Wlss Echo service

Has anyone ever used the echo service of Weblogic Sip Server??? I followed all instructions but it doesn't start on the Engine machine! They don't send heartbeat.

For those interested, the documentation is not correct. The parameter to activate EcoServer is -Dreplica.host.monitor.enabled=true

Similar Messages

  • Coherence 3.6 and ECHO Service port (Port 7)

    We are currently upgrading to Coherence 3.6 from 3.5. We have 2 WKA nodes running behind a firewall (on a virtual appliance cluster). WKA ports are already opened up in firewall.
    In addition to this, we had to open up Port 7 (Used for ECHO Service) for a client node running on different machine to join the cluster.
    Coherence 3.5 did not have this requirement.
    Client nodes on the same virtual appliance cluster were able to join the coherence cluster even when Port 7 was blocked.
    Could you tell us how Port 7 is used by Coherence ? Is it mandatory to open up this port for proper cluster formation? If yes, do we need to open it up for both TCP and UDP traffic?
    Following is the error message that we get at the client node, when Port 7 is not open...
    2010-08-16 16:49:10.989/33.062 Oracle Coherence GE 3.6.0.0 <Warning> (thread=Cluster, member=n/a): Delaying formation of a new cluster; failed to verify the reachability senior Member(Id=1, Timestamp=2010-08-13 21:25:31.911, Address=172.23.73.148:9010, MachineId=62100, Location=site:lss.emc.com,machine:lglor148,process:6488,member:srm_coherence_cache_server-0, Role=cache-server) IP

    I have one more followup question on this. If a node is kicked out from the cluster due to ping timeout, can we expect this node to transparently join back the cluster later?
    Is an external intervention required to bring this node back into the cluster?
    We have an event-service which is part of coherence cluster. This service is listening for Cache events from Coherence. Once it receives cache events, it does some operation on Coherence.
    Now what is happening is, this service is getting kicked out of the cluster due to ping-timeout. Since it is not part of cluster it does not receive any cache events. But, after this, it never joins back the cluster. Can we expect this service to join back into the cluster at a later point of time. The point that i want to highlight is, once this node is kicked out of cluster, it is not invoking any of the Coherence API methods. Will this node try to join back in this case?
    We are still on 3.6.0 and will be upgrading to 3.6.0.1 soon. We know that the chances of ping time out will reduce after this upgrade.

  • How to use Axis to access a web service through Authentication  proxy

    Using axis access internat web service is success,but access a web service through Authentication proxy is failure.But other java classes connect through a proxy to the internet which works very well:
    please help me ,thank you!!!
    import org.apache.axis.client.Call;
    import org.apache.axis.client.Service;
    import javax.xml.namespace.QName;
    //this is my access webservice faliure   codes
    public class TestClient
       public static void main(String [] args) {
           try {
                System.getProperties().setProperty("http.proxySet", "true");
                System.getProperties().setProperty("http.proxyHost","proxy.com");
                System.getProperties().setProperty("http.proxyPort", "8080");
                System.getProperties().setProperty("http.proxyUser", "username");
                System.getProperties().setProperty("http.proxyPassword","password");
               String endpoint =
                        "http://nagoya.apache.org:5049/axis/services/echo";
               Service  service = new Service();
               Call     call    = (Call) service.createCall();
               call.setTargetEndpointAddress( new java.net.URL(endpoint) );
               call.setOperationName(new QName("http://soapinterop.org/", "echoString") );
               String ret = (String) call.invoke( new Object[] { "Hello!" } );
               System.out.println("Sent 'Hello!', got '" + ret + "'");
           } catch (Exception e) {
               System.err.println(e.toString());
       }I get an "(407)Proxy authorization required" error?

    I am also looking for a solution. Does any one know how to do through code instead of jvm settings?
    Thanks in advance!

  • Can I run a .bat, .cmd, or .ps1 on SBS 2011 server startup, without login.... like a service.

    Hi all,
    I'm running Windows SBS 2011.  I need to run a script at server startup, prior to login to any user account (like a service does...).  This short script will check the status of another service.  Because this
    service depends on Exchange & SQL, it sometimes fails to start at reboot if Exchange and or SQL Server haven't finished initializing.
    I was also thinking of using sc.exe to change the config of the service in question (adding dependencies), but this is a third-party software from Reuters, and I am somewhat reluctant to edit the configuration of someone else's code (and possibly break something). 
    This is a production server at a law firm.
    here's the script:
    start of listing
    =============================================
    @echo off
    rem Look for ProLaw Groupware Agent in running Services.
    rem check to see if ProLaw Groupware Agent is running. If it IS
    rem running, jump to exit-program label, else run the Agent after
    rem waiting for Microsoft Exchange & Microsoft SQL Server to start.
    rem =======================================
    :start
    C:\Windows\system32\sc query "ProLawGroupwareAgent" | find "RUNNING" >> c:\temp\plgwagentstatus.txt
    if errorlevel 0 goto :end
    rem wait 10 min after server startup,
    rem to (Allow Exchange & SQL to start)
    rem THEN, start ProLawGroupwareAgent
    rem ========================
    echo "Service not started.... Let's wait 10 minutes, and retry." >> c:\temp\plgwagentstatus.txt
    c:\
    timeout /t 600 > nul
    cd "\Program Files (x86)\ThomsonElite\ProLaw GroupwareAgent"
    net start AgentHostService.exe
    timeout /t 20 > nul
    goto :start
    :end
    =============================================
    end of listing

    What I do in this case (I don't have access to exact script I use) is a similar script scheduled via windows task scheduler every five minutes to check if service running, if not start it but you can have the IF-THEN-ELSE do whatever is required.
    http://gallery.technet.microsoft.com/scriptcenter/01fcf945-ad73-44e0-8cb5-152432bc6bcf
    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]
    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

  • Echo static routing rule

    Hi all,
    Can some one please explain to me when i can use the echo static rule in a mediator component.
    oracle student guide present the echo service like this : "the echo service, to use an internat echo mechanism that enables the request message to be echoed as a response message, which can be transformed before returned to the caller"
    any help are welcome.
    thanks

    According to the documentation Echo is available for the follwing patterns
    The echo option is supported only with the Mediator interfaces having the following types of WSDL files:
    Request/Reply
    Request/Reply/Fault
    Request/Callback
    Note:
    The echo option is not available for Mediator interfaces having Request/Reply/Fault/Callback WSDL Files.
    The echo option is available for synchronous operations like Request/Reply and Request/Reply/Fault.
    Note:
    The echo option is available for the synchronous operations only when the routing rule is sequential because parallel routing rules are not supported for Mediators with synchronous operations.
    For synchronous operations, having a conditional filter set, the echo option does not return any response to the caller, when the filter condition is set to false. Instead, a null response is returned to the caller.
    The echo option is available for asynchronous operations only if the Mediator interface has a callback operation. In this case, the echo is run on a separate thread.
    Note:
    The asynchronous echo option is available only when the routing rule is parallel. To use the echo option, then sequential routing rules are not supported for Mediators with asynchronous operations.
    You can use the follionw link for further information
    http://download.oracle.com/docs/cd/E15523_01/integration.1111/e10224/med_createrr.htm

  • Disabling Services that don't appear to exist

    Chances are they aren't installed. I'm thinking specifically of ftpd. Even the ftp client may not install by default.I'm confused by "netstat"--not aware anything with that name ran as a service. I think there was something called an "echo" service, but I'm pretty sure it is deprecated.
    You could try the command:service statusegText# service ftpd statusftpd: unrecognized service
    Text# service status bootpdstatus: unrecognized serviceNote that if you do have an ftp daemon running, it is probably vsftpd, or proftpdText# service vsftpd statusvsftpd (pid 30961) is running...
    Post the checklist (or link) that you're working from.

