Static interface?

I'm writing some classes that have only static methods. I would like to have them all implement an interface which has these methods, like so:public class AImpl implements A {
  public static void someMethod() {
    // do something
public interface A {
  static void someMethod();
}This isn't allowed. Is there anyway to do something similar? Or is it just not a possibility?
Thanks in advance,
m

This is one of the cases where the benefits of singleton over classes with static methods is vivid. you can turn your class with static methods into a singleton and take benefot of the interfaces you already defined. Here is some simple code to show it,
public interface A {
public void methodA();
//This is the class that had only static methods
public class Foo implements A{
private static Foo instance = new Foo();
private Foo() {}
public static Foo getInstance() {
return instance;
//previously it was a static method
public void methodA(){
usage:
rathern than calling
Foo.methodA()
you have to call
Foo.getInstance().mathodA()
you can use Foo.getIntance() anywhere where an A object is expected.
If it is still not clear, feel free to ask.

Similar Messages

  • Static interface Vs Static nested interface declaration

    Hi,
    I have observed that static interface declaration is not allowed in Java. However static nested interface declaration is allowed.
    I could not understood reason behind this behavior.
    e.g.
    interface A{
         void AA();
         public static abstract interface Aa{
    } ........... this is allowed in Java.
    static interface d{
    } ...... This is not allowed in Java...
    I already know that static mean one for class and interface has only abstract method.
    Please let me know if any one know resign behind this.
    Thanks .

    Why don't you go to a Java forum?

  • Static interfaces

    Hi everybody,
    I could not find eny information about static interfaces (not static members of an interfaces - static interfaces itself).
    Could anybody give me some information about it ?
    I came accross with many interfaces wich are declared as:
    public static interface name_of_interface
    Thank you for all the answers.
    Adrian

    Inner interfaces can be declared static.Well, there you go. I should Google myself before answering!
    Never thought of inner interfaces.
    Cheers!

  • Why a static class can implements a non-static interface?

    public class Test {
         interface II {
              public void foo();
         static class Impl implements II {
              public void foo() {
                   System.out.println("foo");
    }Why a static class can implements a non-static interface?
    In my mind, static members cann't "use" non-static members.

    Why a static class can implements a
    non-static interface?There's no such thing as a non-static member interface. They are always static even if you don't declare them as such.
    An interface defines, well, a public interface to be implemented. It doesn't matter whether it is implemented by a static nested class or by an inner class (or by any class at all). It wouldn't make sense to enforce that it should be one or the other, since the difference between a static and non-static class is surely an irrelevant detail to the client code of the interface.
    In my mind, static members cann't "use" non-static
    members.
    http://java.sun.com/docs/books/jls/third_edition/html/classes.html#246026
    Member interfaces are always implicitly static. It is permitted but not required for the declaration of a member interface to explicitly list the static modifier.

  • Using static interface inner class.. how?

    Can anyone tell me how I'm able to use an inner class that is a static interface?
    Specifically I'm getting DocumentEvents through a DocumentListener..
    Then within DocumentEvents there is an inner class which is a static interface called:
    DocumentEvent.ElementChange, I'm trying to use the methods contained within the interface ElementChange.
    Can anyone throw a helping hand as to how I go about this?
    Thanks :)

    public class A ... {
    public static interface B {
    }Just creates a public interface called A.B
    How are you supposed to use this with your DocumentEvent? I can't say

  • Static Interface Methods in ABAP

    Hello,
    I'd like to know what sense it makes to define static methods in an interface.
    My understanding is, that an interface can only be used with an instance of a class implementing that interface. So I always need to have an instance and thus, static methods are not needed.
    But ABAP-OO (in contrast to Java, for example) allows that, so maybe there is some need for that?
    Thanks for your help, best regards,
    Timo Wolf.

    Hi,
    As you know that static methods are not instance- specific. Hence when a class implements an interface, the methods defined as static do not require an instance-specific call. Rather they are called as CLASSNAME=>INTREFACE_NAME~STATIC_METHOD_NAME. You do not need an instance to access them.
    The only purpose of declaring a method as STATIC in interface definition is to create an agreement that a particular method will not depend on an instance to work. When a class implements the interface, calls to this method will be as mentioned above.
    <b>
    As far as the static components of interfaces are concerned, you can only use the interface name to access constants:
    Addressing a constant <const>: <intf>=><const>
    For all other static components of an interface, you can only use object references or the class <class> that implements the interface:
    Addressing a static attribute <attr>: <class>=><intf~attr>
    Calling a static method <meth>: CALL METHOD <class>=><intf~meth>
    </b>
    Hope this helps.
    Regards
    Message was edited by: Shehryar Khan
    Message was edited by: Shehryar Khan

  • Apply static method requirements on class (Static interface methods)?

