Upgrading from asa711-k8.bin to asa 721-k8.bin error

when i am trying to upgrade to the new image i get this error
test(config)# boot config disk0:/asa721-k8.bin
ERROR: Unable to set this url, file has non-ASCII characters

Hi,
I believe this error message is occurred because the command is not put in the right order.
I've tested a few times in GNS3 and I believe the right sequences are as follows:
enable config t copy run disk0:/.private/startup-config boot config disk0:/.private/startup-config wr mem
I hope this helps.
Btw, I've also documented it here.
http://firewallengineer.wordpress.com/2012/05/06/solved-error-unable-to-set-this-url-file-has-non-ascii-characters/

Similar Messages

  • Upgrade from 3.6.2 to 3.6.3 get error message. 1.92.2 not compatible with mini ver. =1.9.2.3 max ver

    When Upgrading From Ver.3.6.2 To Ver 3.6.3, Get error message (Platform Ver 1.9.2.2 Not Compatible With miniversion>=1.9.2.3
    maxVersion

    Do a clean reinstall and download a fresh Firefox copy from http://www.mozilla.com/firefox/all.html and save the file to the desktop.
    Uninstall your current Firefox version and remove the Firefox program folder before installing that copy of the Firefox installer.
    It is important to delete the Firefox program folder to remove all the files and make sure that there are no problems with files that were leftover after uninstalling.
    You can skip the step to create a new profile, that is not necessary for this issue.
    See http://kb.mozillazine.org/Standard_diagnostic_-_Firefox#Clean_reinstall

  • Tried to upgrade from firefox 3.6.2 to 3.6.3, error message says another instance of firefox is running, then 3.6.2 opens. This occurs when i start firefox after restarting the computer, or when i try to install the upgrade

    Whenever i try to open firefox, i get a message that firefox cannot install the upgrade because another instance of firefox is running. Then firefox 3.6.2 will start. running windows 7 64 bit. This will occur every time i try to open firefox, after rebooting or any time i close it and reopen firefox.
    == This happened ==
    Every time Firefox opened
    == I Ok'd the upgrade from 3.6.2 to 3.6.3

    Do a clean (re)install and download a fresh Firefox copy from http://www.mozilla.com/firefox/all.html and save the file to the desktop.
    Uninstall your current Firefox version and remove the Firefox program folder before installing that copy of the Firefox installer.
    It is important to delete the Firefox program folder to remove all the files and make sure that there are no problems with files that were leftover after uninstalling.
    You can skip the step to create a new profile, that is not necessary for this issue.
    See http://kb.mozillazine.org/Standard_diagnostic_-_Firefox#Clean_reinstall

  • Upgrade from 2005 express to 2008 r2 express - provisionsystemaccounts.sql error

    Hi,
    I’ve been upgrading several of my clients and ran into this problem for one of them.
    When doing the upgrade I got..
    Looking at the error logs indicated..
    2015-03-21 11:54:07.58 spid7s     
    Database 'master' is upgrading script 'provisionsystemaccounts.sql' from level 0 to level 2.
    2015-03-21 11:54:07.59 spid7s     
    2015-03-21 11:54:07.59 spid7s     
    Starting provisionsystemaccounts.sql ...
    2015-03-21 11:54:07.59 spid7s     
    2015-03-21 11:54:08.02 spid7s     
    Error: 15151, Severity: 16, State: 1.
    2015-03-21 11:54:08.02 spid7s     
    Cannot find the user 'FILESERVER01\SQLServer2005MSFTEUser$FILESERVER02$ORSQLEXP', because it does not exist or you do not have permission.
    2015-03-21 11:54:08.03 spid7s     
    Error: 912, Severity: 21, State: 2.
    2015-03-21 11:54:08.03 spid7s     
    Script level upgrade for database 'master' failed because upgrade step 'provisionsystemaccounts.sql' encountered error 15151, state 1, severity 16. This is a serious error condition which might interfere with regular operation and the database will be
    taken offline. If the error happened during upgrade of the 'master' database, it will prevent the entire SQL Server instance from starting. Examine the previous errorlog entries for errors, take the appropriate corrective actions and re-start the database
    so that the script upgrade steps run to completion.
    2015-03-21 11:54:08.03 spid7s     
    Error: 3417, Severity: 21, State: 3.
    2015-03-21 11:54:08.03 spid7s      Cannot recover the master database. SQL Server is unable to run. Restore master from a full backup, repair it, or rebuild it. For more information about how
    to rebuild the master database, see SQL Server Books Online.
    2015-03-21 11:54:08.03 spid7s   
      SQL Trace was stopped due to server shutdown. Trace ID = '1'. This is an informational message only; no user action is required.Running the Repair from the Installation centre
     brings up the same error.
    I noticed that the instance appears to be upgraded but basically the service won’t run. I can start it but it just stops again.
    So I found this which seems the same as my problem..
    https://ilkirk.wordpress.com/2011/03/07/in-place-sql-upgrade-error-2005-to-2008/
    Even though I can start the SQL Services using point 1 from the link above I can’t connect to sql using DAC.
    The sqlcmd won’t work and trying to connect through SSMS.
    > SQLCMD –E –A. I’ve also tried >SQLCMD FILESERVER1\ORSQLEXP –E –A and get the same results
    HResult 0xFFFFFFFF, Level 16, State 1
    SQL Server Network Interfaces: An error occurred while obtaining the dedicated administrator connection (DAC) port.
    Make sure that SQL Browser is running, or check the error log for the port number [xFFFFFFFF].
    When I try to connect to DAC via SSMS I get ..
    So I seem to currently have 2 problems, one using sqlcmd/DAC and the other with provisionsystemaccounts.sql.
    The sqlbrowser is running but from 90 (not sure if that matters) and I have removed (following online research) the 80 and 90 binn settings from the PATH just leaving 100 but this hasn’t changed the errors.
    I’ve tried enabling DAC using this advice below but it hasn’t made any difference. The service keeps stopping and no SQLCMD action.
    http://www.mssqltips.com/sqlservertip/2538/enabling-dedicated-administrator-connection-in-sql-server-2008-express-edition/
    So after trying numerous options I currently stumped.

