Streaks inside monitor

I already made an appointment at the genius bar but was wondering if anyone else has seen this.  There are two areas on a mid-July 2011 27 Intel screen that looks like some kind of liquid got behind the screen and dripped down.  The only thing I've used to clean the screen is a cleaner that I bought from the Apple store (iKlear).  The streaks can be seen only when I use certain desktop pictures.

I completely missed the fact that the machine is brand new and still under warranty, and, so, yeah, make apple open it up and fix it!  Especially since you can't be 100% sure that it's on the glass and not on the plasma display until it's opened up.
iMacs are a real booger to do any work on beyond swapping memory chips.  Replacing a fried hard drive, or even re-seating a connector that has worked loose, everything requires removing the glass, then removing the plasma display (think giant wet noodle), then disassembling the computer inside.  Then you've got to get it all back together!  When I watched the youtube movie and they got to the part where there is a thermostat taped to the disk drive, and if you don't get it on just right then the computer won't run, or worse, will burn up -- that's when we bundled it up and took it to a real repair shop!
I have several iMacs which had their glass smashed in a vandalism attack.  (School computer lab.)  They work, so I bought replacement glass on eBay, and was able to replace it -- it's not that hard.  But keeping the back side clean is pretty challenging.  If your iMac was really built-to-order, that means that a human being took the glass off after it came off of that robot-operated clean-room assembly line, and it would have been really really easy to get the backside dirty.  And when you send it in for repair, they are going to pop off the glass, clean it, put it back on.  So don't be totally surprised if it comes back with the streaks gone but a new fingerprint or two!

Similar Messages

  • Horizontal streak on monitor milliseconds before it turns off?

    Hey, so as the title suggests, I've been seeing this horizontal line over the middle of my Macbook Air Mid-2013's screen whenever I turn it off. It kind of jumps up a bit before the screen turns black. I'm wondering if anyone else has seen this on their mac, or if this just happens to all 11 inch Macbook Airs?
    Thanks!

    damaged monitor feed cable.
    test same by moving monitor slowly while on.   If it changes, thats is.
    If so then contact Apple for appt. for free in shop diagnostic evaluation for repair.

  • Bug walking around inside monitor

    Don't know what to say about this. Looks like a gnat walking around inside. Can't take a screen shot of it. Hopefully it will fall to the bottom when it dies.

    Toraliens wrote:
    My brand new iMac came with a Hair between the Glass and the LCD on the left down corner, I took to apple store and they clean it.
    Apple quality control is not that good nowadays, I heard several issues about this iMac27, and at least was not a dead pixel.
    A random hair and what you read on these forums isn't NOT indicative of the millions of machines Apple sells.

  • Streaks in the monitor

    I have diagonal streaks inside the monitor. I can see them almost all the way across the top portion of my screen. I have a 24 inch iMac. Does anyone else have this problem?

    It's possible for dirt/smoke to get behind the front glass or even inside the panel. I had them both ways from ocassionally burning incense sticks in the next room. If the stains are brownish it's probably dirt (grayish unregularities will more likely be caused by irregular backlight).
    Here's a picture similar to what mine looked like.
    http://discussions.apple.com/thread.jspa?threadID=1915086&tstart=0
    However, if you take this kind of problem to Apple, they will most likely refuse a repair based on "environmental" issues (or even smoking, google for "apple warranty smoking").
    Since my machine was out of warranty anyway, I decided to take things into my own hands:
    http://discussions.apple.com/thread.jspa?threadID=2150293&tstart=90
    Message was edited by: Shimodax

  • VPN client cannot access inside hosts

    Hello,
        I have an ASA 5505 device with the attached configuration and my vpn clients can connect to it fine.  Although, once a vpn client is connected they cannot RDP, ping, or telnet any internal hosts.  The goal is to have a connected vpn client to have all access rights as anyone sitting on the internal network.  Any assistance is greatly appreciated.
    : Saved
    ASA Version 7.2(3)
    hostname Kappa-GW01
    domain-name Kappa.com
    enable password xxxxxxxxx encrypted
    names
    name 172.20.42.42 UMEFTP2 description UMAP FTP2
    name 172.20.40.246 UMEMAIL1 description Exchange Server
    name 172.20.41.3 UMERPS
    name x.x.81.81 Wilkes
    name x.x.84.41 KappaPittston
    dns-guard
    interface Ethernet0/0
    shutdown
    nameif outside
    security-level 0
    ip address x.x.148.194 255.255.255.248
    interface Ethernet0/1
    nameif Outside_Windstream
    security-level 0
    ip address x.x.205.210 255.255.255.240
    interface Ethernet0/2
    nameif inside
    security-level 100
    ip address 10.0.0.1 255.255.255.0
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    passwd 7Tpgc2AiWGxbNjkj encrypted
    boot system disk0:/asa723-k8.bin
    ftp mode passive
    dns server-group DefaultDNS
    domain-name Kappa.com
    object-group network Blue_Bell_Internal_Networks
    description Blue Bell internal network Group
    network-object 192.168.100.0 255.255.255.0
    network-object 10.0.0.0 255.255.255.0
    network-object 10.0.1.0 255.255.255.0
    network-object 10.0.2.0 255.255.255.0
    object-group network VPN-Sites
    network-object host Wilkes
    network-object host KappaPittston
    object-group network Michigan_VPN_GRP
    network-object 172.20.40.0 255.255.252.0
    object-group network ASA_OutSide_Vendors
    description ASA OutSide Vendor Access
    access-list 101 extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 10.0.1.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list 101 extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl remark Blue Bell Office
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl remark Williamston Office
    access-list KappaVPN_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
    access-list KappaVPN_splitTunnelAcl remark Pittston Office
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.10.0 255.255.255.0
    access-list KappaVPN_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.30.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 172.20.40.0 255.255.252.0 inactive
    access-list inside_nat0_outbound extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.0.30.0 255.255.255.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.30.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.10.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
    access-list outside_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
    access-list umeemp_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.30.0 255.255.255.0
    access-list umeemp_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
    access-list outside_5_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list inside_access_in extended permit ip any any
    access-list 102 extended permit tcp any any eq 2000
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq smtp
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq pop3 inactive
    access-list Outside_Winstream_access_in extended permit udp object-group VPN-Sites interface Outside_Windstream eq isakmp
    access-list Outside_Winstream_access_in extended permit tcp object-group ASA_OutSide_Vendors host x.x.205.217 eq 4080
    access-list Outside_Winstream_access_in remark SMTP Access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq smtp
    access-list Outside_Winstream_access_in remark POP access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq pop3
    access-list Outside_Winstream_access_in remark OWA Access
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq https
    access-list Outside_Winstream_access_in extended permit tcp host x.x.87.65 host x.x.205.218 eq 3389
    access-list Outside_Winstream_access_in extended permit udp host x.x.56.111 eq ntp host x.x.205.216 eq ntp
    access-list Outside_Winstream_access_in remark OWA UMAP
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq https
    access-list Outside_Winstream_access_in remark JLAN
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.215 eq https
    access-list Outside_Winstream_access_in remark UMERPS
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq https
    access-list Outside_Winstream_access_in remark UMERPS
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq ssh
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq https
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq 5494
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.214 eq www
    access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq 8081
    access-list Outside_Winstream_access_in extended permit icmp any any echo
    access-list outside_6_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list outside_6_cryptomap extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_11 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_10 extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_5 extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
    access-list Outside_Windstream_cryptomap_12 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
    access-list Outside_Windstream_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
    access-list nonat extended permit ip any any inactive
    pager lines 24
    logging enable
    logging asdm debugging
    logging flash-bufferwrap
    mtu outside 1500
    mtu Outside_Windstream 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn-pool 192.168.100.100-192.168.100.200
    no failover
    monitor-interface outside
    monitor-interface Outside_Windstream
    monitor-interface inside
    monitor-interface management
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (Outside_Windstream) 1 x.x.205.216 netmask 255.0.0.0
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 172.20.40.0 255.255.252.0
    nat (inside) 1 10.0.0.0 255.255.0.0
    static (inside,Outside_Windstream) x.x.205.217 10.0.0.20 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.220 10.0.0.21 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.218 10.0.0.15 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.215 172.20.40.145 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.211 UMEMAIL1 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.212 UMERPS netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.213 172.20.40.243 netmask 255.255.255.255
    static (inside,Outside_Windstream) x.x.205.214 172.20.40.146 netmask 255.255.255.255
    access-group acl_inbound in interface outside
    access-group Outside_Winstream_access_in in interface Outside_Windstream
    route Outside_Windstream 0.0.0.0 0.0.0.0 x.x.205.209 1
    route inside 172.20.40.0 255.255.252.0 10.0.0.3 1
    route inside 10.0.30.0 255.255.255.0 10.0.0.254 1
    route inside 10.0.1.0 255.255.255.0 10.0.0.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server BBPA-SRV-DC01 protocol radius
    aaa-server BBPA-SRV-DC01 host 10.0.0.15
    timeout 5
    key G6G7#02bj!
    aaa-server UMAP protocol radius
    aaa-server UMAP host 172.20.40.245
    timeout 5
    key gfrt1a
    aaa-server UMAP host 172.20.40.244
    timeout 5
    key gfrt1a
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 10.0.0.0 255.255.255.0 inside
    http 10.0.0.15 255.255.255.255 inside
    http 192.168.1.0 255.255.255.0 management
    http 192.168.100.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto dynamic-map Outside_Windstream_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map Outside_Windstream_dyn_map 40 set pfs
    crypto dynamic-map Outside_Windstream_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto map outside_map 5 match address outside_5_cryptomap
    crypto map outside_map 5 set peer Wilkes
    crypto map outside_map 5 set transform-set ESP-3DES-SHA
    crypto map outside_map 10 match address outside_6_cryptomap
    crypto map outside_map 10 set peer KappaPittston
    crypto map outside_map 10 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto map Outside_Windstream_map 5 match address Outside_Windstream_cryptomap_5
    crypto map Outside_Windstream_map 5 set peer Wilkes
    crypto map Outside_Windstream_map 5 set transform-set ESP-3DES-SHA
    crypto map Outside_Windstream_map 10 match address Outside_Windstream_cryptomap_10
    crypto map Outside_Windstream_map 10 set peer KappaPittston
    crypto map Outside_Windstream_map 10 set transform-set ESP-3DES-SHA
    crypto map Outside_Windstream_map 65535 ipsec-isakmp dynamic Outside_Windstream_dyn_map
    crypto map Outside_Windstream_map interface Outside_Windstream
    crypto isakmp enable Outside_Windstream
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 3600
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption des
    hash md5
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    telnet 10.0.0.0 255.255.0.0 inside
    telnet timeout 5
    ssh 10.0.0.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns migrated_dns_map_1
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns migrated_dns_map_1
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ftp
      inspect skinny
      inspect pptp
    service-policy global_policy global
    webvpn
    enable Outside_Windstream
    svc image disk0:/sslclient-win-1.1.4.177.pkg 1
    svc enable
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server none
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    smartcard-removal-disconnect enable
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
      svc required
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy umeemp internal
    group-policy umeemp attributes
    dns-server value 172.20.40.245
    vpn-filter none
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value KappaVPN_splitTunnelAcl
    default-domain value umapinc.com
    group-policy KappaVPN internal
    group-policy KappaVPN attributes
    wins-server value 10.0.0.15
    dns-server value 10.0.0.15
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value umeemp_splitTunnelAcl
    default-domain value kappa.loc
    username gwadmin password AVjtEPq7nvtiAAk0 encrypted
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool vpn-pool
    authentication-server-group BBPA-SRV-DC01
    authorization-required
    tunnel-group KappaVPN type ipsec-ra
    tunnel-group KappaVPN general-attributes
    address-pool vpn-pool
    authentication-server-group BBPA-SRV-DC01
    default-group-policy KappaVPN
    tunnel-group KappaVPN ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.131.62 type ipsec-l2l
    tunnel-group x.x.131.62 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.232.2 type ipsec-l2l
    tunnel-group x.x.232.2 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.49.114 type ipsec-l2l
    tunnel-group x.x.49.114 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.226.218 type ipsec-l2l
    tunnel-group x.x.226.218 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.116.133 type ipsec-l2l
    tunnel-group x.x.116.133 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.21.36 type ipsec-l2l
    tunnel-group x.x.21.36 ipsec-attributes
    pre-shared-key *
    tunnel-group umeemp type ipsec-ra
    tunnel-group umeemp general-attributes
    address-pool vpn-pool
    authentication-server-group UMAP
    default-group-policy umeemp
    tunnel-group umeemp ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.81.81 type ipsec-l2l
    tunnel-group x.x.81.81 ipsec-attributes
    pre-shared-key *
    tunnel-group x.x.84.41 type ipsec-l2l
    tunnel-group x.x.84.41 ipsec-attributes
    pre-shared-key *
    prompt hostname context
    Cryptochecksum:xxxxxxxxxxxxxxxxxxxxx
    : end
    asdm image disk0:/asdm-523.bin
    no asdm history enable