    I have a set of classes where is class is identified with a unique ID number. So each class has a public static int getId() method. Each class also has either a constructor that takes a byte array or a static factory method that takes a byte array.
    I would like to maintain a hashmap of these classes keyed to the ID's however I am not sure how to have some interface of abstract parent class that requires each of these classes to implement these static methods.
    What I was hoping to do was something like this>>>
         public interface MyClasses{
              static MyClasses createInstance(byte[] data);
         HashMap<Integer, MyClasses> map;
         public void init() {
              map = new HashMap<Integer, MyClasses>();
              map.put(Class1.getId(), Class1.class);
              map.put(Class2.getId(), Class2.class);
         public void createInstance (int id, byte[] data) {
              map.get(id).createInstance(data);
         }Is there some way I could do this?

    What about something like this?
    public interface Initializable
         public void initialize(byte[] data);
    public class Factory
         private final Map<Integer, Initializable> map = new HashMap<Integer, Initializable>();
            public void registerClass(int id, Class klass)
                    if (! Initializable.class.isAssignableFrom(klass))
                             // you may also want to ensure the class declares a parameterless constructor
                             throw new IllegalArgumentException("duff class");
                    if (this.map.keySet().contains(id))
                             throw new IllegalArgumentException("duff id");
              this.map.put(id, klass);
         public Initializable createInstance(int id, byte[] data)
                    // need some exception handling of course
              Initializable i = map.get(id).newInstance();
                    i.initialize(data);
                    return i;
    }

  • Static interface functions

    Hi everyone..
    I have a class Tourist, which implements an interface named GenericUser. The former implements a static function "SF" but i cannot define "SF" as static in the interface. Any ideas? Anyone out there? :)

    Here's how it would be called...
    String retValue = GenericUser.getUserResponse();
    And therein lies the problem. It will try to call GenericUser's getUserResponse, not that of any implementing class. How could it possibly even know which class' method to call with what you've got.
    You might think to try something like this: GenericUser gu = new GenericUserImpl();
    gu.getUserResponse(); But that still won't help. If getUserResponse were non-static, it would call GenericUserImpl's version of that methhod.
    But for satic methods, which class' version is called is determined by the compile-time type of the reference (GenericUser), NOT the runtime type of the object.
    In short: Static methods are not polymorphic. That's just a rule of the Java language.

  • Static Interface Pattern

    Summary
    =======
    Define an interface which declares static methods.
    The essence of what I mean by this is: define a number of classes which contain/provide access to common methods to which we can make static calls.
    Details
    =======
    What we are trying to achieve here is effectively an interface which garuantees us that the classes of a particular type (with a common parent class/interface) will all contain a specific method to which we have static access.
    Simple example
    ==============
    Here we have two classes that implement the Animal interface (Dog and Cat). Each class supplies a static method getType() which returns some non-instance-specific information (this method is static because the type is the same for all instances of the given class. E.g. ALL Dogs are of type 'Doggy').
    interface Animal
    class Dog implements Animal
        public static String getType()
            return "Doggy";
    class Cat implements Animal
        public static String getType()
            return "Kitty";
    }The problem is: How can we garuantee a client application that all Animals will supply (in some way) this static method.
    [In this particular example the methods differ only in the information they return, but the solution should allow the implementation of these methods to differ too].
    Thanks for your thoughts.
    JohnSenford [@hotmail.com]

    interface Animal
    class Dog implements Animal
         public static final String getType = "Doggy";
    //    public static String getType()
    //        return "Doggy";
    class Cat implements Animal
          public static final String getType = "Kitty";
    //    public static String getType()
    //        return "Kitty";
    or maybe an abstract base class;

  • Static Interface Fields

    public interface interface {
         static public field = 1;
         public void methods();
    when is this correct to use in the OOP/Software Pattern paradigm?
    I thought interfaces were only there to define behaviors (i.e. methods)
    What are static fields doing here?
    Why are static methods not allowed in interfaces while static fields are?
    Thanks

