What is maximuam site to site connection cisco router 2821

Hi, i want to setup multiple site to site connection, between my headoffice and remote offices.
on HeadOffice, i've cisco router 2821, with IOS model:
c2800nm-adventerprisek9-mz.124-20.T.bin
There is no extra hardware module on this router, and i want to know the number>
What i've found on internet, is that is support up to 10 Cisco VPN Clients, but i've already tested it with 14 simultanious users, so i'm in doubt.
let me know

Duplicate posts. :P
GO here: https://supportforums.cisco.com/discussion/12135781/what-maximuam-site-site-connection-cisco-router-2821

Similar Messages

  • Site-Site VPN PIX501 and CISCO Router

    Hello Experts,
    I'm having a test lab at home, I configure a site-to-site vpn using Cisco PIX501 and CISCO2691 router, for the configurations i just some links on the internet because my background on VPN configuration is not too well, for the routers configuration i follow this link:
    www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/867-cisco-router-site-to-site-ipsec-vpn.html
    and for the pIX configuration I just use the VPN wizard of pix. Done all the confgurations but ping is unsuccessful. Hope you can help me with this, don't know what needs to be done here (Troubleshooting).
    Attached here is my router's configuration, topology as well as the pix configuration. Hope you can help me w/ this. Thanks in advance.

    YES! IT FINALLY WORKS NOW! Here's the updated running-config
    : Saved
    PIX Version 7.2(2)
    hostname PIX
    domain-name aida.com
    enable password 2KFQnbNIdI.2KYOU encrypted
    names
    name 172.21.1.0 network2 description n2
    interface Ethernet0
    speed 100
    duplex full
    nameif OUTSIDE
    security-level 0
    ip address 1.1.1.1 255.255.255.252
    interface Ethernet1
    nameif INSIDE
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Ethernet2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet4
    shutdown
    no nameif
    no security-level
    no ip address
    passwd 2KFQnbNIdI.2KYOU encrypted
    ftp mode passive
    dns server-group DefaultDNS
    domain-name aida.com
    access-list TO_ENCRYPT_TRAFFIC extended permit ip 192.168.1.0 255.255.255.0 network2 255.255.255.0
    access-list nonat extended permit ip 192.168.1.0 255.255.255.0 network2 255.255.255.0
    pager lines 24
    mtu OUTSIDE 1500
    mtu INSIDE 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image flash:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (OUTSIDE) 1 interface
    nat (INSIDE) 0 access-list nonat
    nat (INSIDE) 1 192.168.1.0 255.255.255.0
    route OUTSIDE 0.0.0.0 0.0.0.0 1.1.1.1 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    username mark password MwHKvxGV7kdXuSQG encrypted
    http server enable
    http 192.168.1.3 255.255.255.255 INSIDE
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set MYSET esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto map MYMAP 10 match address TO_ENCRYPT_TRAFFIC
    crypto map MYMAP 10 set peer 2.2.2.2
    crypto map MYMAP 10 set transform-set MYSET
    crypto map MYMAP interface OUTSIDE
    crypto isakmp enable OUTSIDE
    crypto isakmp policy 1
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    tunnel-group 2.2.2.2 type ipsec-l2l
    tunnel-group 2.2.2.2 ipsec-attributes
    pre-shared-key *
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    prompt hostname context
    Cryptochecksum:8491323562e3f1a86ccd4334cd1d37f6
    : end
    ROUTER:
    R9#sh run
    Building configuration...
    Current configuration : 3313 bytes
    version 12.4
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname R9
    boot-start-marker
    boot-end-marker
    aaa new-model
    aaa authentication login default local
    aaa authorization config-commands
    aaa authorization exec default local
    aaa session-id common
    resource policy
    memory-size iomem 5
    ip cef
    no ip domain lookup
    ip domain name aida.com
    ip ssh version 2
    crypto pki trustpoint TP-self-signed-998521732
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-998521732
    revocation-check none
    rsakeypair TP-self-signed-998521732
    crypto pki certificate chain TP-self-signed-998521732
    A75B9F04 E17B5692 35947CAC 0783AD36 A3894A64 FB6CE1AB 1E3069D3
      A818A71C 00D968FE 3AA7463D BA3B4DE8 035033D5 0CA458F3 635005C3 FB543661
      9EE305FF 63
      quit
    username mark privilege 15 secret 5 $1$BTWy$PNE9BFeWm1SiRa/PiO9Ak/
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key cisco address 1.1.1.1 255.255.255.252
    crypto ipsec transform-set MYSET esp-3des esp-sha-hmac
    crypto map MYMAP 10 ipsec-isakmp
    set peer 1.1.1.1
    set transform-set MYSET
    match address TO_ENCRYPT_TRAFFIC
    interface FastEthernet0/0
    ip address 2.2.2.2 255.255.255.252
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map MYMAP
    interface FastEthernet0/1
    ip address 172.21.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    ip route 0.0.0.0 0.0.0.0 2.2.2.1
    ip http server
    ip http authentication local
    ip http secure-server
    ip nat inside source list NAT_IP interface FastEthernet0/0 overload
    ip access-list extended NAT_IP
    deny   ip 172.21.1.0 0.0.0.255 192.168.1.0 0.0.0.255
    permit ip 172.21.1.0 0.0.0.255 any
    ip access-list extended TO_ENCRYPT_TRAFFIC
    permit ip 172.21.1.0 0.0.0.255 192.168.1.0 0.0.0.255
    control-plane
    line con 0
    exec-timeout 0 0
    logging synchronous
    line aux 0
    line vty 0 4
    transport input ssh
    end

  • Trouble connecting Cisco router with cable modem for Internet purposes

    So I am requesting help from the Cisco community on this issue as the cable company states there equipment is working fine.  At all my facilities I have a guest Internet service setup through a local Internet provide to provide Internet services to the residents and guests.  I have the cable modem usually a Motorola SBG6580 or a SMC 8014 (both provided by cable company) connected to my router on a FE or GE interface.  I am using static IPs and using the cable modem just as a modem (bridge mode).  Over the past several months these connections have just stopped working.  I have not made any drastic changes to my router configs; however, the cable company has updated the firmware on these modems.  I am wondering if that could affected how the modem and router talk.  I was told by the cable company that the modem sees the Cisco router but that the port is inactive.  My router shows the port is active and traffic passing.  Does anyone have any ideas that could point where the problem lies?  I will post a basic config to one that currently does not work.  I am using a VRF to route a certain group out, using NAT.  Please let me know if I need to post additional info.  Any help would be greatly appreciated.
    Cisco CISCO2911/K9
    Version 15.2(3)T1
    service timestamps debug datetime localtime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname 1204RTR01
    boot-start-marker
    boot system flash0:c2900-universalk9-mz.SPA.152-3.T1.bin
    boot system flash0:c2900-universalk9-mz.SPA.151-3.T.bin
    boot-end-marker
    card type t1 0 0
    logging buffered 64000
    aaa new-model
    aaa session-id common
    clock timezone cst -6 0
    clock summer-time CDT recurring
    no ipv6 cef
    no ip source-route
    ip vrf 5
     rd 5:1
    ip multicast-routing
    1
    ip dhcp pool Guest
     vrf 5
     network 10.51.XXX.0 255.255.255.0
     default-router 10.51.XXX.XXX
     dns-server 209.18.47.61 209.18.47.62
    ip flow-cache timeout active 1
    no ip bootp server
    no ip domain lookup
    ip cef
    multilink bundle-name authenticated
    application
     global
      service alternate default
    license udi pid CISCO2911/K9 sn FTX1508AHTM
    hw-module pvdm 0/0
    redundancy
    ip tcp synwait-time 10
    interface GigabitEthernet0/0.5
     description Guest VLAN
     encapsulation dot1Q 5
     ip vrf forwarding 5
     ip address 10.51.xx.xxx 255.255.255.0
     no ip redirects
     no ip proxy-arp
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    interface GigabitEthernet0/1
     no ip address
     duplex auto
     speed auto
    interface GigabitEthernet0/2
     description Guest Intenet access
     ip vrf forwarding 5
     ip address 24.242.182.182 255.255.255.252   <--Cable company IP, Modem IP is 24.242.182.181
     ip nat outside
     ip virtual-reassembly in
     load-interval 30
     duplex auto
     speed auto
    ip forward-protocol nd
    no ip http server
    ip http authentication local
    no ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source list 9 interface GigabitEthernet0/2 vrf 5 overload
    ip route vrf 5 0.0.0.0 0.0.0.0 24.242.182.181
    access-list 9 permit 10.51.204.0 0.0.0.255