    I'm sorry, I misunderstood what you were asking.  Yes those three networks are on the inside of our ASA.  we have 2 outside of the ASA (10.0.2.x, 10.0.10.x).  When our clients vpn they connect to the x.x.205.210 ip address, which maps them depending on the preshared key that puts them on either the kappaVPN or the umeempVPN.  (I am kind of new to configuring the ASA).  When the cisco vpn client connects to the network, I checked the statistics and it lists all of our LAN networks under secure routes.  I cannot ping anything inside the LAN nor can I connect RDP, telnet or anything.
    Hope this answers your questions, just let me know if you need any more information.
    -Rudy

  • My ASA5540 8.2.4(4) can not monitor and failover on certain interfaces

    the story is
    we configure the
    monitor interface  inside
    monitor interface  outside
    monitor interface  partner
    and save configue
    but when i show run monitor-interface
    the configure do not show the 3 montitor interfaces, it only show other monitor interfaces,which can failover , but not the above 3 interfaces,  however they are all showed  interface monitor in the ASDM configure
    here is the show version
    ==================================
    Cisco Adaptive Security Appliance Software Version 8.2(4)4
    Device Manager Version 6.4(5)
    Compiled on Thu 03-Mar-11 17:18 by builders
    System image file is "disk0:/asa824-4-k8.bin"
    Config file at boot was "startup-config"
    dcm-lidc-fw1 up 9 days 18 hours
    failover cluster up 16 days 20 hours
    Hardware:   ASA5540, 2048 MB RAM, CPU Pentium 4 2000 MHz
    Internal ATA Compact Flash, 256MB
    BIOS Flash Firmware Hub @ 0xffe00000, 1024KB
    Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                                 Boot microcode   : CN1000-MC-BOOT-2.00
                                 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                                 IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.05
    0: Ext: GigabitEthernet0/0  : address is 30e4.db7b.6f82, irq 9
    1: Ext: GigabitEthernet0/1  : address is 30e4.db7b.6f83, irq 9
    2: Ext: GigabitEthernet0/2  : address is 30e4.db7b.6f84, irq 9
    3: Ext: GigabitEthernet0/3  : address is 30e4.db7b.6f85, irq 9
    4: Ext: Management0/0       : address is 30e4.db7b.6f86, irq 11
    5: Int: Internal-Data0/0    : address is 0000.0001.0002, irq 11
    6: Int: Not used            : irq 5
    7: Ext: GigabitEthernet1/0  : address is 30e4.db02.1f96, irq 255
    8: Ext: GigabitEthernet1/1  : address is 30e4.db02.1f97, irq 255
    9: Ext: GigabitEthernet1/2  : address is 30e4.db02.1f98, irq 255
    10: Ext: GigabitEthernet1/3  : address is 30e4.db02.1f99, irq 255
    11: Int: Internal-Data1/0    : address is 0000.0003.0002, irq 255
    Licensed features for this platform:
    Maximum Physical Interfaces    : Unlimited
    Maximum VLANs                  : 200      
    Inside Hosts                   : Unlimited
    Failover                       : Active/Active
    VPN-DES                        : Enabled  
    VPN-3DES-AES                   : Enabled  
    Security Contexts              : 2        
    GTP/GPRS                       : Disabled 
    SSL VPN Peers                  : 2        
    Total VPN Peers                : 5000     
    Shared License                 : Disabled
    AnyConnect for Mobile          : Disabled 
    AnyConnect for Cisco VPN Phone : Disabled 
    AnyConnect Essentials          : Enabled  
    Advanced Endpoint Assessment   : Disabled 
    UC Phone Proxy Sessions        : 2        
    Total UC Proxy Sessions        : 2        
    Botnet Traffic Filter          : Disabled 
    This platform has an ASA 5540 VPN Premium license.
    ==========here is the show monitor interface, it does not show outside/inside/partner====================
    -fw1# sh run monitor-interface
    monitor-interface app
    monitor-interface dmz
    monitor-interface data
    monitor-interface dev-app
    monitor-interface dev-data
    no monitor-interface management
    -fw1#
    -fw1(config)# sh run all | in monitor
    banner motd *  This is a private and monitored system.      *
    monitor-interface app
    monitor-interface dmz
    monitor-interface data
    monitor-interface dev-app
    monitor-interface dev-data
    no monitor-interface management
    ===============failover test =============
    - unplug the outside interface cable on primary , led go off, but failover does not happen-
    - upplug the cable on inside, or parner , it still do not failover
    - only unplug the cable on other monitor interface , it failover. 
    =======clear config monitor-interface, and enter monitor-interface command for all the interface, re test, again, same result=======

    fw1# sh failover
    Failover On
    Failover unit Secondary
    Failover LAN Interface: failover GigabitEthernet1/3 (up)
    Unit Poll frequency 1 seconds, holdtime 15 seconds
    Interface Poll frequency 5 seconds, holdtime 25 seconds
    Interface Policy 1
    Monitored Interfaces 8 of 210 maximum
    Version: Ours 8.2(4)4, Mate 8.2(4)4
    Last Failover at: 15:44:00 EST Nov 24 2011
            This host: Secondary - Standby Ready
                    Active time: 767625 (sec)
                    slot 0: ASA5540 hw/sw rev (2.0/8.2(4)4) status (Up Sys)
                      Interface outside (209.202.65.132): Normal
                      Interface inside (10.100.161.2): Normal
                      Interface app (10.100.171.2): Normal
                      Interface dmz (10.100.172.2): Normal
                      Interface data (10.100.173.2): Normal
                      Interface dev-app (10.100.174.2): Normal
                      Interface dev-data (10.100.175.2): Normal
                      Interface management (10.7.4.9): Failed (Not-Monitored)
                      Interface partner (10.100.160.14): Normal
                    slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)
            Other host: Primary - Active
                    Active time: 77823 (sec)
                    slot 0: ASA5540 hw/sw rev (2.0/8.2(4)4) status (Up Sys)
                      Interface outside (209.202.65.131): Normal
                      Interface inside (10.100.161.1): Normal
                      Interface app (10.100.171.1): Normal
                      Interface dmz (10.100.172.1): Normal
                      Interface data (10.100.173.1): Normal
                      Interface dev-app (10.100.174.1): Normal
                      Interface dev-data (10.100.175.1): Normal
                      Interface management (10.7.4.8): Normal (Not-Monitored)
                      Interface partner (10.100.160.13): Normal
                    slot 1: ASA-SSM-4GE hw/sw rev (1.0/1.0(0)10) status (Up)
    Stateful Failover Logical Update Statistics
            Link : failover GigabitEthernet1/3 (up)
            Stateful Obj    xmit       xerr       rcv        rerr     
            General         1001073    0          443701     25       
            sys cmd         194284     0          194283     0        
            up time         0          0          0          0        
            RPC services    0          0          0          0        
            TCP conn        262196     0          45389      2        
            UDP conn        342196     0          47480      3        
            ARP tbl         202397     0          156529     20       
            Xlate_Timeout   0          0          0          0        
            IPv6 ND tbl     0          0          0          0        
            VPN IKE upd     0          0          10         0        

  • Monitor Problem please help!

    Hello everybody.
    I have bought my first macbook pro mid2012 (non retina) before 2 months. one day i spilled some juice on it unfortunately. everything seen to working fine with the except of the keyboard that was need to be replaced. i found a keyboard on the market and i replace it. the macbook was working fine after replacement but i was having some problems with microphone so i decided to reopen the macbook to check the microphone cable. after that the monitor was black!!! i saw deeply inside monitor and seems some problem with the light (inverter in pcs). i told to myself that i didnt properly connect the lvds cable so i reopen for last time the macbook to check but after my last try the monitor was tottaly black??? i can work with my macbook pro in external monitor and all are fine only the monitor is black (no signal no light). i went to a friend that fixes electronic and saw that a capacitor near lvds cable was run out ( this capacitor send power to monitor) and he fix it but after this again no signal no light. i thinkin that i need to change the screen ??? could anybody tell me some ideas. im really sorry for my bad english. My model is Md101 mid2012 core i5 non retina..

    If you are running Mavericks, you probably want to un-check "Displays have separate Spaces" in System Preferences > Mission Control.

  • 1 Website Blocked under ASA 5505 - Why?