    I'm following a checklist for a RHEL 6 server build that includes the disabling of quite a few services to include bootpd, echo, finger, ftp, rlogin, netstat, etc. However, when I run a chkconfig --list, none of these services are shown.
    Are these services disabled in some way other than through the use of chkconfig or am I following outdate instructions?
    This topic first appeared in the Spiceworks Community

  • Confused with this ASA - VPN config issue

    Hello. Can anyone help me here? I am new to the ASA config and commands. Everything works well, enough, on this ASA except the VPN. A client can connect but cannot access anything inside or outside. Here is the config. Can someone please take a look and tell me why VPN is not working? I don't want to set up split-tunneling, I would prefer everything to go through the firewall. Also, if you see something else wrong (or have a better implementation) then please let me know.
    ASA Version 8.4(2)
    hostname FIREWALL_NAME
    enable password Some_X's_here encrypted
    passwd Some_X's_here encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/0.22
    description Public Internet space via VLAN 22
    vlan 22
    nameif Public_Internet
    security-level 0
    ip address 1.3.3.7 255.255.255.248
    interface Ethernet0/1
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.42
    description Private LAN space via VLAN 42
    shutdown
    vlan 42
    nameif Private_CDATA
    security-level 100
    ip address 10.30.136.1 255.255.255.0
    interface Ethernet0/1.69
    description Private LAN space via VLAN 69
    vlan 69
    nameif Private_ODATA
    security-level 100
    ip address 10.30.133.1 255.255.255.0
    interface Ethernet0/1.95
    description Private LAN space via VLAN 95
    shutdown
    vlan 95
    nameif Private_OVOICE
    security-level 100
    ip address 192.168.102.254 255.255.255.0
    interface Ethernet0/1.96
    description Private LAN space via VLAN 96
    shutdown
    vlan 96
    nameif Private_CVOICE
    security-level 100
    ip address 192.168.91.254 255.255.255.0
    interface Ethernet0/1.3610
    description Private LAN subnet via VLAN 3610
    shutdown
    vlan 3610
    nameif Private_CeDATA
    security-level 100
    ip address 10.10.100.18 255.255.255.240
    interface Ethernet0/1.3611
    description Private LAN space via VLAN 3611
    shutdown
    vlan 3611
    nameif Private_CeVOICE
    security-level 100
    ip address 10.10.100.66 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    security-level 0
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.69.1 255.255.255.0
    management-only
    banner exec WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    banner exec
    banner exec                                    ,
    banner exec                                  .';
    banner exec                              .-'` .'
    banner exec                            ,`.-'-.`\
    banner exec                           ; /     '-'
    banner exec                           | \       ,-,
    banner exec                           \  '-.__   )_`'._                      \|/
    banner exec                            '.     ```      ``'--._[]--------------*
    banner exec                           .-' ,                   `'-.           /|\
    banner exec                            '-'`-._           ((   o   )
    banner exec                                   `'--....(`- ,__..--'
    banner exec                                            '-'`
    banner exec
    banner exec frickin' sharks with frickin' laser beams attached to their frickin' heads
    banner login WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    banner asdm WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest
    extent of the law.
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network CD_3610-GW
    host 10.10.100.17
    description First hop to 3610
    object network CV_3611-GW
    host 10.10.100.65
    description First hop to 3611
    object network GW_22-EXT
    host 1.3.3.6
    description First hop to 22
    object service MS-RDC
    service tcp source range 1024 65535 destination eq 3389
    description Microsoft Remote Desktop Connection
    object network HDC-LAN
    subnet 192.168.200.0 255.255.255.0
    description DC LAN subnet
    object network HAM-LAN
    subnet 192.168.110.0 255.255.255.0
    description HAM LAN subnet
    object service MSN
    service tcp source range 1 65535 destination eq 1863
    description MSN Messenger
    object network BCCs
    host 2.1.8.1
    description BCCs server access
    object network ODLW-EXT
    host 7.1.1.5
    description OTTDl
    object network SWINDS-INT
    host 10.30.133.67
    description SWINDS server
    object network SWINDS(192.x.x.x)-INT
    host 192.168.100.67
    description SWINDS server
    object service YMSG
    service tcp source range 1 65535 destination eq 5050
    description Yahoo Messenger
    object service c.b.ca1
    service tcp source range 1 65535 destination eq citrix-ica
    description Connections to the bc portal.
    object service c.b.ca2
    service tcp source range 1 65535 destination eq 2598
    description Connections to the bc portal.
    object service HTTP-EXT(7001)
    service tcp source range 1 65535 destination eq 7001
    description HTTP Extended on port 7001.
    object service HTTP-EXT(8000-8001)
    service tcp source range 1 65535 destination range 8000 8001
    description HTTP Extended on ports 8000-8001.
    object service HTTP-EXT(8080-8081)
    service tcp source range 1 65535 destination range 8080 8081
    description HTTP Extended on ports 8080-8081.
    object service HTTP-EXT(8100)
    service tcp source range 1 65535 destination eq 8100
    description HTTP Extended on port 8100.
    object service HTTP-EXT(8200)
    service tcp source range 1 65535 destination eq 8200
    description HTTP Extended on port 8200.
    object service HTTP-EXT(8888)
    service tcp source range 1 65535 destination eq 8888
    description HTTP Extended on port 8888.
    object service HTTP-EXT(9080)
    service tcp source range 1 65535 destination eq 9080
    description HTTP Extended on port 9080.
    object service ntp
    service tcp source range 1 65535 destination eq 123
    description TCP NTP on port 123.
    object network Pl-EXT
    host 7.1.1.2
    description OPl box.
    object service Pl-Admin
    service tcp source range 1 65535 destination eq 8443
    description Pl Admin portal
    object network FW-EXT
    host 1.3.3.7
    description External/Public interface IP address of firewall.
    object network Rs-EXT
    host 7.1.1.8
    description Rs web portal External/Public IP.
    object network DWDM-EXT
    host 2.1.2.1
    description DWDM.
    object network HM_VPN-EXT
    host 6.2.9.7
    description HAM Man.
    object network SIM_MGMT
    host 2.1.1.1
    description SIM Man.
    object network TS_MGMT
    host 2.1.1.4
    description TS Man.
    object network TS_MGMT
    host 2.1.2.2
    description TS Man.
    object service VPN-TCP(1723)
    service tcp source range 1 65535 destination eq pptp
    description For PPTP control path.
    object service VPN-UDP(4500)
    service udp source range 1 65535 destination eq 4500
    description For L2TP(IKEv1) and IKEv2.
    object service VPN-TCP(443)
    service tcp source range 1 65535 destination eq https
    description For SSTP control and data path.
    object service VPN-UDP(500)
    service udp source range 1 65535 destination eq isakmp
    description For L2TP(IKEv1) and IKEv2.
    object network RCM
    host 6.1.8.2
    description RCM
    object network RCM_Y
    host 6.1.8.9
    description RCM Y
    object network r.r.r.c163
    host 2.1.2.63
    description RCV IP.
    object network r.r.r.c227
    host 2.1.2.27
    description RCV IP.
    object network v.t.c-EXT
    host 2.5.1.2
    description RTICR
    object service VPN-TCP(10000)
    service tcp source range 1 65535 destination eq 10000
    description For TCP VPN over port 1000.
    object service BGP-JY
    service tcp source range 1 65535 destination eq 21174
    description BPG
    object network KooL
    host 192.168.100.100
    description KooL
    object network FW_Test
    host 1.3.3.7
    description Testing other External IP
    object network AO_10-30-133-0-LAN
    range 10.30.133.0 10.30.133.229
    description OLS 10.30.133.0/24
    object network AC_10-30-136-0-LAN
    subnet 10.30.136.0 255.255.255.0
    description CLS 10.30.136.0/24
    object network NETWORK_OBJ_192.168.238.0_27
    subnet 192.168.238.0 255.255.255.224
    object-group network All_Private_Interfaces
    description All private interfaces
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    network-object 10.10.100.16 255.255.255.240
    network-object 10.10.100.64 255.255.255.252
    network-object 192.168.102.0 255.255.255.0
    network-object 192.168.91.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service cb.ca
    description All ports required for cb.ca connections.
    service-object object c.b.ca1
    service-object object c.b.ca2
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq https
    service-object udp destination eq snmp
    object-group service FTP
    description All FTP ports (20 + 21)
    service-object tcp destination eq ftp
    service-object tcp destination eq ftp-data
    object-group service HTTP-EXT
    description HTTP Extended port ranges.
    service-object object HTTP-EXT(7001)
    service-object object HTTP-EXT(8000-8001)
    service-object object HTTP-EXT(8080-8081)
    service-object object HTTP-EXT(8100)
    service-object object HTTP-EXT(8200)
    service-object object HTTP-EXT(8888)
    service-object object HTTP-EXT(9080)
    object-group service ICMP_Any
    description ICMP: Any Type, Any Code
    service-object icmp alternate-address
    service-object icmp conversion-error
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp information-reply
    service-object icmp information-request
    service-object icmp mask-reply
    service-object icmp mask-request
    service-object icmp mobile-redirect
    service-object icmp parameter-problem
    service-object icmp redirect
    service-object icmp router-advertisement
    service-object icmp router-solicitation
    service-object icmp source-quench
    service-object icmp time-exceeded
    service-object icmp timestamp-reply
    service-object icmp timestamp-request
    service-object icmp traceroute
    service-object icmp unreachable
    service-object icmp6 echo
    service-object icmp6 echo-reply
    service-object icmp6 membership-query
    service-object icmp6 membership-reduction
    service-object icmp6 membership-report
    service-object icmp6 neighbor-advertisement
    service-object icmp6 neighbor-redirect
    service-object icmp6 neighbor-solicitation
    service-object icmp6 packet-too-big
    service-object icmp6 parameter-problem
    service-object icmp6 router-advertisement
    service-object icmp6 router-renumbering
    service-object icmp6 router-solicitation
    service-object icmp6 time-exceeded
    service-object icmp6 unreachable
    service-object icmp
    object-group service NTP
    description TCP and UPD NTP protocol
    service-object object ntp
    service-object udp destination eq ntp
    object-group service DM_INLINE_SERVICE_3
