform for it. We particularly interested in running it in split PCI switch mode and the disk fail-over between I/O domains that it should permit. We're also glad to see it finally adds dynamic add/removes of disk (VIODR). I'd love to hear others experiences with it, especially in relationship to EMC Clariion storage.
    I must say that I'm just a bit frustrated at the architecture of the current crop of T5x40 systems -- it seems there was little or no thought given to using the split PCI switch configuration to permit I/O domain redundancy. All the local disks reside on one switch and all the built-in network resides on the other. To get two functional I/O domains we'll need to boot one (or both) off the SAN and add a network card (burning up one of the PCI slots which are at a premium in the smaller form factor T5140). And with an add-on card we cannot get the Hybrid I/O for both network ports (only works with the built in Neptune chip).
    What we're hoping to achieve is a system that can take down the Control/IO domain and the secondary IO domain indepedently for patching (required by policy to be pretty frequent) without having to take an outage on all the guests...maybe it's just a pipe dream.
    Cheers!

    LDoms has been released, see http://blogs.sun.com/achartre/ for more info. You will also find
    information about virtual disk multipathing through multiple I/O domains.

  • Domain Splitting and iDisk issues

    First, my apologies if my question has been answered previously. I did search the forums, but didn't find anything promising.
    I have split my large domain.sites file into four separate domain.sites file, following the guidance of folks on this forum. Each domain.sites file contains two sites; a one-page "index" site with links to all my sites and one of my "real" sites. (the index site has a slightly different name in each domain.sites file so I don't ovewrite).
    But now I'm having a dickens of a time keeping all the sites online at the same time. I did some searching in these forums and discovered that I have to do two rounds of "publish all." Since these were existing files, the first time I told one domain file to "publish all," it erased the sites I had deleted from that file. After the second round of publishing, the sites have all come back (except for my biggest one, which I haven't published a second time; I'll do that overnight).
    It looked like I have everything working...until I synced my iDisk. Then one of my sites disappeared again! Plus, some of my sites that I can access on-line don't show up on my iDisk.
    I typically leave my iDisk mounted on my desktop. Do I need to change this if I'm working with multiple domain.sites files?
    Thanks for any help you can provide!

    Thanks to both of you for your help. I after one last publish last night, I got all my sites on line.
    Syncing my iDisk didn't work as well, though. Somehow I ended up with two copies of my iDisk on my desktop: one with the typical globe icon and another with a generic "drive" icon. The globe one was supposedly the current one, saying it had sinced this morning, but it only had some of my sites on it. (Oddly enough, it had each of the index sites, from all four domain.sites files, but not all the "real" sites from those files) The plain "drive" icon idisk had all the files on it. I couldn't get rid of either of them without restarting. But restarting seemed to set things to rights.
    I've taken Varkgirl's advice and don't have my iDisk on my desktop. I didn't really access it much anyway.
    Would it be of benefit to others for me to spell out the steps I took to split my domains and have a site index always show up as the site for the short url? I'd adjust it with some of the things I've learned in the process. I know there are good instructions for domain splitting in this forum already, but I don't know that my approach to a sites index with multiple domains has appeared on the forums before.

  • Interesting experience splitting domain.sites into two sites

    Just thought I would share this interesting experience...
    I have a whole bunch of separate .sites files. (I use iWebSites to do this) I publish them all to .mac but without any difficulty, overwriting, etc. but keep them separate just for ease of use in iWeb.
    I had a .sites file with two websites in it that I wanted to split into separate .sites files. I duplicated the .sites file and opened each one up in iWeb and deleted "half." Then I made a change on one of them and published it. The other "half" disappeaered online!!! I opened the other one and republished and the first one disappeared.
    I was able to rename one of them and the problem was eliminated. But I thought this was interesting! When advising people on how to split domain.sites, keep this in mind!

    I took the suggestion from this thread (thanks to JAMES and VARKGIRL) to upload more sites into .Mac, keeping them in separate domain files.
    It works: the only downside is that iWeb will put as FIRST SITE (reachable when you enter http://web.mac.com/"yourlogin") the first "site" of the last domain file you create.
    If the first site appearing when using your "basic" URL is important to you, you can solve this by copying/re-creating the same first "site" in all of your new domain files.
    I did that with mine (http://web.mac.com/luigi.adami/) and it worked.
    I now have two domain files containing the sites:
    web.mac.com/luigi.adami/FANFIC/home/
    web.mac.com/luigi.adami/RPS/home/
    As I wanted to split my original domain file in smaller ones, the problem remains, though.
    In fact, the idea of splitting the site by duplicating/deleting/republishing has only sense if you have a small site. Mine is over 250 MB and it would be a nightmare to republish every single part. It would make more sense to delete the various reduntant parts after having duplicated the original files and then prevent iWeb from updating (t.i. deleting) the site.
    I knew there was a prepublishstate.plist file you could delete to do that but I cannot find it anymore (was it removed after one of the last iWeb updates?).
    If I was able to make iWeb believe there is nothing to update, the trick explained in this thread would really work.
    Any idea?

  • IP Phone SSL VPN and Split tunneling

    Hi Team,
    I went throught the following document which is very useful:
    https://supportforums.cisco.com/docs/DOC-9124
    The only things i'm not sure about split-tunneling point:
    Group-policy must not be configured with split tunnel or split exclude.  Only tunnel all is the supported tunneling policy
    I could see many implementation when they used split-tunneling, like one of my customer:
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    banner value This system is only for Authorized users.
    dns-server value 10.64.10.13 10.64.10.14
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split-tunnel
    default-domain value prod.mobily.lan
    address-pools value SSLClientPool
    webvpn
      anyconnect keep-installer installed
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect ask none default anyconnect
    username manager-max password XTEsn4mfYvPwC5af encrypted privilege 15
    username manager-max attributes
    vpn-group-policy GroupPolicy1
    tunnel-group PhoneVPN type remote-access
    tunnel-group PhoneVPN general-attributes
    address-pool SSLClientPool
    authentication-server-group AD
    default-group-policy GroupPolicy1
    tunnel-group PhoneVPN webvpn-attributes
    group-url https://84.23.107.10 enable
    ip local pool SSLClientPool 10.200.18.1-10.200.18.254 mask 255.255.254.0
    access-list split-tunnel remark split-tunnel network list
    access-list split-tunnel standard permit 10.0.0.0 255.0.0.0
    It is working for them w/o any issue.
    My question would be
    - is the limitation about split-tunneling still valid? If yes, why it is not recommended?
    Thanks!
    Eva

    Hi,
    If you're not using certificates in client authentication then the SSL handshake will complete before the user is requested to authenticate with username/password.  If this authentication request fails you will see the SSL session terminated immediately following this failure (as in the logs you provided).  Notice the 5 seconds between the SSL session establishment and termination, this is most likely when the user is being authenticated against the aaa server.  If the phone is failing authentication against an external aaa-server you'll want to investigate the logs on that server to determine the root cause of the failure.  The ASA can also provide confirmation of the authentication request/reject with the command 'show aaa-server'.  If you want to see what's going on at an authentication protocol level you can enable several debugs including "debug aaa authentication|common|internal' and protocol specific debugs such as 'debug radius user|session|all' or 'debug ldap'.
    Did this answer your question? If so, please mark it Answered!