    I have had the ASA 5505 set up for over 5 years, no problems.  For some reason there is one website that my users cannot access. www.communityservicepartners.org (173.161.122.9).  I have no idea why it is being blocked.  Can someone assist?  Thanks
    ------------------ show running-config ------------------
    : Saved
    ASA Version 7.2(2)
    hostname ciscoasa
    domain-name mrsh.net
    enable password <removed>
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.10.10.1 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address 173.15.74.73 255.0.0.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd <removed>
    time-range All
    periodic daily 0:00 to 23:59
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
    domain-name mrsh.net
    same-security-traffic permit intra-interface
    access-list mrsh_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 10.10.20.0 255.255.255.192
    access-list DefaultRAGroup_splitTunnelAcl standard permit 10.10.10.0 255.255.255.0
    access-list DefaultRAGroup_splitTunnelAcl standard permit host 173.15.74.73
    access-list DefaultRAGroup_splitTunnelAcl standard permit host 173.15.74.74
    access-list outside_access_in remark Implicit rule
    access-list outside_access_in extended permit ip any any
    access-list inside_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging console debugging
    logging buffered notifications
    logging trap debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool Pool 10.10.20.10-10.10.20.50 mask 255.255.255.192
    ip local pool Pool2 20.20.20.10-20.20.20.50 mask 255.255.255.192
    ip verify reverse-path interface inside
    ip verify reverse-path interface outside
    no failover
    monitor-interface inside
    monitor-interface outside
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list mrsh_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 10.10.10.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    port-forward RDP 3389 173.15.74.73 3389 RDP
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    vpn-access-hours value All
    vpn-simultaneous-logins 20
    vpn-idle-timeout none
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl
    http server enable
    http 10.10.10.100 255.255.255.255 inside
    http 10.10.10.2 255.255.255.255 inside
    http redirect inside 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime none
    crypto isakmp nat-traversal  20
    crypto isakmp ipsec-over-tcp port 10000
    tunnel-group DefaultRAGroup general-attributes
    address-pool Pool
    address-pool Pool2
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *
    isakmp keepalive disable
    tunnel-group DefaultWEBVPNGroup webvpn-attributes
    nbns-server 192.168.2.109 master timeout 2 retry 2
    tunnel-group MRSH type ipsec-ra
    tunnel-group MRSH general-attributes
    address-pool Pool
    default-group-policy DefaultRAGroup
    tunnel-group MRSH ipsec-attributes
    pre-shared-key *
    tunnel-group MRSH ppp-attributes
    authentication pap
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 60
    console timeout 0
    dhcpd address 10.10.10.2-10.10.10.230 inside
    dhcpd enable inside
    policy-map type inspect http http://192.168.2.100/mrshproject
    parameters
      protocol-violation action drop-connection
    webvpn
    svc enable
    port-forward RDP 3389 173.15.74.73 3389 RDP
    cache
      disable
      no cache-compressed
    prompt hostname context
    compression svc
    Cryptochecksum:278c4c6bf9defa17d7201e040655e9a7
    : end

    yes I am trying to access by name.
    Here is my oputput:
    Result of the command: "packet-tracer in inside tcp 10.10.10.10 12345 173.161.122.9 80"
    Phase: 1
    Type: FLOW-LOOKUP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Found no matching flow, creating a new flow
    Phase: 2
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   173.0.0.0       255.0.0.0       outside
    Phase: 3
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   10.10.10.0      255.255.255.0   inside
    Phase: 4
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group inside_access_in in interface inside
    access-list inside_access_in extended permit ip any any
    Additional Information:
    Phase: 5
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 6
    Type: NAT
    Subtype:
    Result: ALLOW
    Config:
    nat (inside) 0 access-list mrsh_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
      match ip inside any outside any
        dynamic translation to pool 1 (173.15.74.73 [Interface PAT])
        translate_hits = 1010100, untranslate_hits = 497459
    Additional Information:
    Dynamic translate 10.10.10.10/12345 to 173.15.74.73/57304 using netmask 255.255.255.255
    Phase: 7
    Type: NAT
    Subtype: host-limits
    Result: ALLOW
    Config:
    nat (inside) 0 access-list mrsh_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
      match ip inside any inside any
        dynamic translation to pool 1 (No matching global)
        translate_hits = 0, untranslate_hits = 0
    Additional Information:
    Phase: 8
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 9
    Type: FLOW-CREATION
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    New flow created with id 1034245, packet dispatched to next module
    Result:
    input-interface: inside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: allow

  • ASA 5505, error in Access Rule

    Hello.
    Tha ASA 5505 is working, but I try to allow http and https from internet to a server running 2012 Essentials. The server has the internal IP 192.168.0.100. I have created an Object called SERVER with IP 192.168.0.100
    The outside Interface is called ICE
    I have configured NAT:
    I have also configured Access Rules:
    But when I test it With the Packet Tracer I get an error:
    Whats wrong With the Access Rule?
    I do prefer the ASDM :)
    Best regards Andreas

    Hello Jeevak.
    This is the running config (Vlan 13 (Interface ICE) is the one in use:
    domain-name DOMAIN.local
    names
    name 192.168.0.150 Server1 description SBS 2003 Server
    name 192.168.10.10 IP_ICE
    name x.x.x.0 outside-network
    name x.x.x.7 IP_outside
    name 192.168.0.100 SERVER description Hovedserver
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.0.1 255.255.255.0
    interface Vlan2
     description Direct Connect
     backup interface Vlan13
     nameif outside
     security-level 0
     pppoe client vpdn group PPPoE_DirectConnect
     ip address pppoe
    interface Vlan3
     description Gjestenettet
     nameif dmz
     security-level 50
     ip address 10.0.0.1 255.255.255.0
    interface Vlan13
     description Backupnett ICE
     nameif ICE
     security-level 0
     ip address IP_ICE 255.255.255.0
    interface Vlan23
     description
     nameif USER
     security-level 50
     ip address 10.1.1.1 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
     switchport access vlan 13
    interface Ethernet0/2
     switchport access vlan 23
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
     switchport access vlan 3
    interface Ethernet0/7
     switchport access vlan 3
    ftp mode passive
    clock timezone CEST 1
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    dns domain-lookup dmz
    dns server-group DefaultDNS
     domain-name DOMAIN.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_access_in extended permit tcp any host IP_outside eq https
    access-list outside_access_in extended permit tcp any host IP_outside eq www
    access-list outside_access_in extended permit icmp any host IP_outside echo-reply
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list outside_access_in remark For RWW
    access-list DOMAINVPN_splitTunnelAcl standard permit any
    access-list inside_nat0_outbound extended permit ip any 192.168.0.192 255.255.255.192
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.0.192 255.255.255.192
    access-list DOMAIN_VPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
    access-list ICE_access_in extended permit tcp any host IP_ICE eq https
    access-list ICE_access_in extended permit tcp any host IP_ICE eq www
    access-list ICE_access_in extended permit icmp any host IP_ICE echo-reply
    access-list ICE_access_in remark For RWW
    access-list ICE_access_in remark For RWW
    access-list USER_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm warnings
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu ICE 1500
    mtu USER 1500
    ip local pool VPNPool 192.168.10.210-192.168.10.225 mask 255.255.255.0
    no failover
    monitor-interface inside
    monitor-interface outside
    monitor-interface dmz
    monitor-interface ICE
    monitor-interface USER
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit outside-network 255.255.255.0 outside
    icmp permit 192.168.10.0 255.255.255.0 ICE
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    global (ICE) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (dmz) 1 10.0.0.0 255.255.255.0
    nat (USER) 1 10.1.1.0 255.255.255.0
    static (inside,ICE) tcp interface www SERVER www netmask 255.255.255.255
    static (inside,outside) tcp interface www SERVER www netmask 255.255.255.255
    static (inside,ICE) tcp interface https SERVER https netmask 255.255.255.255
    static (inside,outside) tcp interface https SERVER https netmask 255.255.255.255
    access-group outside_access_in in interface outside
    access-group ICE_access_in in interface ICE
    access-group USER_access_in in interface USER
    route outside 0.0.0.0 0.0.0.0 x.x.x.1 1 track 123
    route ICE 0.0.0.0 0.0.0.0 192.168.10.1 254
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sla monitor 1
     type echo protocol ipIcmpEcho x.x.x.1 interface outside
     num-packets 3
     frequency 10
    sla monitor schedule 1 life forever start-time now
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs group1
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs group1
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    track 123 rtr 1 reachability
    no vpn-addr-assign local
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    dhcpd address 10.0.0.10-10.0.0.39 dmz
    dhcpd dns y.y.y.2 z.z.z.z interface dmz
    dhcpd lease 6000 interface dmz
    dhcpd enable dmz
    dhcpd address 10.1.1.100-10.1.1.120 USER
    dhcpd dns y.y.y.2 z.z.z.z interface USER
    dhcpd lease 6000 interface USER
    dhcpd domain USER interface USER
    dhcpd enable USER
    ntp server 64.0.0.2 source outside
    group-policy DOMAIN_VPN internal
    group-policy DOMAIN_VPN attributes
     dns-server value 192.168.0.150
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value DOMAIN_VPN_splitTunnelAcl
     default-domain value DOMAIN.local
    class-map inspection_default
     match default-inspection-traffic
    class-map imblock
     match any
    class-map P2P
     match port tcp eq www
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map type inspect im impolicy
     parameters
     match protocol msn-im yahoo-im
      drop-connection log
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect pptp
    policy-map type inspect http P2P_HTTP
     parameters
     match request uri regex _default_gator
      drop-connection log
     match request uri regex _default_x-kazaa-network
      drop-connection log
     match request uri regex _default_msn-messenger
      drop-connection log
     match request uri regex _default_gnu-http-tunnel_arg
      drop-connection log
    policy-map IM_P2P
     class imblock
      inspect im impolicy
     class P2P
      inspect http P2P_HTTP
    service-policy global_policy global
    service-policy IM_P2P interface inside
    prompt hostname context
    : end
    asdm image disk0:/asdm-524.bin
    asdm location Server1 255.255.255.255 inside
    asdm location IP_ICE 255.255.255.255 inside
    asdm location outside-network 255.255.255.0 inside
    asdm location SERVER 255.255.255.255 inside
    no asdm history enable
    What is wrong? Everything Works well except port forwarding.
    Andreas