    group-object FTP
    group-object HTTP-EXT
    group-object ICMP_Any
    group-object NTP
    service-object tcp-udp destination eq domain
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq ssh
    service-object ip
    object-group service DM_INLINE_SERVICE_4
    group-object NTP
    service-object tcp destination eq daytime
    object-group network SWINDS
    description Both Internal IP addresses (192 + 10)
    network-object object SWINDS-INT
    network-object object SWINDS(192.x.x.x)-INT
    object-group service IM_Types
    description All messenger type applications
    service-object object MSN
    service-object object YMSG
    service-object tcp-udp destination eq talk
    service-object tcp destination eq aol
    service-object tcp destination eq irc
    object-group service SNMP
    description Both poll and trap ports.
    service-object udp destination eq snmp
    service-object udp destination eq snmptrap
    object-group service DM_INLINE_SERVICE_2
    group-object FTP
    service-object object MS-RDC
    service-object object Pl-Admin
    group-object SNMP
    object-group network DM_INLINE_NETWORK_1
    network-object object FW-EXT
    network-object object Rs-EXT
    object-group network AMV
    description connections for legacy AM
    network-object object DWDM-EXT
    network-object object HAM_MGMT
    network-object object SIM_MGMT
    network-object object TS_MGMT
    network-object object TS_MGMT
    object-group service IKEv2_L2TP
    description IKEv2 and L2TP VPN configurations
    service-object esp
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    object-group service PPTP
    description PPTP VPN configuration
    service-object gre
    service-object object VPN-TCP(1723)
    object-group service SSTP
    description SSTP VPN configuration
    service-object object VPN-TCP(443)
    object-group network RvIPs
    description Rv IP addresses
    network-object object RCM
    network-object object RCM_Y
    network-object object r.r.r.c163
    network-object object r.r.r.c227
    network-object object v.t.c-EXT
    object-group service Rvs
    description Rv configuration.
    service-object object VPN-TCP(10000)
    service-object object VPN-UDP(500)
    object-group service DM_INLINE_SERVICE_5
    service-object object BGP-JY
    service-object tcp destination eq bgp
    object-group network Local_Private_Subnets
    description OandCl DATA
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    access-list Public/Internet_access_out remark Block all IM traffic out.
    access-list Public/Internet_access_out extended deny object-group IM_Types object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Access from SWINDS to DLM portal
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_1 object-group SWINDS object ODLW-EXT
    access-list Public/Internet_access_out remark Allow access to BMC portal
    access-list Public/Internet_access_out extended permit object-group cb.ca object-group Local_Private_Subnets object BCCs
    access-list Public/Internet_access_out remark Allow basic services out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_3 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow WhoIS traffic out.
    access-list Public/Internet_access_out extended permit tcp object-group Local_Private_Subnets any eq whois
    access-list Public/Internet_access_out remark Allow Network Time protocols out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_4 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow all IP based monitoring traffic to Pl.
    access-list Public/Internet_access_out extended permit ip object-group SWINDS object Pl-EXT
    access-list Public/Internet_access_out remark Allow Management traffic to Pl-JY.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_2 object-group Local_Private_Subnets object Pl-EXT
    access-list Public/Internet_access_out remark Allow FTP traffic to Grimlock and RS FTP.
    access-list Public/Internet_access_out extended permit object-group FTP object-group Local_Private_Subnets object-group DM_INLINE_NETWORK_1
    access-list Public/Internet_access_out remark Allow VPN traffic to AM-JY.
    access-list Public/Internet_access_out extended permit object-group IKEv2_L2TP object-group Local_Private_Subnets object-group AMV
    access-list Public/Internet_access_out remark Allow VPN traffic to RCm devices.
    access-list Public/Internet_access_out extended permit object-group Rvs object-group Local_Private_Subnets object-group RvIPs
    access-list Public/Internet_access_out remark Allow BPG traffic out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_5 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow Kool server out.
    access-list Public/Internet_access_out extended permit ip object KooL any
    pager lines 24
    logging enable
    logging history informational
    logging asdm informational
    logging mail notifications
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu Public_Internet 1500
    mtu Private_CDATA 1500
    mtu Private_ODATA 1500
    mtu Private_OVOICE 1500
    mtu Private_CVOICE 1500
    mtu Private_CeDATA 1500
    mtu Private_CeVOICE 1500
    mtu management 1500
    ip local pool AO-VPN_Pool 192.168.238.2-192.168.238.30 mask 255.255.255.224
    ip verify reverse-path interface Public_Internet
    ip verify reverse-path interface Private_CDATA
    ip verify reverse-path interface Private_ODATA
    ip verify reverse-path interface Private_OVOICE
    ip verify reverse-path interface Private_CVOICE
    ip verify reverse-path interface Private_CeDATA
    ip verify reverse-path interface Private_CeVOICE
    ip verify reverse-path interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any Public_Internet
    no asdm history enable
    arp timeout 14400
    nat (Private_ODATA,Public_Internet) source dynamic AO_10-30-133-0-LAN interface
    nat (Private_CDATA,Public_Internet) source dynamic AC_10-30-136-0-LAN interface
    nat (Private_ODATA,Public_Internet) source static any any destination static NETWORK_OBJ_192.168.238.0_27 NETWORK_OBJ_192.168.238.0_27 no-proxy-arp route-lookup
    access-group Public/Internet_access_out out interface Public_Internet
    route Public_Internet 0.0.0.0 0.0.0.0 1.3.3.6 1
    route Private_CeDATA 10.0.0.0 255.0.0.0 10.10.100.17 1
    route Private_CeDATA 10.1.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.3.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.5.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.11.106.74 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 10.30.128.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.130.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.131.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.132.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.134.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.135.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.67.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.224.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 4.1.1.19 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 1.1.1.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 1.1.1.13 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.24 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.27 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.17.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.64 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.66 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.110 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.251.57 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.56.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.57.152 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 192.168.3.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.9.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.20.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.21.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.30.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.40.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.41.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.50.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.60.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.61.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.70.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.101.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.110.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.200.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.251.177.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 2.1.2.7 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 2.1.2.74 255.255.255.255 10.10.100.17 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (Private_ODATA) host 10.30.133.21
    timeout 5
    nt-auth-domain-controller Cool_Transformer_Name
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.69.0 255.255.255.0 management
    snmp-server host Private_ODATA 10.30.133.67 poll community Some_*s_here version 2c
    snmp-server location OT
    snmp-server contact [email protected]
    snmp-server community Some_*s_here
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change fru-insert fru-remove
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps remote-access session-threshold-exceeded
    snmp-server enable traps connection-limit-reached
    snmp-server enable traps cpu threshold rising
    snmp-server enable traps ikev2 start stop
    snmp-server enable traps nat packet-discard
    sysopt noproxyarp Public_Internet
    sysopt noproxyarp Private_CDATA
    sysopt noproxyarp Private_ODATA
    sysopt noproxyarp Private_OVOICE
    sysopt noproxyarp Private_CVOICE
    sysopt noproxyarp Private_CeDATA
    sysopt noproxyarp Private_CeVOICE
    sysopt noproxyarp management
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Public_Internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Public_Internet_map interface Public_Internet
    crypto ikev1 enable Public_Internet
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh 10.30.133.0 255.255.255.0 Private_ODATA
    ssh 192.168.69.0 255.255.255.0 management
    ssh timeout 2
    ssh version 2
    console timeout 5
    dhcprelay server 10.30.133.13 Private_ODATA
    dhcprelay enable Private_CDATA
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.30.133.13 prefer
    ntp server 132.246.11.227
    ntp server 10.30.133.21
    webvpn
    group-policy AO-VPN_Tunnel internal
    group-policy AO-VPN_Tunnel attributes
    dns-server value 10.30.133.21 10.30.133.13
    vpn-tunnel-protocol ikev1
    default-domain value ao.local
    username helpme password Some_X's_here encrypted privilege 1
    username helpme attributes
    service-type nas-prompt
    tunnel-group AO-VPN_Tunnel type remote-access
    tunnel-group AO-VPN_Tunnel general-attributes
    address-pool AO-VPN_Pool
    authentication-server-group AD
    default-group-policy AO-VPN_Tunnel
    tunnel-group AO-VPN_Tunnel ipsec-attributes
    ikev1 pre-shared-key Some_*s_here
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    class class-default
      user-statistics accounting
    service-policy global_policy global
    smtp-server 192.168.200.25
    prompt hostname context
    no call-home reporting anonymous
    Thanks,
    Jeff.                  