    public interface interface {
         static public field = 1;
         public void methods();
    }Indded it should be public static final (i.e., constants). The compiler supports not specifying final, and adds it automatically, but one should make that explicit.
    when is this correct to use in the OOP/Software
    Pattern paradigm?Unlike the previous posters, I don't find that bad against OO principle.
    If a constant is logically related to the capabilities defined by an interface, it's not a bad thing in itself to declare the constants in the interface's namespace.
    public interface HairDressable {
      public static final int BLONDE = 0;
      public static final int RED = 2;
      public static final int BLACK = 3;
      public void haveHairCut();
      public void haveColorChanged(int newColor);
      public int getHairColor();
    }All classes implementing the interface automaticaly see the constant, and can refer to it without prefixing by the interface name. public class PomPomGirl implements HairDressable {
      public void haveColorChanged(int newColor) {
        if (this.favoriteTeam.getName().equals("Red Socks") && (newColor!=RED)) {...}
    }Any class not implementing the interface can also refer to the constant, by prefixing with the interface's name, as in public class RedTeamFanClub {
    public void makeUp(PomPomGirl pomPomGirl) {
        pomPomGirl.haveColorChanged(HairDressable.RED);
    } What IS bad is to have a class implement the interface only for the sake of referring to the variable without prefixing, like public class HairDresser implements HairDressable {
      public void handleFancyLady(Bimbo bimbo) {
        bimbo.changeColor(RED);
      // Dummy implementation of method that should belong here
      public void haveHairCut() {}
      public void haveColorChanged(int  c) {}
      public int getHairColor() {return BLACK;}
    I thought interfaces were only there to define
    behaviors (i.e. methods) I would say "to advertise capabilities".
    Here both changing the color and getting the current color are capabilities that involve a notion of color that is common to all HairDressable implementing classes. I deem defining this notion in the interface itself makes sense.
    (OK, defining this notion as a bunch of int constants is not very well engineered, but let's keep the discussion focused).
    Now there's the pragmatic approach too : if you define constants in your interface, you run the risk that a bad programmers will someday implement the interface only to lazily refer to the constant.
    But you run that risk with abstract classes too - yes, I've seen that!
    Why are static methods not allowed in interfaces while
    static fields are?Only static final fields, which makes a difference.
    Static methods don't advertise the capabilites of an object. And they can't be overridden.
    Neither does a constant, in itself, but there's a point in defining the constant in the scope where it makes the most logical sense.
    For completeness, note there's an RFE on the BugParade to add statis methods to interfaces (http://developer.java.sun.com/developer/bugParade/bugs/4093687.html).
    As I understand it, and although I don't support it, I think there's a point in defining a static method and its implementation in an interface, so as to, in the same vein as for the constants, put in the interface's scope a method whose implementation logically has a meaning for all implementing classes of the interface
    (I'd say such methods are rare enough not to deserve a language change).
    But it seems ugly (and fortunately impossible at that point) to add the notion of "abstract static methods" that an interface could declare and all implementing class would have to implement.

  • [SOLVED] 2nd static interface is up, but doesn't show an IP address

    I must be missing something basic.  I'm in the process of setting up a simple network configuration in order to test out nftables.  I'm using netctl. I have have 2 ethernet ports.  The first interface, eno1, is connected to a router, and works fine.  The second interface, enp2s0, is connected to a switch (for testing NAT behind the firewall) and can't seem to get an IP address.
            Internet --- router --- eno1 --- [server] --- enp2s0 --- 4-port switch
                                                                                           |
                                                                                     test client
    [root@ibis etc]# cat /etc/netctl/eno1
    Description='A basic static ethernet connection'
    Interface=eno1
    Connection=ethernet
    IP=static
    Address=('192.168.1.5/24')
    #Routes=('192.168.0.0/24 via 192.168.1.2')
    Gateway='192.168.1.1'
    DNS=('192.168.1.1')
    [root@ibis etc]# cat /etc/netctl/enp2s0
    Description='A basic static ethernet connection'
    Interface=enp2s0
    Connection=ethernet
    IP=static
    Address=('172.18.90.1/24')
    #Routes=('192.168.0.0/24 via 192.168.1.2')
    Gateway='192.168.1.5'
    DNS=('192.168.1.1')
    When I try and bring the 2nd interface up I get an error message:
    [root@ibis etc]# netctl start enp2s0
    Job for [email protected] failed. See 'systemctl status [email protected]' and 'journalctl -xn' for details.
    [root@ibis etc]# systemctl status [email protected] -l
    â [email protected] - A basic static ethernet connection
    Loaded: loaded (/etc/systemd/system/[email protected]; enabled)
    Active: failed (Result: exit-code) since Wed 2014-06-04 08:47:36 CDT; 12s ago
    Docs: man:netctl.profile(5)
    Process: 742 ExecStart=/usr/lib/network/network start %I (code=exited, status=1/FAILURE)
    Main PID: 742 (code=exited, status=1/FAILURE)
    Jun 04 08:47:36 ibis network[742]: Starting network profile 'enp2s0'...
    Jun 04 08:47:36 ibis network[742]: The interface of network profile 'enp2s0' is already up
    However, the interface isn't really up, as it doesn't have an IP address:
    [root@ibis etc]# ip addr
    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
    valid_lft forever preferred_lft forever
    2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 74:d4:35:18:11:36 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.5/24 brd 192.168.1.255 scope global eno1
    valid_lft forever preferred_lft forever
    inet6 fe80::76d4:35ff:fe18:1136/64 scope link
    valid_lft forever preferred_lft forever
    3: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 74:d4:35:18:11:34 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::76d4:35ff:fe18:1134/64 scope link
    valid_lft forever preferred_lft forever
    4: wlp3s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 0c:8b:fd:75:13:d6 brd ff:ff:ff:ff:ff:ff
    and is listed as not active:
    [root@ibis etc]# netctl list
    enp2s0
    * eno1
    I must be doing something wrong, but what?
    Last edited by pgoetz (2014-06-04 22:01:36)