    An update to this. I can now DAC via sqlcmd.
    Following the advice on
    [url]https://ilkirk.wordpress.com/2011/03/07/in-place-sql-upgrade-error-2005-to-2008/[/url]
    I'm at point 3
    3.Issue a ‘create login’ command to create the user / group you’re missing, followed by the all important GO
    and I'm a bit unclear on what to do. The user according to the error log is 'FILESERVER01\SQLServer2005MSFTEUser$FILESERVER02$ORSQLEXP'
    and I tried
    >sp_addsrvrolemember 'FILESERVER01\SQLServer2005MSFTEUser$FILESERVER02$ORSQLEXP', 'sysadmin'
    >go
    adding this seemed to work without error but running the repair from the installation centre bought up the exact same error as before.
    So, bearing in mind using the advice from the above link
    Have I added the user to the correct group?
    If not how do I do that?
    In the advice he also mentions..
    Now – why did this happen?  Well, in my situation it seems to be related to the fact that I upgraded the default instance first which also upgraded the Full Text Engine.  That, in turn, removed the Full Text Engine user group from the local groups. 
    In particular, I was missing “<ServerName>\SQLServer2005MSFTEUser$<ServerName>$MSSQLSERVER”.  Note the fact that it mentions the default instance, not the named instance!
    The SQLServer2005MSFTEUser login refers to a local Windows group that is used for controlling access to the Full Text Engine.  I suspect that when I upgraded the default instance, the installer removed the group from Windows, but not necessarily
    from the named instance of SQL.  Once I recreated the group, granted my service account access to mirror the other similar groups, and added that login back into SQL via the DAC, everything went fine from there.
    thanks,

  • I upgraded from Dreamweaver CS4 to CS6. but now "an TFP error occured - cannot make connection to host". I spent hours with the host technician and we cant find the error. I reinstalled DW4 and it connects to host perfectly. Anyone else seen this problem?

    I upgraded from Dreamweaver CS4 to CS6. but now when I want to upload I get "an TFP error occured - cannot make connection to host". I spent hours with the host technician and we cant find the error. I reinstalled DW4 and it connects to host perfectly. Anyone else seen this problem?
    Mac OS 10.8.5
    None of these issues are causing the error in DW CS6. We have double checked all of them and we have everything exactly right. Also I have exactly the same SiteSetup in DW CS4 and that works perfectly well. Could there must be factor in 6 that didn't exist in 4? Something that isnt in the SiteSetup but in some hidden dialog box ?
    I can also upload to my host using Fetch, a third party FTP. And as I said DW CS4 works fine. So the problem is not with my host, its with DW CS6 in particular.