    I tried those commands but this started getting messy and so I looked at the current config and it was not the same as what I originally posted.  Looks like some changes were implemented but not saved so the config that I posted what slightly different.  Thank you for all your suggestions.  Here is the new config, confirmed as the current running and saved config.  Same situation as before though.  I can connect using the Cisco VPN client but can only ping myself and can't get out to the Internet or access anything internal.  If someone can take a look it would be greatly appreciated.  The main difference is the VPN pool has been set as a subset of the 10.30.133.0 network instead of using a separate subnet (VPN pool is 10.30.133.200 - 10.30.133.230).
    ASA Version 8.4(2)
    hostname FIREWALL_NAME
    enable password Some_X's_here encrypted
    passwd Some_X's_here encrypted
    names
    interface Ethernet0/0
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/0.22
    description Public Internet space via VLAN 22
    vlan 22
    nameif Public_Internet
    security-level 0
    ip address 1.3.3.7 255.255.255.248
    interface Ethernet0/1
    speed 100
    duplex full
    no nameif
    no security-level
    no ip address
    interface Ethernet0/1.42
    description Private LAN space via VLAN 42
    shutdown
    vlan 42
    nameif Private_CDATA
    security-level 100
    ip address 10.30.136.1 255.255.255.0
    interface Ethernet0/1.69
    description Private LAN space via VLAN 69
    vlan 69
    nameif Private_ODATA
    security-level 100
    ip address 10.30.133.1 255.255.255.0
    interface Ethernet0/1.95
    description Private LAN space via VLAN 95
    shutdown
    vlan 95
    nameif Private_OVOICE
    security-level 100
    ip address 192.168.102.254 255.255.255.0
    interface Ethernet0/1.96
    description Private LAN space via VLAN 96
    shutdown
    vlan 96
    nameif Private_CVOICE
    security-level 100
    ip address 192.168.91.254 255.255.255.0
    interface Ethernet0/1.3610
    description Private LAN subnet via VLAN 3610
    shutdown
    vlan 3610
    nameif Private_CeDATA
    security-level 100
    ip address 10.10.100.18 255.255.255.240
    interface Ethernet0/1.3611
    description Private LAN space via VLAN 3611
    shutdown
    vlan 3611
    nameif Private_CeVOICE
    security-level 100
    ip address 10.10.100.66 255.255.255.252
    interface Ethernet0/2
    shutdown
    no nameif
    security-level 0
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.69.1 255.255.255.0
    management-only
    banner exec WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    banner exec
    banner exec                                    ,
    banner exec                                  .';
    banner exec                              .-'` .'
    banner exec                            ,`.-'-.`\
    banner exec                           ; /     '-'
    banner exec                           | \       ,-,
    banner exec                           \  '-.__   )_`'._                      \|/
    banner exec                            '.     ```      ``'--._[]--------------*
    banner exec                           .-' ,                   `'-.           /|\
    banner exec                            '-'`-._           ((   o   )
    banner exec                                   `'--....(`- ,__..--'
    banner exec                                            '-'`
    banner exec
    banner exec frickin' sharks with frickin' laser beams attached to their frickin' heads
    banner login WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    banner asdm WARNING!! Access to this device is restricted to those individuals with specific permissions. If you are not an authorized user, disconnect now. Any attempts to gain unauthorized access will be prosecuted to the fullest extent of the law.
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network CD_3610-GW
    host 10.10.100.17
    description First hop to 3610
    object network CV_3611-GW
    host 10.10.100.65
    description First hop to 3611
    object network GW_22-EXT
    host 1.3.3.6
    description First hop to 22
    object network Ts-LAN
    host 192.168.100.4
    description TS
    object service MS-RDC
    service tcp source range 1024 65535 destination eq 3389
    description Microsoft Remote Desktop Connection
    object network HDC-LAN
    subnet 192.168.200.0 255.255.255.0
    description DC LAN subnet
    object network HAM-LAN
    subnet 192.168.110.0 255.255.255.0
    description HAM LAN subnet
    object service MSN
    service tcp source range 1 65535 destination eq 1863
    description MSN Messenger
    object network BCCs
    host 2.1.8.1
    description BCCs server access
    object network ODLW-EXT
    host 7.1.1.5
    description OTTDl
    object network SWINDS-INT
    host 10.30.133.67
    description SWINDS server
    object network SWINDS(192.x.x.x)-INT
    host 192.168.100.67
    description SWINDS server
    object service YMSG
    service tcp source range 1 65535 destination eq 5050
    description Yahoo Messenger
    object service c.b.ca1
    service tcp source range 1 65535 destination eq citrix-ica
    description Connections to the bc portal.
    object service c.b.ca2
    service tcp source range 1 65535 destination eq 2598
    description Connections to the bc portal.
    object service HTTP-EXT(7001)
    service tcp source range 1 65535 destination eq 7001
    description HTTP Extended on port 7001.
    object service HTTP-EXT(8000-8001)
    service tcp source range 1 65535 destination range 8000 8001
    description HTTP Extended on ports 8000-8001.
    object service HTTP-EXT(8080-8081)
    service tcp source range 1 65535 destination range 8080 8081
    description HTTP Extended on ports 8080-8081.
    object service HTTP-EXT(8100)
    service tcp source range 1 65535 destination eq 8100
    description HTTP Extended on port 8100.
    object service HTTP-EXT(8200)
    service tcp source range 1 65535 destination eq 8200
    description HTTP Extended on port 8200.
    object service HTTP-EXT(8888)
    service tcp source range 1 65535 destination eq 8888
    description HTTP Extended on port 8888.
    object service HTTP-EXT(9080)
    service tcp source range 1 65535 destination eq 9080
    description HTTP Extended on port 9080.
    object service ntp
    service tcp source range 1 65535 destination eq 123
    description TCP NTP on port 123.
    object network Pl-EXT
    host 7.1.1.2
    description OPl box.
    object service Pl-Admin
    service tcp source range 1 65535 destination eq 8443
    description Pl Admin portal
    object network FW-EXT
    host 1.3.3.7
    description External/Public interface IP address of firewall.
    object network Rs-EXT
    host 7.1.1.8
    description Rs web portal External/Public IP.
    object network DWDM-EXT
    host 2.1.2.1
    description DWDM.
    object network HM_VPN-EXT
    host 6.2.9.7
    description HAM Man.
    object network SIM_MGMT
    host 2.1.1.1
    description SIM Man.
    object network TS_MGMT
    host 2.1.1.4
    description TS Man.
    object network TS_MGMT
    host 2.1.2.2
    description TS Man.
    object service VPN-TCP(1723)
    service tcp source range 1 65535 destination eq pptp
    description For PPTP control path.
    object service VPN-UDP(4500)
    service udp source range 1 65535 destination eq 4500
    description For L2TP(IKEv1) and IKEv2.
    object service VPN-TCP(443)
    service tcp source range 1 65535 destination eq https
    description For SSTP control and data path.
    object service VPN-UDP(500)
    service udp source range 1 65535 destination eq isakmp
    description For L2TP(IKEv1) and IKEv2.
    object network RCM
    host 6.1.8.2
    description RCM
    object network RCM_Y
    host 6.1.8.9
    description RCM Y
    object network r.r.r.c163
    host 2.1.2.63
    description RCV IP.
    object network r.r.r.c227
    host 2.1.2.27
    description RCV IP.
    object network v.t.c-EXT
    host 2.5.1.2
    description RTICR
