Unable to Access Company LAN via VPN

Hello,
I have a ASA 5505 that I have been using to test run the IPSec VPN connection after studying the different configs and running through the ASDM I keep getting the same issue that I can't receive any traffic.
The company LAN is on a 10.8.0.0 255.255.0.0 network, I have placed the VPN clients in 192.168.10.0 255.255.255.0 network, the 192 clients can't talk to the 10.8 network.
On the Cisco VPN client I can see lots of sent packets but none received.
I think it could be to do with the NAT but from the examples I have seen I believe it should work.
I have attached the complete running-config, as I could well have missed something.
Many Thanks for any help on this...
FWBKH(config)# show running-config           
: Saved
ASA Version 8.2(2)
hostname FWBKH
domain-name test.local
enable password XXXXXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXXXXXX encrypted
names
name 9.9.9.9 zscaler-uk-network
name 10.8.50.0 inside-network-it
name 10.8.112.0 inside-servers
name 17.7.9.10 fwbkh-out
name 10.8.127.200 fwbkh-in
name 192.168.10.0 bkh-vpn-pool
interface Vlan1
nameif inside
security-level 100
ip address fwbkh-in 255.255.0.0
interface Vlan2
nameif outside
security-level 0
ip address fwbkh-out 255.255.255.248
interface Vlan3
nameif vpn
security-level 100
ip address 192.168.10.1 255.255.255.0
interface Ethernet0/0
interface Ethernet0/1
switchport access vlan 2
interface Ethernet0/2
shutdown
interface Ethernet0/3
shutdown
interface Ethernet0/4
shutdown
interface Ethernet0/5
shutdown
interface Ethernet0/6
shutdown    
interface Ethernet0/7
shutdown
banner login Trespassers will be Shot, Survivors will be Prosecuted!!!!
banner motd Trespassers will be Shot, Survivors will be Prosecuted!!!!
banner asdm Trespassers will be Shot, Survivors will be Prosecuted!!!!
boot system disk0:/asa822-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name test.local
object-group service DM_INLINE_TCP_2 tcp
port-object eq www
port-object eq https
object-group service DM_INLINE_UDP_1 udp
port-object eq 4500
port-object eq isakmp
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object icmp
protocol-object udp
access-list inside_access_in extended permit tcp 10.8.0.0 255.255.0.0 any object-group DM_INLINE_TCP_2 log warnings inactive
access-list inside_access_in extended permit ip inside-network-it 255.255.255.0 any inactive
access-list inside_access_in extended permit tcp 10.8.0.0 255.255.0.0 host zscaler-uk-network eq www
access-list inside_access_in extended permit ip inside-servers 255.255.255.0 any log warnings
access-list USER-ACL extended permit tcp 10.8.0.0 255.255.0.0 any eq www
access-list USER-ACL extended permit tcp 10.8.0.0 255.255.0.0 any eq https
access-list outside_nat0_outbound extended permit ip bkh-vpn-pool 255.255.255.0 10.8.0.0 255.255.0.0
access-list outside_access_in extended permit udp any host fwbkh-out object-group DM_INLINE_UDP_1 log errors inactive
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_1 10.8.0.0 255.255.0.0 any
access-list inside_nat0_outbound_1 extended permit ip 10.8.0.0 255.255.0.0 bkh-vpn-pool 255.255.255.0
access-list UK-VPN-USERS_splitTunnel extended permit ip 10.8.0.0 255.255.0.0 bkh-vpn-pool 255.255.255.0
access-list UK-VPN-USERS_splitTunnel extended permit ip inside-servers 255.255.255.0 bkh-vpn-pool 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu vpn 1500
ip local pool UK-VPN-POOL 192.168.10.10-192.168.10.60 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
nat-control  
global (inside) 1 interface
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 10.8.0.0 255.255.0.0 dns
nat (outside) 0 access-list outside_nat0_outbound outside
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 17.7.9.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 10.8.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint BKHFW
enrollment self
subject-name CN=FWBKH
crl configure
crypto ca certificate chain BKHFW
certificate fc968750
    308201dd 30820146 a0030201 020204fc 96875030 0d06092a 864886f7 0d010105
    05003033 310e300c 06035504 03130546 57424b48 3121301f 06092a86 4886f70d 
    ccc6f3cb 977029d5 df42515f d35c0d96 798350bf 7472725c fb8cd64d 514dc9cb
    7f05ffb9 b3336388 d55576cc a3d308e1 88e14c1e 8bcb13e5 c58225ff 67144c53 f2
  quit
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 10.8.0.0 255.255.0.0 inside
ssh timeout 30
ssh version 2
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy UK-VPN-USERS internal
group-policy UK-VPN-USERS attributes
dns-server value 10.8.112.1 10.8.112.2
vpn-tunnel-protocol IPSec svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value UK-VPN-USERS_splitTunnel
default-domain value test.local
address-pools value UK-VPN-POOL
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol webvpn
username admin password XXXXXXXXXXXXXXXXX encrypted privilege 15
username karl password XXXXXXXXXXXXXXX encrypted privilege 15
tunnel-group UK-VPN-USERS type remote-access
tunnel-group UK-VPN-USERS general-attributes
address-pool UK-VPN-POOL
default-group-policy UK-VPN-USERS
tunnel-group UK-VPN-USERS ipsec-attributes
pre-shared-key *****
tunnel-group IT-VPN type remote-access
tunnel-group IT-VPN general-attributes
address-pool UK-VPN-POOL
default-group-policy UK-VPN-USERS
tunnel-group IT-VPN ipsec-attributes
pre-shared-key *****
class-map ALLOW-USER-CLASS
match access-list USER-ACL
class-map type inspect http match-all ALLOW-URL-CLASS
match not request header from regex ALLOW-ZSGATEWAY
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map type inspect http ALLOW-URL-POLICY
parameters
class ALLOW-URL-CLASS
  drop-connection
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny 
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip 
  inspect xdmcp
  inspect ip-options
policy-map ALLOW-USER-URL-POLICY
class ALLOW-USER-CLASS
  inspect http
service-policy global_policy global
service-policy ALLOW-USER-URL-POLICY interface inside
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:00725d3158adc23e6a2664addb24fce1
: end

Hi Karl,
Please make the following changes:
ip local pool VPN_POOL_UK_USERS 192.168.254.1-192.168.254.254
access-list inside_nat0_outbound_1 extended permit ip 10.8.0.0 255.255.0.0 192.168.254.0 255.255.255.0
no nat (outside) 0 access-list outside_nat0_outbound outside
access-list UK-VPN-USERS_SPLIT permit 10.8.0.0 255.255.0.0
group-policy UK-VPN-USERS attributes
split-tunnel-network-list value UK-VPN-USERS_SPLIT
no access-list UK-VPN-USERS_splitTunnel extended permit ip 10.8.0.0 255.255.0.0 bkh-vpn-pool 255.255.255.0
no access-list UK-VPN-USERS_splitTunnel extended permit ip inside-servers 255.255.255.0 bkh-vpn-pool 255.255.255.0
access-list inside_access_in extended permit ip 10.8.0.0 255.255.255.0 192.168.254.0 255.255.255.0
management-access inside
As you can see, I did create a new pool, since you already have an interface in the 192.168.10.0/24 network, which does affect the VPN clients.
Once you are done, connect the client and try:
ping 10.8.127.200
Does it work?
Try to ping other internal IPs as well.
Let me know how it goes.
Portu.
Please rate any helpful posts
Message was edited by: Javier Portuguez