  • ASA 5505 VPN Can not connect clients

    Hi,
    I tried to search for an answer to this question but I couldn't find the answer.
    I configured the VPN on the ASA, I can not  get a client to connect to the ASA  I've tried and search for an answer and I really need som help!
    Any help is greatly appreciated.
    : Saved
    ASA Version 7.2(2)
    hostname
    domain-name
    enable password
    names
    ddns update method
    ddns both
    interface Vlan1
    nameif inside
    security-level 100
    ddns update hostname
    ddns update
    dhcp client update dns
    ip address 192.168.1.1 255.255.255.0
    ospf cost 10
    interface Vlan2
    nameif outside
    security-level 0
    ip address x.x.x.x 255.255.255.0
    ospf cost 10
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server
    name-server
    domain-name
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list EasyVPN_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    access-list OUTSIDE_IN_ACL extended permit ip any any
    access-list OUTSIDE_IN_ACL extended permit icmp any interface outside
    access-list Remote-VPN_splitTunnelAcl standard permit any
    access-list DefaultRAGroup_splitTunnelAcl standard permit any
    access-list Bild_splitTunnelAcl standard permit any
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool TKK 192.168.1.200-192.168.1.220 mask 255.255.255.224
    ip local pool VPN-Pool 192.168.254.1-192.168.254.10 mask 255.255.255.0
    no failover
    monitor-interface inside
    monitor-interface outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any outside
    asdm image disk0:/asdm-522.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    nat (outside) 0 access-list outside_nat0_outbound
    static (inside,inside) tcp interface 3389 access-list inside_nat_static
    static (inside,inside) tcp interface ftp access-list inside_nat_static_2
    static (outside,inside) x.x.x.x 192.168.1.0 netmask 255.255.255.255 dns
    access-group inside_access_in in interface inside
    access-group inside_access_out out interface inside
    access-group outside_access_in in interface outside
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    vpn-tunnel-protocol l2tp-ipsec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    banner none
    wins-server none
    dns-server value 192.168.1.253
    dhcp-network-scope none
    vpn-access-hours none
    vpn-simultaneous-logins 3
    vpn-idle-timeout 30
    vpn-session-timeout none
    vpn-filter none
    vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
    password-storage disable
    ip-comp disable
    re-xauth disable
    group-lock none
    pfs disable
    ipsec-udp disable
    ipsec-udp-port 10000
    split-tunnel-policy tunnelall
    split-tunnel-network-list none
    default-domain none
    split-dns none
    intercept-dhcp 255.255.255.255 disable
    secure-unit-authentication disable
    user-authentication disable
    user-authentication-idle-timeout 30
    ip-phone-bypass disable
    leap-bypass disable
    nem disable
    backup-servers keep-client-config
    msie-proxy server none
    msie-proxy method no-modify
    msie-proxy except-list none
    msie-proxy local-bypass disable
    nac disable
    nac-sq-period 300
    nac-reval-period 36000
    nac-default-acl none
    address-pools none
    client-firewall none
    client-access-rule none
    webvpn
      functions url-entry
      html-content-filter none
      homepage none
      keep-alive-ignore 4
      http-comp gzip
      filter none
      url-list none
      customization value DfltCustomization
      port-forward none
      port-forward-name value Application Access
      sso-server none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission
    to use any of the VPN features. Contact your IT administrator for more information
      svc none
      svc keep-installer installed
      svc keepalive none
      svc rekey time none
      svc rekey method none
      svc dpd-interval client none
      svc dpd-interval gateway none
      svc compression deflate
    group-policy EasyVPN internal
    group-policy EasyVPN attributes
    dns-server value 192.168.1.253
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value EasyVPN_splitTunnelAcl
    default-domain value xxx.se
    group-policy Remote-VPN internal
    group-policy Remote-VPN attributes
    dns-server value 192.168.1.253
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Remote-VPN_splitTunnelAcl
    default-domain value xxx.se
    group-policy CiscoASA internal
    group-policy CiscoASA attributes
    dns-server value 192.168.1.253 x.x.x.x
    vpn-tunnel-protocol IPSec webvpn
    group-policy Bild internal
    group-policy Bild attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Bild_splitTunnelAcl
    username User attributes
    vpn-group-policy DfltGrpPolicy
    username Bild password encrypted privilege 0
    username Bild attributes
    vpn-group-policy Bild
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 40 set pfs
    crypto dynamic-map outside_dyn_map 40 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 60 set pfs
    crypto dynamic-map outside_dyn_map 60 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 80 set pfs
    crypto dynamic-map outside_dyn_map 80 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 100 set pfs
    crypto dynamic-map outside_dyn_map 100 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 120 set pfs
    crypto dynamic-map outside_dyn_map 120 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 140 set pfs
    crypto dynamic-map outside_dyn_map 140 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 160 set pfs
    crypto dynamic-map outside_dyn_map 160 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 180 set pfs
    crypto dynamic-map outside_dyn_map 180 set transform-set TRANS_ESP_DES_SHA
    crypto dynamic-map outside_dyn_map 200 set pfs
    crypto dynamic-map outside_dyn_map 200 set transform-set ESP-DES-SHA
    crypto dynamic-map outside_dyn_map 220 set pfs
    crypto dynamic-map outside_dyn_map 220 set transform-set ESP-DES-SHA
    crypto dynamic-map inside_dyn_map 20 set pfs
    crypto dynamic-map inside_dyn_map 20 set transform-set ESP-DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map
    crypto map inside_map interface inside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp nat-traversal  20
    crypto isakmp ipsec-over-tcp port 10000
    tunnel-group DefaultRAGroup general-attributes
    address-pool vpn
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *
    tunnel-group Bild type ipsec-ra
    tunnel-group Bild general-attributes
    address-pool TKK
    default-group-policy Bild
    tunnel-group Bild ipsec-attributes
    pre-shared-key *
    tunnel-group CiscoASA type ipsec-ra
    tunnel-group CiscoASA general-attributes
    address-pool vpn
    default-group-policy CiscoASA
    tunnel-group CiscoASA ipsec-attributes
    pre-shared-key *
    tunnel-group EasyVPN type ipsec-ra
    tunnel-group EasyVPN general-attributes
    address-pool vpn
    default-group-policy EasyVPN
    tunnel-group EasyVPN ipsec-attributes
    pre-shared-key *
    tunnel-group Remote-VPN type ipsec-ra
    tunnel-group Remote-VPN general-attributes
    address-pool VPN-Pool
    default-group-policy Remote-VPN
    tunnel-group Remote-VPN ipsec-attributes
    pre-shared-key *
    class-map global-class
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global-policy
    class global-class
      inspect ftp
      inspect icmp
      inspect pptp
    service-policy global-policy global
    prompt hostname context
    Cryptochecksum:8cdda33b1993ba7bb33db88d996e939c
    : end

    Hi Fredrik,
    I see your acl "outside_nat0_outbound" set on inside interface for no nat, but I do not see, the acl is being defined anywhere on your config.
    I also strongly recommand create your vpn-pool to be different subnet rather being as same as your inside ip of your ASA.
    so, let assume your vpn pool is 192.168.255.1-254/24
    so, your no-nat for inside will look like this below.
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.255.0 255.255.255.0
    Let me know, if this helps.
    thanks