  • VPN Split-Tunneling not working

    Hello,
    First off - thanks to all who post here.  I often browse the forums and search for help on here and its very useful, so a great pat on the back for everyone who contributes.  My first time posting so here goes.....
    I have my ASA 5505 v8.2 configured to allow AnyConnect. This is working.  Client can connect and access the remote systems through VPN.  What is causing me a massive headache is that the client loses internet connectivity.  I have played around with my config somewhat so what I am about to post I know for certain is incorrect but any help is greatly appreciated.
    Notes
    1.  The Router was set up for a standard site-to-site VPN which is no longer functional but as you can see all the settings are still in the router.
    2.  The router also has a DMZ setup to allow some clients access to the internet through it using the DMZ
    CONFIGURATION:
    ASA Version 8.2(5)
    hostname MYHOST
    enable password mUUvr2NINofYuSh2 encrypted
    passwd UNDrnIuGV0tAPtz2 encrypted
    names
    name x.x.x.x AIME-SD
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 7
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.101.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.0.0
    interface Vlan7
    no forward interface Vlan1
    nameif DMZ
    security-level 20
    ip address 137.57.183.1 255.255.255.0
    ftp mode passive
    clock timezone MST -7
    object-group network obj_any_dmz
    access-list 10 extended permit ip 192.168.25.0 255.255.255.0 192.168.6.0 255.255                                                                                        .255.0
    access-list no_nat extended permit ip host x.x.x.x 192.168.25.0 255.255.25                                                                                        5.0
    access-list split-tunneling standard permit 192.168.101.0 255.255.255.0
    access-list nonat extended permit ip 192.168.101.0 255.255.255.0 any
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu DMZ 1500
    ip local pool Internal_Range 192.168.101.125-192.168.101.130 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 10 interface
    nat (inside) 0 access-list no_nat
    nat (inside) 1 access-list nonat
    nat (DMZ) 10 137.57.183.0 255.255.255.0
    route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
    route inside 192.168.8.0 255.255.255.0 192.168.101.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable 64000
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set batus esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map batus 100 match address 10
    crypto map batus 100 set peer AIME-SD
    crypto map batus 100 set transform-set batus
    crypto map batus interface outside
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment self
    subject-name CN=MYHOST
    keypair ClientX_cert
    crl configure
    crypto ca certificate chain ASDM_TrustPoint1
    certificate 0f817951
        308201e7 30820150 a0030201 0202040f 81795130 0d06092a 864886f7 0d010105
        05003038 31173015 06035504 03130e41 494d452d 56504e2d 42415455 53311d30
        1b06092a 864886f7 0d010902 160e4149 4d452d56 504e2d42 41545553 301e170d
        31333036 32373137 32393335 5a170d32 33303632 35313732 3933355a 30383117
        30150603 55040313 0e41494d 452d5650 4e2d4241 54555331 1d301b06 092a8648
        86f70d01 0902160e 41494d45 2d56504e 2d424154 55533081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 818100c9 ff840bf4 cfb8d394 2c940430
        1887f25a 49038aa0 1299cf10 bda2a436 227dcdbf f1c5566b c35c2f19 8b3514d3
        4e24f5b1 c8840e8c 60e2b39d bdc0082f 08cce525 97ffefba d42bb087 81b9adb9
        db0a8b2f b643e651 d17cd6f8 f67297f2 d785ef46 c3acbb39 615e1ef1 23db072c
        783fe112 acd6dc80 dc38e94b 6e56fe94 d59d5d02 03010001 300d0609 2a864886
        f70d0101 05050003 8181007e 29e90ea0 e337976e 9006bc02 402fd58a a1d30fe8
        b2c1ab49 a1828ee0 488d1d2f 1dc5d150 3ed85f09 54f099b2 064cd622 dc3d3821
        fca46c69 62231fd2 6e396cd1 7ef586f9 f41205af c2199174 3c5ee887 42b684c9
        7f4d2045 4742adb5 d70c3805 4ad13191 8d802bbc b2bcd8c7 8eec111b 761d89f3
        63ebd49d 30dd06f4 e0fa25
      quit
    crypto isakmp enable outside
    crypto isakmp policy 40
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 DMZ
    ssh timeout 10
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-md5 rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    ssl trust-point ASDM_TrustPoint1 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    svc enable
    group-policy ClientX_access internal
    group-policy ClientX_access attributes
    vpn-tunnel-protocol svc
    split-tunnel-network-list value split-tunneling
    default-domain value access.local
    address-pools value Internal_Range
    ipv6-address-pools none
    webvpn
      svc mtu 1406
      svc rekey time none
      svc rekey method ssl
    username ClientX password ykAxQ227nzontdIh encrypted privilege 15
    username ClientX attributes
    vpn-group-policy ClientX_access
    service-type admin
    tunnel-group x.x.x.x type ipsec-l2l
    tunnel-group x.x.x.x ipsec-attributes
    pre-shared-key *****
    tunnel-group ClientX type remote-access
    tunnel-group ClientX general-attributes
    address-pool Internal_Range
    default-group-policy ClientX_access
    tunnel-group SSLClientProfile type remote-access
    tunnel-group SSLClientProfile general-attributes
    default-group-policy ClientX_access
    tunnel-group ClientX_access type remote-access
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:e7d92a387d1c5f07e14b3c894d159ec1
    : end
    Thank you for any help!!

    Karsten!
    That fixed my internet access problem.  Yippee!
    Unfortunately it seems to have broken my access to the internal network.  Boo!
    I can no longer access/ping anything on the internal IP range (192.168.101.x). 
    I assume this is a nat issue somewhere along the line.  Posting the top half of my config for any assistance and the info requested by Raj (although VPN is connecting fine).  Thank you both for your very prompt replies!!!
    Short Config
    object-group network obj_any_dmz
    access-list 10 extended permit ip 192.168.25.0 255.255.255.0 192.168.6.0 255.255.255.0
    access-list no_nat extended permit ip host x.x.x.x 192.168.25.0 255.255.255.0
    access-list split-tunneling standard permit 192.168.101.0 255.255.255.0
    access-list nonat extended permit ip 192.168.101.0 255.255.255.0 any
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu DMZ 1500
    ip local pool Internal_Range 192.168.101.125-192.168.101.130 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 10 interface
    nat (inside) 0 access-list no_nat
    nat (inside) 1 access-list nonat
    nat (DMZ) 10 137.57.183.0 255.255.255.0
    route outside 0.0.0.0 0.0.0.0 207.229.2.129 1
    route inside 192.168.8.0 255.255.255.0 192.168.101.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    Show vpn-sessiondb svc
    Session Type: SVC
    Username     : ClientX                 Index        : 9
    Assigned IP  : 192.168.101.125        Public IP    : x.x.x.x
    Protocol     : Clientless SSL-Tunnel DTLS-Tunnel
    License      : SSL VPN
    Encryption   : RC4 AES128             Hashing      : MD5 SHA1
    Bytes Tx     : 11662                  Bytes Rx     : 62930
    Group Policy : ClientX_access          Tunnel Group : DefaultWEBVPNGroup
    Login Time   : 22:40:56 MST Mon Jul 1 2013
    Duration     : 0h:11m:08s
    Inactivity   : 0h:00m:00s
    NAC Result   : Unknown
    VLAN Mapping : N/A                    VLAN         : none

  • Setting up second domain at work. It tries to take over DHCP for both domains.

    So I have an existing older domain (Server 03 r2) and it's working normally. 
    I'm setting up a second domain, server 08 r2. Each time I activate DHCP on it it begins handling IPs for both domains causing other issues related to DNS.
    They are different IP Schemas. The existing functional is a 192.168._._. The new is internaly 169.254._._, and has a static IP for the other NIC and ultimately the internet connection. The internal networks exist on the same subnet mask for a level of crossover
    for future data transitions. 
    On the 08 server I'm also having DNS issues. It works fine if I have both NICs plugged in, but not with just the external IP plugged in. It would appear it was giving out it's own domain IPs and getting it's DNS from the existing domain, which puzzles me
    as all these items are set to static on the cards. 
    I would love any available help.
    Thank you!

    Do the same DHCP zones exist within the same switch or VLAN?  If so, they're both going to offer DHCP to any device that requests it regardless of what domain that machine may already belong to.  The first DHCP request that the device sees will
    win.  You can really only have one per switching segment. 
    For the DNS issue, when you say the existing domain, do you mean the 2003R2 domain?  From a command prompt if you run ipconfig /all do you see the 2003 R2 server in there as a DNS Server?  Do you see the 2008 R2 server listed?  If you don't
    see the 2003 R2 server, it may just be that you're getting results from a broadcast. 
    You may just need to split these two domains onto separate VLANs if they're not already.
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
    SWC Unified Communications

  • Domain blocking for video player

    i creat domain blocking for video player.
    in this file i took 2 scence.
    message in scence1 & video player in scene2.
    running fine scence1, next scence2 coming.
    but not run script file in scene2
    var allowed_site:String = "website.com";
    var domain:String = this.root.loaderInfo.url.split("/")[2];
    if (domain.indexOf(allowed_site) >=0 && domain.indexOf(allowed_site) == (domain.length - allowed_site.length))
              play();// Everything's okay.  Proceed.
    else
              // Nothing's okay.  Go away.
              myText.text = "Sorry for viewing";

    var domain:String = this.root.loaderInfo.url.split("/")[2];
    this means "domain" is the 3rd element when the URL is split with "/" - may be this is not what you intended? Perhaps the below is sufficient
    if(loaderInfo.url.indexOf(allowed_site) > -1)
    Kenneth Kawamoto
    http://www.materiaprima.co.uk/

  • PeoplePicker not showing domain accounts from other forest in two way trust

    We recently moved from our old farm in domainA of forestA to a new farm in domainB of forestB. We also have an older farm in domainC in forestC. There is two-way trust between all these forests. By default, Peoplepicker-SearchADForests property is not set
    to anything, so it will only allow forestB accounts to be looked up from AD. But, we want PeoplePicker to lookup users from both domainA and domainB. I used below script to update the settings.
    $wa = Get-SPWebApplication -Identity "https://webapp"
    $oldDomain = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
    $oldDomain.IsForest = $false
    $oldDomain.DomainName = "domainA"
    $wa.PeoplePickerSettings.SearchActiveDirectoryDomains.Add($oldDomain)
    $wa.Update()
    $wa = Get-SPWebApplication -Identity "https://webapp"
    $newDomain = New-Object Microsoft.SharePoint.Administration.SPPeoplePickerSearchActiveDirectoryDomain
    $newDomain.IsForest = $false
    $newDomain.DomainName = "domainB"
    $wa.PeoplePickerSettings.SearchActiveDirectoryDomains.Add($newDomain)
    $wa.Update()
    For some reason, this doesn't work for domainA. Actually, it worked once before, but it stopped working at some point. PeoplePicker is only returning domainB accounts. If I add domainC using above script, it works too, but not for domainB.
    So, my question is obvious - how to make this work? I've searched for an answer a lot and went through all troubleshooting there is, but could not resolve this permanently. Any help is appreciated.
    Thanks.