Similar Messages

  • Unable to access secondary subnet via VPN

    I am having a problem with clients accessing a secondary subnet via VPN.
    Clients on VPN are given the address on the 192.168.15.0 subnet. Once connected they can access 192.168.16.0 (Production subnet) fine, but are unable to access the 192.168.8.0 secondary subnet. If you are on the 192.168.16.0 subnet in the office you can access 192.168.8.0 subnet fine. The traffic is coming in via an ASA 5510 then traverses a Juniper firewall and a MPLS router to the secondary subnet. I'm not sure if it's a nat issue or not. Any help would be helpful.
    Below is the config of the ASA. Thank you in advance
    ASA Version 8.2(5)
    hostname charlotte
    domain-name tg.local
    enable password v4DuEgO1ZTlkUiaA encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.254.0 Peak10 description Peak10
    name 192.168.116.0 Charlotte_Phones description Charlotte_Phones
    name 192.168.15.0 Charlotte_SSL_VPN_Clients description Charlotte_SSL_VPN_Client                                                                                                                                                             s
    name 192.168.17.0 Charlotte_Wireless_Data description Charlotte_Wireless_Data
    name 192.168.117.0 Charlotte_Wireless_Phones description Charlotte_Wireless_Phon                                                                                                                                                             es
    name 192.168.5.0 Huntersville description Huntersville
    name 192.168.16.1 SRX_Gateway description Juniper_SRX
    name 192.168.108.0 Canton_Data description Canton_Data
    name 192.168.8.0 Canton_Phones description Canton_Phones
    name 192.168.9.0 Canton_Wireless_Data description Canton_Wireless_Data
    name 192.168.109.0 Canton_Wireless_Phones description Canton_Wireless_Phones
    name 192.168.16.4 TEST_IP description TEST_IP
    name 192.168.16.2 CantonGW description Canton GW 192.168.16.2
    name 192.168.5.1 HuntersvilleGW
    name 10.176.0.0 RS_Cloud description 10.176.0.0/12
    name 172.16.8.0 RS_172.16.8.0
    name 172.16.48.0 RS_172.16.48.0
    name 172.16.52.0 RS_172.16.52.0
    name 10.208.0.0 RS_Cloud_New
    name 10.178.0.0 RS_10.178.0.0 description Rackspace DEV servers
    name 10.178.0.6 RS_10.178.0.6
    name 172.16.20.0 RS_172.16.20.0
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 70.63.165.219 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.16.202 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    banner login ASA Login - Unauthorized access is prohibited
    banner login ASA Login - Unauthorized access is prohibited
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup Outside
    dns domain-lookup Inside
    dns domain-lookup management
    dns server-group DefaultDNS
    name-server 192.168.16.122
    name-server 8.8.8.8
    domain-name tg.local
    dns server-group defaultdns
    name-server 192.168.16.122
    domain-name tg.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network DM_INLINE_NETWORK_2
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_3
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object Huntersville 255.255.255.0
    object-group network DM_INLINE_NETWORK_4
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object Huntersville 255.255.255.0
    object-group network DM_INLINE_NETWORK_10
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.48.0 255.255.252.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_7
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.48.0 255.255.240.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_8
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_9
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_11
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_12
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_13
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_14
    network-object RS_Cloud 255.240.0.0
    network-object RS_172.16.48.0 255.255.252.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object 172.16.0.0 255.255.252.0
    object-group network DM_INLINE_NETWORK_5
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_6
    network-object RS_Cloud 255.240.0.0
    network-object RS_Cloud_New 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object Canton_Phones 255.255.255.0
    object-group network tgnc074.tg.local
    object-group icmp-type DM_INLINE_ICMP_1
    icmp-object echo
    icmp-object echo-reply
    icmp-object traceroute
    icmp-object unreachable
    object-group service DM_INLINE_SERVICE_1
    service-object ip
    service-object tcp eq https
    object-group icmp-type DM_INLINE_ICMP_2
    icmp-object echo
    icmp-object echo-reply
    icmp-object traceroute
    icmp-object unreachable
    object-group service DM_INLINE_SERVICE_2
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_3
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    object-group network DM_INLINE_NETWORK_1
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    object-group service DM_INLINE_SERVICE_4
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_5
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group network DM_INLINE_NETWORK_15
    network-object Canton_Data 255.255.255.0
    network-object host CantonGW
    object-group service DM_INLINE_SERVICE_6
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_7
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_2 Ch                                                                                                                                                             arlotte_SSL_VPN_Clients 255.255.255.0 any
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_5 ho                                                                                                                                                             st SRX_Gateway Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_7 Ch                                                                                                                                                             arlotte_SSL_VPN_Clients 255.255.255.0 host SRX_Gateway
    access-list Inside_access_in extended permit icmp any any object-group DM_INLINE                                                                                                                                                             _ICMP_1
    access-list Inside_access_in remark Permit all in Char_ORD_VPN
    access-list Inside_access_in extended permit ip object-group DM_INLINE_NETWORK_7                                                                                                                                                              object-group DM_INLINE_NETWORK_8
    access-list Inside_access_in remark Permit all out Char_ORD_VPN
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_1 ob                                                                                                                                                             ject-group DM_INLINE_NETWORK_9 object-group DM_INLINE_NETWORK_10
    access-list Inside_access_in extended permit ip Charlotte_SSL_VPN_Clients 255.25                                                                                                                                                             5.255.0 any
    access-list Inside_access_in remark Permit all in Char_ORD_VPN
    access-list Inside_access_in remark Permit all out Char_ORD_VPN
    access-list Inside_access_in extended permit ip object-group DM_INLINE_NETWORK_9                                                                                                                                                              object-group DM_INLINE_NETWORK_10 log disable
    access-list Tunneled_Network_List standard permit 192.168.16.0 255.255.255.0
    access-list Tunneled_Network_List standard permit Charlotte_Phones 255.255.255.0                                                                                                                                                            
    access-list Tunneled_Network_List standard permit Charlotte_Wireless_Data 255.25                                                                                                                                                             5.255.0
    access-list Tunneled_Network_List standard permit Charlotte_Wireless_Phones 255.                                                                                                                                                             255.255.0
    access-list Tunneled_Network_List standard permit Peak10 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Data 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Phones 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Wireless_Data 255.255.2                                                                                                                                                             55.0
    access-list Tunneled_Network_List standard permit Canton_Wireless_Phones 255.255                                                                                                                                                             .255.0
    access-list Tunneled_Network_List standard permit Huntersville 255.255.255.0
    access-list Tunneled_Network_List standard permit 172.16.0.0 255.255.252.0
    access-list Tunneled_Network_List standard permit RS_172.16.8.0 255.255.252.0
    access-list Tunneled_Network_List standard permit RS_Cloud 255.240.0.0
    access-list Tunneled_Network_List standard permit RS_Cloud_New 255.240.0.0
    access-list Tunneled_Network_List standard permit RS_172.16.20.0 255.255.252.0
    access-list Tunneled_Network_List standard permit Charlotte_SSL_VPN_Clients 255.                                                                                                                                                             255.255.0
    access-list Tunneled_Network_List standard permit 172.16.0.0 255.255.0.0
    access-list Inside_nat0_outbound extended permit ip Charlotte_SSL_VPN_Clients 25                                                                                                                                                             5.255.255.0 object-group DM_INLINE_NETWORK_2
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_11 object-group DM_INLINE_NETWORK_12
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_5 object-group DM_INLINE_NETWORK_6
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_1 object-group DM_INLINE_NETWORK_2
    access-list Limited_Access extended permit ip Charlotte_SSL_VPN_Clients 255.255.                                                                                                                                                             255.0 host TEST_IP
    access-list Limited__VPN_Acccess_List standard permit host 192.168.16.123
    access-list Limited__VPN_Acccess_List standard permit Huntersville 255.255.255.0                                                                                                                                                            
    access-list Limited__VPN_Acccess_List standard permit host 192.168.16.124
    access-list Limited__VPN_Acccess_List standard permit 192.168.16.0 255.255.255.0                                                                                                                                                            
    access-list Limited__VPN_Acccess_List standard permit host 172.16.8.52
    access-list Limited__VPN_Acccess_List standard permit Canton_Phones 255.255.255.                                                                                                                                                             0
    access-list Limited__VPN_Acccess_List remark ORD-VM-DEV1
    access-list Limited__VPN_Acccess_List standard permit host RS_10.178.0.6
    access-list Limited__VPN_Acccess_List remark ORD-VM-DEV2
    access-list Limited__VPN_Acccess_List standard permit host 10.178.192.103
    access-list Limited__VPN_Acccess_List standard permit host 192.168.8.10
    access-list Limited__VPN_Acccess_List standard permit RS_172.16.8.0 255.255.252.                                                                                                                                                             0
    access-list Limited__VPN_Acccess_List standard permit 172.16.0.0 255.255.0.0
    access-list Limited__VPN_Acccess_List standard permit host 10.178.133.26
    access-list Limited__VPN_Acccess_List standard permit RS_Cloud_New 255.240.0.0
    access-list Limited__VPN_Acccess_List standard permit host CantonGW
    access-list Limited__VPN_Acccess_List standard permit host SRX_Gateway
    access-list Limited__VPN_Acccess_List standard permit host 192.168.8.1
    access-list Limited__VPN_Acccess_List standard permit RS_Cloud 255.240.0.0
    access-list Limited__VPN_Acccess_List standard permit any
    access-list Limited__VPN_Acccess_List remark TGTFS
    access-list Limited__VPN_Acccess_List remark TGDEV
    access-list Limited__VPN_Acccess_List remark TGTFS
    access-list Limited__VPN_Acccess_List remark TGDEV
    access-list Outside_cryptomap extended permit ip 192.168.16.0 255.255.255.0 Huntersville 255.255.255.0
    access-list Outside_cryptomap extended permit ip Huntersville 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 Huntersville 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Huntersville 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Canton_Phones 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 Canton_Phones 255.255.255.0
    access-list Outside_2_cryptomap extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
    access-list Outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_13 object-group DM_INLINE_NETWORK_14
    access-list Outside_access_in extended permit icmp any any object-group DM_INLINE_ICMP_2 log disable
    access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Outside_access_in extended permit ip Huntersville 255.255.255.0 any log disable
    access-list Outside_access_in extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 any log disable
    access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_4 host SRX_Gateway Charlotte_SSL_VPN_Clients 255.255.255.0 inactive
    access-list Outside_cryptomap_2 extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
    access-list Outside_cryptomap_2 extended permit ip 192.168.16.0 255.255.255.0 RS_172.16.20.0 255.255.252.0
    access-list Canton_nat_outbound extended permit object-group DM_INLINE_SERVICE_6 Charlotte_SSL_VPN_Clients 255.255.255.0 object-group DM_INLINE_NETWORK_15
    access-list splitacl standard permit 192.168.16.0 255.255.255.0
    pager lines 24
    logging enable
    logging console emergencies
    logging monitor informational
    logging asdm informational
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool SSL_VPN_Pool 192.168.15.10-192.168.15.254 mask 255.255.255.0
    ip local pool New_VPN_Pool 192.168.16.50-192.168.16.200 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Inside
    no asdm history enable
    arp timeout 14400
    nat (Outside) 0 access-list Huntersville_nat_outbound
    nat (Inside) 0 access-list Inside_nat0_outbound
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    route Outside 0.0.0.0 0.0.0.0 70.63.165.217 1
    route Inside Canton_Phones 255.255.255.0 CantonGW 1
    route Inside Canton_Wireless_Data 255.255.255.0 CantonGW 1
    route Inside Charlotte_SSL_VPN_Clients 255.255.255.0 SRX_Gateway 1
    route Inside Charlotte_Wireless_Data 255.255.255.0 SRX_Gateway 1
    route Inside Canton_Data 255.255.255.0 CantonGW 1
    route Inside Canton_Wireless_Phones 255.255.255.0 CantonGW 1
    route Inside Charlotte_Phones 255.255.255.0 SRX_Gateway 1
    route Inside 192.168.116.219 255.255.255.255 CantonGW 1
    route Inside Charlotte_Wireless_Phones 255.255.255.0 SRX_Gateway 1
    route Inside Peak10 255.255.255.0 SRX_Gateway 1
    timeout xlate 3:00:00
    timeout conn 8:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    dynamic-access-policy-record TGAD_AccessPolicy
    aaa-server TGAD protocol ldap
    aaa-server TGAD (Inside) host 192.168.16.122
    ldap-base-dn DC=tg,DC=local
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=vpn user,CN=Users,DC=tg,DC=local
    server-type microsoft
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication telnet console LOCAL
    aaa local authentication attempts max-fail 10
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.16.0 255.255.255.0 Inside
    http Charlotte_SSL_VPN_Clients 255.255.255.0 Inside
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 1 match address Outside_cryptomap
    crypto map Outside_map0 1 set pfs
    crypto map Outside_map0 1 set peer 74.218.175.168
    crypto map Outside_map0 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 2 match address Outside_cryptomap_2
    crypto map Outside_map0 2 set peer 192.237.229.119
    crypto map Outside_map0 2 set transform-set ESP-3DES-MD5
    crypto map Outside_map0 3 match address Outside_cryptomap_1
    crypto map Outside_map0 3 set peer 174.143.192.65
    crypto map Outside_map0 3 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Outside_map0 interface Outside
    crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Inside_map interface Inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=charlotte
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment self
    subject-name CN=charlotte
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint1
    certificate 48676150
        3082024c 308201b5 a0030201 02020448 67615030 0d06092a 864886f7 0d010105
        05003038 31123010 06035504 03130963 6861726c 6f747465 31223020 06092a86
        4886f70d 01090216 13636861 726c6f74 74652e74 68696e6b 67617465 301e170d
        31323039 32353038 31373333 5a170d32 32303932 33303831 3733335a 30383112
        30100603 55040313 09636861 726c6f74 74653122 30200609 2a864886 f70d0109
        02161363 6861726c 6f747465 2e746869 6e6b6761 74653081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181008e d3e1ac63 a8a39dab 02170491
        2bf104d2 732c7fd7 7065758b 03bb9772 c8ab9faf 0e5e9e93 bfb57eea a849c875
        7899d261 8d426c37 9749d3d7 c86ca8e0 1d978069 3d43e7c5 569bb738 37e9bb31
        0ebd5065 01eb7a05 87933d2d 786a722e 8eee16e7 3207510b f5e7e704 cbddbda2
        a6b9ae45 efaba898 b8c921b6 2b05c0fb 1b0a9b02 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 8014fb93 35da7dd5 15d8e2ad 8e05ccf7 b5c333cc 95ac301d
        0603551d 0e041604 14fb9335 da7dd515 d8e2ad8e 05ccf7b5 c333cc95 ac300d06
        092a8648 86f70d01 01050500 03818100 6851ae52 5383c6f6 9e3ea714 85b2c5a0
        fd720959 a0b91899 806bad7a 08e2208e de22cad0 6692b09a 7152b21e 3bbfce68
        cc9f1391 8c460a04 a15e1a9e b18f829d 6d42d9bd ed5346bd 73a402f7 21e0c746
        02757fb6 b60405a9 ac3b9070 8c0f2fba d12f157b 85dd0a8b 2e9cf830 90a19412
        c7af1667 37b5ed8e c023ea4d 0c434609
      quit
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 170
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    vpn-addr-assign local reuse-delay 5
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 Outside
    ssh 172.221.228.164 255.255.255.255 Outside
    ssh Charlotte_SSL_VPN_Clients 255.255.255.0 Inside
    ssh 192.168.16.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ssl trust-point ASDM_TrustPoint1 Outside
    webvpn
    enable Outside
    enable Inside
    anyconnect-essentials
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1 regex "Windows NT"
    svc enable
    group-policy DfltGrpPolicy attributes
    dns-server value 192.168.16.122 8.8.8.8
    vpn-idle-timeout none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Limited__VPN_Acccess_List
    default-domain value tg.local
    split-dns value tg.local
    group-policy LimitedAccessGroupPolicy internal
    group-policy LimitedAccessGroupPolicy attributes
    wins-server none
    dns-server value 192.168.16.122 8.8.8.8
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Limited__VPN_Acccess_List
    default-domain value thinkgate.local
    split-tunnel-all-dns disable
    group-policy GroupPolicy2 internal
    group-policy GroupPolicy2 attributes
    vpn-tunnel-protocol IPSec
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    wins-server none
    dns-server value 192.168.16.122 8.8.8.8
    vpn-tunnel-protocol svc
    default-domain value tg.local
    group-policy Site-to-Site_Policy internal
    group-policy Site-to-Site_Policy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec
    tunnel-group DefaultRAGroup general-attributes
    default-group-policy LimitedAccessGroupPolicy
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool SSL_VPN_Pool
    tunnel-group LimitedAccessTunnelGroup type remote-access
    tunnel-group LimitedAccessTunnelGroup general-attributes
    address-pool SSL_VPN_Pool
    default-group-policy LimitedAccessGroupPolicy
    tunnel-group 208.104.76.178 type ipsec-l2l
    tunnel-group 208.104.76.178 ipsec-attributes
    pre-shared-key *****
    tunnel-group 74.218.175.168 type ipsec-l2l
    tunnel-group 74.218.175.168 ipsec-attributes
    pre-shared-key *****
    tunnel-group TGAD_ConnectionProfile type remote-access
    tunnel-group TGAD_ConnectionProfile general-attributes
    authentication-server-group TGAD
    default-group-policy GroupPolicy1
    tunnel-group 174.143.192.65 type ipsec-l2l
    tunnel-group 174.143.192.65 general-attributes
    default-group-policy GroupPolicy2
    tunnel-group 174.143.192.65 ipsec-attributes
    pre-shared-key *****
    tunnel-group 192.237.229.119 type ipsec-l2l
    tunnel-group 192.237.229.119 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:ef741b4905b43dc36d0f621e06508840
    : end
    charlotte#

    What does the packet-tracer say, what does the IPsec associations say (packets encrypted/decrypted)?
    This might be faster that going through your hundreds of lines of config.