    according to ip addr, it looks like it actually does have an IP
    [root@ibis etc]# ip addr
    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
    valid_lft forever preferred_lft forever
    2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 74:d4:35:18:11:36 brd ff:ff:ff:ff:ff:ff
    [b] inet 192.168.1.5/24 brd 192.168.1.255 scope global eno1[/b]
    valid_lft forever preferred_lft forever
    inet6 fe80::76d4:35ff:fe18:1136/64 scope link
    valid_lft forever preferred_lft forever
    3: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 74:d4:35:18:11:34 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::76d4:35ff:fe18:1134/64 scope link
    valid_lft forever preferred_lft forever
    4: wlp3s0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 0c:8b:fd:75:13:d6 brd ff:ff:ff:ff:ff:ff
    have you tried "netctl stop eno1" && :netctl start eno1"?

  • Static nat & public IP on inside interface.

    Hello Guys,
    I am facing some issue related to static nat please provide your replies. let me explain the scenario.
    At site we have 4 cameras connected on switch and NVR (network video recorder) also connected on the same switch.
    Locally at site we are able to access the four cameras via http/web and also through NVR software .
    In order to access this cameras from remote location, we did static natting in router with pubic ip address for this cameras private IP address. Find nat table below.
    At remote site/from internet when we are adding the cameras in NVR software using public IP address. Later automatically public IP address resolving into private IP address.
    We are able to access cameras individually using http://<public ip address for camera> but when we try to add it in INVR software its changing public ip address to private.
    Camera Name
    Private IP address
    Public IP address
    Camera 1
    192.168.1.3
    xx. x8.23.115
    Camera 2
    192.168.1.4
    xx.x8.23.116
    Camera 3
    192.168.1.5
    xx.x8.23.117
    Camera 4
    192.168.1.6
    xx.x8.23.118
    Below is the configuration for the router. I am concerned about the public IP address which is assigned on internal/LAN interface instead of outisde interface by ISP. In other project i experienced Public IP address is at outside interface and private is at inside interface and we do static nat for inside to outside interface.
    But here when i access the cameras through public IP individually its working but not when i am adding this public IP in NVR software. May be something is wrong with static.
    interface GigabitEthernet0/0.1
     encapsulation dot1Q 868
     ip address 172.20.38.26 255.255.255.252
     ip nat outside
     ip virtual-reassembly in
    interface GigabitEthernet0/1
     ip address 192.168.1.1 255.255.255.0 secondary
     ip address 212.x.x.113 255.255.255.240                       (its a public IP address)
     ip nat inside
     ip virtual-reassembly in
     duplex auto
     speed auto
    ip nat inside source list 10 pool SLT overload
    ip nat inside source static 192.168.1.3 x.x.23.115
    ip nat inside source static 192.168.1.4 x.x.23.116
    ip nat inside source static 192.168.1.5 x.x.23.117
    ip nat inside source static 192.168.1.6 x.x.23.118
    ip route 0.0.0.0 0.0.0.0 172.20.38.25
    access-list 10 permit 192.168.1.0 0.0.0.255
    ip nat translation tcp-timeout 1000
    ip nat translation udp-timeout 1000
    ip nat pool SLT xx.xx.23.114 xx.xx.23.114 netmask 255.255.255.240
    ip nat inside source list 10 pool SLT overload
    Please advise on the above configuration. Your help in the above regard will be highly appreciated.
    Many Thanks in Advance.

    It is a bit odd to see the IPv4 address assigned this way. (Putting it on a Loopback would be a more elegant approach if the ISP is using private addresses for the WAN link.) But, there's nothing in here that would cause the NAT to fail. I suspect that the cameras are doing an HTTP redirect to their private IPv4 addresses at some point and this is causing your software to switch.
    With this configuration, there's no reason why you can't just put the cameras directly on the public addresses and forego the NAT entirely. If there is a redirect going on, they will redirect to the correct IPv4 address and things will still work.