    Thank you Jon, that fixed it perfectly. You have saved me from going crazy. The only difference I see now is in "Server Name" it changed what I had entered (my ftp address) to "Remote Server"; which seems odd -- but it works!   Although I know there maybe also some other dialog box I have never seen
    Of course I saw that menu item "Import"  and but I thought thats obviously not for me: "Why would I want to import an entire website?". I did not however see "Export the selected site" for thats only a tiny icon in the footer. However I would have thought the same:  "Why would I want to export my entire website?".
    An observation: I've seen this problem in a lot of Adobe software, the menu-names of items are  obscure, non descriptive. What would be better would be for the menu names or popups to say "Export Site Setup settings" and "Import Site Setup settings"

  • Trying to upgrade from 4.2.10 to 5.1.1. Error message -37 says backup will result in loss of all contents on the phone.

    I need to upgrade from version 4.2.10 to 5.1.1. When I try, I get the following error message: An error occurred while backing up this iPhone (-37). Would you like to continue to update this iPhone? Continuing will result in the loss of all contents on this iPhone.
    How can I upgrade?

    This writeup says you have a security issue. http://support.apple.com/kb/TS3694
    Try following the troubleshooting steps under error 37.
    Good luck.

  • Upgrading from Project Server 2010 to 2013 ConvertTo-SPProjectDatabase gives error (Convertto-SPProjectDatabase : Action 15.0.38.0 of Microsoft.Office.Project.Server.Upgrade.PublishedDatabaseSequence)

    Getting the error on subject line when I try to upgrade from Project 2010 to 2013

    Hi,
    Do you get and error when the command is executed or when you try to start the execution (the command is not valid)?
    If you get the error when you try to start the execution, I would suggest re-typing the command and make sure all parameters are valid.
    Please give us the error details if you get the error when the command is running
    Paul

  • Trying to upgrade from CS5 to CS6 and got Dw and DF error codes?

    Can anyone tell me how to correct the error codes that I get when I tried to upgrade my photoshop from CS5 to 6?

    attach a screenshot of one of the error messages, if it's in english.

  • IPad 1 upgrade from 4.3.1 to 5.1.1 and error message 0e800400C during backup.  The response I get is that it is trying to backup my ipad.

    I'm trying to upgrade my ipad and it tries to backup before the upgrade.  During the backup I get an error message 0e800400C  and a promot that if I continue I may lose data (I'm ok with it.  I have already cleared data and settings).  When I press continue, the upgrade stops and the Ipad restores automatically.  So, I'm unable to get it done.  Any thoughts on what I may be doing wrong?    

    The first generation iPad can't be updated past 5.1.1.
    (114934)

  • Upgrade from Windows 8.1 to 10 fails with an error code, at the very end of processing

    I tried to upgrade to Windows 10.  It went through the whole process, and upon reboot at the very end it failed.  It threw this message:  I searched on these terms and couldn't find an answer.  My machine is brand new.  I haven't installed much on it at all, figuring it's better to wait until I've gotten Windows 10 installed. Any ideas?

    So it looked like I was missing a KB update, the 3035584, which enables the upgrade.  I performed some Windows 8.1 updates and got everything set up. I ran the upgrade to Windows 10.  It went all the way through to the reboot, taking about 20~30 mins.  At this point it asks me to confirm installation, and I select "OK" and it goes for another 20 mins.  It proceeds about 10% of the way there, and then it reboots.  The next thing I see on my screen is "Restoring your previous version of Windows". I'm back to Windows 8.1 again.  I log in... and same error message as shown above. Frankly, I can't understand what is causing this... and why Windows can't "figure out" if my machine is good to go for a full installation in just 10 mins or so.  Why go through all of these gyrations for 45 mins only to reject the whole process?

  • Upgraded from Firefox 4 to 5 now having Javascript application errors. Need to rollback to version 4.

    Whenever I attempt open a page in a new Window these errors appear, but the Window opens in the background without further problems. Windows 7 Home Premium.
    Opening in a tab doesn't normally cause the error unless a popup page is trying to load.
    Having ability to rollback to previous versions would be a nice feature.
    Thanks for an otherwise good product.
    Bob Dingman

    In order to sync my Xoom with my desktop, (and to test out the solution suggested above) the instructions for syncing are to download Firefox, then restart Firefox. Of course that will download Firefox 5, but if I do that, it will defeat the purpose of trying to work with an earlier version. I have been unable to activate the sync with the firefox version now on my desktop (3.16, I think). Any suggestions? Thanks.