    Ok, mysteriously this location just started working yesterday, but I still am dealing with seven others and I really would like to know what is going on.  I will give you everything you may need and let me know.
    Config:
    version 15.2
    no service pad
    service timestamps debug datetime localtime
    service timestamps log datetime localtime show-timezone
    service password-encryption
    hostname 1112RTR01
    boot-start-marker
    boot system flash0:c2900-universalk9-mz.SPA.152-3.T1.bin
    boot system flash0:c2900-universalk9-mz.SPA.151-1.T.bin
    boot-end-marker
    aaa new-model
    aaa session-id common
    clock timezone CDT -6 0
    clock summer-time CDT recurring
    network-clock-participate wic 0
    network-clock-select 1 T1 0/0/0
    no ipv6 cef
    no ip source-route
    ip vrf GuestVRF
     rd 5:1
    ip multicast-routing
    ip dhcp pool Guest
     vrf GuestVRF
     network 10.51.112.0 255.255.255.0
     default-router 10.51.112.1
     dns-server 209.18.47.61 209.18.47.62
    ip flow-cache timeout active 1
    no ip bootp server
    no ip domain lookup
    ip cef
    application
     global
      service alternate default
    interface Embedded-Service-Engine0/0
     no ip address
     shutdown
    interface GigabitEthernet0/0.5
     description Guest VLAN
     encapsulation dot1Q 5
     ip vrf forwarding GuestVRF
     ip address 10.51.112.1 255.255.255.0
     no ip redirects
     no ip proxy-arp
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    interface GigabitEthernet0/1
     description Guest Internet (Time Warner Connection)
     ip vrf forwarding GuestVRF
     ip address 97.77.116.234 255.255.255.252
     ip nat outside
     ip virtual-reassembly in
     load-interval 30
     duplex auto
     speed auto
    ip forward-protocol nd
    ip nat inside source list 5 interface GigabitEthernet0/1 vrf GuestVRF overload
    ip route vrf GuestVRF 0.0.0.0 0.0.0.0 97.77.116.233
    access-list 5 permit 10.51.112.0 0.0.0.255
    control-plane
    end
    router#sh ip arp vrf GuestVRF
    router#Internet  97.77.116.233           2   f80b.bee7.e09f  ARPA   GigabitEthernet0/1
    Protocol  Address          Age (min)  Hardware Addr   Type   Interface
    Internet  97.77.116.234           -   8843.e13c.8d99  ARPA   GigabitEthernet0/1
    router#ping vrf GuestVRF 97.77.116.233
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 97.77.116.233, timeout is 2 seconds:
    Success rate is 0 percent (0/5)
    router#sh int g0/1
    GigabitEthernet0/1 is up, line protocol is up
      Hardware is CN Gigabit Ethernet, address is 8843.e13c.8d99 (bia 8843.e13c.8d99)
      Description: Guest Internet (Time Warner Connection)
      Internet address is 97.77.116.234/30
      MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive set (10 sec)
      Full Duplex, 1Gbps, media type is RJ45
      output flow-control is XON, input flow-control is XON
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output 00:00:00, output hang never
      Last clearing of "show interface" counters 00:00:10
      Input queue: 76/75/15/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      30 second input rate 3000 bits/sec, 7 packets/sec
      30 second output rate 0 bits/sec, 0 packets/sec
         81 packets input, 4860 bytes, 0 no buffer
         Received 81 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 12 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog, 0 multicast, 0 pause input
         16 packets output, 1193 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier, 0 pause output
         0 output buffer failures, 0 output buffers swapped out
    router#sh int g0/1
    GigabitEthernet0/1 is up, line protocol is up
      Hardware is CN Gigabit Ethernet, address is 8843.e13c.8d99 (bia 8843.e13c.8d99)
      Description: Guest Internet (Time Warner Connection)
      Internet address is 97.77.116.234/30
      MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive set (10 sec)
      Full Duplex, 1Gbps, media type is RJ45
      output flow-control is XON, input flow-control is XON
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input 00:00:00, output 00:00:00, output hang never
      Last clearing of "show interface" counters 00:00:42
      Input queue: 76/75/67/0 (size/max/drops/flushes); Total output drops: 0
      Queueing strategy: fifo
      Output queue: 0/40 (size/max)
      30 second input rate 3000 bits/sec, 7 packets/sec
      30 second output rate 1000 bits/sec, 2 packets/sec
         408 packets input, 24480 bytes, 0 no buffer
         Received 408 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 61 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 watchdog, 0 multicast, 0 pause input
         72 packets output, 5669 bytes, 0 underruns
         0 output errors, 0 collisions, 0 interface resets
         0 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier, 0 pause output
         0 output buffer failures, 0 output buffers swapped out
    I am receiving packets in and out of the interface but I cannot ping the modem through the VRF.
    router#sh ip nat translations
    Pro Inside global      Inside local       Outside local      Outside global
    udp 97.77.116.234:3169 10.51.112.39:3169  209.18.47.62:53    209.18.47.62:53
    udp 97.77.116.234:8534 10.51.112.39:8534  209.18.47.61:53    209.18.47.61:53
    udp 97.77.116.234:12244 10.51.112.39:12244 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:14002 10.51.112.39:14002 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:23623 10.51.112.39:23623 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:24489 10.51.112.39:24489 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:24550 10.51.112.39:24550 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:27458 10.51.112.39:27458 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:28603 10.51.112.39:28603 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:37404 10.51.112.39:37404 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:53942 10.51.112.39:53942 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:58125 10.51.112.39:58125 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:64797 10.51.112.39:64797 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:56925 10.51.112.52:56925 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:56925 10.51.112.52:56925 209.18.47.62:53   209.18.47.62:53
    udp 97.77.116.234:62342 10.51.112.52:62342 209.18.47.62:53   209.18.47.62:53
    tcp 97.77.116.234:36559 10.51.112.69:36559 199.167.177.46:1227 199.167.177.46:1227
    tcp 97.77.116.234:48895 10.51.112.69:48895 54.195.253.126:5223 54.195.253.126:5223
    tcp 97.77.116.234:58385 10.51.112.69:58385 54.195.243.137:5223 54.195.243.137:5223
    Pro Inside global      Inside local       Outside local      Outside global
    tcp 97.77.116.234:58658 10.51.112.71:58658 31.13.66.165:443  31.13.66.165:443
    udp 97.77.116.234:3066 10.51.112.72:3066  209.18.47.62:53    209.18.47.62:53
    udp 97.77.116.234:3884 10.51.112.72:3884  209.18.47.61:53    209.18.47.61:53
    udp 97.77.116.234:6656 10.51.112.72:6656  209.18.47.61:53    209.18.47.61:53
    udp 97.77.116.234:11194 10.51.112.72:11194 209.18.47.61:53   209.18.47.61:53
    udp 97.77.116.234:11774 10.51.112.72:11774 209.18.47.62:53   209.18.47.62:53
    Let me know if you need anything else.  I need to figure this out and I just don't get it because the other site wasn't working a few days ago and all of a sudden it is working again but others are still not.

  • What cable do i need to connect my router

    Im getting a new mac mini and will be connecting it by ethernet to my router. Im a bit stupid with these things so can anyone help me.
    1)the mini suppourt 10/100/1000 ethernet. Do i need a special cable to take advantage of the best speeds.
    2) Had a look on the internet and read some stuff about patch and cross over cables which do i need?
    3) Also read about catagory 5 and 6 cables which do i need?
    sorry if these are stupid questions

    Cat 6 cable won't give you any benefit over cat 5 at the lower speed, and unless you are talking about extremely long runs, signal degradation isn't an issue in ethernet cabling. Typically in a domestic environment it's not an issue to consider at all.
    And to be honest, neither is the difference between ethernet speeds unless you're talking about moving data between computers in a network. When connected to the internet and doing such things as web browsing or sending/retrieving email, the bottleneck is the internet connection speed, 'upstream' of the router, rather than the capacity of the computer or router to move data quickly.

  • CCP site-to-site VPN using access rules

    hello, I use CCP for creating site-to-site VPNs on a Cisco router. I need to use network objects on my ipsec rule for having multiple hosts but the network objects are only available on the access rules through access editor.
    On the encryption domain dialogue on site-to-site VPN wizzard the access rules I have created from Access Editor window are not listed. Should I associate the rules with the interface to be listed???
    I manage to create a VPN using an access rule by just inserting the access rule (that is not associated to any interface) number, - it wasn't listed on the access rules when I clicked select from the existing rules - the VPN worked but then another issue came up.
    The issue is that when I created a second VPN the way I described above the public IP of the router is unreachable. No ping/ssh etc. I recover it by shh on private and reload with the old config. While the public interface seems down the VPNs I have already configured are up and running.
    Though the router is going down when a new s-to-s VPN is created by using an access rule if I create a VPN with the way is shown on the image below everything works fine.
    http://www.cisco.com/image/gif/paws/112153/ccp-vpn-asa-router-config-24.gif
    but with that way I cannot have multiple hosts for my VPN.

    hello guys, can anyone help me on this?
    for using network objects on the encryption domains of a site-to-site VPN I have to create access rules from access editor on CCP and associate them with the interface that the vpn will take place. In the encryption domain dialogue of the VPN wizzard i will have to choose them from the existing rules on CCP. Is this right?
    I did it without Network Objects. By creating those access rules I was messing with the allowed traffic.
    So I assigned more than one ipsec rules for each tunnel.