  • Unable to Access Remote LAN over IPSec VPN

    I have a Cisco ASA 5540 setup with Remote Access VPN for users. Suddenly no one can access the remote LAN over VPN. Below is my config:
    ASA Version 7.0(8)
    hostname DC2ASA
    domain-name yorktel.com
    enable password d2XdVlFOzleWlH1j encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    dns-guard
    interface GigabitEthernet0/0
     description outside/savvis
     nameif outside
     security-level 0
     ip address 216.33.198.4 255.255.255.0 standby 216.33.198.5
    interface GigabitEthernet0/1
     description inside
     nameif inside
     security-level 100
     ip address 10.203.204.1 255.255.254.0 standby 10.203.204.2
    interface GigabitEthernet0/2
     nameif insidesan
     security-level 100
     ip address 10.203.206.1 255.255.254.0 standby 10.203.206.2
    interface GigabitEthernet0/3
     description LAN/STATE Failover Interface
    interface Management0/0
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0
     management-only
    ftp mode passive
    object-group service FileMaker tcp-udp
     port-object range 16000 16001
    access-list outside-in extended permit ip 65.123.204.0 255.255.254.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit ip 216.33.198.0 255.255.255.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit icmp 216.33.198.0 255.255.255.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit icmp any any
    access-list outside-in extended permit icmp any any echo
    access-list outside-in extended permit ip any host 216.33.198.22 inactive
    access-list outside-in extended permit tcp any host 216.33.198.19
    access-list outside-in extended permit udp any host 216.33.198.19
    access-list outside-in extended permit ip any host 216.33.198.19
    access-list outside-in extended permit tcp any host 216.33.198.10 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ftp inactive
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ftp-data inactive
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ssh inactive
    access-list outside-in extended permit tcp any host 216.33.198.19 eq www
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.19 eq https
    access-list outside-in extended permit tcp any host 216.33.198.19 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.19 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.19 eq smtp
    access-list outside-in extended permit tcp any host 216.33.198.19 eq pop3
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 587
    access-list outside-in extended permit tcp any host 216.33.198.16 eq www
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.16 eq https
    access-list outside-in extended permit tcp any host 216.33.198.16 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.16 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.38 eq www
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.38 eq https
    access-list outside-in extended permit tcp any host 216.33.198.38 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.38 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.25 eq www
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.25 eq https
    access-list outside-in extended permit tcp any host 216.33.198.25 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.25 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.22 eq www
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.22 eq https
    access-list outside-in extended permit tcp any host 216.33.198.22 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.22 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.17 eq www
    access-list outside-in extended permit tcp any host 216.33.198.17 eq rtsp
    access-list outside-in extended permit udp any host 216.33.198.17 eq 5005
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.17 eq 1755
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.17 eq https
    access-list outside-in extended permit tcp any host 216.33.198.17 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.17 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 989
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 990
    access-list outside-in extended permit tcp any host 216.33.198.24 eq www
    access-list outside-in extended permit tcp any host 216.33.198.24 eq rtsp
    access-list outside-in extended permit udp any host 216.33.198.24 eq 5005
    access-list outside-in extended permit tcp any host 216.33.198.24 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.24 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.24
    access-list outside-in extended permit tcp any host 216.33.198.24 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.24 eq https
    access-list outside-in extended permit tcp 209.67.5.96 255.255.255.224 any inactive
    access-list outside-in extended permit udp 209.67.5.96 255.255.255.224 any inactive
    access-list outside-in extended permit udp any host 216.33.198.17 inactive
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 1433
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 1434
    access-list outside-in extended permit tcp any host 216.33.198.100 eq www
    access-list outside-in extended permit tcp any host 216.33.198.101 eq www
    access-list outside-in extended permit tcp any host 216.33.198.102 eq www
    access-list outside-in extended permit tcp any host 216.33.198.103 eq www
    access-list outside-in extended permit tcp any host 216.33.198.104 eq www
    access-list outside-in extended permit tcp any host 216.33.198.105 eq www
    access-list outside-in extended permit tcp any host 216.33.198.106 eq www
    access-list outside-in extended permit tcp any host 216.33.198.107 eq www
    access-list outside-in extended permit tcp any host 216.33.198.108 eq www
    access-list outside-in extended permit tcp any host 216.33.198.109 eq www
    access-list outside-in extended permit tcp any host 216.33.198.110 eq www
    access-list outside-in extended permit tcp any host 216.33.198.100 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.101 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.102 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.103 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.104 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.105 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.106 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.107 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.108 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.109 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.110 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.100 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.101 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.102 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.103 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.104 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.105 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.106 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.107 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.108 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.109 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.110 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.100 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.101 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.102 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.103 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.104 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.105 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.106 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.107 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.108 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.109 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.110 eq ftp-data
    access-list outside-in extended permit tcp host 12.71.134.4 any
    access-list outside-in extended permit udp host 12.71.134.4 any
    access-list outside-in remark Allow Mark to access remote desktop from home office.
    access-list outside-in extended permit tcp host 96.255.220.240 any
    access-list outside-in remark Allow Mark to access remote desktop from home office.
    access-list outside-in extended permit udp host 96.255.220.240 any
    access-list outside-in extended permit tcp host 67.81.54.83 any
    access-list outside-in remark Allow Chris to access remote desktop from home office.
    access-list outside-in extended permit tcp host 100.1.41.196 any
    access-list outside-in remark Allow Chris to access remote desktop from home office.
    access-list outside-in extended permit udp host 100.1.41.196 any
    access-list outside-in extended permit udp host 67.81.54.83 any
    access-list outside-in remark Allow Jim Johnstone to remote in from home office.
    access-list outside-in extended permit tcp host 96.225.44.46 any
    access-list outside-in remark Allow Jim Johnstone to remote in from home office.
    access-list outside-in extended permit udp host 96.225.44.46 any
    access-list outside-in extended permit tcp host 64.19.183.67 any
    access-list outside-in extended permit udp host 64.19.183.67 any
    access-list outside-in remark Allow Steve Fisher to remote in from home office.
    access-list outside-in extended permit tcp host 173.67.0.16 any
    access-list outside-in remark Allow Steve Fisher to remote in from home office.
    access-list outside-in extended permit udp host 173.67.0.16 any
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq 3389
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq ftp-data
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq ftp
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq www
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq https
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit udp any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit ip any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 3389 inactive
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq 3389
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq www
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq https
    access-list outside-in extended permit tcp any host 216.33.198.21 eq 8080
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq ftp
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 3306
    access-list outside-in extended permit udp any host 216.33.198.19 eq 3306
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq 3389
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq ftp
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq www
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 3389 inactive
    access-list outside-in extended permit tcp any host 216.33.198.17 inactive
    access-list outside-in extended permit ip any host 216.33.198.17 inactive
    access-list outside-in extended permit tcp any host 216.33.198.18 inactive
    access-list outside-in extended permit udp any host 216.33.198.17 eq 554
    access-list outside-in extended permit udp any host 216.33.198.24 eq 554
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit tcp host 64.241.196.50 any
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit udp host 64.241.196.50 any
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit ip host 64.241.196.50 any
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.26 eq www
    access-list outside-in extended permit tcp any host 216.33.198.26 eq https
    access-list outside-in extended permit tcp any host 216.33.198.27 eq https
    access-list outside-in extended permit tcp any host 216.33.198.27 eq www
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.27 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.27 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ftp inactive
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ssh inactive
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 81
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.28 eq www
    access-list outside-in extended permit tcp any host 216.33.198.28 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.29 eq www
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.29 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.30 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.31 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.20 object-group FileMaker
    access-list outside-in extended permit tcp any host 216.33.198.20 eq 5003
    access-list outside-in extended permit udp any host 216.33.198.20 eq 5003
    access-list outside-in extended permit tcp any host 216.33.198.33 eq www
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.33 eq https
    access-list outside-in extended permit tcp any host 216.33.198.33 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.33 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.34 eq www
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.34 eq https
    access-list outside-in extended permit tcp any host 216.33.198.34 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.34 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.36 eq www
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.36 eq https
    access-list outside-in extended permit tcp any host 216.33.198.36 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.36 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.37 eq www
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.37 eq https
    access-list outside-in extended permit tcp any host 216.33.198.37 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.37 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.39 eq www
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.39 eq https
    access-list outside-in extended permit tcp any host 216.33.198.39 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.39 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.41 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.41 eq www
    access-list outside-in extended permit tcp any host 216.33.198.41 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.41 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.41 eq https
    access-list outside-in extended permit tcp any host 216.33.198.41 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.42 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.42 eq www
    access-list outside-in extended permit tcp any host 216.33.198.42 eq https
    access-list outside-in extended permit tcp any host 216.33.198.42 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.42 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.42 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.28
    access-list inside-out extended permit tcp any host 216.33.198.17 eq rtsp
    access-list inside-out extended permit udp any host 216.33.198.17 eq 5004
    access-list inside-out extended permit udp any host 216.33.198.17 eq 5005
    access-list inside-out extended permit tcp any host 216.33.198.17 eq 1755
    access-list inside-out extended permit udp any host 216.33.198.17 eq 1755
    access-list rtsp-acl extended deny tcp any host 216.33.198.17 eq rtsp
    access-list rtsp-acl extended permit tcp any any eq rtsp
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 10.203.204.0 255.255.255.192
    access-list inside_nat0_outbound extended permit ip any 10.203.204.48 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 10.203.204.0 255.255.255.192
    access-list inside_nat0_outbound extended permit ip host 10.203.204.19 10.203.204.32 255.255.255.224
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 192.168.250.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 192.168.252.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 10.203.204.144 255.255.255.240
    access-list inside_nat0_outbound extended permit ip host 216.33.198.33 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.19 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.17 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.24 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.20 any inactive
    access-list inside_nat0_outbound extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip any 10.203.204.48 255.255.255.248
    access-list inside_nat0_outbound extended permit ip any 216.33.198.56 255.255.255.248
    access-list dc2vpn_splitTunnelAcl standard permit 10.203.204.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit 192.168.252.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit any
    access-list outside_map standard permit any
    access-list Split_Tunnel_List standard permit 10.203.204.0 255.255.255.0
    access-list test_splitTunnelAcl standard permit any
    access-list outside_access_out extended permit tcp any host 12.71.134.75 inactive
    access-list outside_in extended permit tcp host 12.71.134.75 any eq smtp
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.130.31
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.102
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.103
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.104
    access-list outside_nat0_inbound extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_80 extended permit ip 10.203.204.0 255.255.255.0 192.168.250.0 255.255.255.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.33 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.19 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.17 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.24 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_100 extended permit ip 10.203.204.0 255.255.255.0 192.168.252.0 255.255.255.0
    access-list dc2vpntest_splitTunnelAcl standard permit 10.203.204.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    logging ftp-bufferwrap
    logging ftp-server 10.203.204.10 logs asa ****
    mtu outside 1500
    mtu inside 1500
    mtu insidesan 1500
    mtu management 1500
    ip local pool vpnpool 10.203.204.60-10.203.204.65 mask 255.255.255.0
    failover
    failover lan unit secondary
    failover lan interface failover GigabitEthernet0/3
    failover polltime unit msec 999 holdtime 3
    failover polltime interface 5
    failover link failover GigabitEthernet0/3
    failover interface ip failover 172.16.100.1 255.255.255.252 standby 172.16.100.2
    monitor-interface outside
    monitor-interface inside
    monitor-interface insidesan
    no monitor-interface management
    icmp permit 65.123.204.0 255.255.254.0 outside
    asdm image disk0:/asdm-508.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    nat (outside) 0 access-list outside_nat0_inbound outside
    nat (inside) 0 access-list inside_nat0_outbound
    static (inside,outside) 216.33.198.10 10.203.204.10 netmask 255.255.255.255
    static (inside,outside) 216.33.198.11 10.203.204.11 netmask 255.255.255.255
    static (inside,outside) 216.33.198.12 10.203.204.12 netmask 255.255.255.255
    static (inside,outside) 216.33.198.13 10.203.204.13 netmask 255.255.255.255
    static (inside,outside) 216.33.198.14 10.203.204.14 netmask 255.255.255.255
    static (inside,outside) 216.33.198.15 10.203.204.15 netmask 255.255.255.255
    static (inside,outside) 216.33.198.16 10.203.204.16 netmask 255.255.255.255
    static (inside,outside) 216.33.198.17 10.203.204.17 netmask 255.255.255.255
    static (inside,outside) 216.33.198.18 10.203.204.18 netmask 255.255.255.255
    static (inside,outside) 216.33.198.19 10.203.204.19 netmask 255.255.255.255