  • Error after upgrading from  sap b1 pl 35 to pl 49

    hello sap experts 
    iam getting the following error after upgrading from  sap b1 pl 35 to pl 49 this error is coming if we have given round off or discount in the below cell
    "Discount deviates from authorised ranges (sales oreder-discount%for document) [message 439-15] pls make it as soon as possible an i will be thankful to those guys .
    regards
    Jenny

    Hello Jenny,
    You may check by supreuser account first to see if you got the same error.  If not, it probably just related to user authorization.  If yes, it must be a bug.
    Thanks,
    Gordon

  • Special Characters in Packed Field After Upgradation from ECC 5 to ECC 6

    Hi All,
    After Upgraded from ECC 5 to ECC 6, we are getting error as 'Packed field contains incorrect BCD format'.
    I found the error in below code..
    CALL METHOD cl_abap_container_utilities=>read_container_c
          EXPORTING
            im_container           = j_2iextrct-extrctdata
          IMPORTING
            ex_value               = i_rg23part2-i_part2_typ
          EXCEPTIONS
            illegal_parameter_type = 1
            OTHERS                 = 2.
    i_rg23part2-i_part2_typ-EXAED = 0.<0
    i_rg23part2-i_part2_typ-CESS   = 0.<0
    for some packed fields special characters are appearing, which leads to a short dump.
    Any Suggestions.....
    Thanks,
    Satish Reddy.
    Edited by: Sathish Reddy on Jun 25, 2010 4:49 PM
    Edited by: Sathish Reddy on Jun 26, 2010 11:01 AM
    Edited by: Sathish Reddy on Jun 29, 2010 12:58 PM
    Edited by: Sathish Reddy on Jun 30, 2010 11:51 AM

    HELLO,
    Search the form you will get few links.
    Also many companies have gone technical upgradation , but not functional upgradation.
    Thanks
    RK