  • Why i cant access asa 8.4 thruogh asdm from outside interface ???

    hi all ,
    plz help e why i cant access asa asdm from outside interface
    my puclic ip on outisde is :
    x.x.55.34
    i changed  portf of asdm to 65000 because i have portforward  ,
    i tried to connect to my ip thriuogh asdm bu :
    x.x.55.34
    x.x.55.34:65000
    but no luck ,
    it succed if i try to connect locally
    here is my sh run command :
    ====================================================
    ASA5505#
    ASA5505# sh run
    : Saved
    ASA Version 8.4(2)
    hostname ASA5505
    enable password qsddsEGCCSH encrypted
    passwd 2KFsdsdbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 2
    interface Vlan1
    nameif ins
    security-level 100
    ip address 10.66.12.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 50
    ip address x.x.55.34 255.255.255.248
    boot system disk0:/asa842-k8.bin
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network obj-0.0.0.0
    host 0.0.0.0
    object network localsubnet
    subnet 10.66.12.0 255.255.255.0
    description localsubnet
    object network HTTP-Host
    host 10.66.12.249
    description web server
    object network HTTPS-HOST
    host 10.66.12.249
    description Https
    object network RDP-Host
    host 10.66.12.122
    description RDP host
    object network citrix-host
    host 10.66.12.249
    description citrix
    object service rdp
    service tcp destination eq 3389
    object service https
    service tcp destination eq https
    object service citrix
    service tcp destination eq 2598
    object service http
    service tcp destination eq www
    object network RDP1
    host 10.66.12.249
    object network HTTPS-Host
    host 10.66.12.249
    object network CITRIX-Host
    host 10.66.12.249
    object-group network RDP-REDIRECT
    object-group network HTTP-REDIRECT
    object-group network HTTPS-REDIRECT
    object-group network CITRIX-ICA-HDX-REDIRECTION
    object-group network CITRIX-ICA-SESSION-RELIABILITY-REDIRECTION
    object-group service CITRIX-ICA-HDX
    object-group service CITRIX-SR
    object-group service RDP
    object-group network MY-insideNET
    network-object 10.66.12.0 255.255.255.0
    access-list outside_in extended permit tcp any host 10.66.12.249 eq www
    access-list outside_in extended permit tcp any host 10.66.12.249 eq https
    access-list outside_in extended permit tcp any host 10.66.12.249 eq 2598
    access-list outside_in extended permit tcp any host 10.66.12.122 eq 3389
    access-list outside_in extended permit tcp any host 10.66.12.249 eq citrix-ica
    access-list outside_in extended permit tcp any host x.x.55.34 eq 65000
    access-list outside_in extended permit tcp any host x.x.55.34 eq https
    access-list outside_in extended permit ip any any
    pager lines 24
    mtu ins 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-645.bin
    no asdm history enable
    arp timeout 14400
    object network localsubnet
    nat (ins,outside) dynamic interface
    object network HTTP-Host
    nat (ins,outside) static interface service tcp www www
    object network RDP-Host
    nat (ins,outside) static interface service tcp 3389 3389
    object network HTTPS-Host
    nat (ins,outside) static interface service tcp https https
    object network CITRIX-Host
    nat (ins,outside) static interface service tcp citrix-ica citrix-ica
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 62.109.55.33 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable 65000
    http 10.66.12.0 255.255.255.0 ins
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
        308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
        0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
        30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
        13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
        0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
        20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
        65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
        65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
        30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
        30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
        496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
        74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
        68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
        3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
        63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
        0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
        a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
        9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
        7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
        15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
        63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
        18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
        4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
        81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
        db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
        ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
        45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
        2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
        1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
        03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
        69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
        02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
        6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
        c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
        69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
        1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
        551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
        1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
        2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
        4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
        b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
        6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
        481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
        b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
        5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
        6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
        6c2527b9 deb78458 c61f381e a4c4cb66
      quit
    telnet 0.0.0.0 0.0.0.0 outside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access outside
    dhcpd address 10.66.12.160-10.66.12.180 ins
    dhcpd dns 212.112.166.22 212.112.166.18 interface ins
    dhcpd enable ins
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    username test password P4ttSdddd3SV8TYp encrypted privilege 15
    username ADMIN password 5dddd3ThngqY encrypted privilege 15
    username drvirus password p03BtCddddryePSDf encrypted privilege 15
    username cisco password edssdsdOAQcNEL encrypted privilege 15
    prompt hostname context
    call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD
    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
    : end

    For access over VPN you need:
    management-access inside
    and don't forget:
    ssh inside
    http inside
    I'm guessing you forgot to grant ASDM (http/https) access to the IP addresses used by the VPN?  Can you SSH?  If not, that is your problem to solve first.