    static (inside,outside) 216.33.198.20 10.203.204.20 netmask 255.255.255.255
    static (inside,outside) 216.33.198.21 10.203.204.21 netmask 255.255.255.255
    static (inside,outside) 216.33.198.22 10.203.204.22 netmask 255.255.255.255
    static (inside,outside) 216.33.198.23 10.203.204.23 netmask 255.255.255.255
    static (inside,outside) 216.33.198.24 10.203.204.24 netmask 255.255.255.255
    static (inside,outside) 216.33.198.25 10.203.204.25 netmask 255.255.255.255
    static (inside,outside) 216.33.198.26 10.203.204.26 netmask 255.255.255.255
    static (inside,outside) 216.33.198.27 10.203.204.27 netmask 255.255.255.255
    static (inside,outside) 216.33.198.28 10.203.204.28 netmask 255.255.255.255
    static (inside,outside) 216.33.198.29 10.203.204.29 netmask 255.255.255.255
    static (inside,outside) 216.33.198.30 10.203.204.30 netmask 255.255.255.255
    static (inside,outside) 216.33.198.31 10.203.204.31 netmask 255.255.255.255
    static (inside,outside) 216.33.198.32 10.203.204.32 netmask 255.255.255.255
    static (inside,outside) 216.33.198.33 10.203.204.33 netmask 255.255.255.255
    static (inside,outside) 216.33.198.34 10.203.204.34 netmask 255.255.255.255
    static (inside,outside) 216.33.198.35 10.203.204.35 netmask 255.255.255.255
    static (inside,outside) 216.33.198.36 10.203.204.36 netmask 255.255.255.255
    static (inside,outside) 216.33.198.37 10.203.204.37 netmask 255.255.255.255
    static (inside,outside) 216.33.198.38 10.203.204.38 netmask 255.255.255.255
    static (inside,outside) 216.33.198.39 10.203.204.39 netmask 255.255.255.255
    static (inside,outside) 216.33.198.40 10.203.204.40 netmask 255.255.255.255
    static (inside,outside) 216.33.198.41 10.203.204.41 netmask 255.255.255.255
    static (inside,outside) 216.33.198.42 10.203.204.42 netmask 255.255.255.255
    static (inside,outside) 216.33.198.43 10.203.204.43 netmask 255.255.255.255
    static (inside,outside) 216.33.198.44 10.203.204.44 netmask 255.255.255.255
    static (inside,outside) 216.33.198.45 10.203.204.45 netmask 255.255.255.255
    static (inside,outside) 216.33.198.46 10.203.204.46 netmask 255.255.255.255
    static (inside,outside) 216.33.198.47 10.203.204.47 netmask 255.255.255.255
    static (inside,outside) 216.33.198.48 10.203.204.48 netmask 255.255.255.255
    static (inside,outside) 216.33.198.49 10.203.204.49 netmask 255.255.255.255
    static (inside,outside) 216.33.198.50 10.203.204.50 netmask 255.255.255.255
    static (inside,outside) 216.33.198.51 10.203.204.51 netmask 255.255.255.255
    static (inside,outside) 216.33.198.52 10.203.204.52 netmask 255.255.255.255
    static (inside,outside) 216.33.198.53 10.203.204.53 netmask 255.255.255.255
    static (inside,outside) 216.33.198.54 10.203.204.54 netmask 255.255.255.255
    static (inside,outside) 216.33.198.55 10.203.204.55 netmask 255.255.255.255
    static (inside,outside) 216.33.198.56 10.203.204.56 netmask 255.255.255.255
    static (inside,outside) 216.33.198.57 10.203.204.57 netmask 255.255.255.255
    static (inside,outside) 216.33.198.58 10.203.204.58 netmask 255.255.255.255
    static (inside,outside) 216.33.198.59 10.203.204.59 netmask 255.255.255.255
    static (inside,outside) 216.33.198.60 10.203.204.60 netmask 255.255.255.255
    static (inside,outside) 216.33.198.61 10.203.204.61 netmask 255.255.255.255
    static (inside,outside) 216.33.198.62 10.203.204.62 netmask 255.255.255.255
    static (inside,outside) 216.33.198.63 10.203.204.63 netmask 255.255.255.255
    static (inside,outside) 216.33.198.64 10.203.204.64 netmask 255.255.255.255
    static (inside,outside) 216.33.198.65 10.203.204.65 netmask 255.255.255.255
    static (inside,outside) 216.33.198.66 10.203.204.66 netmask 255.255.255.255
    static (inside,outside) 216.33.198.67 10.203.204.67 netmask 255.255.255.255
    static (inside,outside) 216.33.198.68 10.203.204.68 netmask 255.255.255.255
    static (inside,outside) 216.33.198.69 10.203.204.69 netmask 255.255.255.255
    static (inside,outside) 216.33.198.70 10.203.204.70 netmask 255.255.255.255
    static (inside,outside) 216.33.198.71 10.203.204.71 netmask 255.255.255.255
    static (inside,outside) 216.33.198.100 10.203.204.100 netmask 255.255.255.255
    static (inside,outside) 216.33.198.101 10.203.204.101 netmask 255.255.255.255
    static (inside,outside) 216.33.198.102 10.203.204.102 netmask 255.255.255.255
    static (inside,outside) 216.33.198.103 10.203.204.103 netmask 255.255.255.255
    static (inside,outside) 216.33.198.104 10.203.204.104 netmask 255.255.255.255
    static (inside,outside) 216.33.198.105 10.203.204.105 netmask 255.255.255.255
    static (inside,outside) 216.33.198.106 10.203.204.106 netmask 255.255.255.255
    static (inside,outside) 216.33.198.107 10.203.204.107 netmask 255.255.255.255
    static (inside,outside) 216.33.198.108 10.203.204.108 netmask 255.255.255.255
    static (inside,outside) 216.33.198.109 10.203.204.109 netmask 255.255.255.255
    static (inside,outside) 216.33.198.110 10.203.204.110 netmask 255.255.255.255
    static (inside,outside) 216.33.198.111 10.203.204.111 netmask 255.255.255.255
    static (inside,outside) 216.33.198.112 10.203.204.112 netmask 255.255.255.255
    static (inside,outside) 216.33.198.113 10.203.204.113 netmask 255.255.255.255
    static (inside,outside) 216.33.198.114 10.203.204.114 netmask 255.255.255.255
    static (inside,outside) 216.33.198.115 10.203.204.115 netmask 255.255.255.255
    static (inside,outside) 216.33.198.116 10.203.204.116 netmask 255.255.255.255
    static (inside,outside) 216.33.198.117 10.203.204.117 netmask 255.255.255.255
    static (inside,outside) 216.33.198.118 10.203.204.118 netmask 255.255.255.255
    static (inside,outside) 216.33.198.119 10.203.204.119 netmask 255.255.255.255
    static (inside,outside) 216.33.198.120 10.203.204.120 netmask 255.255.255.255
    static (inside,outside) 216.33.198.121 10.203.204.121 netmask 255.255.255.255
    static (inside,outside) 216.33.198.122 10.203.204.122 netmask 255.255.255.255
    static (inside,outside) 216.33.198.123 10.203.204.123 netmask 255.255.255.255
    static (inside,outside) 216.33.198.124 10.203.204.124 netmask 255.255.255.255
    static (inside,outside) 216.33.198.125 10.203.204.125 netmask 255.255.255.255
    static (inside,outside) 216.33.198.126 10.203.204.126 netmask 255.255.255.255
    static (inside,outside) 216.33.198.127 10.203.204.127 netmask 255.255.255.255
    static (inside,outside) 216.33.198.128 10.203.204.128 netmask 255.255.255.255
    static (inside,outside) 216.33.198.129 10.203.204.129 netmask 255.255.255.255
    static (inside,outside) 216.33.198.130 10.203.204.130 netmask 255.255.255.255
    static (inside,outside) 216.33.198.131 10.203.204.131 netmask 255.255.255.255
    static (inside,outside) 216.33.198.132 10.203.204.132 netmask 255.255.255.255
    static (inside,outside) 216.33.198.133 10.203.204.133 netmask 255.255.255.255
    static (inside,outside) 216.33.198.134 10.203.204.134 netmask 255.255.255.255
    static (inside,outside) 216.33.198.135 10.203.204.135 netmask 255.255.255.255
    static (inside,outside) 216.33.198.136 10.203.204.136 netmask 255.255.255.255
    static (inside,outside) 216.33.198.137 10.203.204.137 netmask 255.255.255.255
    static (inside,outside) 216.33.198.138 10.203.204.138 netmask 255.255.255.255
    static (inside,outside) 216.33.198.139 10.203.204.139 netmask 255.255.255.255
    static (inside,outside) 216.33.198.140 10.203.204.140 netmask 255.255.255.255
    static (inside,outside) 216.33.198.141 10.203.204.141 netmask 255.255.255.255
    static (inside,outside) 216.33.198.142 10.203.204.142 netmask 255.255.255.255
    static (inside,outside) 216.33.198.143 10.203.204.143 netmask 255.255.255.255
    static (inside,outside) 216.33.198.144 10.203.204.144 netmask 255.255.255.255
    static (inside,outside) 216.33.198.145 10.203.204.145 netmask 255.255.255.255
    static (inside,outside) 216.33.198.146 10.203.204.146 netmask 255.255.255.255
    static (inside,outside) 216.33.198.147 10.203.204.147 netmask 255.255.255.255
    static (inside,outside) 216.33.198.148 10.203.204.148 netmask 255.255.255.255
    static (inside,outside) 216.33.198.149 10.203.204.149 netmask 255.255.255.255
    static (inside,outside) 216.33.198.150 10.203.204.150 netmask 255.255.255.255
    static (inside,outside) 216.33.198.151 10.203.204.151 netmask 255.255.255.255
    static (inside,outside) 216.33.198.152 10.203.204.152 netmask 255.255.255.255
    static (inside,outside) 216.33.198.153 10.203.204.153 netmask 255.255.255.255
    static (inside,outside) 216.33.198.154 10.203.204.154 netmask 255.255.255.255
    static (inside,outside) 216.33.198.155 10.203.204.155 netmask 255.255.255.255
    static (inside,outside) 216.33.198.156 10.203.204.156 netmask 255.255.255.255
    static (inside,outside) 216.33.198.157 10.203.204.157 netmask 255.255.255.255
    static (inside,outside) 216.33.198.158 10.203.204.158 netmask 255.255.255.255
    static (inside,outside) 216.33.198.159 10.203.204.159 netmask 255.255.255.255
    static (inside,outside) 216.33.198.160 10.203.204.160 netmask 255.255.255.255
    static (inside,outside) 216.33.198.161 10.203.204.161 netmask 255.255.255.255
    static (inside,outside) 216.33.198.162 10.203.204.162 netmask 255.255.255.255
    static (inside,outside) 216.33.198.163 10.203.204.163 netmask 255.255.255.255
    static (inside,outside) 216.33.198.164 10.203.204.164 netmask 255.255.255.255
    static (inside,outside) 216.33.198.165 10.203.204.165 netmask 255.255.255.255
    static (inside,outside) 216.33.198.166 10.203.204.166 netmask 255.255.255.255
    static (inside,outside) 216.33.198.167 10.203.204.167 netmask 255.255.255.255
    static (inside,outside) 216.33.198.168 10.203.204.168 netmask 255.255.255.255
    static (inside,outside) 216.33.198.169 10.203.204.169 netmask 255.255.255.255
    static (inside,outside) 216.33.198.170 10.203.204.170 netmask 255.255.255.255
    static (inside,outside) 216.33.198.171 10.203.204.171 netmask 255.255.255.255
    static (inside,outside) 216.33.198.172 10.203.204.172 netmask 255.255.255.255
    static (inside,outside) 216.33.198.173 10.203.204.173 netmask 255.255.255.255
    static (inside,outside) 216.33.198.174 10.203.204.174 netmask 255.255.255.255
    static (inside,outside) 216.33.198.175 10.203.204.175 netmask 255.255.255.255
    static (inside,outside) 216.33.198.176 10.203.204.176 netmask 255.255.255.255
    static (inside,outside) 216.33.198.177 10.203.204.177 netmask 255.255.255.255
    static (inside,outside) 216.33.198.178 10.203.204.178 netmask 255.255.255.255
    static (inside,outside) 216.33.198.179 10.203.204.179 netmask 255.255.255.255
    static (inside,outside) 216.33.198.180 10.203.204.180 netmask 255.255.255.255
    static (inside,outside) 216.33.198.181 10.203.204.181 netmask 255.255.255.255
    static (inside,outside) 216.33.198.182 10.203.204.182 netmask 255.255.255.255
    static (inside,outside) 216.33.198.183 10.203.204.183 netmask 255.255.255.255
    static (inside,outside) 216.33.198.184 10.203.204.184 netmask 255.255.255.255
    static (inside,outside) 216.33.198.185 10.203.204.185 netmask 255.255.255.255
    static (inside,outside) 216.33.198.186 10.203.204.186 netmask 255.255.255.255
    static (inside,outside) 216.33.198.187 10.203.204.187 netmask 255.255.255.255
    static (inside,outside) 216.33.198.188 10.203.204.188 netmask 255.255.255.255
    static (inside,outside) 216.33.198.189 10.203.204.189 netmask 255.255.255.255
    static (inside,outside) 216.33.198.190 10.203.204.190 netmask 255.255.255.255
    static (inside,outside) 216.33.198.191 10.203.204.191 netmask 255.255.255.255
    static (inside,outside) 216.33.198.192 10.203.204.192 netmask 255.255.255.255
    static (inside,outside) 216.33.198.193 10.203.204.193 netmask 255.255.255.255
    static (inside,outside) 216.33.198.194 10.203.204.194 netmask 255.255.255.255
    static (inside,outside) 216.33.198.195 10.203.204.195 netmask 255.255.255.255
    static (inside,outside) 216.33.198.196 10.203.204.196 netmask 255.255.255.255
    static (inside,outside) 216.33.198.197 10.203.204.197 netmask 255.255.255.255
    static (inside,outside) 216.33.198.198 10.203.204.198 netmask 255.255.255.255
    static (inside,outside) 216.33.198.199 10.203.204.199 netmask 255.255.255.255
    static (inside,outside) 216.33.198.200 10.203.204.200 netmask 255.255.255.255
    access-group outside-in in interface outside
    route outside 0.0.0.0 0.0.0.0 216.33.198.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
    timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy test internal
    group-policy test attributes
     dns-server value 10.203.204.14 10.203.204.15
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value test_splitTunnelAcl
     default-domain value yorkmedia.local
     webvpn
    group-policy tunneltest internal
    group-policy tunneltest attributes
     dns-server value 10.203.204.14 4.2.2.2
     default-domain value yorkmedia.local
     webvpn
    group-policy testpol internal
    group-policy testpol attributes
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelall
     split-tunnel-network-list value dc2vpn_splitTunnelAcl
     webvpn
    group-policy aes internal
    group-policy aes attributes
     dns-server value 10.203.204.14 10.203.204.15
     vpn-tunnel-protocol IPSec
     group-lock value aestest
     webvpn
    group-policy grouptest internal
    group-policy grouptest attributes
     dns-server value 10.203.204.14 4.2.2.2
     default-domain value yorkmedia.local
     webvpn
    group-policy dc2vpntest internal
    group-policy dc2vpntest attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dc2vpntest_splitTunnelAcl
     webvpn
    group-policy dc2vpn internal
    group-policy dc2vpn attributes
     dns-server value 10.203.204.14 10.203.204.15
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dc2vpn_splitTunnelAcl
     webvpn
    group-policy BMSTV internal
    group-policy BMSTV attributes
     wins-server none
     dns-server none
     dhcp-network-scope none
     vpn-access-hours none
     vpn-simultaneous-logins 3
     vpn-idle-timeout none
     vpn-session-timeout none
     vpn-filter none
     vpn-tunnel-protocol IPSec
     password-storage disable
     ip-comp disable
     re-xauth disable
     group-lock none
     pfs disable
     ipsec-udp disable
     ipsec-udp-port 10000
     split-tunnel-policy tunnelall
     split-tunnel-network-list none
     default-domain none
     split-dns none
     secure-unit-authentication disable
     user-authentication disable
     user-authentication-idle-timeout none
     ip-phone-bypass disable
     leap-bypass disable
     nem disable
     backup-servers keep-client-config
     client-firewall none
     client-access-rule none
     webvpn
    username mmaxey password zSSKHLc.gx8szpy2 encrypted privilege 15
    username mmaxey attributes
     vpn-group-policy dc2vpn
     webvpn
    username jjohnstone password qElIg/rYW4OoTIEP encrypted privilege 15
    username jjohnstone attributes
     vpn-group-policy dc2vpntest
     webvpn
    username sragona password ZgCBom/StrITlFdU encrypted
    username sragona attributes
     vpn-group-policy dc2vpn
     webvpn
    username admin password 5zvQXQPrcnyHyGKm encrypted
    username seng password PP8UcINDKi7BSsj2 encrypted
    username seng attributes
     vpn-group-policy dc2vpn
     webvpn
    username chauser password I3OIxCe8FBONQlhK encrypted
    username chauser attributes
     vpn-group-policy dc2vpn
     webvpn
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 65.123.204.0 255.255.254.0 outside
    http 0.0.0.0 0.0.0.0 outside
    http 10.203.204.0 255.255.254.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set pfs group7
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-AES-256-SHA
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto map outside_map 60 match address outside_cryptomap_60
    crypto map outside_map 60 set peer 165.89.240.1
    crypto map outside_map 60 set transform-set ESP-3DES-SHA
    crypto map outside_map 60 set security-association lifetime seconds 28800
    crypto map outside_map 60 set security-association lifetime kilobytes 4608000
    crypto map outside_map 80 match address outside_cryptomap_80
    crypto map outside_map 80 set pfs
    crypto map outside_map 80 set peer 64.19.183.67
    crypto map outside_map 80 set transform-set ESP-3DES-SHA
    crypto map outside_map 80 set security-association lifetime seconds 28800
    crypto map outside_map 80 set security-association lifetime kilobytes 4608000
    crypto map outside_map 100 match address outside_cryptomap_100
    crypto map outside_map 100 set pfs
    crypto map outside_map 100 set peer 64.241.196.50
    crypto map outside_map 100 set transform-set ESP-3DES-SHA
    crypto map outside_map 100 set security-association lifetime seconds 28800
    crypto map outside_map 100 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption aes-256
    isakmp policy 30 hash sha
    isakmp policy 30 group 5
    isakmp policy 30 lifetime 86400
    isakmp policy 50 authentication pre-share
    isakmp policy 50 encryption aes-256
    isakmp policy 50 hash sha
    isakmp policy 50 group 7
    isakmp policy 50 lifetime 86400
    isakmp nat-traversal  20
    isakmp ipsec-over-tcp port 10000
    tunnel-group DefaultRAGroup ipsec-attributes
     pre-shared-key *
    tunnel-group dc2vpn type ipsec-ra
    tunnel-group dc2vpn general-attributes
     address-pool vpnpool
     default-group-policy dc2vpn
    tunnel-group dc2vpn ipsec-attributes
     pre-shared-key *
    tunnel-group test type ipsec-ra
    tunnel-group test general-attributes
     default-group-policy test
    tunnel-group test ipsec-attributes
     pre-shared-key *
    tunnel-group 165.89.240.1 type ipsec-l2l
    tunnel-group 165.89.240.1 general-attributes
     default-group-policy BMSTV
    tunnel-group 165.89.240.1 ipsec-attributes
     pre-shared-key *
     isakmp keepalive threshold 3600 retry 2
    tunnel-group 64.19.183.67 type ipsec-l2l
    tunnel-group 64.19.183.67 ipsec-attributes
     pre-shared-key *
    tunnel-group 64.241.196.50 type ipsec-l2l
    tunnel-group 64.241.196.50 ipsec-attributes
     pre-shared-key *
     isakmp keepalive disable
    tunnel-group dc2vpntest type ipsec-ra
    tunnel-group dc2vpntest general-attributes
     default-group-policy dc2vpntest
    tunnel-group dc2vpntest ipsec-attributes
     pre-shared-key *
    tunnel-group aestest type ipsec-ra
    tunnel-group aestest general-attributes
     address-pool vpnpool
     default-group-policy aes
    tunnel-group aestest ipsec-attributes
     pre-shared-key *
    tunnel-group TunnelGroup1 type ipsec-ra
    tunnel-group TunnelGroup1 general-attributes
     address-pool vpnpool
    telnet 10.203.204.10 255.255.255.255 inside
    telnet timeout 5
    ssh 65.123.204.0 255.255.254.0 outside
    ssh 10.203.204.0 255.255.254.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd lease 3600
    dhcpd ping_timeout 50
    class-map rtsp-traffic
     match access-list rtsp-acl
    class-map inspection_default
     match default-inspection-traffic
    policy-map global_policy
     class inspection_default
      inspect dns maximum-length 512
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
     class rtsp-traffic
      inspect rtsp
    service-policy global_policy global
    tftp-server inside 10.203.204.10 dc2asa01/config
    Cryptochecksum:6d74d3994ea6764893c420f477568aac
    : end