  • Upgrading from PIX to ASA 5512X

    Hi everyone,
    We are in the middle of upgrading from two PIX's to some new ASA5512X's. To give you some background on the situation we are upgrading these since the PIXs are fairly old. We had one extra that we had to use since one PIX has failed already. The guy that implemented the PIXs orginally was learning how to do so as he went so there is alot of needless config in the PIX, atleast from what I can tell. Another guy that works with me has done some configuration on the new ASAs and has done the majority of it so far. Today we went to install the new ASAs and switch everything over hoping it would work, but that didn't happen. It seems that there is something wrong with our NAT and ACLs somewhere along the lines. The way our network is laid out is that we have two school campus with a site-to-site VPN one is 172.17.0.0/16 and the other is 172.18.0.0/16. We also have a remote-access VPN on both ASA's. When we connected the new ASAs up and brought up the interfaces, nothing on the inside could ping the internet nor the other side. The VPN showed active on the ASA's and each ASA could ping the others outside interface, but that was it. I have posted the configs below. If anyone could help out I would GREATLY appreciate it! Thank you in advance!
    ASA1:
    : Saved
    : Written by enable_15 at 04:26:18.240 CDT Tue Mar 12 2013
    ASA Version 8.6(1)2
    hostname dallasroadASA
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 70.x.x.x 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 172.18.1.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 172.18.2.21
    name-server 172.18.2.20
    object network WS_VLAN2
    subnet 172.17.2.0 255.255.255.0
    object network WS_VLAN3
    subnet 172.17.3.0 255.255.255.0
    object network WS_VLAN4
    subnet 172.17.4.0 255.255.255.0
    object network WS_VLAN5
    subnet 172.17.5.0 255.255.255.0
    object network WS_VLAN6
    subnet 172.17.6.0 255.255.255.0
    object network WS_VLAN7
    subnet 172.17.7.0 255.255.255.0
    object network WS_VLAN8
    subnet 172.17.8.0 255.255.255.0
    object network WS_VLAN9
    subnet 172.17.9.0 255.255.255.0
    object network WS_VLAN10
    subnet 172.17.10.0 255.255.255.0
    object network WS_VLAN11
    subnet 172.17.11.0 255.255.255.0
    object network WS_VLAN12
    subnet 172.17.12.0 255.255.255.0
    object network WS_VLAN13
    subnet 172.17.13.0 255.255.255.0
    object network WS_VLAN14
    subnet 172.17.14.0 255.255.255.0
    object network WS_VLAN15
    subnet 172.17.15.0 255.255.255.0
    object network WS_VLAN16
    subnet 172.17.16.0 255.255.255.0
    object network DR_VLAN2
    subnet 172.18.2.0 255.255.255.0
    object network DR_VLAN3
    subnet 172.18.3.0 255.255.255.0
    object network DR_VLAN4
    subnet 172.18.4.0 255.255.255.0
    object network DR_VLAN5
    subnet 172.18.5.0 255.255.255.0
    object network DR_VLAN6
    subnet 172.18.6.0 255.255.255.0
    object network DR_VLAN7
    subnet 172.18.7.0 255.255.255.0
    object network DR_VLAN8
    subnet 172.18.8.0 255.255.255.0
    object network DR_VLAN9
    subnet 172.18.9.0 255.255.255.0
    object network DR_VLAN10
    subnet 172.18.10.0 255.255.255.0
    object network DR_CORE_SW
    host 172.18.2.1
    object network dallasdns02_internal
    host 172.18.2.21
    object network faithdallas03_internal
    host 172.18.2.20
    object network dns_external
    host 70.x.x.x
    object network WorthStreet
    subnet 172.17.0.0 255.255.0.0
    object network DallasRoad
    subnet 172.18.0.0 255.255.0.0
    object-group network DALLAS_VLANS
    network-object object DR_VLAN10
    network-object object DR_VLAN2
    network-object object DR_VLAN3
    network-object object DR_VLAN4
    network-object object DR_VLAN5
    network-object object DR_VLAN6
    network-object object DR_VLAN7
    network-object object DR_VLAN8
    network-object object DR_VLAN9
    object-group network WORTH_VLANS
    network-object object WS_VLAN10
    network-object object WS_VLAN11
    network-object object WS_VLAN12
    network-object object WS_VLAN13
    network-object object WS_VLAN14
    network-object object WS_VLAN15
    network-object object WS_VLAN16
    network-object object WS_VLAN2
    network-object object WS_VLAN3
    network-object object WS_VLAN4
    network-object object WS_VLAN5
    network-object object WS_VLAN6
    network-object object WS_VLAN7
    network-object object WS_VLAN8
    network-object object WS_VLAN9
    object-group network dallasitnetwork
    network-object host 172.18.2.20
    network-object host 172.18.2.40
    object-group protocol tcpudp
    protocol-object udp
    protocol-object tcp
    object-group network dallasroaddns
    network-object host 172.18.2.20
    network-object host 172.18.2.21
    object-group service tcpservices tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq ssh
    object-group network remotevpnnetwork
    network-object 172.18.50.0 255.255.255.0
    access-list L2LAccesslist extended permit ip 172.18.0.0 255.255.0.0 172.17.0.0 255.255.0.0
    access-list NONAT extended permit ip any 172.18.50.0 255.255.255.0
    access-list inside_inbound_access extended permit ip 172.18.0.0 255.255.0.0 172.17.0.0 255.255.0.0
    access-list inside_inbound_access extended permit ip object-group dallasitnetwork any
    access-list inside_inbound_access extended permit object-group tcpudp object-group dallasroaddns any eq domain
    access-list inside_inbound_access extended permit ip host 172.18.4.10 any
    access-list inside_inbound_access extended deny object-group tcpudp any any eq domain
    access-list inside_inbound_access extended deny tcp any any eq smtp
    access-list inside_inbound_access extended permit ip any any
    access-list outside_inbound_access extended permit tcp any host 70.x.x.x object-group tcpservices
    pager lines 24
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpnaddresspool 172.18.50.0-172.18.50.255
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static dallasdns02_internal dns_external
    nat (inside,outside) source static faithdallas03_internal dns_external