  • Cisco router interface threshold

    Hello,
    I have a question about getting threshold information out of a specific interface. I have a customer with DSL on a cisco 887 router.
    This customer has 2 different pvc's on the ATM0 interface, 2 dialer's (1 for voice, one for data) 2 vlan's (1 for voice, one for data).
    What I would like is that the cisco router wil send me a message that only the voice dialer or voice vlan has exceeded it's threshold limit.
    I can configure this with the "rmon alarm" command, but then it isn't specific for the voice dialer, it gives me info on both the dialers.
    I also tried it with SNMP traps, but this isn't "real-time"
    Does anyone know if there is a different solution to solve this?

    Sorry, small mistake :-)
    Heres my configuration:
    event manager applet int-rate-test
     event interface name Dialer1 parameter receive_rate_bps entry-op gt entry-val 110000 entry-type rate exit-op lt exit-val 50000 exit-type rate average-factor 1 poll-interval 1
    snmp-server community G***** RO
    snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
    snmp-server enable traps vrrp
    snmp-server enable traps call-home message-send-fail server-fail
    snmp-server enable traps tty
    snmp-server enable traps ospf state-change
    snmp-server enable traps ospf errors
    snmp-server enable traps ospf retransmit
    snmp-server enable traps ospf lsa
    snmp-server enable traps ospf cisco-specific state-change nssa-trans-change
    snmp-server enable traps ospf cisco-specific state-change shamlink interface
    snmp-server enable traps ospf cisco-specific state-change shamlink neighbor
    snmp-server enable traps ospf cisco-specific errors
    snmp-server enable traps ospf cisco-specific retransmit
    snmp-server enable traps ospf cisco-specific lsa
    snmp-server enable traps license
    snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config
    snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up
    snmp-server enable traps flash insertion removal
    snmp-server enable traps adslline
    snmp-server enable traps vdsl2line
    snmp-server enable traps envmon
    snmp-server enable traps c3g
    snmp-server enable traps isdn call-information
    snmp-server enable traps isdn layer2
    snmp-server enable traps isdn chan-not-avail
    snmp-server enable traps isdn ietf
    snmp-server enable traps mac-notification
    snmp-server enable traps energywise
    snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-change inconsistency
    snmp-server enable traps aaa_server
    snmp-server enable traps atm subif
    snmp-server enable traps bfd
    snmp-server enable traps memory bufferpeak
    snmp-server enable traps config-copy
    snmp-server enable traps config
    snmp-server enable traps config-ctid
    snmp-server enable traps entity
    snmp-server enable traps fru-ctrl
    snmp-server enable traps resource-policy
    snmp-server enable traps event-manager
    snmp-server enable traps hsrp
    snmp-server enable traps ipmulticast
    snmp-server enable traps msdp
    snmp-server enable traps mvpn
    snmp-server enable traps cpu threshold
    snmp-server enable traps ipsla
    snmp-server enable traps syslog
    snmp-server enable traps l2tun session
    snmp-server enable traps l2tun pseudowire status
    snmp-server enable traps vtp
    snmp-server enable traps pw vc
    snmp-server enable traps firewall serverstatus
    snmp-server enable traps nhrp nhs
    snmp-server enable traps nhrp nhc
    snmp-server enable traps nhrp nhp
    snmp-server enable traps nhrp quota-exceeded
    snmp-server enable traps isakmp policy add
    snmp-server enable traps isakmp policy delete
    snmp-server enable traps isakmp tunnel start
    snmp-server enable traps isakmp tunnel stop
    snmp-server enable traps ipsec cryptomap add
    snmp-server enable traps ipsec cryptomap delete
    snmp-server enable traps ipsec cryptomap attach
    snmp-server enable traps ipsec cryptomap detach
    snmp-server enable traps ipsec tunnel start
    snmp-server enable traps ipsec tunnel stop
    snmp-server enable traps ipsec too-many-sas
    snmp-server enable traps vrfmib vrf-up vrf-down vnet-trunk-up vnet-trunk-down
    snmp-server host *.*.*.30 G****
    interface Dialer1
     description tbv Internet KPN-lijn
     ip address negotiated
     ip nat outside
     no ip virtual-reassembly in
     encapsulation ppp
     dialer pool 1
     dialer-group 1
     ppp authentication chap pap callin
     ppp chap hostname test-vdsl-inet
     ppp chap password 7 051F031C3501580D0A095A1B050910
     ppp pap sent-username test-vdsl-inet password 7 111D1C16035F1D081726662D263621
     no cdp enable
    When I download something from the internet it only shows the interface bandwidth usage stats every 5min. I'm not getting any event messages to my Zenoss server that a threshold has been reached or anything like that.
    I have attached a file with the results.

  • Airport Time capsule behind cisco router download speed

    My airport time capsule  is connected to the internet in bridge mode via a cisco router.
    The cisco router provides a 99Mbps download speed. However, when I " bridge"  my time capsule in between (wired) the speed slows down to 9 Mbps.
    I have already tried to assign a static DHCP IP to my time capsules MAC address and disabled DMZ for that specific IP address, but am failing to get the speed up to par.
    Any suggestions?

    I have used Time capsule 1.5 year behind a copperjet  modem on ADSL, no problems.
    Changed provider and am connected by cable with new cisco modem including router.
    So the set up looks like:
    internet>cisco modem/router>airport time capsule>macbook pro
    The cisco modem without airport time capsule is working ok: when logged in speed is 99 Mbps as it should be (wired and wireless)
    Connecting cisco router with UTP cable to time capsule and time capsule with UTP to macbook slows down speed to 9 Mbps
    (time capsule in bridgemode)
    Specs:
    Macbook pro OSX yosemite
    Airport Time capsule 2TB 2013 (v 7.7.3)
    Cisco modem/router:EPC3928

  • Cisco ASA 5505 IPSec tunnel won't establish until remote site attempts to connect

    I have a site to site IPSec tunnel setup and operational but periodically the remote site goes down, because of a somewhat reliable internet connection. The only way to get the tunnel to re-establish is to go to the remote site and simply issue a ping from a workstation on the remote network. We were having this same issue with a Cisco PIX 506E but decided to upgrade the hardware and see if that resolve the issue. It ran for well over a year and our assumtions was that the issue was resolved. I was looking in the direction of the security-association lifetime but if we power cycle the unit, I would expect that it would kill the SA but even after power cycling, the VPN does not come up automatically.
    Any assistance would be appreciated.
    ASA Version 8.2(1)
    hostname KRPS-FW
    domain-name lottonline.org
    enable password uniQue
    passwd uniQue
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.20.30.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address xxx.xxx.xxx.xxx 255.255.255.248
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    description Inside Network on VLAN1
    interface Ethernet0/2
    shutdown
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    shutdown
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    description Inside Network on VLAN1
    ftp mode passive
    dns server-group DefaultDNS
    domain-name lottonline.org
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list NONAT extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 10.20.20.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.0.0 255.255.255.0
    access-list KWPS-BITP extended permit ip 10.20.30.0 255.255.255.0 192.168.15.0 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list NONAT
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group OUTSIDE_ACCESS_IN in interface outside
    route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 10.20.30.0 255.255.255.0 inside
    http 10.20.20.0 255.255.255.0 inside
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map DYNMAP 65535 set transform-set ESP-AES-256-SHA
    crypto map VPNMAP 1 match address KWPS-BITP
    crypto map VPNMAP 1 set peer xxx.xxx.xxx.001
    crypto map VPNMAP 1 set transform-set ESP-AES-256-SHA
    crypto map VPNMAP 65535 ipsec-isakmp dynamic DYNMAP
    crypto map VPNMAP interface outside
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    ssh timeout 5
    console timeout 0
    management-access inside
    tunnel-group xxx.xxx.xxx.001 type ipsec-l2l
    tunnel-group xxx.xxx.xxx.001 ipsec-attributes
    pre-shared-key somekey

    Hi there,
    I had same issue with PIX 506E and it was not even a circuit issue and I got ride of it and problem got fixed with PIX515E
    I don't know, the device is too old to stay alive.
    thanks

  • No Ping-Answer in Site-To-Site-Connection between Cisco 876 and CheckPoint-Firewall

    Hello!
    We try to establish a Site-To-Site-IPSec-connection between a Cisco 876 (local site) and a CheckPoint-firewall (remote site). The Cisco 876 is not directly connected to the internet, but is behind a DSL-Router with port-forwarding, forwarding ports 500 and 4500. The running config of the Cisco 876 is appended to this discussion thread. Unfortunately I get no output when debugging the connection with commands "debug crypto isakmp" and "debug crypto ipsec".
    From the Checkpoint-firewall point of view the connection seems to establish, but there is no ping answer.
    The server on the local site that should be reached from the network behind the Checkpoint-firewall has a routing entry "route -P add [inside ip-net remote] 255.255.255.0 [inside ip local]" (see also appended running config for naming of ip-addresses).
    Establishing a Cisco VPN-Client connection to the same Cisco 876 router works fine.
    Any help would be very much appreciated!
    Jakob J. Blaette

    Hi Jakob,
    Adding my two cents here.
    You always need to confirm that the following ports and protocol are opened:
    1- UDP port 500 --> ISAKMP
    2- UDP port 4500 --> NAT-T
    3- Protocol 50 ---> ESP
    A LAN-to-LAN tunnel will never establish a session over TCP, but it could use NAT-T (if behind NAT). Remember that a one-to-one translation is not a port-forwarding, a LAN-to-LAN tunnel does not work well unless you have a one-to-one translation for the NATted device, which I think, in your case is the Router.
    HTH.
    Portu.
    Please rate any helpful posts and mark this post as answered.