    You have three site-site VPNs and a remote access VPN setup. so the statement "Suddenly no one can access the remote LAN over VPN. " is a bit ambiguous in that context.
    From which source to what destination is not working for you?

  • Unable to access vpn box internal address after vpn

    Hi all. My office network is protected by asa5510 firewall with vpn configured. When i vpn into my office network i could not access the firewall via the firewall's internal address using telnet etc even though i have already enable telnet. The firewall is my office network gateway. Below is my config. Pls advise. Thks in advance. Access to my office network is fine using vpn.
    hostname firewall
    domain-name default.domain.invalid
    enable password xxx
    names
    dns-guard
    interface Ethernet0/0
    nameif inside
    security-level 100
    ip address 192.168.1x.x 255.255.255.0
    interface Ethernet0/1
    nameif DMZ
    security-level 50
    ip address 192.168.2x.x 255.255.255.0
    interface Ethernet0/2
    nameif outside
    security-level 0
    ip address 8x.x.x.x 255.255.255.240
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    passwd xxx
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list inside_access_in extended permit ip 192.168.1x.0 255.255.255.0 any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in extended deny ip any any
    access-list DMZ_access_in extended permit ip 192.168.2x.0 255.255.255.0 any
    access-list inside_nat0_outbound extended permit ip any 172.16.0.0 255.255.255.224
    access-list split-tunnel standard permit 192.168.1x.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm-buffer-size 500
    logging asdm informational
    mtu inside 1500
    mtu DMZ 1500
    mtu outside 1500
    mtu management 1500
    ip local pool addpool 172.16.0.1-172.16.0.20 mask 255.255.0.0
    no failover
    monitor-interface inside
    monitor-interface DMZ
    monitor-interface outside
    monitor-interface management
    asdm image disk0:/asdm-507.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 100 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 100 192.168.1x.0 255.255.255.0
    access-group inside_access_in in interface inside
    access-group DMZ_access_in in interface DMZ
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 8x.x.x.x 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
    timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy vpn internal
    group-policy vpn attributes
    dns-server value 192.168.1x.x 192.168.1x.x
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split-tunnel
    webvpn
    username ciscoadm password xxx encrypted privilege 15
    username ciscoadm attributes
    vpn-group-policy vpn
    webvpn
    http server enable
    http 192.168.1x.x 255.255.255.255 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection tcpmss 13800
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    tunnel-group vpn type ipsec-ra
    tunnel-group vpn general-attributes
    address-pool addpool
    default-group-policy vpn
    tunnel-group vpn ipsec-attributes
    pre-shared-key *
    telnet 192.168.1x.x 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0

    Hi all. Below is my configuration. After i enable "management-access inside" i could access my firewall internal ip via ping after establishing vpn connection but not others like telnet even though "telnet 0.0.0.0 0.0.0.0 inside" is enabled. Pls advise.
    interface Ethernet0/0
    nameif inside
    security-level 100
    ip address 192.168.1x.254 255.255.255.0
    interface Ethernet0/1
    nameif DMZ
    security-level 50
    ip address 192.168.2x.254 255.255.255.0
    interface Ethernet0/2
    nameif outside
    security-level 0
    ip address 8x.xx.xx.xx 255.255.255.240
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    passwd xxx
    ftp mode passive
    same-security-traffic permit inter-interface
    access-list inside_access_in extended permit ip 192.168.1x.0 255.255.255.0 any
    access-list inside_access_in extended permit esp any any
    access-list inside_access_in extended permit gre any any
    access-list outside_access_in extended permit icmp any any
    access-list outside_access_in extended deny ip any any
    access-list DMZ_access_in extended permit ip 192.168.2x.0 255.255.255.0 any
    access-list inside_nat0_outbound extended permit ip any 172.16.0.0 255.255.0.0
    access-list split-tunnel standard permit 192.168.1x.0 255.255.255.0
    access-list prod standard permit host 192.168.1x.x
    access-list prod standard deny any
    pager lines 24
    logging enable
    logging asdm-buffer-size 500
    logging asdm informational
    mtu inside 1500
    mtu DMZ 1500
    mtu outside 1500
    mtu management 1500
    ip local pool pool 172.16.0.1-172.16.0.20 mask 255.255.0.0
    no failover
    monitor-interface inside
    monitor-interface DMZ
    monitor-interface outside
    monitor-interface management
    asdm image disk0:/asdm-507.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 100 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 100 192.168.1x.0 255.255.255.0
    access-group inside_access_in in interface inside
    access-group DMZ_access_in in interface DMZ
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 8x.xx.xx.xx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
    timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy vpnuser internal
    group-policy vpnuser attributes
    dns-server value 192.168.1x.x 192.168.1x.x
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value prod
    default-domain value mm.com
    webvpn
    username user password xxx encrypted privilege 15
    username user attributes
    vpn-group-policy vpnuser
    webvpn
    http server enable
    http 192.168.1x.x 255.255.255.255 inside
    http 0.0.0.0 0.0.0.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection tcpmss 13800
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    tunnel-group vpnuser type ipsec-ra
    tunnel-group vpnuser general-attributes
    address-pool pool
    default-group-policy vpnuser
    tunnel-group vpnuser ipsec-attributes
    pre-shared-key *
    telnet 0.0.0.0 0.0.0.0 inside
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd dns 8x.x.1x.x 8x.x.x.x
    dhcpd lease 3600
    dhcpd ping_timeout 50
    dhcpd enable management

  • Mac Mini not displaying on two screens - was fine, but now it is not!