    nat (inside,outside) source dynamic any interface
    nat (any,outside) source static remotevpnnetwork remotevpnnetwork destination static remotevpnnetwork remotevpnnetwork description NONAT for remote vpn users
    nat (inside,outside) source static DallasRoad DallasRoad destination static WorthStreet WorthStreet
    access-group outside_inbound_access in interface outside
    access-group inside_inbound_access in interface inside
    route outside 0.0.0.0 0.0.0.0 70.x.x.x 1
    route inside 172.18.0.0 255.255.0.0 172.18.1.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    ldap attribute-map CISCOMAP
      map-name  VPNALLOW IETF-Radius-Class
      map-value VPNALLOW FALSE NOACESS
      map-value VPNALLOW TRUE ALLOWACCESS
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 172.17.2.28
    server-port 389
    ldap-base-dn DC=campus,DC=fcschool,DC=org
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password ****
    ldap-login-dn CN=fcsadmin,CN=Users,DC=campus,DC=fcschool,DC=org
    server-type microsoft
    ldap-attribute-map CISCOMAP
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 172.17.11.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac
    crypto map outside_map 10 match address L2LAccesslist
    crypto map outside_map 10 set peer 71.x.x.x
    crypto map outside_map 10 set ikev1 transform-set myset
    crypto map outside_map 10 set reverse-route
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 172.18.0.0 255.255.0.0 inside
    ssh 172.17.0.0 255.255.0.0 inside
    ssh timeout 5
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
    vpn-simultaneous-logins 0
    vpn-tunnel-protocol ikev1
    group-policy DfltGrpPolicy attributes
    dns-server value 172.18.2.20
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
    password-storage enable
    group-policy DallasRoad internal
    group-policy DallasRoad attributes
    dns-server value 172.18.2.20 172.18.2.21
    password-storage enable
    default-domain value campus.fcschool.org
    group-policy ALLOWACCESS internal
    group-policy ALLOWACCESS attributes
    banner value Now connected to the FCS Network
    vpn-tunnel-protocol ikev1
    username iwerkadmin password i6vIlW5ctGaR0l7n encrypted privilege 15
    tunnel-group remoteaccessvpn type remote-access
    tunnel-group remoteaccessvpn general-attributes
    address-pool vpnaddresspool
    authentication-server-group LDAP
    tunnel-group 71.x.x.x type ipsec-l2l
    tunnel-group 71.x.x.x ipsec-attributes
    ikev1 pre-shared-key ****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny 
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip 
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:fd69fbd7a2cb0a6a125308dd85302198
    : end
    ASA2:
    : Saved
    : Written by enable_15 at 09:27:47.579 UTC Tue Mar 12 2013
    ASA Version 8.6(1)2
    hostname worthstreetASA
    enable password **** encrypted
    passwd **** encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 71.x.x.x 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 172.17.1.1 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    boot system disk0:/asa861-2-smp-k8.bin
    ftp mode passive
    dns domain-lookup inside
    dns server-group DefaultDNS
    name-server 172.17.2.23
    name-server 172.17.2.28
    object network mail_external
    host 71.x.x.x
    object network mail_internal
    host 172.17.2.57
    object network faweb_external
    host 71.x.x.x
    object network netclassroom_external
    host 71.x.x.x
    object network blackbaud_external
    host 71.x.x.x
    object network netclassroom_internal
    host 172.17.2.41
    object network nagios
    host 208.x.x.x
    object network DallasRoad_ASA
    host 70.x.x.x
    object network WS_VLAN2
    subnet 172.17.2.0 255.255.255.0
    object network WS_VLAN3
    subnet 172.17.3.0 255.255.255.0
    object network WS_VLAN4
    subnet 172.17.4.0 255.255.255.0
    object network WS_VLAN5
    subnet 172.17.5.0 255.255.255.0
    object network WS_VLAN6
    subnet 172.17.6.0 255.255.255.0
    object network WS_VLAN7
    subnet 172.17.7.0 255.255.255.0
    object network WS_VLAN8
    subnet 172.17.8.0 255.255.255.0
    object network WS_VLAN9
    subnet 172.17.9.0 255.255.255.0
    object network WS_VLAN10
    subnet 172.17.10.0 255.255.255.0
    object network WS_VLAN11
    subnet 172.17.11.0 255.255.255.0
    object network WS_VLAN12
    subnet 172.17.12.0 255.255.255.0
    object network WS_VLAN13
    subnet 172.17.13.0 255.255.255.0
    object network WS_VLAN14
    subnet 172.17.14.0 255.255.255.0
    object network WS_VLAN15
    subnet 172.17.15.0 255.255.255.0
    object network WS_VLAN16
    subnet 172.17.16.0 255.255.255.0
    object network DR_VLAN2
    subnet 172.18.2.0 255.255.255.0
    object network DR_VLAN3
    subnet 172.18.3.0 255.255.255.0
    object network DR_VLAN4
    subnet 172.18.4.0 255.255.255.0
    object network DR_VLAN5
    subnet 172.18.5.0 255.255.255.0
    object network DR_VLAN6
    subnet 172.18.6.0 255.255.255.0
    object network DR_VLAN7
    subnet 172.18.7.0 255.255.255.0
    object network DR_VLAN8
    subnet 172.18.8.0 255.255.255.0
    object network DR_VLAN9
    subnet 172.18.9.0 255.255.255.0
    object network DR_VLAN10
    subnet 172.18.10.0 255.255.255.0
    object network WS_CORE_SW
    host 172.17.2.1
    object network blackbaud_internal
    host 172.17.2.26
    object network spiceworks_internal
    host 172.17.2.15
    object network faweb_internal
    host 172.17.2.31
    object network spiceworks_external
    host 71.x.x.x
    object network WorthStreet
    subnet 172.17.0.0 255.255.0.0
    object network DallasRoad
    subnet 172.18.0.0 255.255.0.0
    object network remotevpnnetwork
    subnet 172.17.50.0 255.255.255.0
    object-group icmp-type echo_svc_group
    icmp-object echo
    icmp-object echo-reply
    object-group service mail.fcshool.org_svc_group
    service-object icmp
    service-object icmp echo
    service-object icmp echo-reply
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq imap4
    service-object tcp destination eq pop3
    service-object tcp destination eq smtp