  • Setting up site to site vpn with cisco asa 5505

    I have a cisco asa 5505 that needs to be set up for site to site vpn to a cisco asa 5500. The 5505 is the remote office and the 5500 is the main office.
    IP of remote office router is 71.37.178.142
    IP of the main office firewall is 209.117.141.82
    Can someone tell me if my config is correct, this is the first time I am setting this up and it can not be tested until I set it up at the remote office. I would rather know its correct before I go.
    ciscoasa# show run
    : Saved
    ASA Version 7.2(4)
    hostname ciscoasa
    domain-name default.domain.invalid
    enable password TMACBloMlcBsq1kp encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 host 209.117.141.82
    access-list inside_nat0_outbound extended permit ip host 71.37.178.142 host 209.117.141.82
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-524.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs group5
    crypto map outside_map 1 set peer 209.117.141.82
    crypto map outside_map 1 set transform-set ESP-AES-256-SHA
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 5
    lifetime 86400
    telnet timeout 5
    ssh timeout 5
    console timeout 0
    vpdn username [email protected] password ********* store-local
    dhcpd auto_config outside
    dhcpd address 192.168.1.2-192.168.1.129 inside
    dhcpd enable inside
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:7e338fb2bf32a9ceb89560b314a5ef6c
    : end
    ciscoasa#
    Thanks!