  • Window 8.1 system unable to access network shares via VPN connection

    Is there something inherent to Windows 8.1 that prevents it from accessing shares on a domain?
    I know that it cannot join a domain, but does that also mean that it cannot access shares which are on a domain?
    My problem is that I have several user that are running windows 8.1 that are connecting to our network via a VPN.
    The users have domain accounts but their computers as windows 8.1 cannot joined to the domain.
    So to access network shares they have to use their domain credentials to create a VPN connection.
    Once connected the user can RDP to systems on the domain using their domain accounts, so I know that their user names/passwords and permissions are correct. They can access these systems using the computer name, so I don't feel that I have a DNS issue.
    They can see the shares on our file server, but when they try to access their departments shared file, they receive an access denied message. There are a few shares that are completely wide open, shared to all users and all departments but they cannot access
    those shares either.
    You can ping the file server, from the the client when they are connected to the VPN but you just cannot access any of the shares.
    So...
    I am thinking that it has something to do with windows 8.1 and not being able to join a domain, but I cannot find anything to explicitly support this thought.
    Other users running a variety different OS (windows 7, OSX, Linux) can all access the shares without any problems via the VPN, so I am a little stumped.

    I have done some more testing and oddly enough I can map a drive if I use the IPaddress, but not the computer name, when checking the check box "connect using different credentials"and providing they users domain credentials.
    This seems to point to a DNS issue, one would think, but I can hit the file share server by name \\fileserver.dev.lan
    I can see all the shares, so dns seems to be fine right?
    So I don't understand why I can map a drive using do the IPaddress and not the machine name, but yet I can see and ping the server by name?
    When I try to create a mapped drive by machine name I receive the following message:
    Windows cannot access \\fileserver.dev.lan\all
    You do not have permissions to access \\fileserver.dev.lan. contact your network administrator  to request access.
    But if I use the \\x.x.x.x\all using the very same user and password I get connected with no problem.
    This only seems to happen on windows 8.1, which leads me to think that has something to do with OS. 
    I am thinking about upgrading to windows 8.1 pro, but I don't want to go though the hassle and expanse is the OS is not the problem.

  • Unable to access Standalone VM via Remote Desktop through a VPN

    Good Morning everyone, now here is my problem.
    My company is a small software development house and we test our software on Win 7 or 8 VM's running on standalone (ie not on the domain) VM's. We are running the VM's on WS2012 R2 Hyper V and when we are inside the building we are able to Remote Desktop
    onto these VM's direct without any problem. The problem comes when we want to RD onto the VM's when working from home via the VPN. When we try to connect to the VM's via RD through the VPN the Remote Desktop Connection fails with the following alert "Remote
    Desktop can't find the computer '[Computers Name]'. This might mean that '[Computers Name]' does not belong to the specified network. Verify the computer name and domain that you are trying to connect to." The only way I can connect to the VM's is
    by going onto the host server and access the VM's via Hyper V manager and use it that way.
    Now when I try to connect to a VM that is running on the Domain via the VPN I connect without any problems at all.
    So my question is why can I connect to standalone VM's via RD without any problems when in the office but when I am at home via VPN I can't but I can connect to VM's on the domain without any problems? What do I need to do to make this work?
    Phil

    Hi Darren,
    I have just tested it and when at work I can ping by name a named server and the standalone VM without any problems.
    But when I connect from the outside via the VPN I am still able to ping by name a named server but not the stand alone server. Nor can I ping the IP address of the standalone VM although I can connect to a standalone VM using its IP address via RDC
    Phil