    object-group service nagios_svc_group tcp
    port-object eq 12489
    object-group service http_s_svc_group tcp
    port-object eq www
    port-object eq https
    object-group network DALLAS_VLANS
    network-object object DR_VLAN10
    network-object object DR_VLAN2
    network-object object DR_VLAN3
    network-object object DR_VLAN4
    network-object object DR_VLAN5
    network-object object DR_VLAN6
    network-object object DR_VLAN7
    network-object object DR_VLAN8
    network-object object DR_VLAN9
    object-group network WORTH_VLANS
    network-object object WS_VLAN10
    network-object object WS_VLAN11
    network-object object WS_VLAN12
    network-object object WS_VLAN13
    network-object object WS_VLAN14
    network-object object WS_VLAN15
    network-object object WS_VLAN16
    network-object object WS_VLAN2
    network-object object WS_VLAN3
    network-object object WS_VLAN4
    network-object object WS_VLAN5
    network-object object WS_VLAN6
    network-object object WS_VLAN7
    network-object object WS_VLAN8
    network-object object WS_VLAN9
    object-group network MailServers
    network-object host 172.17.2.57
    network-object host 172.17.2.58
    network-object host 172.17.2.17
    object-group protocol DM_INLINE_PROTOCOL
    protocol-object ip
    protocol-object udp
    protocol-object tcp
    object-group network DNS_Servers
    network-object host 172.17.2.23
    network-object host 172.17.2.28
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    access-list outside_access_in extended permit object-group mail.fcshool.org_svc_group any object mail_internal
    access-list outside_access_in extended permit tcp object nagios object mail_internal object-group nagios_svc_group
    access-list outside_access_in extended permit tcp any object faweb_external object-group http_s_svc_group
    access-list outside_access_in extended permit tcp any object netclassroom_external object-group http_s_svc_group
    access-list outside_access_in extended permit tcp any object blackbaud_external eq https
    access-list outside_access_in extended permit tcp any object spiceworks_external object-group http_s_svc_group
    access-list L2LAccesslist extended permit ip 172.17.0.0 255.255.0.0 172.18.0.0 255.255.0.0
    access-list inside_inbound extended permit object-group TCPUDP object-group DNS_Servers any eq domain
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL host 172.17.15.10 any inactive
    access-list inside_access_in extended permit tcp object-group MailServers any eq smtp
    access-list inside_access_in extended permit tcp host 172.17.14.10 any eq smtp
    access-list inside_access_in extended deny object-group TCPUDP any any eq domain
    access-list inside_access_in extended deny tcp any any eq smtp
    access-list inside_access_in extended permit ip any any
    access-list vpn_access extended permit ip any any
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpnaddresspool 172.17.50.1-172.17.50.255
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-66114.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static mail_internal mail_external
    nat (inside,outside) source static netclassroom_internal netclassroom_external
    nat (inside,outside) source static faweb_internal faweb_external
    nat (inside,outside) source static spiceworks_internal interface
    nat (inside,outside) source static blackbaud_internal blackbaud_external
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source static WorthStreet WorthStreet destination static DallasRoad DallasRoad
    nat (any,outside) source static remotevpnnetwork remotevpnnetwork destination static remotevpnnetwork remotevpnnetwork description NONAT for remote vpn users
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 71.x.x.x 1
    route inside 172.17.0.0 255.255.0.0 172.17.2.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    ldap attribute-map CISCOMAP
      map-name  VPNALLOW IETF-Radius-Class
      map-value VPNALLOW FALSE NOACESS
      map-value VPNALLOW TRUE ALLOWACCESS
    dynamic-access-policy-record DfltAccessPolicy
    network-acl vpn_access
    aaa-server LDAP protocol ldap
    aaa-server LDAP (inside) host 172.17.2.28
    ldap-base-dn DC=campus,DC=fcschool,DC=org
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password Iw@FCS730w
    ldap-login-dn CN=VPN Admin,CN=Users,DC=campus,DC=fcschool,DC=org
    server-type microsoft
    ldap-attribute-map CISCOMAP
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 172.17.0.0 255.255.0.0 inside
    http 172.18.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac
    crypto map outside_map 10 match address L2LAccesslist
    crypto map outside_map 10 set peer 70.x.x.x
    crypto map outside_map 10 set ikev1 transform-set myset
    crypto map outside_map 10 set reverse-route
    crypto map outside_map interface outside
    crypto ikev1 enable outside
    crypto ikev1 policy 1
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    telnet 172.17.0.0 255.255.0.0 inside
    telnet 172.18.0.0 255.255.0.0 inside
    telnet 192.168.1.0 255.255.255.0 inside
    telnet timeout 5
    ssh 172.17.0.0 255.255.0.0 inside
    ssh 172.18.0.0 255.255.0.0 inside
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    management-access management
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes256-sha1 aes128-sha1 3des-sha1
    webvpn
    group-policy NOACCESS internal
    group-policy NOACCESS attributes
    vpn-simultaneous-logins 0
    vpn-tunnel-protocol ikev1
    group-policy ALLOWACCESS internal
    group-policy ALLOWACCESS attributes
    banner value Now connected to the FCS Network
    vpn-tunnel-protocol ikev1
    username iwerkadmin password i6vIlW5ctGaR0l7n encrypted privilege 15
    tunnel-group 70.x.x.x type ipsec-l2l
    tunnel-group 70.x.x.x ipsec-attributes
    ikev1 pre-shared-key FC$vpnn3tw0rk
    tunnel-group remoteaccessvpn type remote-access
    tunnel-group remoteaccessvpn general-attributes
    address-pool vpnaddresspool
    authentication-server-group LDAP
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:b599ba0f719f39b213e7f01fe55588ac
    : end