    Hello,
    At my work we have a Mac Mini running Keynote with videos and various slides looping round, displaying on a LG 42" LCD screen in our display window. On the other side of the window - the bit the public does not see - is a monitor to start the presentations and run the computer.
    This was working fine, running both screens simultaneously. However recently, it had to be turned off to carry out some work in the display area, and a few days later upon setting it up again its not working with both screens.
    The mini boots up and will run fine @ 1024 x 768 60hz on the inside monitor. This is connected to the mini DVI port, with a DVI to VGA adapter. However, when I plug in the LG 42" LCD at the same time (Connected via the mini display port, to an HDMI connector/adapter, the monitor will change to display an "out of range" message, while the LG will display as normal.
    I really need both screens running simultaneously as they were before! Nothing has changed in the setup and both screens will run fine by themselves, so I know that they are functioning correctly.
    Any suggestions are much appreciated!
    Any thoughts

    It sounds like perhaps the displays got set to mirror mode somehow. This means both displays are trying to display the same thing instead of working independently as you want them to.
    Which screen is set to primary, e.g. which one shows the menu bar when both are active? Are you able to get into Displays preferences and make changes? If so, I would check the mirror setting.
    Something else that may be worth trying is to start the mini in Safe mode with both displays connected. Hopefully the result will be useable screens on both displays. If so, go into Displays preferences and set the respective displays to the desired setting and restart normally. The selections made under Safe mode should persist through a normal restart.
    http://support.apple.com/kb/HT1455

  • ACS v5.4 Patch 1.

    We are running ACS v5.4 Patch 1.
    I need help with the command I can use to pull specific daily logs of a sql database. The default ACS 5.4 setting saves info locally and then to remote syslog servers. The auditing software pulls the info from the syslog servers to its sql database.
    Collection/logs I am interested in are
    1.-login in & out
    2.-devices (router & switches) reboot
    3.-configuration changes
    We have severity level of 5 and 4 setup for AAA audit and accounting.
    Looking forward for you help
    Thank you.

    you want to monitor the logging for ACS configuration changes performed by acsadmin or on the configuration changes made at network access device.
    For Network Access devices to log configuration change and start/stop packets, please configure the command authorization and command accounting.
    For ACS, you need to look inside Monitoring and reports > reports > Catalog > ACS instance.
    ~BR
    Jatin Katyal
    **Do rate helpful posts**

  • 5585X-IPS SSM40 Event alert

    Hello,
    ASA Firewall is running in Active/Active mode. Below is the configuration of the firewall and IPS SSM module.
    We are not getting event on IPS sensor when we type "show event alerts".
    IPS configuration:
    ++++++++++++++++++++++
    IPS1#
    IPS1# sh configuration
    ! Current configuration last modified Tue Jul 02 07:19:13 2013
    ! Version 7.1(1)
    ! Host:
    !     Realm Keys          key1.0
    ! Signature Definition:
    !     Signature Update    S552.0   2011-03-07
    service interface
    exit
    service authentication
    exit
    service event-action-rules rules0
    exit
    service host
    network-settings
    host-ip 10.15.1.58/28,10.15.1.57
    host-name IPS1
    telnet-option disabled
    access-list 0.0.0.0/0
    dns-primary-server disabled
    dns-secondary-server disabled
    dns-tertiary-server disabled
    exit
    time-zone-settings
    offset 60
    standard-time-zone-name GMT+03:00
    exit
    exit
    service logger
    exit
    service network-access
    exit
    service notification
    exit
    service signature-definition sig0
    exit
    service ssh-known-hosts
    exit
    service trusted-certificates
    exit
    service web-server
    exit
    service anomaly-detection ad0
    exit
    service external-product-interface
    exit
    service health-monitor
    exit
    service global-correlation
    exit
    service analysis-engine
    virtual-sensor vs1
    description virtual-sensor-1
    anomaly-detection
    operational-mode learn
    exit
    physical-interface PortChannel0/0
    exit
    exit
    IPS1#
    ASA in system mode
    +++++++++++++++++++++++++++++++++++++++
    ASA-1/act/pri# sh run
    : Saved
    ASA Version 9.1(1) <system>
    hostname ASA-1
    enable password u14FkAnxI.kNNH7a encrypted
    no mac-address auto
    interface GigabitEthernet0/0
    description LAN Failover Interface
    interface GigabitEthernet0/1
    description STATE Failover Interface
    interface GigabitEthernet0/2
    interface GigabitEthernet0/3
    interface GigabitEthernet0/4
    shutdown
    interface GigabitEthernet0/5
    shutdown
    interface Management0/0
    interface Management0/1
    interface TenGigabitEthernet0/6
    channel-group 20 mode active
    interface TenGigabitEthernet0/7
    channel-group 20 mode active
    interface TenGigabitEthernet0/8
    channel-group 10 mode active
    interface TenGigabitEthernet0/9
    channel-group 10 mode active
    interface GigabitEthernet1/0
    shutdown
    interface GigabitEthernet1/1
    shutdown
    interface GigabitEthernet1/2
    shutdown
    interface GigabitEthernet1/3
    shutdown
    interface GigabitEthernet1/4
    shutdown
    interface GigabitEthernet1/5
    shutdown
    interface TenGigabitEthernet1/6
    shutdown
    interface TenGigabitEthernet1/7
    shutdown
    interface TenGigabitEthernet1/8
    shutdown
    interface TenGigabitEthernet1/9
    shutdown
    interface Port-channel10
    interface Port-channel10.96
    description "Inside-CTX-1"
    vlan 96
    interface Port-channel10.97
    description "Inside-CTX-2"
    vlan 97
    interface Port-channel20
    interface Port-channel20.98
    description "Outside-CTX-1"
    vlan 98
    interface Port-channel20.99
    description "Outside-CTX-2"
    vlan 99
    class default
      limit-resource All 0
      limit-resource Mac-addresses 65535
      limit-resource ASDM 5
      limit-resource SSH 5
      limit-resource Telnet 5
    boot system disk0:/asa911-smp-k8.bin
    ftp mode passive
    pager lines 24
    failover
    failover lan unit primary
    failover lan interface FOL GigabitEthernet0/0
    failover link STATEFULL-LINK GigabitEthernet0/1
    failover interface ip FOL 10.15.1.33 255.255.255.252 standby 10.15.1.34
    failover interface ip STATEFULL-LINK 10.15.1.37 255.255.255.252 standby 10.15.1.38
    failover group 1
      preempt
    failover group 2
      secondary
      preempt
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    console timeout 0
    tls-proxy maximum-session 1000
    admin-context admin
    context admin
      allocate-ips vs0 adminvs0
      config-url disk0:/admin.cfg
    context arm-1
      description ARM-1
      allocate-interface Management0/0 MGT
      allocate-interface Port-channel10.96 inside
      allocate-interface Port-channel20.98 outside
      allocate-ips vs1 arm-1vs1
      config-url disk0:/arm-1_Context.cfg
      join-failover-group 1
    context arm-2
      description ARM-2
      allocate-interface Management0/1 MGT
      allocate-interface Port-channel10.97 inside
      allocate-interface Port-channel20.99 outside
      allocate-ips vs1 arm-2vs1
      config-url disk0:/arm-2_Context.cfg
      join-failover-group 2
    prompt hostname context state priority
    no call-home reporting anonymous
    Cryptochecksum:ad532251aad3ca65f6da8f1ff0762816
    ASA in one arm context mode
    +++++++++++++++++++++++++++++++++++++++
    ASA-1/arm-1/act/pri# sh run
    : Saved
    ASA Version 9.1(1) <context>
    firewall transparent
    hostname arm-1
    enable password u14FkAnxI.kNNH7a encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface BVI1
    ip address 10.15.1.57 255.255.255.240
    interface MGT
    management-only
    nameif management
    security-level 0
    ip address 10.14.1.9 255.255.255.0 standby 10.14.1.10
    interface inside
    nameif inside
    bridge-group 1
    security-level 100
    interface outside
    nameif outside
    bridge-group 1
    security-level 0
    access-list global extended permit ip any any
    access-list out extended permit ip any any
    access-list in extended permit ip any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu management 1500
    mtu inside 1500
    mtu outside 1500
    monitor-interface inside
    monitor-interface outside
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    access-group in in interface inside
    access-group out in interface outside
    route inside 10.0.0.0 255.255.0.0 10.15.1.51 1
    route inside 10.0.10.45 255.255.255.255 10.15.1.51 1
    route outside 10.11.0.0 255.255.0.0 10.15.1.53 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 inside
    http 0.0.0.0 0.0.0.0 outside
    no snmp-server location
    no snmp-server contact
    crypto ipsec security-association pmtu-aging infinite
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 30
    no threat-detection statistics tcp-intercept
    username admin password fMQ/rjnxl9Vwe9mv encrypted privilege 15
    class-map inspection_default
    match default-inspection-traffic
    class-map any
    match access-list global
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map IPS
    class any
      ips promiscuous fail-open sensor arm-1vs1
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    service-policy IPS interface outside
    Cryptochecksum:00b87b7c25f21d91cf5b90cb18c4d745
    : end
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++
    Why we are not able to see any event on IPS. As MPF is configured on ASA and that ACL is gettin hit count?
    Regards,

    In the CLI enter the following command to see if any signatures are triggering, it could just be that you haven't had the right combination of signatures trigger to cause an actual event:
    show stat virtual-sensor | begin Per-Signature
    You could also enable Signature 2000 and that will usually generate events in a short time to ensure you have traffic configured correctly for inspection by the IDS.

Maybe you are looking for

  • Export Layout view

    Hi I know its a wrong place to Post this question but i could not get the answer from Incopy forum How to print the layout view of a document. When it try to print or export a doument to PDF the story view is exported or printed. How to change it to

  • I'm trying to manually sync my music to my iPhone but it needs so much free space

    I used to be synced to a different iTunes on a different computer. Now that I have my own laptop with my on music library I'm trying to sync it to my phone. I have to do it manually because I don't have enough space on my phone to sync my entire musi

  • Displaying date/time in the report of last updating data?

    Hi, I have produced a report over a multiprovider. The multiprovider is built up from tow cubes. The data is being updated to one cube each hour and to the another cube one time daily. The date/time that display in the report is for the last updating

  • Enable Single Window Mode in Acrobat 9

    Please re-enable the Single Window (MDI) Mode in Acrobat 9 as it is an un welcome user experience of having dozens of Acrobat windows open in the taskbar. I can suggest to have either of the following:- 1. Give an option to the user whether to open t

  • Text on xAxis for stacked chart

    Hi All, I am using the following code for stacked chart control. I am able to display the text along Yaxis but not able to do the same with xAxis. I am uding the following code. Please advice. var testchart = new sap.viz.ui5.StackedColumn("oChart",{