    Hi Mandy,
    By using following access list define Peer IP as source and destination
    access-list outside_1_cryptomap extended permit ip host 71.37.178.142 host 209.117.141.82
    you are not defining the interesting traffic / subnets from both ends.
    Make some number ACL 101 as you do not have to write the extended keyword then if you like as follows, or else NAME aCL will also work:
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=4 access-list 101 remark IPSEC Rule
    !.1..source subnet(called local encryption domain) at your end  192.168.200.0
    !..2.and destination subnet(called remote encryption domain)at other end 192.168.100.0 !.3..I mean you have to define what subnets you need to communicate between which are behind these firewalls
    !..4...Local Subnets behind IP of the main office firewall is 209.117.141.82 say
    !...at your end  192.168.200.0
    !..5.Remote Subnets behind IP of remote office router is 71.37.178.142 say
    !...at other end 192.168.100.0
    Please use Baisc Steps as follows:
    A. Configuration in your MAIN office  having IP = 209.117.141.82  (follow step 1 to 6)
    Step 1.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.200.0 0.0.0.255 192.168.100.0 0.0.0.255
    Step 2.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 3.
    Define Preshared key or PKI which you will use with other side Peer address 71.37.178.142, either key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 2 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 71.37.178.142
    or , but not both
    crypto isakmp key 6 CISCO123 address71.37.178.142
    step 4.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 5.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 6.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Configure the same but just change ACL on other end in step one  by reversing source and destination
    and also set the peer IP of this router in other end.
    So other side config should look as follows:
    B.  Configuration in oyur Remote PEER IP having IP = 71.37.178.142 (follow step 7 to 12)
    Step 7.
    Define Crypto ACL/ mirror ACL for other end (change source to destination and destination to source in other side router or VPN device and thats why they are called mirror ACL/ or also called Proxy ID or also called Proxy ACL, your interesting traffic , that you want to encrypt / trave/enter in the tunnel)
    access-list outside_1_cryptomap extended ip 192.168.100.0 0.0.0.255 192.168.200.0 0.0.0.255
    Step 8.
    Config ISAKMP Policy with minimum 4 parameters are to be config for
    crypto isakmp policy 10
    authentication pre-share  ---> Ist parameter of setting Authentication type ISAKMP Policy is OK
    encryption aes-256   --->2nd parameter of ISAKMP Policy is OK
    hash sha   --->  3rd parameter of ISAKMP Policy is OK
    group 5  --->  4th parameter of ISAKMP Policy is OK
    lifetime 86400  ------ >  this 5th parameter is optional , and will negotiate for the less value at either end or by default is will be taken 86400
    Step 9.
    Define Preshared key or PKI which you will use with other side Peer address key type 0 is Plain text anyone can see it over internet, or use key type 6 for encrypted key , say your password is CISCO123
    Here in your case in step 8 Authentication is using PSK, looks you have not defines Password
    Use following command:
    crypto isakmp key 0 CISCO123 address 209.117.141.82
    or , but not both
    crypto isakmp key 6 CISCO123 address 209.117.141.82
    step 10.
    Define Transform set , which will be used for phase 2 tunnel parameters, if you use ESP it can have to sets one cor encryption and other for Authentication.
    Here is yours one:
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    this is correct but give name somthing easier to remember /distinguish it is a transform set , like TSET1 instead of ESP-AES-256-SHA ,try following (here you are using ESP so for encryption we use first set as esp-des and for authentication we use second set esp-sha-hmac)
    crypto ipsec transform-set TSET1 esp-des esp-sha-hmac
    or
    crypto ipsec transform-set TSET1 esp-aes-256 esp-sha-hmac
    Suppose you are using only AH then as AH does not support encryption or confidentiality hence it always use onle one set not 2 sets like ESP(remember the difference) say for example only one set for auth etc but no set for encryption hence AH have no such sets like ah-des or ah-3des or ah-aes, it has only second set for authentication like
    ah-sha-hmac or  ah-md5-hmac
    crypto ipsec transform-set TSET1 ah-sha-hmac
    or
    crypto ipsec transform-set TSET1 ah-md5-hmac
    Step 11.
    Now configure Crypto MAP as follows and only one CMPA can be applied to OUTSIDE Interface as VPN tunnel is alsways applied for traffic from inside subnets to outside subnets and only once Cryptomap can be applied to OUTSIDE Interface and hence for several VPN peers from different vendors we use seq no 10, 2 30 for different tunnels in one single CMAP:
    crypto map    ipsec-isakmp
    1. Define peer -- called WHO to set tunnel with
    2. Define or call WHICH - Transform Set, only one is permissible
    3. Define WHAT to call interesting traffic define in your ACL or Proxy ID or Proxy ACL in step 1 using match address
    Like in your case it is but ipsec-isakmp keyword missing in the ;ast
    crypto map outside_map 10 ipsec-isakmp
    1. set peer 209.117.141.82  -----> is correct as this is your other side peer called WHO in my step
    2. set transform-set TSET1  -----> is correct as this is WHICH, and only one transform set can be called
    !..In you case it is correct
    !...set transform-set ESP-AES-256-SHA (also correct)
    3.  match address outside_1_cryptomap  ---->Name of the extended ACL define as WHAT to pass through this tunnel
    4. set pfs group5 (this is optional but if config at one end same has to be config at other side peer as well)
    Step 12.
    Now apply this one crypto MAP to your OUTSIDE interface always
    interface outside
    crypto map outside_map
    Now initite a ping
    Here is for your summary:
    IPSec: Site to Site - Routers
    Configuration Steps
    Phase 1
    Step 1: Configure Mirrored ACL/Crypto ACL       for Interesting Traffic
    Step 2: Configure ISAKMP Policy
    Step 3: Configure ISAKMP Key
    Phase 2
    Step 4: Configure Transform Set
    Step 5: Configure Crypto Map
    Step 6: Apply Crypto Map to an Interface
    To debug for Phase 1 and Phase 2. Store it in buffer without displaying logs on terminal.
    Router#debug crpyto isakmp
    Router#debug crpyto ipsec
    Router(config)# logging buffer 7
    Router(config)# logging buffer 99999
    Router(config)# logging console 6
    Router# clear logging
    Configuration
    In R1:
    (config)# access-list 101 permit ipo host 10.1.1.1 host      10.1.2.1
    (config)# crypto isakmp policy 10
    (config-policy)# encryption 3des
    (config-policy)# authentication pre-share
    (config-policy)# group 2
    (config-policy)# hash sha1
    (config)# crypto isakmp key 0 cisco address 2.2.2.1
    (config)# crypto ipsec transform-set TSET esp-3des      sha-aes-hmac
    (config)# crypto map CMAP 10 ipsec-isakmp
    (config-crypto-map)# set peer 2.2.2.1
    (config-crypto-map)# match address 101
    (config-crypto-map)# set transform-set TSET
    (config)# int f0/0
    (config-if)# crypto map CMAP
    Similarly in R2
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Change to Transport Mode, add the following command in Step 4:
    (config-tranform-set)# mode transport
    Even after  doing this change, the ipsec negotiation will still be done through  tunnel mode if pinged from Loopback to Loopback. To overcome this we  make changes to ACL.
    Change to Aggressive Mode, replace the Step 3 command with these commands in R1:
    (config)# crypto isakmp peer address 2.2.2.1
    (config-peer)# set aggressive-mode password cisco
    (config-peer)# set aggressive-mode clien-endpoint       ipv4-address 2.2.2.1
    Similarly on R2.
    The below process is for the negotiation using RSA-SIG (PKI) as authentication type
    Debug Process:
    After  we debug, we can see the negotiation between the two peers. The first  packet of the interesting traffic triggers the ISAKMP (Phase1)  negotiation. Important messages are marked in BOLD and explanation in  RED
    R2(config)#do ping 10.1.1.1 so lo0 // Interesting Traffic
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
    Packet sent with a source address of 2.2.2.2
    Mar  2 16:18:42.939: ISAKMP:(0): SA request profile is (NULL) //  Router tried to find any IPSec SA matching the outgoing connection but  no valid SA has been found in Security Association Database (SADB)
    Mar  2 16:18:42.939: ISAKMP: Created a peer struct for 20.1.1.10, peer port 500
    Mar  2 16:18:42.939: ISAKMP: New peer created peer = 0x46519678 peer_handle = 0x8000000D
    Mar  2 16:18:42.939: ISAKMP: Locking peer struct 0x46519678, refcount 1 for isakmp_initiator
    Mar  2 16:18:42.939: ISAKMP: local port 500, remote port 500
    Mar  2 16:18:42.939: ISAKMP: set new node 0 to QM_IDLE    
    Mar  2 16:18:42.939: ISAKMP:(0):insert sa successfully sa = 4542B818
    Mar  2 16:18:42.939: ISAKMP:(0):Can not start Aggressive mode, trying Main mode. // Not an error. By default it is configured for Main Mode
    Mar  2 16:18:42.939: ISAKMP:(0):No pre-shared key with 20.1.1.10! // Since we are using RSA Signature, this message. If we use pre-share, this is where it would indicate so!
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-rfc3947 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-07 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-03 ID
    Mar  2 16:18:42.939: ISAKMP:(0): constructed NAT-T vendor-02 ID
    Mar  2 16:18:42.939: ISAKMP:(0):Input = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM
    Mar  2 16:18:42.939: ISAKMP:(0):Old State = IKE_READY  New State = IKE_I_MM1
    Mar  2 16:18:42.943: ISAKMP:(0): beginning Main Mode exchange
    Mar  2 16:18:42.943: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.943: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.943: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_NO_STATE // Sending ISAKMP Policy to peer
    Mar  2 16:18:42.947: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.947: ISAKMP:(0):Old State = IKE_I_MM1  New State = IKE_I_MM2
    Mar  2 16:18:42.947: ISAKMP:(0): processing SA payload. message ID = 0
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch // Do not worry about this! Not an ERROR!
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947:.!!!!
    Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
    R2(config)# ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.947: ISAKMP : Scanning profiles for xauth ...
    Mar  2 16:18:42.947: ISAKMP:(0):Checking ISAKMP transform 1 against priority 10 policy
    Mar  2 16:18:42.947: ISAKMP:      encryption 3DES-CBC
    Mar  2 16:18:42.947: ISAKMP:      hash SHA
    Mar  2 16:18:42.947: ISAKMP:      default group 2
    Mar  2 16:18:42.947: ISAKMP:      auth RSA sig
    Mar  2 16:18:42.947: ISAKMP:      life type in seconds
    Mar  2 16:18:42.947: ISAKMP:      life duration (VPI) of  0x0 0x1 0x51 0x80
    Mar  2 16:18:42.947: ISAKMP:(0):atts are acceptable. Next payload is 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:actual life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Acceptable atts:life: 0
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa vpi_length:4
    Mar  2 16:18:42.947: ISAKMP:(0):Fill atts in sa life_in_seconds:86400
    Mar  2 16:18:42.947: ISAKMP:(0):Returning Actual lifetime: 86400
    Mar  2 16:18:42.947: ISAKMP:(0)::Started lifetime timer: 86400.
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID seems Unity/DPD but major 123 mismatch
    Mar  2 16:18:42.947: ISAKMP:(0): vendor ID is NAT-T v2
    Mar  2 16:18:42.947: ISAKMP:(0): processing vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0): processing IKE frag vendor id payload
    Mar  2 16:18:42.951: ISAKMP:(0):Support for IKE Fragmentation not enabled
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM2
    Mar  2 16:18:42.951: ISAKMP (0): constructing CERT_REQ for issuer cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:42.951: ISAKMP:(0): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_SA_SETUP // Sending Key Exchange Information to peer
    Mar  2 16:18:42.951: ISAKMP:(0):Sending an IKE IPv4 Packet.
    Mar  2 16:18:42.951: ISAKMP:(0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:42.951: ISAKMP:(0):Old State = IKE_I_MM2  New State = IKE_I_MM3
    Mar  2 16:18:42.955: ISAKMP (0): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_SA_SETUP // Receive key exchange information from peer
    Mar  2 16:18:42.955: ISAKMP:(0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:42.955: ISAKMP:(0):Old State = IKE_I_MM3  New State = IKE_I_MM4
    Mar  2 16:18:42.959: ISAKMP:(0): processing KE payload. message ID = 0
    Mar  2 16:18:43.003: ISAKMP:(0): processing NONCE payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): processing CERT_REQ payload. message ID = 0
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.007: ISAKMP:(1008): peer wants cert issued by cn=ca_server OU=cisco C=India S=Karnataka L=Bangalore
    Mar  2 16:18:43.007:  Choosing trustpoint CA_Server as issuer
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is Unity
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID seems Unity/DPD but major 180 mismatch
    Mar  2 16:18:43.007: ISAKMP:(1008): vendor ID is XAUTH
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008): speaking to another IOS box!
    Mar  2 16:18:43.007: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.007: ISAKMP:(1008):vendor ID seems Unity/DPD but hash mismatch
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): His hash no match - this node outside NAT
    Mar  2 16:18:43.007: ISAKMP:received payload type 20
    Mar  2 16:18:43.007: ISAKMP (1008): No NAT Found for self or peer
    Mar  2 16:18:43.007: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.007: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM4
    Mar  2 16:18:43.011: ISAKMP:(1008):Send initial contact
    Mar  2 16:18:43.011: ISAKMP:(1008):My ID configured as IPv4 Addr, but Addr not in Cert!
    Mar  2 16:18:43.011: ISAKMP:(1008):Using FQDN as My ID
    Mar  2 16:18:43.011: ISAKMP:(1008):SA is doing RSA signature authentication using id type ID_FQDN
    Mar  2 16:18:43.011: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : R2
              protocol     : 17
              port         : 500
              length       : 10
    Mar  2 16:18:43.011: ISAKMP:(1008):Total payload length: 10
    Mar  2 16:18:43.019: ISAKMP (1008): constructing CERT payload for hostname=R2+serialNumber=FHK1502F2H8
    Mar  2 16:18:43.019: ISAKMP:(1008): using the CA_Server trustpoint's keypair to sign
    Mar  2 16:18:43.035: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) MM_KEY_EXCH
    Mar  2 16:18:43.035: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.035: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.035: ISAKMP:(1008):Old State = IKE_I_MM4  New State = IKE_I_MM5
    Mar  2 16:18:43.047: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) MM_KEY_EXCH
    // "MM_KEY_EXCH" indicates that the peers have exchanged DH Public keys and generated a shared secret!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing ID payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP (1008): ID payload
              next-payload : 6
              type         : 2
              FQDN name    : ASA1
              protocol     : 0
              port         : 0
              length       : 12
    Mar  2 16:18:43.047: ISAKMP:(0):: peer matches *none* of the profiles // Normal Message! Not an error!
    Mar  2 16:18:43.047: ISAKMP:(1008): processing CERT payload. message ID = 0
    Mar  2 16:18:43.047: ISAKMP:(1008): processing a CT_X509_SIGNATURE cert
    Mar  2 16:18:43.051: ISAKMP:(1008): peer's pubkey isn't cached
    Mar  2 16:18:43.059: ISAKMP:(1008): Unable to get DN from certificate!
    Mar  2 16:18:43.059: ISAKMP:(1008): Cert presented by peer contains no OU field.
    Mar  2 16:18:43.059: ISAKMP:(0):: peer matches *none* of the profiles
    Mar  2 16:18:43.063: ISAKMP:(1008): processing SIG payload. message ID = 0
    Mar  2 16:18:43.067: ISAKMP:received payload type 17
    Mar  2 16:18:43.067: ISAKMP:(1008): processing vendor id payload
    Mar  2 16:18:43.067: ISAKMP:(1008): vendor ID is DPD
    Mar  2 16:18:43.067: ISAKMP:(1008):SA authentication status:
              authenticated
    Mar  2 16:18:43.067: ISAKMP:(1008):SA has been authenticated with 20.1.1.10
    Mar  2 16:18:43.067: ISAKMP: Trying to insert a peer 40.1.1.1/20.1.1.10/500/,  and inserted successfully 46519678. // SA inserted into SADB
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM5  New State = IKE_I_MM6
    Mar  2 16:18:43.067: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
    Mar  2 16:18:43.067: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_I_MM6
    Mar  2 16:18:43.071: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):Old State = IKE_I_MM6  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.071: ISAKMP:(1008):beginning Quick Mode exchange, M-ID of -1523793378
    Mar  2 16:18:43.071: ISAKMP:(1008):QM Initiator gets spi
    Mar  2 16:18:43.075: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.075: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.075: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_INTERNAL, IKE_INIT_QM
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_QM_READY  New State = IKE_QM_I_QM1
    Mar  2 16:18:43.075: ISAKMP:(1008):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
    Mar  2 16:18:43.075: ISAKMP:(1008):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE
    Mar  2 16:18:43.079: ISAKMP (1008): received packet from 20.1.1.10 dport 500 sport 500 Global (I) QM_IDLE // IPSec Policies
    Mar  2 16:18:43.079: ISAKMP:(1008): processing HASH payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing SA payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008):Checking IPSec proposal 1
    Mar  2 16:18:43.079: ISAKMP: transform 1, ESP_3DES
    Mar  2 16:18:43.079: ISAKMP:   attributes in transform:
    Mar  2 16:18:43.079: ISAKMP:      SA life type in seconds
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (basic) of 3600
    Mar  2 16:18:43.079: ISAKMP:      SA life type in kilobytes
    Mar  2 16:18:43.079: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
    Mar  2 16:18:43.079: ISAKMP:      encaps is 1 (Tunnel)
    Mar  2 16:18:43.079: ISAKMP:      authenticator is HMAC-SHA
    Mar  2 16:18:43.079: ISAKMP:(1008):atts are acceptable. // IPSec attributes are acceptable!
    Mar  2 16:18:43.079: ISAKMP:(1008): processing NONCE payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.079: ISAKMP:(1008): processing ID payload. message ID = -1523793378
    Mar  2 16:18:43.083: ISAKMP:(1008): Creating IPSec SAs
    Mar  2 16:18:43.083:         inbound SA from 20.1.1.10 to 40.1.1.1 (f/i)  0/ 0
              (proxy 1.1.1.1 to 2.2.2.2)
    Mar  2 16:18:43.083:         has spi 0xA9A66D46 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083:         outbound SA from 40.1.1.1 to 20.1.1.10 (f/i) 0/0
              (proxy 2.2.2.2 to 1.1.1.1)
    Mar  2 16:18:43.083:         has spi  0x2B367FB4 and conn_id 0
    Mar  2 16:18:43.083:         lifetime of 3600 seconds
    Mar  2 16:18:43.083:         lifetime of 4608000 kilobytes
    Mar  2 16:18:43.083: ISAKMP:(1008): sending packet to 20.1.1.10 my_port 500 peer_port 500 (I) QM_IDLE    
    Mar  2 16:18:43.083: ISAKMP:(1008):Sending an IKE IPv4 Packet.
    Mar  2 16:18:43.083: ISAKMP:(1008):deleting node -1523793378 error FALSE reason "No Error"
    Mar  2 16:18:43.083: ISAKMP:(1008):Node -1523793378, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
    Mar  2 16:18:43.083: ISAKMP:(1008):Old State = IKE_QM_I_QM1  New State = IKE_QM_PHASE2_COMPLETE // At this point tunnels are up and ready to pass traffic!
    Verification Commands
    #show crypto isakmp SA
    #show crypto ipsec SA
    Kindly rate if you find the explanation useful !!
    Best Regards
    Sachin Garg