    object service VPN-TCP(10000)
    service tcp source range 1 65535 destination eq 10000
    description For TCP VPN over port 1000.
    object service BGP-JY
    service tcp source range 1 65535 destination eq 21174
    description BPG
    object network KooL
    host 192.168.100.100
    description KooL
    object network FW_Test
    host 1.3.3.7
    description Testing other External IP
    object network AO_10-30-133-0-LAN
    subnet 10.30.133.0 255.255.255.0
    description OLS 10.30.133.0/24
    object network AC_10-30-136-0-LAN
    subnet 10.30.136.0 255.255.255.0
    description CLS 10.30.136.0/24
    object-group network All_Private_Interfaces
    description All private interfaces
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    network-object 10.10.100.16 255.255.255.240
    network-object 10.10.100.64 255.255.255.252
    network-object 192.168.102.0 255.255.255.0
    network-object 192.168.91.0 255.255.255.0
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service cb.ca
    description All ports required for cb.ca connections.
    service-object object c.b.ca1
    service-object object c.b.ca2
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq https
    service-object udp destination eq snmp
    object-group service FTP
    description All FTP ports (20 + 21)
    service-object tcp destination eq ftp
    service-object tcp destination eq ftp-data
    object-group service HTTP-EXT
    description HTTP Extended port ranges.
    service-object object HTTP-EXT(7001)
    service-object object HTTP-EXT(8000-8001)
    service-object object HTTP-EXT(8080-8081)
    service-object object HTTP-EXT(8100)
    service-object object HTTP-EXT(8200)
    service-object object HTTP-EXT(8888)
    service-object object HTTP-EXT(9080)
    object-group service ICMP_Any
    description ICMP: Any Type, Any Code
    service-object icmp alternate-address
    service-object icmp conversion-error
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp information-reply
    service-object icmp information-request
    service-object icmp mask-reply
    service-object icmp mask-request
    service-object icmp mobile-redirect
    service-object icmp parameter-problem
    service-object icmp redirect
    service-object icmp router-advertisement
    service-object icmp router-solicitation
    service-object icmp source-quench
    service-object icmp time-exceeded
    service-object icmp timestamp-reply
    service-object icmp timestamp-request
    service-object icmp traceroute
    service-object icmp unreachable
    service-object icmp6 echo
    service-object icmp6 echo-reply
    service-object icmp6 membership-query
    service-object icmp6 membership-reduction
    service-object icmp6 membership-report
    service-object icmp6 neighbor-advertisement
    service-object icmp6 neighbor-redirect
    service-object icmp6 neighbor-solicitation
    service-object icmp6 packet-too-big
    service-object icmp6 parameter-problem
    service-object icmp6 router-advertisement
    service-object icmp6 router-renumbering
    service-object icmp6 router-solicitation
    service-object icmp6 time-exceeded
    service-object icmp6 unreachable
    service-object icmp
    object-group service NTP
    description TCP and UPD NTP protocol
    service-object object ntp
    service-object udp destination eq ntp
    object-group service DM_INLINE_SERVICE_3
    group-object FTP
    group-object HTTP-EXT
    group-object ICMP_Any
    group-object NTP
    service-object tcp-udp destination eq domain
    service-object tcp-udp destination eq www
    service-object tcp destination eq https
    service-object tcp destination eq ssh
    service-object ip
    object-group service DM_INLINE_SERVICE_4
    group-object NTP
    service-object tcp destination eq daytime
    object-group network SWINDS
    description Both Internal IP addresses (192 + 10)
    network-object object SWINDS-INT
    network-object object SWINDS(192.x.x.x)-INT
    object-group service IM_Types
    description All messenger type applications
    service-object object MSN
    service-object object YMSG
    service-object tcp-udp destination eq talk
    service-object tcp destination eq aol
    service-object tcp destination eq irc
    object-group service SNMP
    description Both poll and trap ports.
    service-object udp destination eq snmp
    service-object udp destination eq snmptrap
    object-group service DM_INLINE_SERVICE_2
    group-object FTP
    service-object object MS-RDC
    service-object object Pl-Admin
    group-object SNMP
    object-group network DM_INLINE_NETWORK_1
    network-object object FW-EXT
    network-object object Rs-EXT
    object-group network AMV
    description connections for legacy AM
    network-object object DWDM-EXT
    network-object object HAM_MGMT
    network-object object SIM_MGMT
    network-object object TS_MGMT
    network-object object TS_MGMT
    object-group service IKEv2_L2TP
    description IKEv2 and L2TP VPN configurations
    service-object esp
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    object-group service PPTP
    description PPTP VPN configuration
    service-object gre
    service-object object VPN-TCP(1723)
    object-group service SSTP
    description SSTP VPN configuration
    service-object object VPN-TCP(443)
    object-group network RvIPs
    description Rv IP addresses
    network-object object RCM
    network-object object RCM_Y
    network-object object r.r.r.c163
    network-object object r.r.r.c227
    network-object object v.t.c-EXT
    object-group service Rvs
    description Rv configuration.
    service-object object VPN-TCP(10000)
    service-object object VPN-UDP(500)
    object-group service DM_INLINE_SERVICE_5
    service-object object BGP-JY
    service-object tcp destination eq bgp
    object-group network Local_Private_Subnets
    description OandCl DATA
    network-object 10.30.133.0 255.255.255.0
    network-object 10.30.136.0 255.255.255.0
    object-group service IPSec
    description IPSec traffic
    service-object object VPN-UDP(4500)
    service-object object VPN-UDP(500)
    access-list Public/Internet_access_out remark Block all IM traffic out.
    access-list Public/Internet_access_out extended deny object-group IM_Types object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Access from SWINDS to DLM portal
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_1 object-group SWINDS object ODLW-EXT
    access-list Public/Internet_access_out remark Allow access to BMC portal
    access-list Public/Internet_access_out extended permit object-group cb.ca object-group Local_Private_Subnets object BCCs
    access-list Public/Internet_access_out remark Allow basic services out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_3 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow WhoIS traffic out.
    access-list Public/Internet_access_out extended permit tcp object-group Local_Private_Subnets any eq whois
    access-list Public/Internet_access_out remark Allow Network Time protocols out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_4 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow all IP based monitoring traffic to Pl.
    access-list Public/Internet_access_out extended permit ip object-group SWINDS object Pl-EXT
    access-list Public/Internet_access_out remark Allow Management traffic to Pl-JY.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_2 object-group Local_Private_Subnets object Pl-EXT
    access-list Public/Internet_access_out remark Allow FTP traffic to Grimlock and RS FTP.
    access-list Public/Internet_access_out extended permit object-group FTP object-group Local_Private_Subnets object-group DM_INLINE_NETWORK_1
    access-list Public/Internet_access_out remark Allow VPN traffic to AM-JY.
    access-list Public/Internet_access_out extended permit object-group IKEv2_L2TP object-group Local_Private_Subnets object-group AMV
    access-list Public/Internet_access_out remark Allow VPN traffic to RCm devices.