    Thanks Vladimir. I was able to run it finally in CMD. Here are the results. Now I'm thinking that the ports are not open )) Trevor's app was probably checking the ports in domain controller servers, though not sure.
      TCP    0.0.0.0:80             0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       672
      TCP    0.0.0.0:443            0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       2184
      TCP    0.0.0.0:5985           0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:8081           0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:14004          0.0.0.0:0              LISTENING       1464
      TCP    0.0.0.0:22233          0.0.0.0:0              LISTENING       5240
      TCP    0.0.0.0:22234          0.0.0.0:0              LISTENING       5240
      TCP    0.0.0.0:22236          0.0.0.0:0              LISTENING       5240
      TCP    0.0.0.0:32843          0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:32844          0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING       4
      TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       448
      TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       540
      TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       776
      TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       800
      TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       540
      TCP    0.0.0.0:49177          0.0.0.0:0              LISTENING       928
      TCP    0.0.0.0:49201          0.0.0.0:0              LISTENING       532
      TCP    SERVERIP:139         0.0.0.0:0              LISTENING       4
      TCP    [::]:80                [::]:0                 LISTENING       4
      TCP    [::]:135               [::]:0                 LISTENING       672
      TCP    [::]:443               [::]:0                 LISTENING       4
      TCP    [::]:445               [::]:0                 LISTENING       4
      TCP    [::]:3389              [::]:0                 LISTENING       2184
      TCP    [::]:5985              [::]:0                 LISTENING       4
      TCP    [::]:8081              [::]:0                 LISTENING       4
      TCP    [::]:14004             [::]:0                 LISTENING       1464
      TCP    [::]:22233             [::]:0                 LISTENING       5240
      TCP    [::]:22234             [::]:0                 LISTENING       5240
      TCP    [::]:22236             [::]:0                 LISTENING       5240
      TCP    [::]:32843             [::]:0                 LISTENING       4
      TCP    [::]:32844             [::]:0                 LISTENING       4
      TCP    [::]:47001             [::]:0                 LISTENING       4
      TCP    [::]:49152             [::]:0                 LISTENING       448
      TCP    [::]:49153             [::]:0                 LISTENING       540
      TCP    [::]:49154             [::]:0                 LISTENING       776
      TCP    [::]:49155             [::]:0                 LISTENING       800
      TCP    [::]:49156             [::]:0                 LISTENING       540
      TCP    [::]:49177             [::]:0                 LISTENING       928
      TCP    [::]:49201             [::]:0                 LISTENING       532

  • Configuring Separate Wikis for Different Domains

    Hello:
    I've been trying to configure Lion Server to host several different domains on the same IP.  Configuring the virtual hosts settings using the Server App seem to handle this just fine.  What I'm confounded by, however, is how to have each site/domain have its own separate Wiki content.  No matter which domain I browse to, I can still see all of the wiki content on the server.  For my purposes, it's imperative that the Wikis from each of my sites not be visible to the others.  Has anyone figured out how to do this?  Perhaps there's an easy way to get this done, but it's anything but obvious to me.
    Insights are most appreciated.  Thanks.

    kigrant:
    To be able to publish each site to its own folder you'll have to split your current domain file into 3 files. I use iWebSites to manage multiple sites.. It lets me create multiple sites and multiple domain files.
    If you have multiple sites in one domain file here's the workflow I used to split them into individual site files with iWebSites. Be sure to make a backup copy of your original Domain.sites files before starting the splitting process.
    This lets me edit several sites and only republish the one I want.
    OT

  • ASA5510 VPN not working after upgrade from 8.2 to 8.3

    Hi,
    I have recently upgraded a customer ASA5510 to version 8.3.
    After upgrade web access etc is working fine however VPN is down.
    The config looks very different after the upgrade plus what looks to be duplicate entries.
    I suspect its an access list issue but I'm not sure.
    If anyone has any ideas based on the config below it would be greatly appreciated as I'm at a loss....?!
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password NvZgxFP5WhDo0hQl encrypted
    passwd FNeDAwBbhVaOtVAu encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 217.75.8.203 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    management-only
    boot system disk0:/asa832-k8.bin
    ftp mode passive
    clock timezone GMT/IST 0
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup Inside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network obj-192.168.1.2-04
    host 192.168.1.2
    object network obj-192.168.1.7-04
    host 192.168.1.7
    object network obj-192.168.1.0-02
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.0-02
    subnet 192.168.2.0 255.255.255.0
    object network obj-10.1.2.0-02
    subnet 10.1.2.0 255.255.255.0
    object network obj-192.168.1.224-02
    subnet 192.168.1.224 255.255.255.240
    object network obj-192.168.1.9-02
    host 192.168.1.9
    object network obj-192.168.1.2-05
    host 192.168.1.2
    object network obj-192.168.1.103-02
    host 192.168.1.103
    object network obj-192.168.1.7-05
    host 192.168.1.7
    object network NETWORK_OBJ_10.1.2.0_24
    subnet 10.1.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group network obj-192.168.1.2-02
    object-group network obj-192.168.1.7-02
    object-group network obj-192.168.1.0-01
    object-group network obj-192.168.2.0-01
    object-group network obj-10.1.2.0-01
    object-group network obj-192.168.1.224-01
    object-group network obj-192.168.1.9-01
    object-group network obj-192.168.1.2-03
    object-group network obj-192.168.1.103-01
    object-group network obj-192.168.1.7-03
    object-group network obj-192.168.1.2
    object-group network obj-192.168.1.7
    object-group network obj-192.168.1.0
    object-group network obj-192.168.2.0
    object-group network obj-10.1.2.0
    object-group network obj-192.168.1.224
    object-group network obj-192.168.1.9
    object-group network obj-192.168.1.2-01
    object-group network obj-192.168.1.103
    object-group network obj-192.168.1.7-01
    object-group network obj_any
    object-group network obj-0.0.0.0
    object-group network obj_any-01
    object-group service MonitcomUDP udp
    port-object range 3924 3924
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip any 192.168.1.224 255.255.255.240
    access-list Outside_cryptomap_60 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_cryptomap_60 extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq smtp
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq pop3
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq 2000 inactive
    access-list Outside_access_in extended permit icmp any any
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in extended permit tcp any host 217.75.8.204 eq 1200
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in extended permit tcp host 87.232.117.66 host 217.75.8.205 eq 5900
    access-list Outside_access_in extended permit udp any host 217.75.8.205 eq 3924
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 220
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 230
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 240
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 250
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 260
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 1433
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in extended permit tcp any host 217.75.8.206 eq www
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq https
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq www
    access-list Outside_access_in extended permit udp any any eq 4500 inactive
    access-list Outside_access_in extended permit udp any any eq isakmp inactive
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Inside_access_in extended permit ip any any
    access-list Inside_access_in extended permit icmp any any
    access-list RemoteVPN_splitTunnelAcl standard permit any
    access-list Outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Outside_cryptomap_dyn_20 extended permit ip any 192.168.1.224 255.255.255.240
    pager lines 24
    logging enable
    logging asdm warnings
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool VPNPool 192.168.1.230-192.168.1.240 mask 255.255.255.0
    ip verify reverse-path interface Outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    icmp permit any Inside
    asdm location 192.168.1.208 255.255.255.252 Inside
    asdm location 192.168.1.103 255.255.255.255 Inside
    asdm location 192.168.1.6 255.255.255.255 Inside
    asdm location 192.168.1.7 255.255.255.255 Inside
    asdm location 192.168.1.9 255.255.255.255 Inside
    no asdm history enable
    arp timeout 14400
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-192.168.2.0-02 obj-192.168.2.0-02 unidirectional
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-10.1.2.0-02 obj-10.1.2.0-02 unidirectional
    nat (Inside,any) source static any any destination static obj-192.168.1.224-02 obj-192.168.1.224-02 unidirectional
    nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.1.2.0_24 NETWORK_OBJ_10.1.2.0_24
    object network obj-192.168.1.2-04
    nat (Outside,Inside) static 217.75.8.204
    object network obj-192.168.1.7-04
    nat (Outside,Inside) static 217.75.8.206
    object network obj-192.168.1.0-02
    nat (Inside,Outside) dynamic interface
    object network obj-192.168.1.9-02
    nat (Inside,Outside) static 217.75.8.201
    object network obj-192.168.1.2-05
    nat (Inside,Outside) static 217.75.8.204
    object network obj-192.168.1.103-02
    nat (Inside,Outside) static 217.75.8.205
    object network obj-192.168.1.7-05
    nat (Inside,Outside) static 217.75.8.206
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    route Outside 0.0.0.0 0.0.0.0 217.75.8.198 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server DellServerAAA protocol radius
    aaa-server DellServerAAA (Inside) host 192.168.1.4
    key test
    http server enable
    http 62.17.29.2 255.255.255.255 Outside
    http 82.141.224.155 255.255.255.255 Outside
    http 63.218.54.8 255.255.255.252 Outside
    http 213.79.44.213 255.255.255.255 Outside
    http 192.168.1.0 255.255.255.0 Inside
    http 10.1.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec df-bit clear-df Outside
    crypto ipsec df-bit clear-df Inside
    crypto dynamic-map Outside_dyn_map 20 match address Outside_cryptomap_dyn_20
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set peer 89.127.172.29
    crypto map Outside_map 1 set transform-set ESP-3DES-SHA
    crypto map Outside_map 60 match address Outside_cryptomap_60
    crypto map Outside_map 60 set peer 89.105.114.98
    crypto map Outside_map 60 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface Outside
    crypto isakmp identity key-id nattingreallymatters
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet 192.168.1.0 255.255.255.0 Inside
    telnet timeout 5
    ssh 82.141.224.155 255.255.255.255 Outside
    ssh 62.17.29.2 255.255.255.255 Outside
    ssh 213.79.44.213 255.255.255.255 Outside
    ssh 192.168.1.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy RemoteVPN internal
    group-policy RemoteVPN attributes
    wins-server value 192.168.1.31
    dns-server value 192.168.1.31
    default-domain value freefoam.ie
    username freefoam password JLYaVf7FqRM2LH0e encrypted
    username cork password qbK2Hqt1H5ttJzPD encrypted
    tunnel-group 193.114.70.130 type ipsec-l2l
    tunnel-group 193.114.70.130 ipsec-attributes
    pre-shared-key ******
    tunnel-group 89.127.172.29 type ipsec-l2l
    tunnel-group 89.127.172.29 ipsec-attributes
    pre-shared-key ******
    tunnel-group 89.105.114.98 type ipsec-l2l
    tunnel-group 89.105.114.98 ipsec-attributes
    pre-shared-key *****
    tunnel-group RemoteVPN type remote-access
    tunnel-group RemoteVPN general-attributes
    address-pool VPNPool
    authentication-server-group DellServerAAA
    default-group-policy RemoteVPN
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:0dc16fe893bd4bba6fdf6b7eed93e553