  • VPN Site-to-Site or VPN Client Server with Cisco IP Phone 8941 and 8945

    Hi everyone,
    I decide to deploy a CUCM (BE6K platform), SX20, and IP Phone 8941/8945 on Head Office and Cisco SX10 and IP Phone 8941/8945 for branch offices (actually 9 branch offices).
    The connection will use internet connection for HO and each branch offices.
    And the IT guy want to use kind a VPN client server or VPN site-to-site for the connection through internet,
    what kind of VPN client server or VPN site-to-site that recommended for this deployment?
    and what type of Cisco router that support that kind of VPN (the cheapest one will be great)?
    So the SX10 and IP Phone 8941/8945 in branch offices can work properly through internet connection?
    please advise
    Regards,
    Ovindo

    Hi Leo,
    technically, the ipsec users will not use up any premium license seats, so if you have 10 ipsec users connecting first, the premium seats are still free and so you can then still have 10 phones/anyconnect users connect.
    However, the 250 you mention is the global platform limit, so it refers to the sum of premium and non-premium connections. Or in other words, you can have 240 ipsec users and 10 phones,  but not 250 ipsec users and 10 phones.
    If 250 ipsec users and 10 phones would try to connect, it would be first-in, first-served, e.g. you could have 248 ipsec users and 2 phones connected.
    Note: since you have Essentials disabled I'm assuming you are referring to the legacy "Cisco vpnclient" (IKEv1 client) which does not require any license on the ASA. But for the benefit of others reading this thread: if  you do have Anyconnect clients (using SSL or IPsec/IKEv2) for which you currently have an Essentials license, then note that the Essentials and Premium license cannot co-exist. So for e.g. 240 Anyconnect users and no phones, you can use Essentials. For 240 Anyconnect users and 10 phones, you need a 250-seat Premium license (and a vpn phone license).
    hth
    Herbert

  • ASA 5505. VPN Site-to-Site does not connect!