    Hi Derrick,
    I just did the same for a customer; replaced 2 PIX515s failover cluster with 5512X. The NAT change is major with ASAs version 8.3 and later...
    here's what you need: a manual NAT rule called twice NAT (policy NAT or NONAT is the old terminology) for the VPNs to work. also add the no-proxy-arp keyword:
    nat (inside,outside) source static INSIDE_NETWORKS INSIDE_NETWORKS VPN_NETWORKS VPN_NETWORKS no-proxy-arp
    nat (inside,outside) source static INSIDE_NETWORKS INSIDE_NETWORKS RA_VPN_NETWORKS RA_VPN_NETWORKS no-proxy-arp
    then the dynamic PAT for internet access (after the twice NATs for VPN); could be a manual NAT like you did, or preferred an object NAT.
    you did:
    nat (inside,outside) source dynamic any interface
    would also work with object nat:
    object network INSIDE_NETWORKS
    subnet ...
    nat (inside,outside) dynamic interface
    Same on the other side (except the networks are reversed since the inside network is now what the other side refers to as vpn network and vice versa)
    If you don't put the no-proxy-arp, your NAT configuration will cause network issues.
    also to be able to pass pings through ASA, add the following:
    policy-map global_policy
    class inspection_default
      inspect icmp
    The asa will do some basic inspection of the ICMP protocol with that config ex. it will make sure there is 1 echo-reply for each echo-request...
    hope that helps,
    Patrick

  • After upgrading from ASA 8.2 to 9.1(2) not able to get web site

    Dears,
    ASA Version has been upgraded from 8.2 to 9.1(2). Since then, website is not accessible from outside.
    Diagnosis:
    Many web sites are deployed behind the ASA. When anyone accesses website from outside, the following error is reported: The page cannot be displayed. No issues have been reported with any other websites.
    In the ASA, two different public subnets are in use in order to allow accessing the website from the public domain. No issues have been reported so far with the first subnet. The website is mapped to a public address in the second subnet. When the website is mapped to an IP address in the working subnet, the website is accessible from outside. As a workaround, this is applied and the website is up and running.
    As the website is working fine with the second subnet, NAT and ACL configuration is fine. We have turned on logging in the ASDM, but no traffic was observed on the ASA for the non-working subnet. On the other hand, the traffic was noticed on the ASDM for the working subnet.
    The working subnet is XX.YY.XX.X
    Non working subnet is XX.YY.YY.X
    The outside interface ip is XX.YY.XX.X (Working Subnet)
    Tried to assign one ip address to the PC from non working subnet and connected to the Switch , its pinging from outside

    Hi
    Have you tried using packet tracer?

Maybe you are looking for