  • Unable to Access Remote LAN over IPSec VPN

    I have a Cisco ASA 5540 setup with Remote Access VPN for users. Suddenly no one can access the remote LAN over VPN. Below is my config:
    ASA Version 7.0(8)
    hostname DC2ASA
    domain-name yorktel.com
    enable password d2XdVlFOzleWlH1j encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    dns-guard
    interface GigabitEthernet0/0
     description outside/savvis
     nameif outside
     security-level 0
     ip address 216.33.198.4 255.255.255.0 standby 216.33.198.5
    interface GigabitEthernet0/1
     description inside
     nameif inside
     security-level 100
     ip address 10.203.204.1 255.255.254.0 standby 10.203.204.2
    interface GigabitEthernet0/2
     nameif insidesan
     security-level 100
     ip address 10.203.206.1 255.255.254.0 standby 10.203.206.2
    interface GigabitEthernet0/3
     description LAN/STATE Failover Interface
    interface Management0/0
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0
     management-only
    ftp mode passive
    object-group service FileMaker tcp-udp
     port-object range 16000 16001
    access-list outside-in extended permit ip 65.123.204.0 255.255.254.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit ip 216.33.198.0 255.255.255.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit icmp 216.33.198.0 255.255.255.0 216.33.198.0 255.255.255.0 log
    access-list outside-in extended permit icmp any any
    access-list outside-in extended permit icmp any any echo
    access-list outside-in extended permit ip any host 216.33.198.22 inactive
    access-list outside-in extended permit tcp any host 216.33.198.19
    access-list outside-in extended permit udp any host 216.33.198.19
    access-list outside-in extended permit ip any host 216.33.198.19
    access-list outside-in extended permit tcp any host 216.33.198.10 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ftp inactive
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ftp-data inactive
    access-list outside-in extended permit tcp any host 216.33.198.10 eq ssh inactive
    access-list outside-in extended permit tcp any host 216.33.198.19 eq www
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.19 eq https
    access-list outside-in extended permit tcp any host 216.33.198.19 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.19 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.19 eq smtp
    access-list outside-in extended permit tcp any host 216.33.198.19 eq pop3
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 587
    access-list outside-in extended permit tcp any host 216.33.198.16 eq www
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.16 eq https
    access-list outside-in extended permit tcp any host 216.33.198.16 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.16 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.16 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.38 eq www
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.38 eq https
    access-list outside-in extended permit tcp any host 216.33.198.38 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.38 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.38 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.25 eq www
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.25 eq https
    access-list outside-in extended permit tcp any host 216.33.198.25 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.25 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.25 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.22 eq www
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.22 eq https
    access-list outside-in extended permit tcp any host 216.33.198.22 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.22 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.22 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.17 eq www
    access-list outside-in extended permit tcp any host 216.33.198.17 eq rtsp
    access-list outside-in extended permit udp any host 216.33.198.17 eq 5005
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.17 eq 1755
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.17 eq https
    access-list outside-in extended permit tcp any host 216.33.198.17 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.17 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 989
    access-list outside-in extended permit tcp any host 216.33.198.17 eq 990
    access-list outside-in extended permit tcp any host 216.33.198.24 eq www
    access-list outside-in extended permit tcp any host 216.33.198.24 eq rtsp
    access-list outside-in extended permit udp any host 216.33.198.24 eq 5005
    access-list outside-in extended permit tcp any host 216.33.198.24 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.24 eq 1755
    access-list outside-in extended permit udp any host 216.33.198.24
    access-list outside-in extended permit tcp any host 216.33.198.24 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.24 eq https
    access-list outside-in extended permit tcp 209.67.5.96 255.255.255.224 any inactive
    access-list outside-in extended permit udp 209.67.5.96 255.255.255.224 any inactive
    access-list outside-in extended permit udp any host 216.33.198.17 inactive
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 1433
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 1434
    access-list outside-in extended permit tcp any host 216.33.198.100 eq www
    access-list outside-in extended permit tcp any host 216.33.198.101 eq www
    access-list outside-in extended permit tcp any host 216.33.198.102 eq www
    access-list outside-in extended permit tcp any host 216.33.198.103 eq www
    access-list outside-in extended permit tcp any host 216.33.198.104 eq www
    access-list outside-in extended permit tcp any host 216.33.198.105 eq www
    access-list outside-in extended permit tcp any host 216.33.198.106 eq www
    access-list outside-in extended permit tcp any host 216.33.198.107 eq www
    access-list outside-in extended permit tcp any host 216.33.198.108 eq www
    access-list outside-in extended permit tcp any host 216.33.198.109 eq www
    access-list outside-in extended permit tcp any host 216.33.198.110 eq www
    access-list outside-in extended permit tcp any host 216.33.198.100 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.101 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.102 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.103 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.104 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.105 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.106 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.107 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.108 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.109 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.110 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.100 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.101 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.102 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.103 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.104 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.105 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.106 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.107 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.108 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.109 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.110 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.100 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.101 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.102 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.103 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.104 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.105 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.106 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.107 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.108 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.109 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.110 eq ftp-data
    access-list outside-in extended permit tcp host 12.71.134.4 any
    access-list outside-in extended permit udp host 12.71.134.4 any
    access-list outside-in remark Allow Mark to access remote desktop from home office.
    access-list outside-in extended permit tcp host 96.255.220.240 any
    access-list outside-in remark Allow Mark to access remote desktop from home office.
    access-list outside-in extended permit udp host 96.255.220.240 any
    access-list outside-in extended permit tcp host 67.81.54.83 any
    access-list outside-in remark Allow Chris to access remote desktop from home office.
    access-list outside-in extended permit tcp host 100.1.41.196 any
    access-list outside-in remark Allow Chris to access remote desktop from home office.
    access-list outside-in extended permit udp host 100.1.41.196 any
    access-list outside-in extended permit udp host 67.81.54.83 any
    access-list outside-in remark Allow Jim Johnstone to remote in from home office.
    access-list outside-in extended permit tcp host 96.225.44.46 any
    access-list outside-in remark Allow Jim Johnstone to remote in from home office.
    access-list outside-in extended permit udp host 96.225.44.46 any
    access-list outside-in extended permit tcp host 64.19.183.67 any
    access-list outside-in extended permit udp host 64.19.183.67 any
    access-list outside-in remark Allow Steve Fisher to remote in from home office.
    access-list outside-in extended permit tcp host 173.67.0.16 any
    access-list outside-in remark Allow Steve Fisher to remote in from home office.
    access-list outside-in extended permit udp host 173.67.0.16 any
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq 3389
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq ftp-data
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq ftp
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq www
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 eq https
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit udp any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to remote.yorkcast.com
    access-list outside-in extended permit ip any host 216.33.198.20 inactive
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 3389 inactive
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq 3389
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq www
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq https
    access-list outside-in extended permit tcp any host 216.33.198.21 eq 8080
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq ftp
    access-list outside-in remark Allow remote desktop connections to BMS-TV
    access-list outside-in extended permit tcp any host 216.33.198.21 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.19 eq 3306
    access-list outside-in extended permit udp any host 216.33.198.19 eq 3306
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq 3389
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq ftp
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq www
    access-list outside-in remark Allow remote desktop connections to ftp.yorkcast.com
    access-list outside-in extended permit tcp any host 216.33.198.23 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.18 eq 3389 inactive
    access-list outside-in extended permit tcp any host 216.33.198.17 inactive
    access-list outside-in extended permit ip any host 216.33.198.17 inactive
    access-list outside-in extended permit tcp any host 216.33.198.18 inactive
    access-list outside-in extended permit udp any host 216.33.198.17 eq 554
    access-list outside-in extended permit udp any host 216.33.198.24 eq 554
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit tcp host 64.241.196.50 any
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit udp host 64.241.196.50 any
    access-list outside-in remark Allow any access from Treasury
    access-list outside-in extended permit ip host 64.241.196.50 any
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.26 eq www
    access-list outside-in extended permit tcp any host 216.33.198.26 eq https
    access-list outside-in extended permit tcp any host 216.33.198.27 eq https
    access-list outside-in extended permit tcp any host 216.33.198.27 eq www
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.27 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.27 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.27 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ftp inactive
    access-list outside-in extended permit tcp any host 216.33.198.26 eq ssh inactive
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 81
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.28 eq www
    access-list outside-in extended permit tcp any host 216.33.198.28 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.29 eq www
    access-list outside-in extended permit tcp any host 216.33.198.28 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.29 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.30 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.31 eq ssh
    access-list outside-in extended permit tcp any host 216.33.198.20 object-group FileMaker
    access-list outside-in extended permit tcp any host 216.33.198.20 eq 5003
    access-list outside-in extended permit udp any host 216.33.198.20 eq 5003
    access-list outside-in extended permit tcp any host 216.33.198.33 eq www
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.33 eq https
    access-list outside-in extended permit tcp any host 216.33.198.33 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.33 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.33 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.34 eq www
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.34 eq https
    access-list outside-in extended permit tcp any host 216.33.198.34 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.34 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.34 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.36 eq www
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.36 eq https
    access-list outside-in extended permit tcp any host 216.33.198.36 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.36 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.36 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.37 eq www
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.37 eq https
    access-list outside-in extended permit tcp any host 216.33.198.37 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.37 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.37 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.39 eq www
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.39 eq https
    access-list outside-in extended permit tcp any host 216.33.198.39 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.39 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8094
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8096
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8097
    access-list outside-in extended permit tcp any host 216.33.198.39 eq 8090
    access-list outside-in extended permit tcp any host 216.33.198.41 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.41 eq www
    access-list outside-in extended permit tcp any host 216.33.198.41 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.41 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.41 eq https
    access-list outside-in extended permit tcp any host 216.33.198.41 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.42 eq 3389
    access-list outside-in extended permit tcp any host 216.33.198.42 eq www
    access-list outside-in extended permit tcp any host 216.33.198.42 eq https
    access-list outside-in extended permit tcp any host 216.33.198.42 eq ftp
    access-list outside-in extended permit tcp any host 216.33.198.42 eq ftp-data
    access-list outside-in extended permit tcp any host 216.33.198.42 eq 8080
    access-list outside-in extended permit tcp any host 216.33.198.28
    access-list inside-out extended permit tcp any host 216.33.198.17 eq rtsp
    access-list inside-out extended permit udp any host 216.33.198.17 eq 5004
    access-list inside-out extended permit udp any host 216.33.198.17 eq 5005
    access-list inside-out extended permit tcp any host 216.33.198.17 eq 1755
    access-list inside-out extended permit udp any host 216.33.198.17 eq 1755
    access-list rtsp-acl extended deny tcp any host 216.33.198.17 eq rtsp
    access-list rtsp-acl extended permit tcp any any eq rtsp
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 10.203.204.0 255.255.255.192
    access-list inside_nat0_outbound extended permit ip any 10.203.204.48 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 10.203.204.0 255.255.255.192
    access-list inside_nat0_outbound extended permit ip host 10.203.204.19 10.203.204.32 255.255.255.224
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 192.168.250.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.203.204.0 255.255.255.0 192.168.252.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 10.203.204.144 255.255.255.240
    access-list inside_nat0_outbound extended permit ip host 216.33.198.33 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.19 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.17 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.24 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip host 216.33.198.20 any inactive
    access-list inside_nat0_outbound extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list inside_nat0_outbound extended permit ip any 10.203.204.48 255.255.255.248
    access-list inside_nat0_outbound extended permit ip any 216.33.198.56 255.255.255.248
    access-list dc2vpn_splitTunnelAcl standard permit 10.203.204.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit 192.168.252.0 255.255.255.0
    access-list dc2vpn_splitTunnelAcl standard permit any
    access-list outside_map standard permit any
    access-list Split_Tunnel_List standard permit 10.203.204.0 255.255.255.0
    access-list test_splitTunnelAcl standard permit any
    access-list outside_access_out extended permit tcp any host 12.71.134.75 inactive
    access-list outside_in extended permit tcp host 12.71.134.75 any eq smtp
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.130.31
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.102
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.103
    access-list outside_nat0_inbound extended permit ip host 216.33.198.21 host 165.89.18.104
    access-list outside_nat0_inbound extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_80 extended permit ip 10.203.204.0 255.255.255.0 192.168.250.0 255.255.255.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.33 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.19 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.17 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended deny ip host 216.33.198.24 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_60 extended permit ip 216.33.198.0 255.255.255.0 165.89.0.0 255.255.0.0
    access-list outside_cryptomap_100 extended permit ip 10.203.204.0 255.255.255.0 192.168.252.0 255.255.255.0
    access-list dc2vpntest_splitTunnelAcl standard permit 10.203.204.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    logging ftp-bufferwrap
    logging ftp-server 10.203.204.10 logs asa ****
    mtu outside 1500
    mtu inside 1500
    mtu insidesan 1500
    mtu management 1500
    ip local pool vpnpool 10.203.204.60-10.203.204.65 mask 255.255.255.0
    failover
    failover lan unit secondary
    failover lan interface failover GigabitEthernet0/3
    failover polltime unit msec 999 holdtime 3
    failover polltime interface 5
    failover link failover GigabitEthernet0/3
    failover interface ip failover 172.16.100.1 255.255.255.252 standby 172.16.100.2
    monitor-interface outside
    monitor-interface inside
    monitor-interface insidesan
    no monitor-interface management
    icmp permit 65.123.204.0 255.255.254.0 outside
    asdm image disk0:/asdm-508.bin
    no asdm history enable
    arp timeout 14400
    nat-control
    nat (outside) 0 access-list outside_nat0_inbound outside
    nat (inside) 0 access-list inside_nat0_outbound
    static (inside,outside) 216.33.198.10 10.203.204.10 netmask 255.255.255.255
    static (inside,outside) 216.33.198.11 10.203.204.11 netmask 255.255.255.255