    access-list Public/Internet_access_out extended permit object-group Rvs object-group Local_Private_Subnets object-group RvIPs
    access-list Public/Internet_access_out remark Allow BPG traffic out.
    access-list Public/Internet_access_out extended permit object-group DM_INLINE_SERVICE_5 object-group Local_Private_Subnets any
    access-list Public/Internet_access_out remark Allow Kool server out.
    access-list Public/Internet_access_out extended permit ip object KooL any
    pager lines 24
    logging enable
    logging history informational
    logging asdm informational
    logging mail notifications
    logging from-address [email protected]
    logging recipient-address [email protected] level errors
    mtu Public_Internet 1500
    mtu Private_CDATA 1500
    mtu Private_ODATA 1500
    mtu Private_OVOICE 1500
    mtu Private_CVOICE 1500
    mtu Private_CeDATA 1500
    mtu Private_CeVOICE 1500
    mtu management 1500
    ip local pool AO-VPN_Pool 192.168.238.2-192.168.238.30 mask 255.255.255.224
    ip verify reverse-path interface Public_Internet
    ip verify reverse-path interface Private_CDATA
    ip verify reverse-path interface Private_ODATA
    ip verify reverse-path interface Private_OVOICE
    ip verify reverse-path interface Private_CVOICE
    ip verify reverse-path interface Private_CeDATA
    ip verify reverse-path interface Private_CeVOICE
    ip verify reverse-path interface management
    icmp unreachable rate-limit 1 burst-size 1
    icmp deny any Public_Internet
    no asdm history enable
    arp timeout 14400
    nat (Private_ODATA,Public_Internet) source dynamic AO_10-30-133-0-LAN interface
    nat (Private_CDATA,Public_Internet) source dynamic AC_10-30-136-0-LAN interface
    nat (Private_ODATA,Public_Internet) source static any any destination static NETWORK_OBJ_192.168.238.0_27 NETWORK_OBJ_192.168.238.0_27 no-proxy-arp route-lookup
    access-group Public/Internet_access_out out interface Public_Internet
    route Public_Internet 0.0.0.0 0.0.0.0 1.3.3.6 1
    route Private_CeDATA 10.0.0.0 255.0.0.0 10.10.100.17 1
    route Private_CeDATA 10.1.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.3.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.5.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 10.11.106.74 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 10.30.128.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.130.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.131.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.132.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.134.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.30.135.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.67.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 10.224.0.0 255.255.0.0 10.10.100.17 1
    route Private_CeDATA 4.1.1.19 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 1.1.1.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 1.1.1.13 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.24 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.27 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.11.29 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.17.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.64 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.66 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.147.110 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.19.251.57 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.56.105 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 172.21.57.152 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 192.168.3.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.9.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.20.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.21.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.30.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.31.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.40.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.41.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.50.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.60.0 255.255.255.0 10.10.100.17 1
    route Private_CeVOICE 192.168.61.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.70.0 255.255.255.0 10.10.100.65 1
    route Private_CeVOICE 192.168.101.0 255.255.255.0 10.10.100.65 1
    route Private_CeDATA 192.168.110.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.168.200.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 192.251.177.0 255.255.255.0 10.10.100.17 1
    route Private_CeDATA 2.1.2.7 255.255.255.255 10.10.100.17 1
    route Private_CeDATA 2.1.2.74 255.255.255.255 10.10.100.17 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server AD protocol nt
    aaa-server AD (Private_ODATA) host 10.30.133.21
    timeout 5
    nt-auth-domain-controller Cool_Transformer_Name
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication telnet console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.69.0 255.255.255.0 management
    snmp-server host Private_ODATA 10.30.133.67 poll community Some_*s_here version 2c
    snmp-server location OT
    snmp-server contact [email protected]
    snmp-server community Some_*s_here
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    snmp-server enable traps syslog
    snmp-server enable traps ipsec start stop
    snmp-server enable traps entity config-change fru-insert fru-remove
    snmp-server enable traps memory-threshold
    snmp-server enable traps interface-threshold
    snmp-server enable traps remote-access session-threshold-exceeded
    snmp-server enable traps connection-limit-reached
    snmp-server enable traps cpu threshold rising
    snmp-server enable traps ikev2 start stop
    snmp-server enable traps nat packet-discard
    sysopt noproxyarp Public_Internet
    sysopt noproxyarp Private_CDATA
    sysopt noproxyarp Private_ODATA
    sysopt noproxyarp Private_OVOICE
    sysopt noproxyarp Private_CVOICE
    sysopt noproxyarp Private_CeDATA
    sysopt noproxyarp Private_CeVOICE
    sysopt noproxyarp management
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Public_Internet_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Public_Internet_map interface Public_Internet
    crypto ikev1 enable Public_Internet
    crypto ikev1 policy 10
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    client-update enable
    telnet timeout 5
    ssh 10.30.133.0 255.255.255.0 Private_ODATA
    ssh 192.168.69.0 255.255.255.0 management
    ssh timeout 2
    ssh version 2
    console timeout 5
    dhcprelay server 10.30.133.13 Private_ODATA
    dhcprelay enable Private_CDATA
    dhcprelay timeout 60
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 10.30.133.13 prefer
    ntp server 132.246.11.227
    ntp server 10.30.133.21
    webvpn
    group-policy AO-VPN_Tunnel internal
    group-policy AO-VPN_Tunnel attributes
    dns-server value 10.30.133.21 10.30.133.13
    vpn-tunnel-protocol ikev1
    default-domain value ao.local
    username helpme password Some_X's_here encrypted privilege 1
    username helpme attributes
    service-type nas-prompt
    tunnel-group AO-VPN_Tunnel type remote-access
    tunnel-group AO-VPN_Tunnel general-attributes
    address-pool AO-VPN_Pool
    authentication-server-group AD
    default-group-policy AO-VPN_Tunnel
    tunnel-group AO-VPN_Tunnel ipsec-attributes
    ikev1 pre-shared-key Some_*s_here
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
    message-length maximum client auto
    message-length maximum 512
    policy-map global_policy
    class inspection_default
    inspect dns preset_dns_map
    inspect ftp
    inspect h323 h225
    inspect h323 ras
    inspect rsh
    inspect rtsp
    inspect esmtp
    inspect sqlnet
    inspect skinny 
    inspect sunrpc
    inspect xdmcp
    inspect sip 
    inspect netbios
    inspect tftp
    inspect ip-options
    class class-default
    user-statistics accounting
    service-policy global_policy global
    smtp-server 192.168.200.25
    prompt hostname context
    no call-home reporting anonymous
    Thanks in advance,
    Jeff.