    Hi,
    Many thanks for your reply.
    Finally got access to implement your suggestions.
    Initially none of the VPN's were up.
    After making the change the two VPN's came up.
    However only data via the first VPN is possible.
    Accessing resources on the 10.1.2.0 network is still not possible.
    Attached is the latest config, any input is greatly appreciated;
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password NvZgxFP5WhDo0hQl encrypted
    passwd FNeDAwBbhVaOtVAu encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 217.75.8.203 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.1.254 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 10.1.1.1 255.255.255.0
    management-only
    boot system disk0:/asa832-k8.bin
    ftp mode passive
    clock timezone GMT/IST 0
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup Inside
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    object network obj-192.168.1.2-04
    host 192.168.1.2
    object network obj-192.168.1.7-04
    host 192.168.1.7
    object network obj-192.168.1.0-02
    subnet 192.168.1.0 255.255.255.0
    object network obj-192.168.2.0-02
    subnet 192.168.2.0 255.255.255.0
    object network obj-10.1.2.0-02
    subnet 10.1.2.0 255.255.255.0
    object network obj-192.168.1.224-02
    subnet 192.168.1.224 255.255.255.240
    object network obj-192.168.1.9-02
    host 192.168.1.9
    object network obj-192.168.1.2-05
    host 192.168.1.2
    object network obj-192.168.1.103-02
    host 192.168.1.103
    object network obj-192.168.1.7-05
    host 192.168.1.7
    object network NETWORK_OBJ_10.1.2.0_24
    subnet 10.1.2.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group network obj-192.168.1.2-02
    object-group network obj-192.168.1.7-02
    object-group network obj-192.168.1.0-01
    object-group network obj-192.168.2.0-01
    object-group network obj-10.1.2.0-01
    object-group network obj-192.168.1.224-01
    object-group network obj-192.168.1.9-01
    object-group network obj-192.168.1.2-03
    object-group network obj-192.168.1.103-01
    object-group network obj-192.168.1.7-03
    object-group network obj-192.168.1.2
    object-group network obj-192.168.1.7
    object-group network obj-192.168.1.0
    object-group network obj-192.168.2.0
    object-group network obj-10.1.2.0
    object-group network obj-192.168.1.224
    object-group network obj-192.168.1.9
    object-group network obj-192.168.1.2-01
    object-group network obj-192.168.1.103
    object-group network obj-192.168.1.7-01
    object-group network obj_any
    object-group network obj-0.0.0.0
    object-group network obj_any-01
    object-group service MonitcomUDP udp
    port-object range 3924 3924
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_inbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Inside_nat0_outbound extended permit ip any 192.168.1.224 255.255.255.240
    access-list Outside_cryptomap_60 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_cryptomap_60 extended permit icmp 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq smtp
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq pop3
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq 2000 inactive
    access-list Outside_access_in extended permit icmp any any
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in extended permit tcp any host 217.75.8.204 eq 1200
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in extended permit tcp host 87.232.117.66 host 217.75.8.205 eq 5900
    access-list Outside_access_in extended permit udp any host 217.75.8.205 eq 3924
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 220
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 230
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 240
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 250
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 260
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in extended permit tcp host 196.36.153.251 any eq 1433
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in extended permit tcp any host 217.75.8.206 eq www
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq https
    access-list Outside_access_in extended permit tcp any host 217.75.8.201 eq www
    access-list Outside_access_in extended permit udp any any eq 4500 inactive
    access-list Outside_access_in extended permit udp any any eq isakmp inactive
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Outside_access_in remark Allow webmail access
    access-list Outside_access_in remark Allow Hansa Live access
    access-list Outside_access_in remark Monitcom
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark ESS Access
    access-list Outside_access_in remark Allow TMS Web Access
    access-list Inside_access_in extended permit ip any any
    access-list Inside_access_in extended permit icmp any any
    access-list RemoteVPN_splitTunnelAcl standard permit any
    access-list Outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Outside_cryptomap_dyn_20 extended permit ip any 192.168.1.224 255.255.255.240
    access-list global_access extended permit ip any any
    access-list Outside_cryptomap_80_3 extended permit ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0
    access-list Split-tunnel standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm warnings
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool VPNPool 192.168.1.230-192.168.1.240 mask 255.255.255.0
    ip verify reverse-path interface Outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Outside
    icmp permit any Inside
    asdm image disk0:/asdm-647.bin
    asdm location 192.168.1.208 255.255.255.252 Inside
    asdm location 192.168.1.103 255.255.255.255 Inside
    asdm location 192.168.1.6 255.255.255.255 Inside
    asdm location 192.168.1.7 255.255.255.255 Inside
    asdm location 192.168.1.9 255.255.255.255 Inside
    no asdm history enable
    arp timeout 14400
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-192.168.2.0-02 obj-192.168.2.0-02
    nat (Inside,any) source static obj-192.168.1.0-02 obj-192.168.1.0-02 destination static obj-10.1.2.0-02 obj-10.1.2.0-02
    nat (Inside,any) source static any any destination static obj-192.168.1.224-02 obj-192.168.1.224-02 unidirectional
    nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_10.1.2.0_24 NETWORK_OBJ_10.1.2.0_24
    object network obj-192.168.1.2-04
    nat (Outside,Inside) static 217.75.8.204
    object network obj-192.168.1.7-04
    nat (Outside,Inside) static 217.75.8.206
    object network obj-192.168.1.0-02
    nat (Inside,Outside) dynamic interface
    object network obj-192.168.1.9-02
    nat (Inside,Outside) static 217.75.8.201
    object network obj-192.168.1.2-05
    nat (Inside,Outside) static 217.75.8.204
    object network obj-192.168.1.103-02
    nat (Inside,Outside) static 217.75.8.205
    object network obj-192.168.1.7-05
    nat (Inside,Outside) static 217.75.8.206
    nat (Inside,Outside) after-auto source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    access-group global_access global
    route Outside 0.0.0.0 0.0.0.0 217.75.8.198 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server DellServerAAA protocol radius
    aaa-server DellServerAAA (Inside) host 192.168.1.4
    key test
    http server enable
    http 62.17.29.2 255.255.255.255 Outside
    http 82.141.224.155 255.255.255.255 Outside
    http 63.218.54.8 255.255.255.252 Outside
    http 213.79.44.213 255.255.255.255 Outside
    http 192.168.1.0 255.255.255.0 Inside
    http 10.1.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection timewait
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ipsec df-bit clear-df Outside
    crypto ipsec df-bit clear-df Inside
    crypto dynamic-map Outside_dyn_map 20 match address Outside_cryptomap_dyn_20
    crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map Outside_map 1 match address Outside_1_cryptomap
    crypto map Outside_map 1 set peer 89.127.172.29
    crypto map Outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-DES-SHA ESP-3DES-MD5 ESP-AES-256-MD5 ESP-3DES-SHA ESP-DES-MD5
    crypto map Outside_map 60 match address Outside_cryptomap_60
    crypto map Outside_map 60 set peer 89.105.114.98
    crypto map Outside_map 60 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
    crypto map Outside_map interface Outside
    crypto isakmp identity key-id nattingreallymatters
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash md5
    group 5
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    telnet 192.168.1.0 255.255.255.0 Inside
    telnet timeout 5
    ssh 82.141.224.155 255.255.255.255 Outside
    ssh 62.17.29.2 255.255.255.255 Outside
    ssh 213.79.44.213 255.255.255.255 Outside
    ssh 192.168.1.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable Outside
    anyconnect-essentials
    svc image disk0:/anyconnect-dart-win-2.5.3055-k9.pkg 1
    svc image disk0:/anyconnect-macosx-powerpc-2.5.3055-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy RemoteVPN internal
    group-policy RemoteVPN attributes
    wins-server value 192.168.1.31
    dns-server value 192.168.1.31
    vpn-tunnel-protocol IPSec svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Split-tunnel
    default-domain value freefoam.ie
    username freefoam password JLYaVf7FqRM2LH0e encrypted
    username cisco password DfO7NBd5PZ1b0kZ1 encrypted privilege 15
    username cork password qbK2Hqt1H5ttJzPD encrypted
    tunnel-group 193.114.70.130 type ipsec-l2l
    tunnel-group 193.114.70.130 ipsec-attributes
    pre-shared-key ************
    tunnel-group 89.127.172.29 type ipsec-l2l
    tunnel-group 89.127.172.29 ipsec-attributes
    pre-shared-key ************
    tunnel-group 89.105.114.98 type ipsec-l2l
    tunnel-group 89.105.114.98 ipsec-attributes
    pre-shared-key ************
    tunnel-group RemoteVPN type remote-access
    tunnel-group RemoteVPN general-attributes
    address-pool VPNPool
    authentication-server-group DellServerAAA
    default-group-policy RemoteVPN
    tunnel-group RemoteVPN webvpn-attributes
    group-alias Anyconnect enable
    tunnel-group RemoteVPN ipsec-attributes
    pre-shared-key c0nnect10nParameter$
    class-map inspection_default
    match default-inspection-traffic
    policy-map global_policy
    class inspection_default
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:fae6b7bc25fcf39daffbcdc6b91c9d8e

  • AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside network

    My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.
    I have seen other people that appeared to have similar posts but none of those solutions have worked for me.  I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly.  I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.
    My configuration is included below.
    Thank you in advance for your assistance.
    Jerry
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password (removed)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f2c7362097b71bcada023c6bbfc45121
    : end

    Hi,
    Yes, I have saved the config and did a write erase and reloaded the config, no difference. I rebuilt it once a couple of weeks ago, but that was before I had gotten this far with your assistance.  I'll include my ASA and switches configs after this. Here is a little background (took it form the Firewall section issue just because it gives a little insight for the network). I have 2 3560s, one as a L3 switch the other L2 with an etherchannel between them (one of the cables was bad so I am waiting on the replacement to have 2 - Gigabit channels between the switches).
    I think our issue with the VPN not getting to the Inside is posibly related to my DMZ issue not getting to the internet.
    I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.
    I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.
    The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet.  I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.
    E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).
    So for a simple diagram:
    PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)
    I will be back at this tomorrow morning - I've been up since 4pm yesterday and it is almost 3pm.
    Thank you for all of your assistance.
    Jerry
    Current ASA Config:
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password $$$$$$$$$$$$$$$ encrypted
    passwd $$$$$$$$$$$$$$$$ encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    switchport access vlan 20
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    object network INSIDE
    subnet 10.0.1.0 255.255.255.0
    access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222
    access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22
    access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222
    access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231
    access-list capvpn extended permit icmp host 192.168.60.20 host 10.1.10.23
    access-list capvpn extended permit icmp host 10.1.10.23 host 192.168.60.20
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0
    access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0
    access-list capins extended permit icmp host 10.1.10.23 host 10.0.1.1
    access-list capins extended permit icmp host 10.0.1.1 host 10.1.10.23
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) after-auto source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f6d9bbacca2a5c8b5af946a8ddc12550
    : end
    L3 3560 connects to ASA via port f0/3 routed port 10.0.1.0/24 network
    Connects to second 3560 via G0/3 & G0/4
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560a
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    authentication mac-move permit
    ip subnet-zero
    ip routing
    ip dhcp excluded-address 10.1.10.1 10.1.10.20
    ip dhcp excluded-address 10.1.12.1 10.1.12.20
    ip dhcp excluded-address 10.1.14.1 10.1.14.20
    ip dhcp excluded-address 10.1.16.1 10.1.16.20
    ip dhcp excluded-address 10.1.30.1 10.1.30.20
    ip dhcp excluded-address 10.1.35.1 10.1.35.20
    ip dhcp excluded-address 10.1.50.1 10.1.50.20
    ip dhcp excluded-address 10.1.80.1 10.1.80.20
    ip dhcp excluded-address 10.1.90.1 10.1.90.20
    ip dhcp excluded-address 10.1.100.1 10.1.100.20
    ip dhcp excluded-address 10.1.101.1 10.1.101.20
    ip dhcp pool VLAN10
       network 10.1.10.0 255.255.255.0
       default-router 10.1.10.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN12
       network 10.1.12.0 255.255.255.0
       default-router 10.1.12.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN14
       network 10.1.14.0 255.255.255.0
       default-router 10.1.14.1
       option 150 ip 10.1.13.1
    ip dhcp pool VLAN16
       network 10.1.16.0 255.255.255.0
       default-router 10.1.16.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN30
       network 10.1.30.0 255.255.255.0
       default-router 10.1.30.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN35
       network 10.1.35.0 255.255.255.0
       default-router 10.1.35.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN50
       network 10.1.50.0 255.255.255.0
       default-router 10.1.50.1
       option 43 hex f104.0a01.6564
    ip dhcp pool VLAN80
       network 10.1.80.0 255.255.255.0
       default-router 10.1.80.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN90
       network 10.1.90.0 255.255.255.0
       default-router 10.1.90.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN100
       network 10.1.100.0 255.255.255.0
       default-router 10.1.100.1
    ip dhcp pool VLAN101
       network 10.1.101.0 255.255.255.0
       default-router 10.1.101.1
    ip dhcp pool VLAN40
       dns-server 208.67.222.222 208.67.220.220
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree etherchannel guard misconfig
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    link state group 1 downstream
    interface FastEthernet0/1
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 100
    switchport mode trunk
    power inline never
    interface FastEthernet0/2
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/3
    description Interface to MXFW E0/1
    no switchport
    ip address 10.0.1.2 255.255.255.0
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/6
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    power inline never
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/11
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/18
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/19
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/22
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/24
    switchport access vlan 35
    switchport mode access
    power inline never
    interface FastEthernet0/25
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/26
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/27
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/34
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/35
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/38
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/42
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/43
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport mode access
    shutdown
    power inline never
    interface GigabitEthernet0/1
    description Interface to MXC2911 Port G0/0
    no switchport
    ip address 10.1.13.2 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    shutdown
    interface Vlan10
    ip address 10.1.10.1 255.255.255.0
    interface Vlan12
    ip address 10.1.12.1 255.255.255.0
    interface Vlan14
    ip address 10.1.14.1 255.255.255.0
    interface Vlan16
    ip address 10.1.16.1 255.255.255.0
    interface Vlan20
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    ip address 172.26.22.1 255.255.255.0
    interface Vlan30
    ip address 10.1.30.1 255.255.255.0
    interface Vlan35
    ip address 10.1.35.1 255.255.255.0
    interface Vlan40
    ip address 10.1.40.1 255.255.255.0
    interface Vlan50
    ip address 10.1.50.1 255.255.255.0
    interface Vlan80
    ip address 172.16.80.1 255.255.255.0
    interface Vlan86
    no ip address
    shutdown
    interface Vlan90
    ip address 10.1.90.1 255.255.255.0
    interface Vlan100
    ip address 10.1.100.1 255.255.255.0
    interface Vlan101
    ip address 10.1.101.1 255.255.255.0
    router eigrp 1
    network 10.0.0.0
    network 10.1.13.0 0.0.0.255
    network 10.1.14.0 0.0.0.255
    passive-interface default
    no passive-interface GigabitEthernet0/1
    ip classless
    ip route 0.0.0.0 0.0.0.0 FastEthernet0/3 10.0.1.1
    ip route 192.168.60.0 255.255.255.0 FastEthernet0/3 10.0.1.1 2
    ip http server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end
    L3 3560 Route Table (I added 192.168.60.0/24 instead of just using the default route just in case it wasn't routing for some reason - no change)
    mx3560a#sho ip route
    Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route
    Gateway of last resort is 10.0.1.1 to network 0.0.0.0
    S    192.168.60.0/24 [2/0] via 10.0.1.1, FastEthernet0/3
         172.16.0.0/24 is subnetted, 1 subnets
    C       172.16.80.0 is directly connected, Vlan80
         172.26.0.0/24 is subnetted, 2 subnets
    C       172.26.22.0 is directly connected, Vlan22
    C       172.26.20.0 is directly connected, Vlan20
         10.0.0.0/8 is variably subnetted, 14 subnets, 2 masks
    C       10.1.10.0/24 is directly connected, Vlan10
    D       10.1.13.5/32 [90/3072] via 10.1.13.1, 4d02h, GigabitEthernet0/1
    C       10.1.14.0/24 is directly connected, Vlan14
    C       10.1.13.0/24 is directly connected, GigabitEthernet0/1
    C       10.1.12.0/24 is directly connected, Vlan12
    C       10.0.1.0/24 is directly connected, FastEthernet0/3
    C       10.1.30.0/24 is directly connected, Vlan30
    C       10.1.16.0/24 is directly connected, Vlan16
    C       10.1.40.0/24 is directly connected, Vlan40
    C       10.1.35.0/24 is directly connected, Vlan35
    C       10.1.50.0/24 is directly connected, Vlan50
    C       10.1.90.0/24 is directly connected, Vlan90
    C       10.1.101.0/24 is directly connected, Vlan101
    C       10.1.100.0/24 is directly connected, Vlan100
    S*   0.0.0.0/0 [1/0] via 10.0.1.1, FastEthernet0/3
    I have a C2911 for CME on G0/1 - using it only for that purpose at this time.
    L2 3560 Config it connects to the ASA as a trunk on e0/5 of the ASA and port f0/3 of the switch - I am using L2 switching for the DMZ networks from the switches to the ASA and allowing the ASA to provide the DHCP and routing out of the network. DMZ networks: 172.26.20.0/24 and 172.26.22.0/24.
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560b
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    crypto pki trustpoint TP-self-signed-3877365632
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3877365632
    revocation-check none
    rsakeypair TP-self-signed-3877365632
    crypto pki certificate chain TP-self-signed-3877365632
    certificate self-signed 01
      30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 33383737 33363536 3332301E 170D3933 30333031 30303031
      30395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 38373733
      36353633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100DF81 DA515E0B 7FC760CF 2CC98400 42DCA007 215E4DDE D0C3FBF2 D974CE85
      C46A8700 6AE44C2C 79D9BD2A A9297FA0 2D9C2BE4 B3941A2F 435AC4EA 17E89DFE
      34EC8E93 63BD4CDF 784E91D7 2EE0093F 06CC97FD 83CB818B 1ED624E6 F0F5DA51
      1DE4B8A7 169EED2B 40575B81 BADDE052 85BA9D19 4C206DCB 00878FF3 89E74028
      B3F30203 010001A3 68306630 0F060355 1D130101 FF040530 030101FF 30130603
      551D1104 0C300A82 086D7833 35363062 2E301F06 03551D23 04183016 80147125
      78CE8540 DB95D852 3C0BD975 5D9C6EB7 58FC301D 0603551D 0E041604 14712578
      CE8540DB 95D8523C 0BD9755D 9C6EB758 FC300D06 092A8648 86F70D01 01040500
      03818100 94B98410 2D9CD602 4BD16181 BCB7C515 77C8F947 7C4AF5B8 281E3131
      59298655 B12FAB1D A6AAA958 8473483C E993D896 5251770B 557803C0 531DEB62
      A349C057 CB473F86 DCEBF8B8 7DDE5728 048A49D0 AB18CE8C 8257C00A C2E06A63
      B91F872C 5F169FF9 77DC523B AB1E3965 C6B67FCC 84AE11E9 02DD10F0 C45EAFEA 41D7FA6C
      quit
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    interface FastEthernet0/1
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/2
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/3
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    shutdown
    power inline never
    interface FastEthernet0/6
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/11
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/18
    shutdown
    power inline never
    interface FastEthernet0/19
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    shutdown
    power inline never
    interface FastEthernet0/22
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/24
    shutdown
    power inline never
    interface FastEthernet0/25
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/26
    shutdown
    power inline never
    interface FastEthernet0/27
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/34
    shutdown
    power inline never
    interface FastEthernet0/35
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport mode access
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    shutdown
    power inline never
    interface FastEthernet0/38
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    shutdown
    power inline never
    interface FastEthernet0/42
    shutdown
    power inline never
    interface FastEthernet0/43
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport access vlan 40
    switchport mode access
    shutdown
    interface GigabitEthernet0/1
    shutdown
    interface GigabitEthernet0/2
    switchport access vlan 40
    switchport mode access
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    ip classless
    ip http server
    ip http secure-server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end