    static (inside,outside) 216.33.198.12 10.203.204.12 netmask 255.255.255.255
    static (inside,outside) 216.33.198.13 10.203.204.13 netmask 255.255.255.255
    static (inside,outside) 216.33.198.14 10.203.204.14 netmask 255.255.255.255
    static (inside,outside) 216.33.198.15 10.203.204.15 netmask 255.255.255.255
    static (inside,outside) 216.33.198.16 10.203.204.16 netmask 255.255.255.255
    static (inside,outside) 216.33.198.17 10.203.204.17 netmask 255.255.255.255
    static (inside,outside) 216.33.198.18 10.203.204.18 netmask 255.255.255.255
    static (inside,outside) 216.33.198.19 10.203.204.19 netmask 255.255.255.255
    static (inside,outside) 216.33.198.20 10.203.204.20 netmask 255.255.255.255
    static (inside,outside) 216.33.198.21 10.203.204.21 netmask 255.255.255.255
    static (inside,outside) 216.33.198.22 10.203.204.22 netmask 255.255.255.255
    static (inside,outside) 216.33.198.23 10.203.204.23 netmask 255.255.255.255
    static (inside,outside) 216.33.198.24 10.203.204.24 netmask 255.255.255.255
    static (inside,outside) 216.33.198.25 10.203.204.25 netmask 255.255.255.255
    static (inside,outside) 216.33.198.26 10.203.204.26 netmask 255.255.255.255
    static (inside,outside) 216.33.198.27 10.203.204.27 netmask 255.255.255.255
    static (inside,outside) 216.33.198.28 10.203.204.28 netmask 255.255.255.255
    static (inside,outside) 216.33.198.29 10.203.204.29 netmask 255.255.255.255
    static (inside,outside) 216.33.198.30 10.203.204.30 netmask 255.255.255.255
    static (inside,outside) 216.33.198.31 10.203.204.31 netmask 255.255.255.255
    static (inside,outside) 216.33.198.32 10.203.204.32 netmask 255.255.255.255
    static (inside,outside) 216.33.198.33 10.203.204.33 netmask 255.255.255.255
    static (inside,outside) 216.33.198.34 10.203.204.34 netmask 255.255.255.255
    static (inside,outside) 216.33.198.35 10.203.204.35 netmask 255.255.255.255
    static (inside,outside) 216.33.198.36 10.203.204.36 netmask 255.255.255.255
    static (inside,outside) 216.33.198.37 10.203.204.37 netmask 255.255.255.255
    static (inside,outside) 216.33.198.38 10.203.204.38 netmask 255.255.255.255
    static (inside,outside) 216.33.198.39 10.203.204.39 netmask 255.255.255.255
    static (inside,outside) 216.33.198.40 10.203.204.40 netmask 255.255.255.255
    static (inside,outside) 216.33.198.41 10.203.204.41 netmask 255.255.255.255
    static (inside,outside) 216.33.198.42 10.203.204.42 netmask 255.255.255.255
    static (inside,outside) 216.33.198.43 10.203.204.43 netmask 255.255.255.255
    static (inside,outside) 216.33.198.44 10.203.204.44 netmask 255.255.255.255
    static (inside,outside) 216.33.198.45 10.203.204.45 netmask 255.255.255.255
    static (inside,outside) 216.33.198.46 10.203.204.46 netmask 255.255.255.255
    static (inside,outside) 216.33.198.47 10.203.204.47 netmask 255.255.255.255
    static (inside,outside) 216.33.198.48 10.203.204.48 netmask 255.255.255.255
    static (inside,outside) 216.33.198.49 10.203.204.49 netmask 255.255.255.255
    static (inside,outside) 216.33.198.50 10.203.204.50 netmask 255.255.255.255
    static (inside,outside) 216.33.198.51 10.203.204.51 netmask 255.255.255.255
    static (inside,outside) 216.33.198.52 10.203.204.52 netmask 255.255.255.255
    static (inside,outside) 216.33.198.53 10.203.204.53 netmask 255.255.255.255
    static (inside,outside) 216.33.198.54 10.203.204.54 netmask 255.255.255.255
    static (inside,outside) 216.33.198.55 10.203.204.55 netmask 255.255.255.255
    static (inside,outside) 216.33.198.56 10.203.204.56 netmask 255.255.255.255
    static (inside,outside) 216.33.198.57 10.203.204.57 netmask 255.255.255.255
    static (inside,outside) 216.33.198.58 10.203.204.58 netmask 255.255.255.255
    static (inside,outside) 216.33.198.59 10.203.204.59 netmask 255.255.255.255
    static (inside,outside) 216.33.198.60 10.203.204.60 netmask 255.255.255.255
    static (inside,outside) 216.33.198.61 10.203.204.61 netmask 255.255.255.255
    static (inside,outside) 216.33.198.62 10.203.204.62 netmask 255.255.255.255
    static (inside,outside) 216.33.198.63 10.203.204.63 netmask 255.255.255.255
    static (inside,outside) 216.33.198.64 10.203.204.64 netmask 255.255.255.255
    static (inside,outside) 216.33.198.65 10.203.204.65 netmask 255.255.255.255
    static (inside,outside) 216.33.198.66 10.203.204.66 netmask 255.255.255.255
    static (inside,outside) 216.33.198.67 10.203.204.67 netmask 255.255.255.255
    static (inside,outside) 216.33.198.68 10.203.204.68 netmask 255.255.255.255
    static (inside,outside) 216.33.198.69 10.203.204.69 netmask 255.255.255.255
    static (inside,outside) 216.33.198.70 10.203.204.70 netmask 255.255.255.255
    static (inside,outside) 216.33.198.71 10.203.204.71 netmask 255.255.255.255
    static (inside,outside) 216.33.198.100 10.203.204.100 netmask 255.255.255.255
    static (inside,outside) 216.33.198.101 10.203.204.101 netmask 255.255.255.255
    static (inside,outside) 216.33.198.102 10.203.204.102 netmask 255.255.255.255
    static (inside,outside) 216.33.198.103 10.203.204.103 netmask 255.255.255.255
    static (inside,outside) 216.33.198.104 10.203.204.104 netmask 255.255.255.255
    static (inside,outside) 216.33.198.105 10.203.204.105 netmask 255.255.255.255
    static (inside,outside) 216.33.198.106 10.203.204.106 netmask 255.255.255.255
    static (inside,outside) 216.33.198.107 10.203.204.107 netmask 255.255.255.255
    static (inside,outside) 216.33.198.108 10.203.204.108 netmask 255.255.255.255
    static (inside,outside) 216.33.198.109 10.203.204.109 netmask 255.255.255.255
    static (inside,outside) 216.33.198.110 10.203.204.110 netmask 255.255.255.255
    static (inside,outside) 216.33.198.111 10.203.204.111 netmask 255.255.255.255
    static (inside,outside) 216.33.198.112 10.203.204.112 netmask 255.255.255.255
    static (inside,outside) 216.33.198.113 10.203.204.113 netmask 255.255.255.255
    static (inside,outside) 216.33.198.114 10.203.204.114 netmask 255.255.255.255
    static (inside,outside) 216.33.198.115 10.203.204.115 netmask 255.255.255.255
    static (inside,outside) 216.33.198.116 10.203.204.116 netmask 255.255.255.255
    static (inside,outside) 216.33.198.117 10.203.204.117 netmask 255.255.255.255
    static (inside,outside) 216.33.198.118 10.203.204.118 netmask 255.255.255.255
    static (inside,outside) 216.33.198.119 10.203.204.119 netmask 255.255.255.255
    static (inside,outside) 216.33.198.120 10.203.204.120 netmask 255.255.255.255
    static (inside,outside) 216.33.198.121 10.203.204.121 netmask 255.255.255.255
    static (inside,outside) 216.33.198.122 10.203.204.122 netmask 255.255.255.255
    static (inside,outside) 216.33.198.123 10.203.204.123 netmask 255.255.255.255
    static (inside,outside) 216.33.198.124 10.203.204.124 netmask 255.255.255.255
    static (inside,outside) 216.33.198.125 10.203.204.125 netmask 255.255.255.255
    static (inside,outside) 216.33.198.126 10.203.204.126 netmask 255.255.255.255
    static (inside,outside) 216.33.198.127 10.203.204.127 netmask 255.255.255.255
    static (inside,outside) 216.33.198.128 10.203.204.128 netmask 255.255.255.255
    static (inside,outside) 216.33.198.129 10.203.204.129 netmask 255.255.255.255
    static (inside,outside) 216.33.198.130 10.203.204.130 netmask 255.255.255.255
    static (inside,outside) 216.33.198.131 10.203.204.131 netmask 255.255.255.255
    static (inside,outside) 216.33.198.132 10.203.204.132 netmask 255.255.255.255
    static (inside,outside) 216.33.198.133 10.203.204.133 netmask 255.255.255.255
    static (inside,outside) 216.33.198.134 10.203.204.134 netmask 255.255.255.255
    static (inside,outside) 216.33.198.135 10.203.204.135 netmask 255.255.255.255
    static (inside,outside) 216.33.198.136 10.203.204.136 netmask 255.255.255.255
    static (inside,outside) 216.33.198.137 10.203.204.137 netmask 255.255.255.255
    static (inside,outside) 216.33.198.138 10.203.204.138 netmask 255.255.255.255
    static (inside,outside) 216.33.198.139 10.203.204.139 netmask 255.255.255.255
    static (inside,outside) 216.33.198.140 10.203.204.140 netmask 255.255.255.255
    static (inside,outside) 216.33.198.141 10.203.204.141 netmask 255.255.255.255
    static (inside,outside) 216.33.198.142 10.203.204.142 netmask 255.255.255.255
    static (inside,outside) 216.33.198.143 10.203.204.143 netmask 255.255.255.255
    static (inside,outside) 216.33.198.144 10.203.204.144 netmask 255.255.255.255
    static (inside,outside) 216.33.198.145 10.203.204.145 netmask 255.255.255.255
    static (inside,outside) 216.33.198.146 10.203.204.146 netmask 255.255.255.255
    static (inside,outside) 216.33.198.147 10.203.204.147 netmask 255.255.255.255
    static (inside,outside) 216.33.198.148 10.203.204.148 netmask 255.255.255.255
    static (inside,outside) 216.33.198.149 10.203.204.149 netmask 255.255.255.255
    static (inside,outside) 216.33.198.150 10.203.204.150 netmask 255.255.255.255
    static (inside,outside) 216.33.198.151 10.203.204.151 netmask 255.255.255.255
    static (inside,outside) 216.33.198.152 10.203.204.152 netmask 255.255.255.255
    static (inside,outside) 216.33.198.153 10.203.204.153 netmask 255.255.255.255
    static (inside,outside) 216.33.198.154 10.203.204.154 netmask 255.255.255.255
    static (inside,outside) 216.33.198.155 10.203.204.155 netmask 255.255.255.255
    static (inside,outside) 216.33.198.156 10.203.204.156 netmask 255.255.255.255
    static (inside,outside) 216.33.198.157 10.203.204.157 netmask 255.255.255.255
    static (inside,outside) 216.33.198.158 10.203.204.158 netmask 255.255.255.255
    static (inside,outside) 216.33.198.159 10.203.204.159 netmask 255.255.255.255
    static (inside,outside) 216.33.198.160 10.203.204.160 netmask 255.255.255.255
    static (inside,outside) 216.33.198.161 10.203.204.161 netmask 255.255.255.255
    static (inside,outside) 216.33.198.162 10.203.204.162 netmask 255.255.255.255
    static (inside,outside) 216.33.198.163 10.203.204.163 netmask 255.255.255.255
    static (inside,outside) 216.33.198.164 10.203.204.164 netmask 255.255.255.255
    static (inside,outside) 216.33.198.165 10.203.204.165 netmask 255.255.255.255
    static (inside,outside) 216.33.198.166 10.203.204.166 netmask 255.255.255.255
    static (inside,outside) 216.33.198.167 10.203.204.167 netmask 255.255.255.255
    static (inside,outside) 216.33.198.168 10.203.204.168 netmask 255.255.255.255
    static (inside,outside) 216.33.198.169 10.203.204.169 netmask 255.255.255.255
    static (inside,outside) 216.33.198.170 10.203.204.170 netmask 255.255.255.255
    static (inside,outside) 216.33.198.171 10.203.204.171 netmask 255.255.255.255
    static (inside,outside) 216.33.198.172 10.203.204.172 netmask 255.255.255.255
    static (inside,outside) 216.33.198.173 10.203.204.173 netmask 255.255.255.255
    static (inside,outside) 216.33.198.174 10.203.204.174 netmask 255.255.255.255
    static (inside,outside) 216.33.198.175 10.203.204.175 netmask 255.255.255.255
    static (inside,outside) 216.33.198.176 10.203.204.176 netmask 255.255.255.255
    static (inside,outside) 216.33.198.177 10.203.204.177 netmask 255.255.255.255
    static (inside,outside) 216.33.198.178 10.203.204.178 netmask 255.255.255.255
    static (inside,outside) 216.33.198.179 10.203.204.179 netmask 255.255.255.255
    static (inside,outside) 216.33.198.180 10.203.204.180 netmask 255.255.255.255
    static (inside,outside) 216.33.198.181 10.203.204.181 netmask 255.255.255.255
    static (inside,outside) 216.33.198.182 10.203.204.182 netmask 255.255.255.255
    static (inside,outside) 216.33.198.183 10.203.204.183 netmask 255.255.255.255
    static (inside,outside) 216.33.198.184 10.203.204.184 netmask 255.255.255.255
    static (inside,outside) 216.33.198.185 10.203.204.185 netmask 255.255.255.255
    static (inside,outside) 216.33.198.186 10.203.204.186 netmask 255.255.255.255
    static (inside,outside) 216.33.198.187 10.203.204.187 netmask 255.255.255.255
    static (inside,outside) 216.33.198.188 10.203.204.188 netmask 255.255.255.255
    static (inside,outside) 216.33.198.189 10.203.204.189 netmask 255.255.255.255
    static (inside,outside) 216.33.198.190 10.203.204.190 netmask 255.255.255.255
    static (inside,outside) 216.33.198.191 10.203.204.191 netmask 255.255.255.255
    static (inside,outside) 216.33.198.192 10.203.204.192 netmask 255.255.255.255
    static (inside,outside) 216.33.198.193 10.203.204.193 netmask 255.255.255.255
    static (inside,outside) 216.33.198.194 10.203.204.194 netmask 255.255.255.255
    static (inside,outside) 216.33.198.195 10.203.204.195 netmask 255.255.255.255
    static (inside,outside) 216.33.198.196 10.203.204.196 netmask 255.255.255.255
    static (inside,outside) 216.33.198.197 10.203.204.197 netmask 255.255.255.255
    static (inside,outside) 216.33.198.198 10.203.204.198 netmask 255.255.255.255
    static (inside,outside) 216.33.198.199 10.203.204.199 netmask 255.255.255.255
    static (inside,outside) 216.33.198.200 10.203.204.200 netmask 255.255.255.255
    access-group outside-in in interface outside
    route outside 0.0.0.0 0.0.0.0 216.33.198.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
    timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    group-policy test internal
    group-policy test attributes
     dns-server value 10.203.204.14 10.203.204.15
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value test_splitTunnelAcl
     default-domain value yorkmedia.local
     webvpn
    group-policy tunneltest internal
    group-policy tunneltest attributes
     dns-server value 10.203.204.14 4.2.2.2
     default-domain value yorkmedia.local
     webvpn
    group-policy testpol internal
    group-policy testpol attributes
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelall
     split-tunnel-network-list value dc2vpn_splitTunnelAcl
     webvpn
    group-policy aes internal
    group-policy aes attributes
     dns-server value 10.203.204.14 10.203.204.15
     vpn-tunnel-protocol IPSec
     group-lock value aestest
     webvpn
    group-policy grouptest internal
    group-policy grouptest attributes
     dns-server value 10.203.204.14 4.2.2.2
     default-domain value yorkmedia.local
     webvpn
    group-policy dc2vpntest internal
    group-policy dc2vpntest attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dc2vpntest_splitTunnelAcl
     webvpn
    group-policy dc2vpn internal
    group-policy dc2vpn attributes
     dns-server value 10.203.204.14 10.203.204.15
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value dc2vpn_splitTunnelAcl
     webvpn
    group-policy BMSTV internal
    group-policy BMSTV attributes
     wins-server none
     dns-server none
     dhcp-network-scope none
     vpn-access-hours none
     vpn-simultaneous-logins 3
     vpn-idle-timeout none
     vpn-session-timeout none
     vpn-filter none
     vpn-tunnel-protocol IPSec
     password-storage disable
     ip-comp disable
     re-xauth disable
     group-lock none
     pfs disable
     ipsec-udp disable
     ipsec-udp-port 10000
     split-tunnel-policy tunnelall
     split-tunnel-network-list none
     default-domain none
     split-dns none
     secure-unit-authentication disable
     user-authentication disable
     user-authentication-idle-timeout none
     ip-phone-bypass disable
     leap-bypass disable
     nem disable
     backup-servers keep-client-config
     client-firewall none
     client-access-rule none
     webvpn
    username mmaxey password zSSKHLc.gx8szpy2 encrypted privilege 15
    username mmaxey attributes
     vpn-group-policy dc2vpn
     webvpn
    username jjohnstone password qElIg/rYW4OoTIEP encrypted privilege 15
    username jjohnstone attributes
     vpn-group-policy dc2vpntest
     webvpn
    username sragona password ZgCBom/StrITlFdU encrypted
    username sragona attributes
     vpn-group-policy dc2vpn
     webvpn
    username admin password 5zvQXQPrcnyHyGKm encrypted
    username seng password PP8UcINDKi7BSsj2 encrypted
    username seng attributes
     vpn-group-policy dc2vpn
     webvpn
    username chauser password I3OIxCe8FBONQlhK encrypted
    username chauser attributes
     vpn-group-policy dc2vpn
     webvpn
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    http server enable
    http 65.123.204.0 255.255.254.0 outside
    http 0.0.0.0 0.0.0.0 outside
    http 10.203.204.0 255.255.254.0 inside
    http 192.168.1.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map outside_dyn_map 20 set pfs group7
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-AES-256-SHA
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
    crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
    crypto map outside_map 60 match address outside_cryptomap_60
    crypto map outside_map 60 set peer 165.89.240.1
    crypto map outside_map 60 set transform-set ESP-3DES-SHA
    crypto map outside_map 60 set security-association lifetime seconds 28800
    crypto map outside_map 60 set security-association lifetime kilobytes 4608000
    crypto map outside_map 80 match address outside_cryptomap_80
    crypto map outside_map 80 set pfs
    crypto map outside_map 80 set peer 64.19.183.67
    crypto map outside_map 80 set transform-set ESP-3DES-SHA
    crypto map outside_map 80 set security-association lifetime seconds 28800
    crypto map outside_map 80 set security-association lifetime kilobytes 4608000
    crypto map outside_map 100 match address outside_cryptomap_100
    crypto map outside_map 100 set pfs
    crypto map outside_map 100 set peer 64.241.196.50
    crypto map outside_map 100 set transform-set ESP-3DES-SHA
    crypto map outside_map 100 set security-association lifetime seconds 28800
    crypto map outside_map 100 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    isakmp enable outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption 3des
    isakmp policy 10 hash sha
    isakmp policy 10 group 2
    isakmp policy 10 lifetime 86400
    isakmp policy 30 authentication pre-share
    isakmp policy 30 encryption aes-256
    isakmp policy 30 hash sha
    isakmp policy 30 group 5
    isakmp policy 30 lifetime 86400
    isakmp policy 50 authentication pre-share
    isakmp policy 50 encryption aes-256
    isakmp policy 50 hash sha
    isakmp policy 50 group 7
    isakmp policy 50 lifetime 86400
    isakmp nat-traversal  20
    isakmp ipsec-over-tcp port 10000
    tunnel-group DefaultRAGroup ipsec-attributes
     pre-shared-key *
    tunnel-group dc2vpn type ipsec-ra
    tunnel-group dc2vpn general-attributes
     address-pool vpnpool
     default-group-policy dc2vpn
    tunnel-group dc2vpn ipsec-attributes
     pre-shared-key *
    tunnel-group test type ipsec-ra
    tunnel-group test general-attributes
     default-group-policy test
    tunnel-group test ipsec-attributes
     pre-shared-key *
    tunnel-group 165.89.240.1 type ipsec-l2l
    tunnel-group 165.89.240.1 general-attributes
     default-group-policy BMSTV
    tunnel-group 165.89.240.1 ipsec-attributes
     pre-shared-key *
     isakmp keepalive threshold 3600 retry 2
    tunnel-group 64.19.183.67 type ipsec-l2l
    tunnel-group 64.19.183.67 ipsec-attributes
     pre-shared-key *
    tunnel-group 64.241.196.50 type ipsec-l2l
    tunnel-group 64.241.196.50 ipsec-attributes
     pre-shared-key *
     isakmp keepalive disable
    tunnel-group dc2vpntest type ipsec-ra
    tunnel-group dc2vpntest general-attributes
     default-group-policy dc2vpntest
    tunnel-group dc2vpntest ipsec-attributes
     pre-shared-key *
    tunnel-group aestest type ipsec-ra
    tunnel-group aestest general-attributes
     address-pool vpnpool
     default-group-policy aes
    tunnel-group aestest ipsec-attributes
     pre-shared-key *
    tunnel-group TunnelGroup1 type ipsec-ra
    tunnel-group TunnelGroup1 general-attributes
     address-pool vpnpool
    telnet 10.203.204.10 255.255.255.255 inside
    telnet timeout 5
    ssh 65.123.204.0 255.255.254.0 outside
    ssh 10.203.204.0 255.255.254.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd lease 3600
    dhcpd ping_timeout 50
    class-map rtsp-traffic
     match access-list rtsp-acl
    class-map inspection_default
     match default-inspection-traffic
    policy-map global_policy
     class inspection_default
      inspect dns maximum-length 512
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
     class rtsp-traffic
      inspect rtsp
    service-policy global_policy global
    tftp-server inside 10.203.204.10 dc2asa01/config
    Cryptochecksum:6d74d3994ea6764893c420f477568aac
    : end