  • ASA 5505 Static NAT

    Hi Guys,
    Me again asking for some more help, thanks.
    I am trying to deploy a Polycom Access Director behind an ASA 5505 firewall and am having some problems configuring inbound NAT for this device.
    Currenlty I am able to dial from an endpoint outbound through the ASA with no problem but am unable to dial into the VC endpoint by the IP address (Traffic is not hitting the Access Director)
    This blog post shows what I am trying to achieve along with the ACLs that I have applied.
    http://blog.networkfoo.org/2014/02/deploy-polycom-rpad-single-nic-with.html#!/2014/02/deploy-polycom-rpad-single-nic-with.html
    These are my NAT Rules
    nat (Wireless_LAN,VC_INFRA) source static obj-10.255.222.0 obj-10.255.222.0 destination static obj-10.255.243.0 obj-10.255.243.0
    nat (Wireless_LAN,VC_DMZ) source static obj-10.255.222.0 obj-10.255.222.0 destination static obj-10.255.239.0 obj-10.255.239.0
    nat (Wireless_LAN,VC_LAN) source static obj-10.255.222.0 obj-10.255.222.0 destination static obj-10.255.243.0 obj-10.255.243.0
    nat (VC_INFRA,any) source static obj-10.255.243.0 obj-10.255.243.0 destination static VPNPool-Network VPNPool-Network
    object network obj-10.255.222.0
     nat (outside,outside) dynamic interface
    object network obj-10.255.243.0
     nat (outside,outside) dynamic interface
    object network obj_any
     nat (Wireless_LAN,outside) dynamic interface
    object network obj_any-01
     nat (VC_DMZ,outside) dynamic interface
    object network obj_any-02
     nat (VC_INFRA,outside) dynamic interface
    object network obj_any-03
     nat (VC_LAN,outside) dynamic interface
    nat (outside,VC_DMZ) after-auto source static any any destination static interface obj-CV2RPAD1
    This is my ACLs
    access-list outside_access_in extended permit udp any eq 1719 object-group RPAD_SERVERS_EXT eq 1719
    access-list outside_access_in extended permit udp any eq 1720 object-group RPAD_SERVERS_EXT eq 1720
    access-list outside_access_in extended permit tcp any gt 1023 object-group RPAD_SERVERS_EXT eq h323
    access-list outside_access_in extended permit tcp any gt 1023 object-group RPAD_SERVERS_EXT range 10001 13000
    access-list outside_access_in extended permit udp any gt 1023 object-group RPAD_SERVERS_EXT range 20002 30001
    access-list outside_access_in extended permit tcp any gt 1023 object-group RPAD_SERVERS_EXT eq sip
    access-list outside_access_in extended permit udp any gt 1023 object-group RPAD_SERVERS_EXT eq sip
    access-list outside_access_in extended permit tcp any gt 1023 object-group RPAD_SERVERS_EXT eq 5061
    access-list outside_access_in extended permit tcp any gt 1023 object-group RPAD_SERVERS_EXT eq 5222
    access-list outside_access_in extended permit icmp any any object-group DefaultICMP
    access-list dmz_access_in extended permit udp object-group RPAD_SERVERS_EXT range 20002 30001 any range 20002 30001
    access-list dmz_access_in extended permit udp object-group RPAD_SERVERS_EXT range 20002 30001 any range 16386 25386
    access-list dmz_access_in extended permit udp object-group RPAD_SERVERS_EXT eq 1719 any eq 1719
    access-list dmz_access_in extended permit udp object-group RPAD_SERVERS_EXT eq 1720 object-group DMA_SERVERS_INT eq 1720
    access-list dmz_access_in extended permit tcp object-group RPAD_SERVERS_EXT range 10001 13000 object-group DMA_SERVERS_INT eq h323
    access-list dmz_access_in extended permit tcp object-group RPAD_SERVERS_EXT range 10001 13000 object-group DMA_SERVERS_INT range 36000 61000
    access-list dmz_access_in extended permit tcp object-group RPAD_SERVERS_EXT range 13001 15000 any gt 1023
    access-list dmz_access_in extended permit udp object-group RPAD_SERVERS_EXT eq sip any gt 1023
    access-list dmz_access_in extended permit udp object-group RPAD_SERVERS_EXT eq 5070 object-group DMA_SERVERS_INT eq sip
    access-list dmz_access_in extended permit tcp object-group RPAD_SERVERS_EXT range 30001 60000 object-group RM_SERVERS_INT eq https
    access-list dmz_access_in extended permit tcp object-group RPAD_SERVERS_EXT range 10001 13000 any gt 1023
    access-list dmz_access_in extended permit icmp object-group RPAD_SERVERS_EXT any object-group DefaultICMP
    If I move my NAT statement as follows
          no nat after-auto 1
          nat (outside,VC_DMZ) 5 source static any any destination static interface obj-CV2RPAD1
    I am able to dial outbound still with no issues and am also able to intiate a call inbound which partially connects. The call seems to fail at the Capabilities exchange so the RTP media stream does not start up so there is some additional troubleshooting to be done.
    However moving this NAT statement has the side effect of breaking the IPSec VPN that I have configured for the Cisco VPN Client, I would like to be able to keep my VPN working and be able to do a port forwards/Static 1:1 NAT towards my RPAD.
    Once this is happy and working I can then go and troubleshoot why inbound calls are failing at the cpabilities exchange.

    Thanks a lot Jon, for assisted me solve this problem.
    The weird thing that i can't undestand, is that the icmp was working without a problem using the above mentioned access-list however accesing the web server using www wasn't working.
    How you explain that?