  • Communication problem from the vpn-anyconnect to easy-vpn-remote

    Hi Team,
    I have a communication problem from the vpn-anyconnect to easy-vpn-remote, I´ll explain better bellow and see the attached
    topology:
    1) VPN Tunnel between HQ to Branch Office - That´s OK
    2) VPN Tunnel between Client AnyConnect to HQ - That´s OK
    The idea is that the Client Anyconnect is to reach the LAN at Branch Office, but did not reach.
    The communication is stablished just when I start a session (icmp and/or rdp) from Branch Office to the Client AnyConnect,
    in this way, the communication is OK, but just during a few minutes.
    Could you help me?
    Bellow the IOS version and configurations
    ASA5505 Version 8.4(7)23 (headquarters)
    ASA5505 Version 8.4(7)23 (Branch)
    **************** Configuration Easy VPN Server (HQ) **************** 
    crypto dynamic-map DYNAMIC-MAP 5 set ikev1 transform-set ESP-AES-256-SHA
    crypto map outside-link-2_map 1 ipsec-isakmp dynamic DYNAMIC-MAP
    crypto map outside-link-2_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside-link-2_map interface outside-link-2
    access-list ACL_EZVPN standard permit 10.0.0.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 192.168.1.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 192.168.50.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 10.10.0.0 255.255.255.0 
    group-policy EZVPN_GP internal
    group-policy EZVPN_GP attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value ACL_EZVPN
     nem enable 
    tunnel-group EZVPN_TG type remote-access
    tunnel-group EZVPN_TG general-attributes
     default-group-policy EZVPN_GP
    tunnel-group EZVPN_TG ipsec-attributes
     ikev1 pre-shared-key *****
    object-group network Obj_VPN_anyconnect-local
     network-object 192.168.1.0 255.255.255.0
     network-object 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
     network-object 192.168.50.0 255.255.255.0
    object-group network NAT_EZVPN_Source
     network-object 192.168.1.0 255.255.255.0
     network-object 10.10.0.0 255.255.255.0
    object-group network NAT_EZVPN_Destination
     network-object 10.0.0.0 255.255.255.0
    nat (inside,outside-link-2) source static Obj_VPN_anyconnect-local Obj_VPN_anyconnect-local destination static Obj-VPN-
    anyconnect-remote Obj-VPN-anyconnect-remote no-proxy-arp route-lookup
    nat (inside,outside-link-2) source static NAT_EZVPN_Source NAT_EZVPN_Source destination static NAT_EZVPN_Destination 
    NAT_EZVPN_Destination no-proxy-arp route-lookup
    nat (outside-link-2,outside-link-2) source static Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote destination static 
    NAT_EZVPN_Destination NAT_EZVPN_Destination no-proxy-arp route-lookup
    **************** Configuration VPN AnyConnect (HQ) **************** 
    webvpn
     enable outside-link-2
     default-idle-timeout 60
     anyconnect-essentials
     anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
     anyconnect profiles Remote_Connection_for_TS_Users disk0:/remote_connection_for_ts_users.xml
     anyconnect enable
     tunnel-group-list enable
    access-list split-tunnel standard permit 192.168.1.0 255.255.255.0 
    access-list split-tunnel standard permit 192.168.15.0 255.255.255.0 
    access-list split-tunnel standard permit 10.0.0.0 255.255.255.0 
    group-policy clientgroup internal
    group-policy clientgroup attributes
     wins-server none
     dns-server value 192.168.1.41
     vpn-tunnel-protocol ssl-client 
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value split-tunnel
     default-domain value ipconnection.com.br
     webvpn       
      anyconnect keep-installer installed
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect profiles value Remote_Connection_for_TS_Users type user
      anyconnect ask none default anyconnect
    tunnel-group sslgroup type remote-access
    tunnel-group sslgroup general-attributes
     address-pool vpnpool
     authentication-server-group DC03
     default-group-policy clientgroup
    tunnel-group sslgroup webvpn-attributes
     group-alias IPConnection-vpn-anyconnect enable
    object-group network Obj_VPN_anyconnect-local
     network-object 192.168.1.0 255.255.255.0
     network-object 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
     network-object 192.168.50.0 255.255.255.0
    object-group network NAT_EZVPN_Source
     network-object 192.168.1.0 255.255.255.0
     network-object 10.10.0.0 255.255.255.0
    object-group network NAT_EZVPN_Destination
     network-object 10.0.0.0 255.255.255.0
    nat (inside,outside-link-2) source static Obj_VPN_anyconnect-local Obj_VPN_anyconnect-local destination static Obj-VPN-
    anyconnect-remote Obj-VPN-anyconnect-remote no-proxy-arp route-lookup
    nat (inside,outside-link-2) source static NAT_EZVPN_Source NAT_EZVPN_Source destination static NAT_EZVPN_Destination 
    NAT_EZVPN_Destination no-proxy-arp route-lookup
    nat (outside-link-2,outside-link-2) source static Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote destination static 
    NAT_EZVPN_Destination NAT_EZVPN_Destination no-proxy-arp route-lookup

    Hi,
    the communication works when you send traffic from easyvpn branch side because it froms the IPSEC SA for local subnet and anyconnect HQ pool. The SA will only form when branch initiates the connection as this is dynamic peer connection to HQ ASA.
    when there no SA between branch and HQ for this traffic, HQ ASA has no clue about where to send the traffic from anyconnect to branch network.
    I hope it explains the cause.
    Regards,
    Abaji.

  • Cisco ASA 5505 and comodo SSL certificate

    Hey All,
    I am having an issue with setting up the SSL certificate piece of the Cisco AnyConnect VPN. I purchased the certificate and installed it via the ASDM under Configuration > Remote Access VPN > Certificate Management > Identity Certificates. I also placed the CA 2 piece under the CA Certificates. I have http redirect to https and under my browser it is green.
    Once the AnyConnect client installs and automatically connects i get no errors or anything. The minute I disconnect and try to reconnect again, I get the "Untrusted VPN Server Certificate!" which isn't true because the connection information is https://vpn.mydomain.com and the SSL Cert is setup as vpn.mydomain.com.
    On that note it lists the IP address instead of the vpn.mydomain.com as the untrusted piece of this. Now obviously I don't have the IP address as part of the SSL cert, just the web address. On the web side I have an A record setup to go from vpn.mydomain.com to the IP address of the Cisco ASA.
    What am I missing here? I can post config if anyone needs it.
    (My Version of ASA Software is 9.0 (2) and ASDM Version 7.1 (2))