    You have three site-site VPNs and a remote access VPN setup. so the statement "Suddenly no one can access the remote LAN over VPN. " is a bit ambiguous in that context.
    From which source to what destination is not working for you?

  • Slow finder Browsing when accessing LAN via VPN connexion

    I am running ML Server, latest upadte on a 2010 Mac Mini Server machine.
    When I am connected to my network from a remote location via VPN, and I try to browse my LAN structure with Finder, it takes ages for the list of folders/files to appear and refresh.
    I have checked my VPN configuration and tried different type (L2TP, PPTP) but nothing significantly differ in term of browsing speed.
    I also appreciate that the network connection at the remote location, as well as the upload speed on my local network can influence the overwal browsing speed... but after several test, I confirm I have more than 3 Mbps bandwith for upload on the local network, and 20 Mbps minimum on the remote location.
    I also tried AFP / SMB, but does not seem to change anything.
    So, I guess I hope the Community has already experienced the issue and some of you guys may have found a workaround to this issue.
    Many thanks.

    why not try cisco ipsec
    Input the following settings:
    Interface: VPN
    VPN Type: Cisco IPSec
    Service Name: This can be anything, I left the default.
    Edit the new interface details as follows:
    Server Address: cisco.vpntraffic.com or other country vpn such as Portugal VPN
    Account Name: Your vpn account
    Password: Your vpn password
    How to setup Mac OS X Built-In Cisco VPN

  • Unable to access/lan2lan ping from VPN Fortigate to Cisco ASA 5505

    Problem : Unable to access user A to user B
    User A --- router A (122, fortigate 80c) --- (Site to Site VPN between fortigate & cisco asa) --- router B (93, cisco Asa 5505{in front asa got cisco800[81] before to internet} )  --- User B
    After using wizard to configure the cisco ASA site to site VPN, the site-to-site tunnel is up.
    Ping is unsuccessful from user A to user B
    Ping is successful from user B to user A, data is accessable
    After done the packet tracer from user A to user B,
    Result :
    Flow-lookup
    Action : allow
    Info: Found no matching flow, creating a new flow
    Route-lookup
    Action : allow
    Info : 192.168.5.203 255.255.255.255 identity
    Access-list
    Action : drop
    Config Implicit Rule
    Result - The packet is dropped
    Input Interface : inside
    Output Interface : NP Identify Ifc
    Info: (acl-drop)flow is denied by configured rule
    Below is Cisco ASA 5505's show running-config
    ASA Version 8.2(1)
    hostname Asite
    domain-name ssms1.com
    enable password ZZZZ encrypted
    passwd WWWW encrypted
    names
    name 82 B-firewall description Singapore office firewall
    name 192.168.1.0 B-inside-subnet description Singapore office internal LAN IP
    name 192.168.200.0 A-inside-VLAN12 description A-inside-VLAN12 (fortinet)
    name 192.168.2.0 fw-inside-subnet description A office internal LAN IP
    name 122 A-forti
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.5.203 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 93 255.255.255.240
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name ssms1.com
    object-group network obj_any
    network-object 0.0.0.0 0.0.0.0
    access-list inside_nat0_outbound extended permit ip any 80 255.255.255.240
    access-list inside_nat0_outbound extended permit ip fw-inside-subnet 255.255.255.0 B-inside-subnet 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.5.0 255.255.255.0 A-inside-VLAN12 255.255.255.0
    access-list outside_cryptomap extended permit ip fw-inside-subnet 255.255.255.0 B-inside-subnet 255.255.255.0
    access-list Outside_nat-inbound extended permit ip A-inside-VLAN12 255.255.255.0 192.168.5.0 255.255.255.0
    access-list Outside_nat-inbound extended permit ip host A-forti 192.168.5.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.5.0 255.255.255.0 A-inside-VLAN12 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-631.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 101 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 101 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 81 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http B-inside-subnet 255.255.255.0 inside
    http fw-inside-subnet 255.255.255.0 inside
    http 0.0.0.0 255.255.255.255 outside
    http 0.0.0.0 0.0.0.0 outside
    http 192.168.5.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer A-forti
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map 2 match address outside_cryptomap
    crypto map outside_map 2 set peer B-firewall
    crypto map outside_map 2 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication pre-share
    encryption aes-192
    hash md5
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash md5
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    dhcpd address 192.168.5.10-192.168.5.20 inside
    dhcpd dns 165 165 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    username admin password XXX encrypted privilege 15
    tunnel-group 122 type ipsec-l2l
    tunnel-group 122 ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    class-map outside-class
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
      message-length maximum client auto
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
    policy-map outside-policy
    description ok
    class outside-class
      inspect dns
      inspect esmtp
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect icmp
      inspect icmp error
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect sip
      inspect skinny
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
    service-policy global_policy global
    service-policy outside-policy interface outside
    prompt hostname context
    Cryptochecksum: XXX
    : end
    Kindly need your expertise&help to solve the problem

    any1 can help me ?

  • Is symbian or windows mobile better to access mac shares via vpn?

    I am considering a smart phone purchase in the next few months, and I would like to be able to browse my server via vpn from the phone the same way I can with my Palm LifeDrive. I think Symbian or Windows Mobile are my best OS choices for a phone, and I was wondering if anyone has actual experience with this. Do they use PPTP or L2TP? At this point, the iPhone cannot edit documents, so it is not a consideration, but I am also curious if it allows for this type of remote browsing through a VPN.
    Thank you for any help that you can offer.
    Michael

    I have done some more testing and oddly enough I can map a drive if I use the IPaddress, but not the computer name, when checking the check box "connect using different credentials"and providing they users domain credentials.
    This seems to point to a DNS issue, one would think, but I can hit the file share server by name \\fileserver.dev.lan
    I can see all the shares, so dns seems to be fine right?
    So I don't understand why I can map a drive using do the IPaddress and not the machine name, but yet I can see and ping the server by name?
    When I try to create a mapped drive by machine name I receive the following message:
    Windows cannot access \\fileserver.dev.lan\all
    You do not have permissions to access \\fileserver.dev.lan. contact your network administrator  to request access.
    But if I use the \\x.x.x.x\all using the very same user and password I get connected with no problem.
    This only seems to happen on windows 8.1, which leads me to think that has something to do with OS. 
    I am thinking about upgrading to windows 8.1 pro, but I don't want to go though the hassle and expanse is the OS is not the problem.

  • Can't access management interface via vpn connection

    Hi all,
    I can't seem to be able to manage my ASA 5510 when I connect via vpn. My asa sits at a remote colo, and from my office i can connect fine. I have it configured as management-access (dmz), bc as of now we are just doing some staging and all the servers are in the dmz interface.
    When i connect with the vpn client, in the routes it sees 192.168.1.0 255.255.255.0 which is the management network/interface.
    For some reason I can't get access to 192.168.1.1 to use the ASDM.
    Here is how i did my vpn via CLI
    isakmp enable outside
    isakmp identity address
    isakmp policy 10
    authentication pre-share
    encryption des
    hash md5
    group 2
    lifetime 86400
    ip local pool vpnpool 10.1.1.2-10.1.1.10
    access-list split_tunnel standard permit 192.168.200.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    group-policy xxxxx internal
    group-policy xxxxx attributes
    dns value
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split_tunnel
    username xxxxx password
    username xxxxxx attributes
    vpn-group-policy xxxx
    username xxxxxx password
    username xxxxxx attributes
    vpn-group-policy xxxx
    username xxxx password
    username xxxx attributes
    vpn-group-policy xxxx
    tunnel-group xxxx type ipsec-ra
    tunnel-group xxxx general-attributes
    address-pool vpnpool
    tunnel-group xxxx ipsec-attributes
    pre-shared-key
    access-list vpnra permit ip 192.168.200.0 255.255.255.0 10.1.1.0 255.255.255.0
    access-list vpnra permit ip 192.168.100.0 255.255.255.0 10.1.1.0 255.255.255.0
    access-list vpnra permit ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
    nat (inside) 0 access-list vpnra
    nat (dmz) 0 access-list vpnra
    nat (management) 0 access-list vprna
    crypto ipsec transform-set md5des esp-des esp-md5-hmac
    crypto dynamic-map dynomap 10 set transform-set md5des
    crypto map vpnpeer 20 ipsec-isakmp dynamic dynomap
    crypto map vpnpeer interface outside
    Any help would be much appreciated

    it seems like you are missing a line:
    management-access "interface"
    http://www.cisco.com/en/US/docs/security/asa/asa71/command/reference/m_711.html#wp1631964

  • Accessing a subnet via VPN session

    Hi everybody.
    I have not to much experience configuring and managing VPN´s and at this moment I am facing a bit issue. I've got a remote site which is connected to the headquarters via VPN site to site IP Sec tunnel. When I am in my office I have no problem to reach the remote network, but, when I try to connect to the remote network via VPN client, I can't reach it.
    in the remote office I've hot a Router 3800 (Cisco IOS Software, 3800 Software (C3845-ADVENTERPRISEK9-M), Version 12.4(13c), RELEASE SOFTWARE (fc2)) in the headquarters I've got an ASA 5520 Version 8.0(3) I've chequed access-list, and network objects and it seems everythink ok.
    local network: 10.30.0.0 0.0.0.0
    remote network 10.31.0.0 0.0.0.0
    ASA
    object-group network remote-network
    network-object 172.16.27.0 255.255.255.0
    network-object 10.31.0.0 255.255.0.0
    object-group network network-local
    network-object 0.0.0.0 0.0.0.0
    access-list VPN_Remote_Access_splitTunnelAcl standard permit 10.31.0.0 255.255.0.0
    Router 3800
    ip access-list extended vpn
      permit ip 10.31.0.0 0.0.255.255 any
    Can someone guide me about what is missing in the config? no problem if you need more "sho run" lines.
    Regards and Thanks very much!!