  • Connect to VPN but can't ping past inside interface

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

    Hello,
    I've been working on this issue for a few days with no success. We're setting  up a new Cisco ASA 5515 in our environment and are trying to get a simple IPSec  VPN setup on it for remote access. After some initial problems, we've gotten it  to where the VPN tunnel authenticates the user and connects as it should,  however we cannot ping into our LAN. We are able to ping as far as the  firewall's inside interface. I've tried other types of traffic too and nothing  gets through. I've checked the routes listed on the VPN client while we're  connected and they look correct - the client also shows both sent and received  bytes when we connect using TCP port 10000, but no Received bytes when we  connect using UDP 4500. We are trying to do split tunneling, and that seems to  be setup correctly because I can still surf while the VPN is connected.
    Below is our running config. Please excuse any messyness in the config as  there are a couple of us working on it and we've been trying a whole bunch of  different settings throughout the troubleshooting process. I will also note that  we're using ASDM as our primary method of configuring the unit, so any  suggestions that could be made with that in mind would be most helpful.  Thanks!
    ASA-01# sh run
    : Saved
    ASA Version 8.6(1)2
    hostname ASA-01
    domain-name domain.org
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    speed 100
    duplex full
    nameif inside
    security-level 100
    ip address 10.2.0.1 255.255.0.0
    interface GigabitEthernet0/1
    description Primary WAN Interface
    nameif outside
    security-level 0
    ip address 76.232.211.169 255.255.255.192
    interface GigabitEthernet0/2
    shutdown
    <--- More --->
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    speed 100
    <--- More --->
    duplex full
    shutdown
    nameif management
    security-level 100
    ip address 10.4.0.1 255.255.0.0
    ftp mode passive
    clock timezone MST -7
    clock summer-time MDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 10.2.11.6
    domain-name domain.org
    dns server-group sub
    name-server 10.2.11.121
    name-server 10.2.11.138
    domain-name sub.domain.net
    same-security-traffic permit intra-interface
    object network 76.232.211.132
    host 76.232.211.132
    object network 10.2.11.138
    host 10.2.11.138
    object network 10.2.11.11
    host 10.2.11.11
    <--- More --->
    object service DB91955443
    service tcp destination eq 55443
    object service 113309
    service tcp destination range 3309 8088
    object service 11443
    service tcp destination eq https
    object service 1160001
    service tcp destination range 60001 60008
    object network LAN
    subnet 10.2.0.0 255.255.0.0
    object network WAN_PAT
    host 76.232.211.170
    object network Test
    host 76.232.211.169
    description test
    object network NETWORK_OBJ_10.2.0.0_16
    subnet 10.2.0.0 255.255.0.0
    object network NETWORK_OBJ_10.2.250.0_24
    subnet 10.2.250.0 255.255.255.0
    object network VPN_In
    subnet 10.3.0.0 255.255.0.0
    description VPN User Network
    object-group service 11
    service-object object 113309
    <--- More --->
    service-object object 11443
    service-object object 1160001
    object-group service IPSEC_VPN udp
    port-object eq 4500
    port-object eq isakmp
    access-list outside_access_in extended permit icmp object VPN_In 10.2.0.0 255.255.0.0 traceroute log disable
    access-list outside_access_in extended permit object-group 11 object 76.232.211.132 interface outside
    access-list outside_access_in extended permit object DB91955443 any interface outside
    access-list outside_access_in extended permit udp any object Test object-group IPSEC_VPN inactive
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list outside_access_in extended deny ip any any
    access-list inside_access_in extended permit ip any any log disable
    access-list inside_access_in extended permit icmp any any echo-reply log disable
    access-list inside_access_in extended permit ip object VPN_In 10.2.0.0 255.255.0.0 log disable
    access-list domain_splitTunnelAcl standard permit 10.2.0.0 255.255.0.0
    access-list domain_splitTunnelAcl standard permit 10.3.0.0 255.255.0.0
    access-list vpn_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNUsers 10.3.0.1-10.3.0.254 mask 255.255.0.0
    <--- More --->
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any management
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source dynamic any WAN_PAT inactive
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 113309 113309
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 11443 11443
    nat (outside,outside) source static 76.232.211.132 76.232.211.132 destination static interface 10.2.11.11 service 1160001 1160001
    nat (outside,outside) source static any any destination static interface 10.2.11.138 service DB91955443 DB91955443
    nat (inside,outside) source static NETWORK_OBJ_10.2.0.0_16 NETWORK_OBJ_10.2.0.0_16 destination static NETWORK_OBJ_10.2.250.0_24 NETWORK_OBJ_10.2.250.0_24 no-proxy-arp route-lookup
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 76.232.211.129 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    <--- More --->