    It's AnyConnect version 3.0. I don't know about the EKU piece. I didn't know that was required. I will attach my config.
    ASA Version 9.0(2)
    hostname MyDomain-firewall-1
    domain-name MyDomain.com
    enable password omitted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd omitted
    names
    name 10.0.0.13.1 MyDomain-Inside description MyDomain Inside
    name 10.200.0.0 MyDomain_New_IP description MyDomain_New
    name 10.100.0.0 MyDomain-Old description Inside_Old
    name XXX.XXX.XX.XX Provider description Provider_Wireless
    name 10.0.13.2 Cisco_ASA_5505 description Cisco ASA 5505
    name 192.168.204.0 Outside_Wireless description Outside Wireless for Guests
    ip local pool MyDomain-Employee-Pool 192.168.208.1-192.168.208.254 mask 255.255.255.0
    ip local pool MyDomain-Vendor-Pool 192.168.209.1-192.168.209.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ip address Cisco_ASA_5505 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address Provider 255.255.255.252
    boot system disk0:/asa902-k8.bin
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.0.3.21
    domain-name MyDomain.com
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network MyDomain-Employee
    subnet 192.168.208.0 255.255.255.0
    description MyDomain-Employee
    object-group network Inside-all
    description All Networks
    network-object MyDomain-Old 255.255.254.0
    network-object MyDomain_New_IP 255.255.192.0
    network-object host MyDomain-Inside
    access-list inside_access_in extended permit ip any4 any4
    access-list split-tunnel standard permit host 10.0.13.1
    pager lines 24
    logging enable
    logging buffered errors
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-712.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static Inside-all Inside-all destination static RVP-Employee RVP-Employee no-proxy-arp route-lookup
    object network obj_any
    nat (inside,outside) dynamic interface
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 XXX.XXX.XX.XX 1
    route inside MyDomain-Old 255.255.254.0 MyDomain-Inside 1
    route inside MyDomain_New_IP 255.255.192.0 MyDomain-Inside 1
    route inside Outside_Wireless 255.255.255.0 MyDomain-Inside 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    action terminate
    dynamic-access-policy-record "Network Access Policy Allow VPN"
    description "Must have the Network Access Policy Enabled to get VPN access"
    aaa-server LDAP_Group protocol ldap
    aaa-server LDAP_Group (inside) host 10.0.3.21
    ldap-base-dn ou=MyDomain,dc=MyDomainnet,dc=local
    ldap-group-base-dn ou=MyDomain,dc=MyDomainnet,dc=local
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn cn=Cisco VPN,ou=Special User Accounts,ou=MyDomain,dc=MyDomainNET,dc=local
    server-type microsoft
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http MyDomain_New_IP 255.255.192.0 inside
    http redirect outside 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint LOCAL-CA-SERVER
    keypair LOCAL-CA-SERVER
    no validation-usage
    no accept-subordinates
    no id-cert-issuer
    crl configure
    crypto ca trustpoint VPN
    enrollment terminal
    fqdn vpn.mydomain.com
    subject-name CN=vpn.mydomain.com,OU=IT
    keypair vpn.mydomain.com
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment terminal
    crl configure
    crypto ca trustpool policy
    crypto ca server
    shutdown
    crypto ca certificate chain LOCAL-CA-SERVER
    certificate ca 01
        omitted
      quit
    crypto ca certificate chain VPN
    certificate
        omitted
      quit
    crypto ca certificate chain ASDM_TrustPoint1
    certificate ca
        omitted
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint VPN
    telnet timeout 5
    ssh MyDomain_New_IP 255.255.192.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    dynamic-filter updater-client enable
    dynamic-filter use-database
    dynamic-filter enable
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1 rc4-md5 des-sha1
    ssl trust-point VPN outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 3
    anyconnect image disk0:/anyconnect-linux-2.4.1012-k9.pkg 4
    anyconnect image disk0:/anyconnect-win-3.1.01065-k9.pkg 5
    anyconnect profiles MyDomain-employee disk0:/MyDomain-employee.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    dns-server value 10.0.3.21
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client
    default-domain value MyDomain.com
    group-policy MyDomain-Employee internal
    group-policy MyDomain-Employee attributes
    wins-server none
    dns-server value 10.0.3.21
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split-tunnel
    default-domain value MyDomain.com
    webvpn
      anyconnect profiles value MyDomain-employee type user
    username MyDomainadmin password omitted encrypted privilege 15
    tunnel-group MyDomain-Employee type remote-access
    tunnel-group MyDomain-Employee general-attributes
    address-pool MyDomain-Employee-Pool
    authentication-server-group LDAP_Group LOCAL
    default-group-policy MyDomain-Employee
    tunnel-group MyDomain-Employee webvpn-attributes
    group-alias MyDomain-Employee enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:1c7e3d7ff324e4fd7567aa21a96a8b22
    : end
    asdm image disk0:/asdm-712.bin
    asdm location MyDomain_New_IP 255.255.192.0 inside
    asdm location MyDomain-Inside 255.255.255.255 inside
    asdm location MyDomain-Old 255.255.254.0 inside
    no asdm history enable