    Hello!
    Already more than a week ago, as we had a new channel of communication from MGTSa (ONT terminal Sercomm RV6688BCM, who just barely made in the "bridge" - was forced to make the provider in order to receive our white Cisco Ip-address), and now I'm trying too much more than a week to raise between our offices firm VPN IKEv1 IPsec Site-to-Site tunnel.
    Configurable and use the wizard in ASDM and handles in CLI, the result of one, the connection does not rise.
    Version Cisco 9.2 (2), the image of Cisco asa922-k8.bin, version license Security Plus, version ASDM 7.2 (2).
    What I'll never know ...
    Full configuration and debug enclose below.
    Help, what can follow any responses, please! I was quite exhausted!
    Config:
    Result of the command: "sh run"
    : Saved
    : Serial Number: XXXXXXXXXXXX
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.2(2)
    hostname gate-71
    enable password F6OJ0GOws7WHxeql encrypted
    names
    ip local pool vpnpool 10.1.72.100-10.1.72.120 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 10.1.72.254 255.255.255.0
    interface Vlan2
     nameif outside_mgts
     security-level 0
     ip address 62.112.100.R1 255.255.255.252
    ftp mode passive
    clock timezone MSK/MSD 3
    clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00
    dns domain-lookup inside
    dns server-group MGTS
     name-server 195.34.31.50
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network NET72
     subnet 10.1.72.0 255.255.255.0
    object network obj-0.0.0.0
     host 0.0.0.0
    object network Nafanya
     host 10.1.72.5
    object network obj-10.1.72.0
     subnet 10.1.72.0 255.255.255.0
    object network NET61
     subnet 10.1.61.0 255.255.255.0
    object network NETWORK_OBJ_10.1.72.96_27
     subnet 10.1.72.96 255.255.255.224
    object network NETT72
     subnet 10.1.72.0 255.255.255.0
    object network NET30
     subnet 10.1.30.0 255.255.255.0
    object network NETWORK_OBJ_10.1.72.0_24
     subnet 10.1.72.0 255.255.255.0
    object-group service OG-FROM-INET
     service-object icmp echo
     service-object icmp echo-reply
     service-object icmp traceroute
     service-object icmp unreachable
     service-object tcp-udp destination eq echo
    object-group network DM_INLINE_NETWORK_1
     network-object object NET30
     network-object object NET72
    object-group service DM_INLINE_TCP_1 tcp
     port-object eq www
     port-object eq https
    access-list inside_access_in extended permit ip object NET72 object-group DM_INLINE_NETWORK_1
    access-list inside_access_in extended permit ip 10.1.72.0 255.255.255.0 any
    access-list inside_access_in extended permit ip object Nafanya any inactive
    access-list inside_access_in extended permit object-group OG-FROM-INET any any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in extended deny ip any any log alerts
    access-list outside_mgts_access_in extended permit object-group OG-FROM-INET any any
    access-list outside_mgts_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
    access-list outside_mgts_access_in extended deny ip any any log alerts
    access-list outside_mgts_cryptomap extended permit ip 10.1.72.0 255.255.255.0 object NET61
    access-list VPN-ST_splitTunnelAcl standard permit 10.1.72.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside_mgts 1500
    ip verify reverse-path interface outside_mgts
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside_mgts) source static NET72 NET72 destination static NETWORK_OBJ_10.1.72.96_27 NETWORK_OBJ_10.1.72.96_27 no-proxy-arp route-lookup
    nat (inside,outside_mgts) source static NETWORK_OBJ_10.1.72.0_24 NETWORK_OBJ_10.1.72.0_24 destination static NET61 NET61 no-proxy-arp route-lookup
    object network obj_any
     nat (inside,outside_mgts) dynamic obj-0.0.0.0
    object network NET72
     nat (inside,outside_mgts) dynamic interface dns
    access-group inside_access_in in interface inside
    access-group outside_mgts_access_in in interface outside_mgts
    route outside_mgts 0.0.0.0 0.0.0.0 62.112.100.R 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    no user-identity enable
    user-identity default-domain LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 10.1.72.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_mgts_map 1 match address outside_mgts_cryptomap
    crypto map outside_mgts_map 1 set pfs group1
    crypto map outside_mgts_map 1 set peer 91.188.180.42
    crypto map outside_mgts_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_mgts_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_mgts_map interface outside_mgts
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
     enrollment self
     email [email protected]
     subject-name CN=gate-71
     serial-number
     ip-address 62.112.100.42
     proxy-ldc-issuer
     crl configure
    crypto ca trustpoint ASDM_TrustPoint1
     enrollment self
     keypair ASDM_TrustPoint1
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
     certificate eff26954
        30820395 3082027d a0030201 020204ef f2695430 0d06092a 864886f7 0d010105
        019
        6460ae26 ec5f301d 0603551d 0e041604 14c9a3f2 d70e6789 38fa4b01 465d1964
        60ae26ec 5f300d06 092a8648 86f70d01 01050500 03820101 00448753 7baa5c77
        62857b65 d05dc91e 3edfabc6 7b3771af bbedee14 673ec67d 3d0c2de4 b7a7ac05
        5f203a8c 98ab52cf 076401e5 1a2c6cb9 3f7afcba 52c617a5 644ece10 d6e1fd7d
        28b57d8c aaf49023 2037527e 9fcfa218 9883191f 60b221bf a561f2be d6882091
        0222b7a3 3880d6ac 49328d1f 2e085b15 6d1c1141 5f850e5c b6cb3e67 0e373591
        94a82781 44493217 38097952 003d5552 5c445f1f 92f04039 a23fba20 b9d51b13
        f511f311 d1feb2bb 6d056a15 7e63cc1b 1f134677 8124c024 3af56b97 51af8253
        486844bc b1954abe 8acd7108 5e4212df 193b8167 db835d76 98ffdb2b 8c8ab915
        0db3dd54 c8346b96 c4f4eff7 1e7cd576 a8b1f86e 3b868a6e 89
      quit
    crypto ca certificate chain ASDM_TrustPoint1
     certificate a39a2b54
        30820377 3082025f a0030201 020204a3 9a2b5430 0d06092a 864886f7 0d010105
        0500304b 3110300e 06035504 03130767 6174652d 36313137 30120603 55040513
        c084dcd9 d250e194 abcb3eb8 1da93bd0 fb0dba1a b1c35b43 d547a841 5d4ee1a4
        14bdb207 7dd790a4 0cd70471 5f3a896a 07bd56dc ea01b3dd 254cde88 e1490e97
        f3e54c05 551adde0 66aa3782 c85880c2 b162ec29 4e49346a df71062d 6d6d8f49
        62b9de93 ba07b4f7 a50e77e1 8f54b32b 6627cb27 e982b36f 362973a0 88de3272
        9bd6d4d2 8ca1e11f 214f20a9 78bdea95 78fdc45c d6d45674 6acb9bcb d0bd930e
        638eedfe cd559ab1 e1205c48 3ee9616f e631db55 e82b623c 434ffdc1 11020301
        0001a363 3061300f 0603551d 130101ff 04053003 0101ff30 0e060355 1d0f0101
        ff040403 02018630 1f060355 1d230418 30168014 0cea70bf 0d0e0c4b eb34a0b1
        8242a549 5183ccf9 301d0603 551d0e04 1604140c ea70bf0d 0e0c4beb 34a0b182
        42a54951 83ccf930 0d06092a 864886f7 0d010105 05000382 0101004e 7bfe054a
        d434a27c 1d3dce15 529bdc5f 70a2dff1 98975de9 96077966 2a97333b 05a8e9ef
        bf320cbd ecec3819 ade20a86 9aeb5bde bd129c7b 29341e4b edf91473 f2bf235d
        9aaeae21 a629ccc6 3c79200b b9a89b08 4745a411 bf38afb6 ea56b957 4430f692
        34d71fad 588e4e18 2b2d97af b2aae6b9 b6a22350 d031615b 49ea9b9f 2fdd82e6
        ebd4dccd df93c17e deceb796 f268abf1 bd5f7b69 89183841 881409b5 f484f0e7
        ebf7481c faf69d3e 9d24df6e 9c2b0791 785019f7 a0d20e95 2ef35799 66ffc819
        4a77cdf2 c6fb4380 fe94c13c d4261655 7bf3d6ba 6289dc8b f9aad4e1 bd918fb7
        32916fe1 477666ab c2a3d591 a84dd435 51711f6e 93e2bd84 89884c
      quit
    crypto isakmp identity address
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable outside_mgts client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside_mgts
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    no ssh stricthostkeycheck
    ssh 10.1.72.0 255.255.255.0 inside
    ssh timeout 60
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    vpnclient server 91.188.180.X
    vpnclient mode network-extension-mode
    vpnclient nem-st-autoconnect
    vpnclient vpngroup VPN-L2L password *****
    vpnclient username aradetskayaL password *****
    dhcpd auto_config outside_mgts
    dhcpd update dns both override interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 inside
    ssl trust-point ASDM_TrustPoint0 outside_mgts
    webvpn
     enable outside_mgts
    group-policy GroupPolicy_91.188.180.X internal
    group-policy GroupPolicy_91.188.180.X attributes
     vpn-tunnel-protocol ikev1
    group-policy VPN-ST internal
    group-policy VPN-ST attributes
     dns-server value 195.34.31.50 8.8.8.8
     vpn-tunnel-protocol ikev1
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value VPN-ST_splitTunnelAcl
     default-domain none
    username aradetskayaL password HR3qeva85hzXT6KK encrypted privilege 15
    tunnel-group 91.188.180.X type ipsec-l2l
    tunnel-group 91.188.180.X general-attributes
     default-group-policy GroupPolicy_91.188.180.42
    tunnel-group 91.188.180.X ipsec-attributes
     ikev1 pre-shared-key *****
     ikev2 remote-authentication pre-shared-key *****
     ikev2 remote-authentication certificate
     ikev2 local-authentication pre-shared-key *****
    tunnel-group VPN-ST type remote-access
    tunnel-group VPN-ST general-attributes
     address-pool vpnpool
     default-group-policy VPN-ST
    tunnel-group VPN-ST ipsec-attributes
     ikev1 pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:212e4f5035793d1c219fed57751983d8
    : end
    gate-71# sh crypto ikev1 sa
    There are no IKEv1 SAs
    gate-71# sh crypto ikev2 sa
    There are no IKEv2 SAs
    gate-71# sh crypto ipsec sa
    There are no ipsec sas
    gate-71# sh crypto isakmp
    There are no IKEv1 SAs
    There are no IKEv2 SAs
    Global IKEv1 Statistics
      Active Tunnels:              0
      Previous Tunnels:            0
      In Octets:                   0
      In Packets:                  0
      In Drop Packets:             0
      In Notifys:                  0
      In P2 Exchanges:             0
      In P2 Exchange Invalids:     0
      In P2 Exchange Rejects:      0
      In P2 Sa Delete Requests:    0
      Out Octets:                  0
      Out Packets:                 0
      Out Drop Packets:            0
      Out Notifys:                 0
      Out P2 Exchanges:            0
      Out P2 Exchange Invalids:    0
      Out P2 Exchange Rejects:     0
      Out P2 Sa Delete Requests:   0
      Initiator Tunnels:           0
      Initiator Fails:             0
      Responder Fails:             0
      System Capacity Fails:       0
      Auth Fails:                  0
      Decrypt Fails:               0
      Hash Valid Fails:            0
      No Sa Fails:                 0
    IKEV1 Call Admission Statistics
      Max In-Negotiation SAs:                 25
      In-Negotiation SAs:                      0
      In-Negotiation SAs Highwater:            0
      In-Negotiation SAs Rejected:             0
    Global IKEv2 Statistics
      Active Tunnels:                          0
      Previous Tunnels:                        0
      In Octets:                               0
      In Packets:                              0
      In Drop Packets:                         0
      In Drop Fragments:                       0
      In Notifys:                              0
      In P2 Exchange:                          0
      In P2 Exchange Invalids:                 0
      In P2 Exchange Rejects:                  0
      In IPSEC Delete:                         0
      In IKE Delete:                           0
      Out Octets:                              0
      Out Packets:                             0
      Out Drop Packets:                        0
      Out Drop Fragments:                      0
      Out Notifys:                             0
      Out P2 Exchange:                         0
      Out P2 Exchange Invalids:                0
      Out P2 Exchange Rejects:                 0
      Out IPSEC Delete:                        0
      Out IKE Delete:                          0
      SAs Locally Initiated:                   0
      SAs Locally Initiated Failed:            0
      SAs Remotely Initiated:                  0
      SAs Remotely Initiated Failed:           0
      System Capacity Failures:                0
      Authentication Failures:                 0
      Decrypt Failures:                        0
      Hash Failures:                           0
      Invalid SPI:                             0
      In Configs:                              0
      Out Configs:                             0
      In Configs Rejects:                      0
      Out Configs Rejects:                     0
      Previous Tunnels:                        0
      Previous Tunnels Wraps:                  0
      In DPD Messages:                         0
      Out DPD Messages:                        0
      Out NAT Keepalives:                      0
      IKE Rekey Locally Initiated:             0
      IKE Rekey Remotely Initiated:            0
      CHILD Rekey Locally Initiated:           0
      CHILD Rekey Remotely Initiated:          0
    IKEV2 Call Admission Statistics
      Max Active SAs:                   No Limit
      Max In-Negotiation SAs:                 50
      Cookie Challenge Threshold:          Never
      Active SAs:                              0
      In-Negotiation SAs:                      0
      Incoming Requests:                       0
      Incoming Requests Accepted:              0
      Incoming Requests Rejected:              0
      Outgoing Requests:                       0
      Outgoing Requests Accepted:              0
      Outgoing Requests Rejected:              0
      Rejected Requests:                       0
      Rejected Over Max SA limit:              0
      Rejected Low Resources:                  0
      Rejected Reboot In Progress:             0
      Cookie Challenges:                       0
      Cookie Challenges Passed:                0
      Cookie Challenges Failed:                0
    Global IKEv1 IPSec over TCP Statistics
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Inbound packets: 0
    Inbound dropped packets: 0
    Outbound packets: 0
    Outbound dropped packets: 0
    RST packets: 0
    Recevied ACK heart-beat packets: 0
    Bad headers: 0
    Bad trailers: 0
    Timer failures: 0
    Checksum errors: 0
    Internal errors: 0
    gate-71# sh crypto protocol statistics all
    [IKEv1 statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [IKEv2 statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [IPsec statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [SSL statistics]
       Encrypt packet requests: 19331
       Encapsulate packet requests: 19331
       Decrypt packet requests: 437
       Decapsulate packet requests: 437
       HMAC calculation requests: 19768
       SA creation requests: 178
       SA rekey requests: 0
       SA deletion requests: 176
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [SSH statistics are not supported]
    [SRTP statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [Other statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 6238
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 76
       Failed requests: 9
    gate-71# sh crypto ca trustpoints
    Trustpoint ASDM_TrustPoint0:
        Configured for self-signed certificate generation.
    Trustpoint ASDM_TrustPoint1:
        Configured for self-signed certificate generation.
    If you need something more, then lay out!
    Please explain why it is I do not want to work?