  • Cisco ASA 5505 Site to Site VPN

    Hello All,
    First time posting to the forums. I've been working with Cisco ASA 5505 for a number of months and recently I purchased a 2nd ASA with the goal of setting up Site to Site VPN tunnel. It look so simple from the number of videos that I have watched on the internet. But when I have done it suprise suprise it didn't work for me ... I have deleted the tunnels a number of times and attempted to recreate them. I am using the VPN wizard in the ADM to create the tunnel. Both the asa are 5505 and have the same same firmware etc.
    I would appreciate any help that can be directed towards this issue please.  Slowly losing my mind
    Please see details below:
    Both ADM are 7.1
    IOS
    ASA 1
    aved
    ASA Version 9.0(1)
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address 92.51.193.158 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network CIX_Subnet
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network NETWORK_OBJ_84.39.233.50
    host 84.39.233.50
    object network NETWORK_OBJ_92.51.193.158
    host 92.51.193.158
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address
    [email protected]
    logging recipient-address
    [email protected]
    level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    http 192.168.40.0 255.255.255.0 wireless
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 84.39.233.50
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 192.168.10.0 255.255.255.0 inside
    ssh 192.168.40.0 255.255.255.0 wireless
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password uYePLcrFadO9pBZx encrypted
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:d06974501eb0327a5ed229c8445f4fe1
    ASA 2
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address 84.39.233.50 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network Eiresoft
    host 146.66.160.70
    description DBA Contractor
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_3
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_7
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in remark Access for Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 object Eiresoft object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark This is allowing access from Eiresoft to the OLTP Failover server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_7 object Eiresoft object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 192.168.10.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source dynamic any interface
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.10.0_24 NETWORK_OBJ_192.168.10.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 92.51.193.156 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 92.51.193.158
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 77.75.100.208 255.255.255.240 outside
    ssh 92.51.193.156 255.255.255.252 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:83b2069fa311e6037163ae74f9b2bec2
    : end