  • One way encryption, decrypting not encrypting ASA5505

    Hello All,
    I've been troubleshooting this issue and was hoping to get some more feed back and maybe point out an error if I'm not seeing it. I recently setup a remote access VPN on Cisco ASA 5505. Everything appeared to work at first and the IPsec client connect. However if you look at the packets being encrypted an decrypted on the Client side only the encrypted counter is incrementing and the decrypted stays at 0. The opposite is true on the ASA side the decrypted continures to increment and the encrypted stays at zero. My first thought was maybe a mis configured NAT 0 statement or not defining the correct Split tunnel ACL but I have verified that. I will post my config so maybe someone can point on the error. The asa version 8.2(5), I'll also list a packet-tracer I did from an inside host to VPN IP.
    Any help will be greatly appreacted, thanks in advance!
    ASA Version 8.2(5)
    terminal width 511
    hostname xyz
    domain-name xyz.local
    no names
    dns-guard
    interface Ethernet0/0
    description ISP Connection
    switchport access vlan 900
    interface Ethernet0/1
    switchport access vlan 10
    interface Ethernet0/2
    switchport access vlan 20
    interface Ethernet0/3
    switchport access vlan 30
    interface Ethernet0/4
    switchport access vlan 40
    interface Ethernet0/5
      switchport access vlan 50
    switchport trunk allowed vlan 10,20,30,40,350
    switchport trunk native vlan 10
    switchport mode trunk
    interface Ethernet0/6
    switchport trunk allowed vlan 10,20,30,40,350
    switchport trunk native vlan 10
    switchport mode trunk
    interface Ethernet0/7
    description WAP
    switchport trunk allowed vlan 10,20,30,40,350
    switchport trunk native vlan 10
    switchport mode trunk
    interface Vlan10
    description LAN
    nameif inside
    security-level 100
    ip address 10.10.254.1 255.255.0.0
    interface Vlan20
    description LAN
    nameif inside20
    security-level 100
    ip address 10.20.254.1 255.255.0.0
    interface Vlan30
    description LAN
    nameif inside30
    security-level 100
    ip address 10.30.254.1 255.255.0.0
    interface Vlan40
    description LAN
    nameif inside40
    security-level 100
    ip address 10.40.254.1 255.255.0.0
    interface Vlan350
    description Guest LAN
    nameif guest
    security-level 50
    ip address 10.3.50.254 255.255.255.0
    interface Vlan900
    description ISP Connection
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.252
    boot system disk0:/asa825-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name xyz.local
    same-security-traffic permit intra-interface
    access-list OUTSIDE-IN remark :
    access-list OUTSIDE-IN remark : Allow OUTSIDE to inside
    access-list OUTSIDE-IN remark :
    access-list OUTSIDE-IN remark Allow ICMP Replies
    access-list OUTSIDE-IN extended permit icmp any any echo-reply
    access-list OUTSIDE-IN extended permit icmp any any time-exceeded
    access-list OUTSIDE-IN extended permit icmp any any unreachable
    access-list NAT-0-INSIDE remark :
    access-list NAT-0-INSIDE remark : Do not NAT this traffic
    access-list NAT-0-INSIDE remark :
    access-list NAT-0-INSIDE remark Allow LAN to VPN Users
    access-list NAT-0-INSIDE extended permit ip 10.10.0.0 255.255.0.0 172.16.10.0 255.255.255.0
    access-list NAT-0-INSIDE extended permit ip 10.20.0.0 255.255.0.0 172.16.10.0 255.255.255.0
    access-list NAT-0-INSIDE extended permit ip 10.40.0.0 255.255.0.0 172.16.10.0 255.255.255.0
    access-list NAT-0-INSIDE extended permit ip 10.30.0.0 255.255.0.0 172.16.10.0 255.255.255.0
    access-list NAT-0-INSIDE extended permit ip 10.3.0.0 255.255.255.0 172.16.10.0 255.255.255.0
    access-list NAT-10-INSIDE remark :
    access-list NAT-10-INSIDE remark : Allow LAN NAT
    access-list NAT-10-INSIDE remark :
    access-list NAT-10-INSIDE extended permit ip 10.0.0.0 255.0.0.0 any
    access-list VPN-SPLIT-TUNNEL remark :
    access-list VPN-SPLIT-TUNNEL remark : Add Routes for these networks to the VPN clients
    access-list VPN-SPLIT-TUNNEL remark :
    access-list VPN-SPLIT-TUNNEL extended permit ip 10.10.0.0 255.255.0.0 any
    access-list VPN-SPLIT-TUNNEL extended permit ip 10.20.0.0 255.255.0.0 any
    access-list VPN-SPLIT-TUNNEL extended permit ip 10.30.0.0 255.255.0.0 any
    access-list VPN-SPLIT-TUNNEL extended permit ip 10.40.0.0 255.255.0.0 any
    access-list VPN-SPLIT-TUNNEL extended permit ip 10.3.0.0 255.255.255.0 any
    pager lines 40
    logging enable
    logging timestamp
    logging buffer-size 16384
    logging buffered debugging
    logging trap informational
    logging history errors
    logging asdm informational
    mtu inside 1500
    mtu inside20 1500
    mtu inside30 1500
    mtu inside40 1500
    mtu guest 1500
    mtu outside 1500
    ip local pool VPN-POOL 172.16.10.1-172.16.10.99 mask 255.255.255.0
    ip audit name IDSATTACK attack action alarm drop reset
    ip audit interface inside IDSATTACK
    ip audit interface inside20 IDSATTACK
    ip audit interface inside30 IDSATTACK
    ip audit interface inside40 IDSATTACK
    ip audit interface guest IDSATTACK
    ip audit interface outside IDSATTACK
    ip audit attack action alarm drop reset
    ip audit signature 2000 disable
    ip audit signature 2001 disable
    ip audit signature 2004 disable
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any inside20
    icmp permit any inside30
    icmp permit any inside40
    icmp permit any guest
    icmp permit any outside
    asdm image disk0:/asdm-649.bin
    asdm history enable
    arp timeout 14400
    global (outside) 10 interface
    nat (inside) 0 access-list NAT-0-INSIDE
    nat (inside) 10 access-list NAT-10-INSIDE
    nat (inside20) 0 access-list NAT-0-INSIDE
    nat (inside20) 10 access-list NAT-10-INSIDE
    nat (inside30) 0 access-list NAT-0-INSIDE
    nat (inside30) 10 access-list NAT-10-INSIDE
    nat (inside40) 0 access-list NAT-0-INSIDE
    nat (inside40) 10 access-list NAT-10-INSIDE
    nat (guest) 0 access-list NAT-0-INSIDE
    nat (guest) 10 access-list NAT-10-INSIDE
    access-group OUTSIDE-IN in interface outside
    route outside 0.0.0.0 0.0.0.0 x.x.x.y 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server TACACS+ protocol tacacs+
    aaa-server RADIUS protocol radius
    aaa-server RADIUS-AUTH protocol radius
    aaa authentication serial console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication secure-http-client
    http server enable 444
    http 0.0.0.0 0.0.0.0 outside
    http 0.0.0.0 0.0.0.0 inside
    sysopt noproxyarp inside
    sysopt noproxyarp inside20
    sysopt noproxyarp inside30
    sysopt noproxyarp inside40
    crypto ipsec transform-set AES-256-SHA-ENCRYPT esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map VPN-DYN-MAP 1 set transform-set AES-256-SHA-ENCRYPT
    crypto dynamic-map VPN-DYN-MAP 1 set security-association lifetime seconds 28800
    crypto dynamic-map VPN-DYN-MAP 1 set security-association lifetime kilobytes 4608000
    crypto map OUTSIDE-MAP 65535 ipsec-isakmp dynamic VPN-DYN-MAP
    crypto map OUTSIDE-MAP interface outside
    crypto isakmp identity hostname
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    telnet 0.0.0.0 0.0.0.0 inside
    telnet 0.0.0.0 0.0.0.0 outside
    telnet timeout 20
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 20
    console timeout 0
    dhcpd ping_timeout 750
    dhcpd address 10.10.1.1-10.10.1.99 inside
    dhcpd dns 4.2.2.2 interface inside
    dhcpd domain xyz.local interface inside
    dhcpd enable inside
    dhcpd address 10.20.1.1-10.20.1.99 inside20
    dhcpd dns 4.2.2.2 interface inside20
    dhcpd enable inside20
    dhcpd address 10.30.1.1-10.30.1.99 inside30
    dhcpd dns 4.2.2.2 interface inside30
    dhcpd enable inside30
    dhcpd address 10.40.1.1-10.40.1.99 inside40
    dhcpd dns 4.2.2.2 interface inside40
    dhcpd enable inside40
    dhcpd address 10.3.50.1-10.3.50.99 guest
    dhcpd dns 4.2.2.2 interface guest
    dhcpd enable guest
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    tunnel-group-list enable
    group-policy VPN-POLICY internal
    group-policy VPN-POLICY attributes
    vpn-simultaneous-logins 20
    vpn-idle-timeout 3600
    vpn-session-timeout 1440
    vpn-tunnel-protocol IPSec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN-SPLIT-TUNNEL
    default-domain value xyz.local
    split-dns value xyz.local
    tunnel-group secant type remote-access
    tunnel-group secant general-attributes
    address-pool VPN-POOL
    authentication-server-group (outside) LOCAL
    default-group-policy VPN-POLICY
    tunnel-group secant ipsec-attributes
    pre-shared-key *****
    class-map INSPECTION-DEFAULT
    description Complete Protocol Inspection List Class Map
    match default-inspection-traffic
    policy-map type inspect dns INSPECT-DNS-MAP
    parameters
      message-length maximum client auto
      message-length maximum 4096
    policy-map GLOBAL-INSPECTION-POLICY
    description Global Inspection Policy
    class INSPECTION-DEFAULT
      inspect ftp
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
      inspect http
      inspect ils
      inspect pptp
      inspect ipsec-pass-thru
      inspect icmp
      inspect dns INSPECT-DNS-MAP
      inspect ctiqbe
      inspect dcerpc
      inspect mgcp
      inspect icmp error
      inspect snmp
      inspect waas
      inspect h323 h225
      inspect h323 ras
    service-policy GLOBAL-INSPECTION-POLICY global
    A5505-1# packet-tracer input inside icmp 10.10.253.1 1 1 172.16.10.1 detailed
    Phase: 1
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   172.16.10.1     255.255.255.255 outside
    Phase: 2
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc96adb20, priority=0, domain=inspect-ip-options, deny=true
            hits=69511, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 3
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    class-map INSPECTION-DEFAULT
    description Complete Protocol Inspection List Class Map
    match default-inspection-traffic
    policy-map GLOBAL-INSPECTION-POLICY
    description Global Inspection Policy
    class INSPECTION-DEFAULT
      inspect icmp
    service-policy GLOBAL-INSPECTION-POLICY global
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xcc510638, priority=70, domain=inspect-icmp, deny=false
            hits=10388, user_data=0xcc510438, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 4
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xcc51dbb8, priority=70, domain=inspect-icmp-error, deny=false
            hits=10388, user_data=0xcc51d9b8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 5
    Type: DEBUG-ICMP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc97e7e30, priority=12, domain=debug-icmp-trace, deny=false
            hits=16500, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=1
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 6
    Type: NAT-EXEMPT
    Subtype:
    Result: ALLOW
    Config:
      match ip inside 10.10.0.0 255.255.0.0 outside 172.16.10.0 255.255.255.0
        NAT exempt
        translate_hits = 5, untranslate_hits = 796
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc97b1d40, priority=6, domain=nat-exempt, deny=false
            hits=5, user_data=0xc9840640, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
            src ip=10.10.0.0, mask=255.255.0.0, port=0
            dst ip=172.16.10.0, mask=255.255.255.0, port=0, dscp=0x0
    Phase: 7
    Type: NAT
    Subtype:
    Result: ALLOW
    Config:
    nat (inside) 10 access-list NAT-10-INSIDE
      match ip inside 10.0.0.0 255.0.0.0 outside any
        dynamic translation to pool 10 (x.x.x.x [Interface PAT])
        translate_hits = 61470, untranslate_hits = 8513
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc9950080, priority=2, domain=nat, deny=false
            hits=61604, user_data=0xc994ffc0, cs_id=0x0, flags=0x0, protocol=0
            src ip=10.0.0.0, mask=255.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 8
    Type: NAT
    Subtype: host-limits
    Result: ALLOW
    Config:
    nat (inside) 10 access-list NAT-10-INSIDE
      match ip inside 10.0.0.0 255.0.0.0 inside any
        dynamic translation to pool 10 (No matching global)
        translate_hits = 0, untranslate_hits = 0
    Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0xc994d1e0, priority=2, domain=host, deny=false
            hits=69627, user_data=0xc994cdc8, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=10.0.0.0, mask=255.0.0.0, port=0
            dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
    Phase: 9
    Type: VPN
    Subtype: encrypt
    Result: ALLOW
    Config:
    Additional Information:
    Forward Flow based lookup yields rule:
    out id=0xc983d570, priority=70, domain=encrypt, deny=false
            hits=777, user_data=0x4c2e4, cs_id=0x0, reverse, flags=0x0, protocol=0
            src ip=0.0.0.0, mask=0.0.0.0, port=0
            dst ip=172.16.10.1, mask=255.255.255.255, port=0, dscp=0x0
    Phase: 10
    Type: FLOW-CREATION
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    New flow created with id 102356, packet dispatched to next module
    Module information for forward flow ...
    snp_fp_tracer_drop
    snp_fp_inspect_ip_options
    snp_fp_inspect_icmp
    snp_fp_dbg_icmp
    snp_fp_adjacency
    snp_fp_encrypt
    snp_fp_fragment
    snp_ifc_stat
    Module information for reverse flow ...
    Result:
    input-interface: inside
    input-status: up
    input-line-status: up
    output-interface: outside
    output-status: up
    output-line-status: up
    Action: allow

    Hi Alan,
    Please make the following changes:
    access-list VPN_SPLIT_ACL remark :
    access-list VPN_SPLIT_ACL remark : Add Routes for these networks to the VPN clients
    access-list VPN_SPLIT_ACL remark :
    access-list VPN_SPLIT_ACL  permit  10.10.0.0 255.255.0.0
    access-list VPN_SPLIT_ACL  permit  10.20.0.0 255.255.0.0
    access-list VPN_SPLIT_ACL  permit  10.30.0.0 255.255.0.0
    access-list VPN_SPLIT_ACL  permit  10.40.0.0 255.255.0.0
    access-list VPN_SPLIT_ACL  permit  10.3.0.0 255.255.255.0
    group-policy VPN-POLICY attributes
         split-tunnel-network-list value VPN_SPLIT_ACL
    crypto isakmp nat-traversal 30
    capture capin interface inside match ip 10.10.0.0 255.255.0.0 172.16.10.0 255.255.255.0
    Then connect and try to ping any IP within the 10.10.0.0 /16 range.
    Once done, issue:
    show capture capin
    HTH.
    Portu.
    Please rate any helpful posts

Maybe you are looking for