    Hi Ankur, thanks very much for your reply!
    this is the "sho run" in my remote router:
    I do not undesrtand well your first question, but if it is usefull, I loggin to headquerters "headquerters public ip address"
    this is a simple diagram of where I want to connect to:
    REMOTE_SITE --------------------------( vpn site to site IP sec tunnel )-------------------------HEADQUERTERS
    (10.31.0.0/24 network)                                                                                      (10.30.0.0/16network)
                                                                                                                                            |
                                                                                                                                            |
                                                                                                                                            |
                                                                                                                                            |
                                                                                                                                  REMOTE USER
                                                                                                                                 (10.30.23.130/25)
    REMOTESITE#sho run
    Building configuration...
    Current configuration : 10834 bytes
    version 12.4
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname PYASU1ROU01
    boot-start-marker
    boot-end-marker
    logging buffered 64000 debugging
    no logging console
    aaa new-model
    aaa authentication login default group tac-auth local
    aaa authentication enable default group tac-auth enable
    aaa authorization console
    aaa authorization exec default group tac-auth local if-authenticated
    aaa authorization network default local
    aaa accounting exec default start-stop group tac-auth
    aaa session-id common
    clock timezone PR -3
    ip cef
    voice-card 0
    no dspfarm
    crypto pki trustpoint TP-self-signed-4112391703
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-4112391703
    revocation-check none
    rsakeypair TP-self-signed-4112391703
    crypto pki certificate chain TP-self-signed-4112391703
    certificate self-signed 01
      30820243 308201AC A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 34313132 33393137 3033301E 170D3131 31313234 30323430
      34335A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 31313233
      39313730 3330819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100A09B 8740E68A 0C5BB452 D4D26D1B C91E4B5A 71FF0E11 411D70DB ED09EE4C
      95C67911 0DFB9557 EB17CE79 9A3AF1C8 3B4DC1C0 75F6B938 F3431C4D 6DEAB793
      A560C0AE 88007146 4312FBDF F979476B AB55CACD 9EE00DAC B3227CD6 9861DE87
      DD462212 6E8FDA90 7BEA7967 26FCF6B6 6DDDBD5A A6E3D7F8 12AE4F5E 71BDDEE3
      D5130203 010001A3 6B306930 0F060355 1D130101 FF040530 030101FF 30160603
      551D1104 0F300D82 0B505941 53553152 4F553031 301F0603 551D2304 18301680
      14C86D3D 3AF1854B 977D5BD8 A9ABAF33 4E7483BC 3B301D06 03551D0E 04160414
      C86D3D3A F1854B97 7D5BD8A9 ABAF334E 7483BC3B 300D0609 2A864886 F70D0101
      04050003 8181005A 5A20ACB9 EE50A66C 054B5449 62A98E5F B42E5193 6D3D71A8
      B0949BE2 70BE6F3C 2FAD7E2D AA0FCF6C 4D8E8344 035A33D6 6538EF32 33F8C746
      31119E9C F08091A2 9F8DCF8F 1B779D90 82F3366C D0F84D6B AB7E3248 E532E224
      91E404E9 608ECF11 5525D52B A02C3D9C 7BC1C1EF 496D1246 1125086B 54EEF4A2
      94350AFF EA7CB2
      quit
    username admin privilege 15 secret 5 $1$P3xv$e99l3YcRWgFPEp/m6uXZg1
    username cwuser privilege 15 secret 5 $1$Ir9X$CZgLaFy7XKsmT9avFHTTk/
    ip tcp synwait-time 10
    ip ssh time-out 60
    ip ssh authentication-retries 2
    ip ssh version 2
    crypto keyring apex
      pre-shared-key address "headquerters public ip address"
    key apex
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp profile companyname
       keyring apex
       match identity address "headquerters public ip address"
    crypto ipsec transform-set esp-aes256-sha esp-aes 256 esp-sha-hmac
    crypto ipsec transform-set 3DES esp-3des esp-sha-hmac
    crypto map outside 10 ipsec-isakmp
    set peer "headquerters public ip address"
    set transform-set 3DES
    set isakmp-profile companyname
    match address vpn-companyname
    interface Loopback1
    description monitoreo
    ip address 10.31.21.255 255.255.255.255
    interface GigabitEthernet0/0
    description Teysa
    ip address public ip address
    ip nat outside
    no ip virtual-reassembly
    load-interval 30
    duplex auto
    speed auto
    media-type rj45
    crypto map outside
    interface GigabitEthernet0/1
    description TO CORE-SW
    ip address 192.168.255.249 255.255.255.252
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    media-type rj45
    interface FastEthernet0/0/0
    switchport access vlan 2
    duplex full
    speed 100
    interface FastEthernet0/0/1
    switchport access vlan 10
    shutdown
    duplex full
    speed 100
    interface FastEthernet0/0/2
    switchport mode trunk
    shutdown
    interface FastEthernet0/0/3
    switchport access vlan 10
    shutdown
    duplex full
    speed 100
    interface Vlan1
    no ip address
    no ip http server
    ip http authentication aaa login-authentication default
    ip http authentication aaa exec-authorization default
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source route-map nat interface GigabitEthernet0/0 overload
    ip access-list extended nat
    deny   ip host 172.16.27.236 10.0.0.0 0.255.255.255
    deny   ip 10.31.0.0 0.0.255.255 10.0.0.0 0.255.255.255
    deny   ip 172.16.27.0 0.0.0.255 10.0.0.0 0.255.255.255
    permit ip 10.31.11.0 0.0.0.255 any
    permit ip 10.31.13.0 0.0.0.255 any
    permit ip 172.16.27.0 0.0.0.255 host 209.59.188.93
    permit ip 172.16.27.0 0.0.0.255 host 190.180.145.46
    permit ip 172.16.27.0 0.0.0.255 host 46.51.171.127
    permit ip 172.16.27.224 0.0.0.31 any
    ip access-list extended vpn-apex
    permit ip 10.50.20.0 0.0.1.255 any
    permit ip 172.16.27.0 0.0.0.255 any
    permit ip 10.31.0.0 0.0.255.255 any
    permit ip 10.30.0.0 0.0.255.255 any
    route-map nat permit 10
    match ip address nat
    control-plane
    line con 0
    password 7 xxxxxxxxxx
    stopbits 1
    line aux 0
    stopbits 1
    line vty 0 4
    password 7 xxxxxxxxxx
    scheduler allocate 20000 1000
    ntp server 10.30.5.38
    end
    REMOTESITE#
    Regards!

  • Having trouble accessing wikis & blogs via VPN

    After I connect to our server via VPN when I'm outside of our network, I'm having trouble getting wiki and blog pages to open up. Currently I'm using the internal hostname to pull up the pages: ajax.private (we used the .private domain because it is an internal server only).
    So, when I type in: ajax.private into the browser, the page starts to load and I can see the graphics starting to load, but it never finishes loading. Likewise, if I try and access the pages using the server's internal IP address, the same thing happens. Am I doing something wrong here?
    My other services like ichat and ical are able to access and authenticate using the FQDN of ajax.private

    You'd have to provide a lot more details of the setup to have any hope of a useful response. You don't even say what kind of VPN it is. What does the network admin at work say?

  • Transfer files from mac to company drives via VPN?

    I have several files that I design/update on my mac which I want to write to a company network drive.
    On my PC I go through the installed VPN (I have host address, passwords etc). I am new to mac's and wondered if a similar method is available?
    Any step by step instructions would be very much appreciated.
    Al
    iMac 2006   Mac OS X (10.4.5)  

    It depends on the VPN system being used by the office.
    If it uses PPTP or L2TP, just open /Application/Utilities/Internet Connect and create a new VPN connection profile.
    Fill in the blanks and click connect. With luck you'll be connected to the office network via VPN and can do whatever you would normally do while in the office.
    If the office VPN uses IPSec as its VPN protocol, or doesn't work with the built-in client then you may need to install a separate VPN client. You should be able to get this from the network administrators, or you can try one of the third-party clients such as VPNTracker or DigiTunnel.