    When I launched a packet tracer from the CLI connection has gone! Hooray!
    I just do not understand why it had not launched with the same settings?
    As I understood MGTS finally required ports began to miss!

  • Cisco ASA 5510 site to site VPN only

    Hi,
    Need some expert help. I will be deploying the CISCO ASA 5510 in VPN site to site scenario only. One interface will be for the WAN and the other LAN interface is connected to another firewall appliance. The main purpose of the ASA is for branch site VPN connection only. My default gateway is pointing to the Internet router on my WAN inteface. Should NAT be enabled on my WAN inteface? The only expected traffic to go thru my ASA is VPN traffic to the other site. I have already defined static routes and have gone thru the wizard for site to site VPN and added my local and remote networks. Also how do I approach my access policies, the default deny any any is in place. Should I allow anything on it? The firewall connected to my LAN interface is expected to do the filtering, like I said the ASA's purpose is just to do VPN site to site. Thanks all

    Thanks Jon. That is what I want to clarify as well, running the VPN site to site wizard, will automatically create the 'cryptomap' access rules, will the existing deny all rule apply to the VPN traffic? I think there was an option that VPN traffic will bypass access rules.
    So having NAT enabled for anything that goes out on My WAN inteface would not matter at all, even if the VPN traffic will go out of that interface right? Hope I don't sound confusing.
    As per your second question, I know it sounds weird and is not good network design, but customer just renewed maintenance contract for the other firewall box that is why he does not want to get rid of it yet. Although ISA can perform the function as well. Thanks.

  • Cisco ASA Site to Site VPN with routers on inside

    I have been asked to setup a site to site vpn to connect two remote offices.
    We have two ASA 5510's, one on each side.
    I can get the two ASA's setup and setup the VPN and have everything work like it is suppose to. Traffic passing from local network to remote network.
    However, I have been asked to add two secure routers to the setup. One secure router between the local network and the ASA, and the other the same on the other end, between the remote network and it's ASA
    Essentially, just like this:
    LAN---------------------Router-------------------------ASA----------------ISP-----------ASA-------------------------Router---------------------------LAN
    192.168.1.x   (inside 192.168.1.1)        (inside 10.0.1.1)               (inside 10.0.2.1)            (inside 192.168.2.1)          192.168.2.x
                              (outside 10.0.1.2)           (outside public ip)             (outside public ip)          (outside 10.0.2.2)
    I don't understand how this is suppose to work. I can get each side configured so that the clients on the inside can get out to the internet.
    A local client using the inside interface of the router as the gateway, the router then sends by route this traffic to the ASA's inside interface which then forwards the traffic to the default route/gateway of the ASA to the ISP gateway out to the internet.
    However, when I am thinking about the VPN I don't understand how it is suppose to work. Because the LAN address get's translated to the outside address of the Router which is 10.0.0.2, so that it goes to the ASA inside address 10.0.0.1. If I were to ping an ip address of the other LAN, it shows up as coming from 10.0.0.2 which wouldn't be part of the VPN traffic, since the VPN traffic is the local addresses as it was setup with just the two ASA's. I don't see changing the VPN traffic to the 10.0.0.0 network working because the clients on the remote network have 192.168.2.x addresses. While the ASA and router can translate from 192.168.1.x to 10.0.1.2 to the internet and back will work, I don't see requesting a connection to 192.168.2.x from 192.168.1.x working).
    If it matters, one router is a cisco 1841, and the other an hp 7102dl.
    I don't really understand why, but they just want to have the routers used in the setup. Whether it is on the inside or outside of the ASA, it doesn't matter.
    Can someone help me make sense of this please?

    Hi Julio,
    To set it up the way you mention would I keep the ip addresses the same or would I need to change them?
    Also, in response to everyone, would setting it up using gre tunnel allow for some clients to still just go straight out to the internet as well as to the "other side" remote lan?
    I appreciate everyones input very much.
    In response to Jouni, yes there is a big L2 switch behind the ASA's, which under the new setup there would be a router between the L2 switch and the ASA.
    This may be an important part I don't understand, but on the router, unless I nat the inside traffic to have the address of the outside interface on the router, then no traffic goes through. I just get messages from the router saying unable to determine destination route seemingly regardless of what static routes I put on the router, but maybe I am just not configuring the static routes correctly.

  • Configuring Cisco ASA for site to site VPN ( Issue with setting up local network)

    OK, so our primary firewall is a checkpoint gateway. Behind that we have a cisco ASA for vpn users. I have a project at the moment where we need to connect to another company using site to site VPN through the cisco ASA, as the checkpoint gateway is unable to establish a permanent tunnel with the other companies Cisco ASA.
    What would be the best practise for setting up the local network on my side? Create the network on the ASA and then use a L2 vlan to connect to the Core switch? 
    Setup a L3 interface on the core switch and point it towards the checkpoint gateway which would then point to the ASA?
    When you have to select your local network through the site to site wizard do you have to put the inside network address of the ASA?
    Our network is setup like this: Access layer switch > Core 6500 Switch > Checkpoint-Firewall > Internet
    The ASA is connected to a checkpoint sub interface
    Any help would be beneficial as im new to cisco ASAs 
    Thanks
    Mark

    Mark
    If we understood more about your environment we might be able to give you better answers. My initial reaction was similar to the suggestion from Michael to use a L2 vlan. But as I think a bit more my attention is drawn to something that you mention in the original post. The ASA is there for VPN users. If the VPN users need to access your internal network then you probably already have something configured on the ASA that allows access to the internal network. Perhaps that same thing might provide access for your site to site VPN?
    HTH
    Rick

Maybe you are looking for