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ActiveDirectory protocol nt
    aaa-server ActiveDirectory (inside) host 10.2.11.121
    nt-auth-domain-controller sub.domain.net
    aaa-server ActiveDirectory (inside) host 10.2.11.138
    nt-auth-domain-controller sub.domain.net
    user-identity default-domain LOCAL
    eou allow none
    http server enable
    http 10.4.0.0 255.255.255.0 management
    http 10.2.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    no sysopt connection permit-vpn
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    <--- More --->
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    <--- More --->
    subject-name CN=ASA-01
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate a6c98751
        308201f1 3082015a a0030201 020204a6 c9875130 0d06092a 864886f7 0d010105
        0500303d 31153013 06035504 03130c43 5248442d 4d432d46 57303131 24302206
        092a8648 86f70d01 09021615 43524844 2d4d432d 46573031 2e637268 642e6f72
        67301e17 0d313330 35303730 32353232 325a170d 32333035 30353032 35323232
        5a303d31 15301306 03550403 130c4352 48442d4d 432d4657 30313124 30220609
        2a864886 f70d0109 02161543 5248442d 4d432d46 5730312e 63726864 2e6f7267
        30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00c23d5f
        acbf2b3f 9fe6e3c9 1866c344 07b6ee49 f6f31798 0b87a38b 890f70e2 c28cc1d5
        fd1b4e80 7fa25483 09e79459 6bf92155 c55240b4 93eeb4eb af3f8aec 8906ef48
        140c57bb 5ca4471f 275c1932 7e90976f f0dfe8a3 04a7861f cce7a320 7267df2e
        61f9b6b8 22bb70ac d9cedb73 3cf9747b c2636892 48b35385 a94bfae5 fd020301
        0001300d 06092a86 4886f70d 01010505 00038181 003c7e16 be4aff40 8fe69a31
        acf31808 680e44eb 8ede9094 f9a4a147 0ae18cdc 000dc07f c1da1af4 a2d964ed
        288689ee 95179ad0 90728324 9803248d b9d10641 01897453 fe7fafcd 34dee13a
        92798615 4acb1f27 14fdb346 ab3eb825 04f23791 81d08fa2 b54c6a47 aedd9694
        1c9fbcb4 455fd5ce 420298aa 9333737c 19f0e715 50
      quit
    crypto isakmp identity address
    crypto isakmp nat-traversal 30
    crypto ikev2 policy 1
    <--- More --->
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    <--- More --->
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside
    crypto ikev1 ipsec-over-tcp port 10000
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    <--- More --->
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    <--- More --->
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    <--- More --->
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    <--- More --->
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd dns 10.2.11.121 10.2.11.138
    dhcpd lease 36000
    dhcpd ping_timeout 30
    dhcpd domain sub.domain.net
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    <--- More --->
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect profiles VPN_client_profile disk0:/VPN_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy domain internal
    group-policy domain attributes
    banner value You are attempting to access secured systems at thsi facility. All activity is monitored and recorded. Disconnect now if you are not authorized to access these systems or do not possess valid logon credentials.
    wins-server value 10.2.11.121 10.2.11.138
    dns-server value 10.2.11.121 10.2.11.138
    vpn-idle-timeout none
    vpn-filter value vpn_access_in
    vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value domain_splitTunnelAcl
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    group-policy DfltGrpPolicy attributes
    dns-server value 10.2.11.121 10.2.11.138
    vpn-filter value outside_access_in
    vpn-tunnel-protocol l2tp-ipsec
    default-domain value sub.domain.net
    split-dns value sub.domain.net
    address-pools value VPNUsers
    username **** password **** encrypted privilege 15
    <--- More --->
    username **** password **** encrypted privilege 15
    username **** attributes
    webvpn
      anyconnect keep-installer installed
      anyconnect dtls compression lzs
      anyconnect ssl dtls enable
      anyconnect profiles value VPN_client_profile type user
    tunnel-group DefaultL2LGroup general-attributes
    default-group-policy domain
    tunnel-group DefaultRAGroup general-attributes
    address-pool VPNUsers
    authentication-server-group ActiveDirectory
    default-group-policy domain
    tunnel-group DefaultRAGroup ipsec-attributes
    ikev1 pre-shared-key *****
    ikev1 trust-point ASDM_TrustPoint0
    tunnel-group DefaultWEBVPNGroup general-attributes
    default-group-policy domain
    tunnel-group domain type remote-access
    tunnel-group domain general-attributes
    address-pool (inside) VPNUsers
    address-pool VPNUsers
    authentication-server-group ActiveDirectory LOCAL
    authentication-server-group (inside) ActiveDirectory LOCAL
    <--- More --->
    default-group-policy domain
    dhcp-server link-selection 10.2.11.121
    tunnel-group domain ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
    <--- More --->
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 21
      subscribe-to-alert-group configuration periodic monthly 21
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:2578e19418cb5c61eaf15e9e2e5338a0
    : end

Maybe you are looking for