  • Unable to access secondary subnet from VPN client

    Please can someone help with the following; I have an ASA 5510 running v8.4(3)9 and have setup a remote user VPN using the Cisco VPN client v5.0.07.0410 which is working appart from the fact that I cannot access resources on a secondary subnet.
    The setup is as follows:
    ASA inside interface on 192.168.10.240
    VPN clients on 192.168.254.x
    I can access reources on the 192.168.10 subnet but not any other subnets internally, I need to specifically allow access to the 192.168.20 subnet, but I cannot figure out how to do this please advise, the config is below: -
    Result of the command: "show startup-config"
    ASA Version 8.4(3)9
    hostname blank
    domain-name
    enable password encrypted
    passwd encrypted
    names
    dns-guard
    interface Ethernet0/0
    nameif outside
    security-level 0
    ip address 255.255.255.224
    interface Ethernet0/1
    nameif inside
    security-level 100
    ip address 192.168.10.240 255.255.255.0
    interface Ethernet0/2
    nameif DMZ
    security-level 50
    ip address 10.10.10.253 255.255.255.0
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa843-9-k8.bin
    boot system disk0:/asa823-k8.bin
    ftp mode passive
    clock timezone GMT/BST 0
    clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 194.168.4.123
    name-server 194.168.8.123
    domain-name nifcoeu.com
    object network obj-192.168.0.0
    subnet 192.168.0.0 255.255.255.0
    object network obj-192.168.5.0
    subnet 192.168.5.0 255.255.255.0
    object network obj-192.168.10.0
    subnet 192.168.10.0 255.255.255.0
    object network obj-192.168.100.0
    subnet 192.168.100.0 255.255.255.0
    object network obj-192.168.254.0
    subnet 192.168.254.0 255.255.255.0
    object network obj-192.168.20.1
    host 192.168.20.1
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-01
    subnet 0.0.0.0 0.0.0.0
    object network obj-0.0.0.0
    host 0.0.0.0
    object network obj_any-02
    subnet 0.0.0.0 0.0.0.0
    object network obj-10.10.10.1
    host 10.10.10.1
    object network obj_any-03
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-04
    subnet 0.0.0.0 0.0.0.0
    object network obj_any-05
    subnet 0.0.0.0 0.0.0.0
    object network NS1000_EXT
    host 80.4.146.133
    object network NS1000_INT
    host 192.168.20.1
    object network SIP_REGISTRAR
    host 83.245.6.81
    object service SIP_INIT_TCP
    service tcp destination eq sip
    object service SIP_INIT_UDP
    service udp destination eq sip
    object network NS1000_DSP
    host 192.168.20.2
    object network SIP_VOICE_CHANNEL
    host 83.245.6.82
    object service DSP_UDP
    service udp destination range 6000 40000
    object service DSP_TCP
    service tcp destination range 6000 40000
    object network 20_range_subnet
    subnet 192.168.20.0 255.255.255.0
    description Voice subnet
    object network 25_range_Subnet
    subnet 192.168.25.0 255.255.255.0
    description VLAN 25 client PC devices
    object-group network ISP_NAT
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service SIP_INIT tcp-udp
    port-object eq sip
    object-group service DSP_TCP_UDP tcp-udp
    port-object range 6000 40000
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.254.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip object 20_range_subnet 192.168.254.0 255.255.255.0
    access-list Remote-VPN_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0
    access-list Remote-VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list 100 extended permit object-group TCPUDP object SIP_REGISTRAR object NS1000_INT object-group SIP_INIT
    access-list 100 extended permit object-group TCPUDP object SIP_VOICE_CHANNEL object NS1000_DSP object-group DSP_TCP_UDP
    access-list 100 extended permit ip 62.255.171.0 255.255.255.224 any
    access-list 100 extended permit icmp any any echo-reply inactive
    access-list 100 extended permit icmp any any time-exceeded inactive
    access-list 100 extended permit icmp any any unreachable inactive
    access-list 100 extended permit tcp any host 10.10.10.1 eq ftp
    access-list 100 extended permit tcp any host 10.10.10.1 eq ftp-data
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu DMZ 1500
    mtu management 1500
    ip local pool VPN-Pool 192.168.254.1-192.168.254.254 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    asdm history enable
    arp timeout 14400
    nat (inside,any) source static obj-192.168.0.0 obj-192.168.0.0 destination static obj-192.168.5.0 obj-192.168.5.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-192.168.10.0 obj-192.168.10.0 destination static obj-192.168.100.0 obj-192.168.100.0 no-proxy-arp route-lookup
    nat (inside,any) source static obj-192.168.10.0 obj-192.168.10.0 destination static obj-192.168.254.0 obj-192.168.254.0 no-proxy-arp route-lookup
    nat (outside,inside) source static SIP_REGISTRAR SIP_REGISTRAR destination static interface NS1000_INT service SIP_INIT_TCP SIP_INIT_TCP
    nat (outside,inside) source static SIP_REGISTRAR SIP_REGISTRAR destination static interface NS1000_INT service SIP_INIT_UDP SIP_INIT_UDP
    object network obj_any
    nat (inside,outside) dynamic interface
    object network obj_any-01
    nat (inside,outside) dynamic obj-0.0.0.0
    object network obj_any-02
    nat (inside,DMZ) dynamic obj-0.0.0.0
    object network obj-10.10.10.1
    nat (DMZ,outside) static 80.4.146.134
    object network obj_any-03
    nat (DMZ,outside) dynamic obj-0.0.0.0
    object network obj_any-04
    nat (management,outside) dynamic obj-0.0.0.0
    object network obj_any-05
    nat (management,DMZ) dynamic obj-0.0.0.0
    access-group 100 in interface outside
    route outside 0.0.0.0 0.0.0.0 80.4.146.129 1
    route inside 192.168.20.0 255.255.255.0 192.168.10.254 1
    route inside 192.168.25.0 255.255.255.0 192.168.10.254 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.10.0 255.255.255.0 inside
    http 192.168.25.0 255.255.255.0 inside
    http 62.255.171.0 255.255.255.224 outside
    http 192.168.254.0 255.255.255.0 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=
    crl configure
    crypto ca trustpoint _SmartCallHome_ServerCA
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 2f0e024d
      quit
    crypto ca certificate chain _SmartCallHome_ServerCA
    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
      quit
    crypto isakmp identity address
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.168.1.0 255.255.255.0 management
    telnet timeout 5
    ssh 62.255.171.0 255.255.255.224 outside
    ssh 192.168.254.0 255.255.255.0 outside
    ssh 192.168.10.0 255.255.255.0 inside
    ssh 192.168.25.0 255.255.255.0 inside
    ssh timeout 5
    ssh version 2
    console timeout 0
    vpn-sessiondb max-other-vpn-limit 250
    vpn-sessiondb max-anyconnect-premium-or-essentials-limit 2
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ntp server 192.168.10.6 source inside prefer
    webvpn
    group-policy Remote-VPN internal
    group-policy Remote-VPN attributes
    wins-server value 192.168.10.21 192.168.10.22
    dns-server value 192.168.10.21 192.168.10.22
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Remote-VPN_splitTunnelAcl
    default-domain value
    username blank password blank encrypted privilege 0
    username blank attributes
    vpn-group-policy Remote-VPN
    username blank password encrypted privilege 0
    username blank attributes
      vpn-group-policy Remote-VPN
    tunnel-group Remote-VPN type remote-access
    tunnel-group Remote-VPN general-attributes
    address-pool VPN-Pool
    default-group-policy Remote-VPN
    tunnel-group Remote-VPN ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect sip 
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    contact-email-addr
    profile CiscoTAC-1
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:b8263c5aa7a6a4d9cb08368c042ea236

    Your config was missing a no-nat between your "192.168.20.0" and "obj-192.168.254.0"
    So, if you look at your config there is a no-nat for inside subnet "obj-192.168.10.0" as shown below.
    nat (inside,any) source static obj-192.168.10.0 obj-192.168.10.0 destination static obj-192.168.254.0 obj-192.168.254.0
    So all you have to do is create a no-nat for your second subnet, like I showed you before, the solution was already there on your config but I guess you over looked at it.
    I hope that helps.
    Thanks
    Rizwan Rafeek

  • Unable to access cisco asa via https or asdm!! connection interrupted message appears on the browser

    Hey guys,
    I am unable to access cisco asa device using https and cannot lunch asdm, after recent power failure at our location. I have asdm installed on my machine and whenever i try to access the asdm, receive Error: unable to lunch device manager from X.X.X.X The following is log from java console
    Trying for ASDM version file; url = https://x.x.x.x/admin/
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    When i try to access it from the browser it show error message
    "The connection was interrupted"
    I am running CISCO ASA 8.3 (1)
    with asdm image as asdm 7.1.3
    JAVA version installed Java 7 update 71
    I have added the https:> to exception site list and set security level to medium,
    even ssh access is not working !!
    I would appreciate if anyone can help me out!!
    Thanks
    Fareed

    Hey lcaruso,
    thanks for information!!
    i was able to connection through console as suggested and regenerated the rsa key .. was able to connection through ssh, but the issue with the asdm or web access was not resolved. 
    I have tried few of the steps as suggested on 
    https://supportforums.cisco.com/document/49741/asa-pixfwsm-unable-manage-unit-sshtelnetasdm#collect_captures
    capture output 
    ZHHFP-FIREWALL1(config)# sh cap capin
    139 packets captured
       1: 18:50:17.654720 802.1Q vlan#1 P0 192.168.160.113.58084 > 192.168.160.126.8
    443: S 2567327150:2567327150(0) win 8192 <mss 1260,nop,wscale 8,nop,nop,sackOK>
       2: 18:50:17.654812 802.1Q vlan#1 P0 192.168.160.126.8443 > 192.168.160.113.58
    084: S 590825877:590825877(0) ack 2567327151 win 8192 <mss 1380>
       3: 18:50:17.655621 802.1Q vlan#1 P0 192.168.160.113.58084 > 192.168.160.126.8
    443: . ack 590825878 win 65520
       4: 18:50:17.656078 802.1Q vlan#1 P0 192.168.160.113.58084 > 192.168.160.126.8
    443: P 2567327151:2567327332(181) ack 590825878 win 65520
       5: 18:50:17.656139 802.1Q vlan#1 P0 192.168.160.126.8443 > 192.168.160.113.58
    084: . ack 2567327332 win 8192
       6: 18:50:17.656475 802.1Q vlan#1 P0 192.168.160.126.8443 > 192.168.160.113.58
    084: FP 590825878:590825878(0) ack 2567327332 win 8192
       7: 18:50:17.657696 802.1Q vlan#1 P0 192.168.160.113.58084 > 192.168.160.126.8
    443: . ack 590825879 win 65520
       8: 18:50:17.657802 802.1Q vlan#1 P0 192.168.160.113.58084 > 192.168.160.126.8
    443: F 2567327332:2567327332(0) ack 590825879 win 65520
       9: 18:50:17.657848 802.1Q vlan#1 P0 192.168.160.126.8443 > 192.168.160.113.58
    084: . ack 2567327333 win 8192
      10: 18:50:17.658108 802.1Q vlan#1 P0 192.168.160.113.58085 > 192.168.160.126.8
    443: S 1351758892:1351758892(0) win 8192 <mss 1260,nop,wscale 8,nop,nop,sackOK>
    also i have downgraded the java to 1.6_45 but still not luck.
    error message i received on java console
    Trying for IDM. url=https://x.x.x.x/idm/idm.jnlp/
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
    at com.cisco.launcher.w.a(Unknown Source)
    at com.cisco.launcher.s.for(Unknown Source)
    at com.cisco.launcher.s.new(Unknown Source)
    at com.cisco.launcher.s.access$000(Unknown Source)
    at com.cisco.launcher.s$2.a(Unknown Source)
    at com.cisco.launcher.g$2.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
    Caused by: java.io.EOFException: SSL peer shut down incorrectly
    at sun.security.ssl.InputRecord.read(Unknown Source)
    ... 15 more
    Any help would be highly appreciated!!
    Thanks
    Fareed 

  • Cannot access internal LAN after VPN connect

    I know this is either an ACL or NAT issue that I cannot figure out.  The nat-t config in defaulted in the IOS config for the ASA.  I actually forgot the command to show the hidden default config lines.  Either way, can someone take a look at my config, and let me know what I am doing wrong, again.
    Thanks ahead of time.
    ASA Version 8.2(2)
    hostname ciscousa
    enable password
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 1.1.1.2 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 14.14.11.5 255.255.255.0
    interface Vlan3
    shutdown
    no forward interface Vlan2
    nameif dmz
    security-level 50
    ip address dhcp
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    speed 100
    duplex full
    ftp mode passive
    same-security-traffic permit intra-interface
    access-list outside_in extended permit icmp any any
    access-list inside_nat0 extended permit ip any 1.1.1.0 255.255.255.0
    access-list inside_nat0 extended permit ip any 10.12.27.0 255.255.255.0
    access-list split_tunnel standard permit 1.1.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    ip local pool vpnpool 10.12.27.100-10.12.27.120 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group outside_in in interface outside
    route outside 0.0.0.0 0.0.0.0 14.14.11.6 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 1.1.1.0 255.255.255.0 inside
    http 1.1.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map inet-1_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map inet-1_map 65535 ipsec-isakmp dynamic inet-1_dyn_map
    crypto map inet-1_map interface outside
    crypto isakmp identity address
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy vpnipsec internal
    group-policy vpnipsec attributes
    wins-server value 1.1.1.16
    dns-server value 1.1.1.16
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value split_tunnel
    default-domain value company.com
    tunnel-group vpnipsec type remote-access
    tunnel-group vpnipsec general-attributes
    address-pool vpnpool
    default-group-policy vpnipsec
    tunnel-group vpnipsec ipsec-attributes
    pre-shared-key *****
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512

    Hello,
    I have been trying to get this to work within the last week but to no avail.  I changed my config altogether and started from scratch.  I have Split Tunnel working well, and I can access the VPN client from the internal LAN.  But I still cannot access the internal LAN from the VPN client host.    Can anyone take a look at my config and tell me what ACL\Access Group I am missing.  I know I am close but I cannot get over the hump.
    Thanks!
    ASA Version 8.2(2)
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.2 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address xxx.xxx.xxx.xxx 255.255.255.0
    interface Vlan3
    shutdown
    no forward interface Vlan2
    nameif dmz
    security-level 50
    ip address dhcp
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    speed 100
    duplex full
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_in extended permit icmp any any
    access-list outside_in_vpn extended permit ip 192.168.3.0 255.255.255.0 any
    access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 192.168.0.0 255.255.0.0
    access-list split_tunnel standard permit 192.168.0.0 255.255.0.0
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit ip any any
    pager lines 24
    logging enable
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    ip local pool ipvpn 192.168.3.100-192.168.3.200 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inside_access_in in interface inside
    access-group outside_in in interface outside control-plane
    access-group outside_in_vpn in interface outside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map internet-1_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHAESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map internet-1_map 65535 ipsec-isakmp dynamic internet-1_dyn_map
    crypto map internet-1_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto isakmp identity address
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    management-access inside
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy DfltGrpPolicy attributes
    group-policy vpnipsec internal
    group-policy vpnipsec attributes
    wins-server value 192.168.1.5
    dns-server value 192.168.1.5
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value company.com
    tunnel-group vpnipsec type remote-access
    tunnel-group vpnipsec general-attributes
    address-pool ipvpn
    default-group-policy vpnipsec
    tunnel-group vpnipsec ipsec-attributes
    pre-shared-key *
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    prompt hostname context
    Cryptochecksum:7e41045c9d7c66ac2c03c3b12ae63908

Maybe you are looking for