    Hi,
    Thanks for the help to date
    I now have the Site to Site working but there is one little issue I have. If I try to RD to a server through the tunnel it will not allow connection on the first attempt however if I ping that host and then attempt to RD it will allow the connection. It looks like the host is asleep until it receives traffic through the tunnel. Is this thje correct behaviour.
    See below the details:
    ASA1:
    hostname PAYBACK
    enable password HSMurh79NVmatjY0 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    ip local pool VPN1 192.168.50.1-192.168.50.254 mask 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description Trunk link to SW1
    switchport trunk allowed vlan 1,10,20,30,40
    switchport trunk native vlan 1
    switchport mode trunk
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    no nameif
    no security-level
    no ip address
    interface Vlan2
    nameif outside
    security-level 0
    ip address XX.XX.XX.XX 255.255.255.252
    interface Vlan10
    nameif inside
    security-level 100
    ip address 192.168.10.1 255.255.255.0
    interface Vlan20
    nameif servers
    security-level 100
    ip address 192.168.20.1 255.255.255.0
    interface Vlan30
    nameif printers
    security-level 100
    ip address 192.168.30.1 255.255.255.0
    interface Vlan40
    nameif wireless
    security-level 100
    ip address 192.168.40.1 255.255.255.0
    banner login line Welcome to Payback Loyalty Systems
    boot system disk0:/asa901-k8.bin
    ftp mode passive
    clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns domain-lookup servers
    dns domain-lookup printers
    dns domain-lookup wireless
    dns server-group DefaultDNS
    name-server 83.147.160.2
    name-server 83.147.160.130
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network ftp_server
    object network Internal_Report_Server
    host 192.168.20.21
    description Automated Report Server Internal Address
    object network Report_Server
    host 89.234.126.9
    description Automated Report Server
    object service RDP
    service tcp destination eq 3389
    description RDP to Server
    object network Host_QA_Server
    host 89.234.126.10
    description QA Host External Address
    object network Internal_Host_QA
    host 192.168.20.22
    description Host of VM machine for QA
    object network Internal_QA_Web_Server
    host 192.168.20.23
    description Web Server in QA environment
    object network Web_Server_QA_VM
    host 89.234.126.11
    description Web server in QA environment
    object service SQL_Server
    service tcp destination eq 1433
    object network Demo_Server
    host 89.234.126.12
    description Server set up to Demo Product
    object network Internal_Demo_Server
    host 192.168.20.24
    description Internal IP Address of Demo Server
    object network NETWORK_OBJ_192.168.20.0_24
    subnet 192.168.20.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_26
    subnet 192.168.50.0 255.255.255.192
    object network NETWORK_OBJ_192.168.0.0_16
    subnet 192.168.0.0 255.255.0.0
    object service MSSQL
    service tcp destination eq 1434
    description MSSQL port
    object network VPN-network
    subnet 192.168.50.0 255.255.255.0
    object network NETWORK_OBJ_192.168.50.0_24
    subnet 192.168.50.0 255.255.255.0
    object service TS
    service tcp destination eq 4400
    object service TS_Return
    service tcp source eq 4400
    object network External_QA_3
    host 89.234.126.13
    object network Internal_QA_3
    host 192.168.20.25
    object network Dev_WebServer
    host 192.168.20.27
    object network External_Dev_Web
    host 89.234.126.14
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    description Wireless network
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object-group service DM_INLINE_SERVICE_1
    service-object tcp destination eq ftp
    service-object tcp destination eq netbios-ssn
    service-object tcp destination eq smtp
    service-object object TS
    service-object object SQL_Server
    object-group service DM_INLINE_SERVICE_3
    service-object tcp destination eq www
    service-object tcp destination eq https
    service-object object TS
    service-object object TS_Return
    object-group service DM_INLINE_SERVICE_4
    service-object object RDP
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group service DM_INLINE_SERVICE_5
    service-object object MSSQL
    service-object object RDP
    service-object object TS
    object-group protocol TCPUDP
    protocol-object udp
    protocol-object tcp
    object-group service DM_INLINE_SERVICE_6
    service-object object TS
    service-object object TS_Return
    service-object tcp destination eq www
    service-object tcp destination eq https
    object-group network DM_INLINE_NETWORK_1
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    object-group network Payback_Internal
    network-object 192.168.10.0 255.255.255.0
    network-object 192.168.20.0 255.255.255.0
    network-object 192.168.40.0 255.255.255.0
    access-list outside_access_in remark This rule is allowing from internet to interal server.
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark FTP
    access-list outside_access_in remark RDP
    access-list outside_access_in remark SMTP
    access-list outside_access_in remark Net Bios
    access-list outside_access_in remark SQL
    access-list outside_access_in remark TS - 4400
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 object Internal_Report_Server
    access-list outside_access_in remark Access rule to internal host QA
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit tcp any4 object Internal_Host_QA eq www
    access-list outside_access_in remark Access to INternal Web Server:
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark HTTP
    access-list outside_access_in remark RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 object Internal_QA_Web_Server
    access-list outside_access_in remark Rule for allowing access to Demo server
    access-list outside_access_in remark Allowed:
    access-list outside_access_in remark RDP
    access-list outside_access_in remark MSSQL
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 any4 object Internal_Demo_Server
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any object Internal_QA_3
    access-list outside_access_in remark Access for Development WebServer
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 any object Dev_WebServer
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
    access-list Payback_VPN_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
    access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging console informational
    logging asdm informational
    logging from-address [email protected]
    logging recipient-address [email protected] level alerts
    mtu outside 1500
    mtu inside 1500
    mtu servers 1500
    mtu printers 1500
    mtu wireless 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711-52.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (wireless,outside) source static Wireless Wireless destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Servers Servers destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup
    nat (inside,outside) source dynamic any interface
    nat (wireless,outside) source dynamic any interface
    nat (servers,outside) source dynamic any interface
    nat (servers,outside) source static Internal_Report_Server Report_Server
    nat (servers,outside) source static Internal_Host_QA Host_QA_Server
    nat (servers,outside) source static Internal_QA_Web_Server Web_Server_QA_VM
    nat (servers,outside) source static Internal_Demo_Server Demo_Server
    nat (servers,outside) source static NETWORK_OBJ_192.168.20.0_24 NETWORK_OBJ_192.168.20.0_24 destination static NETWORK_OBJ_192.168.50.0_24 NETWORK_OBJ_192.168.50.0_24 no-proxy-arp route-lookup
    nat (servers,outside) source static Internal_QA_3 External_QA_3
    nat (servers,outside) source static Dev_WebServer External_Dev_Web
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 92.51.193.157 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.10.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer XX.XX.XX.XX
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto map servers_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map servers_map interface servers
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable inside client-services port 443
    crypto ikev1 enable outside
    crypto ikev1 enable inside
    crypto ikev1 enable servers
    crypto ikev1 policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 192.168.10.0 255.255.255.0 inside
    ssh timeout 5
    console timeout 0
    dhcpd dns 192.168.0.1
    dhcpd auto_config outside
    dhcpd address 192.168.10.21-192.168.10.240 inside
    dhcpd dns 192.168.20.21 83.147.160.2 interface inside
    dhcpd option 15 ascii paybackloyalty.com interface inside
    dhcpd enable inside
    dhcpd address 192.168.40.21-192.168.40.240 wireless
    dhcpd dns 192.168.20.21 83.147.160.2 interface wireless
    dhcpd update dns interface wireless
    dhcpd option 15 ascii paybackloyalty.com interface wireless
    dhcpd enable wireless
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy Payback_VPN internal
    group-policy Payback_VPN attributes
    vpn-simultaneous-logins 10
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Payback_VPN_splitTunnelAcl
    group-policy DfltGrpPolicy attributes
    dns-server value 83.147.160.2 83.147.160.130
    vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
    group-policy GroupPolicy_84.39.233.50 internal
    group-policy GroupPolicy_84.39.233.50 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username Noelle password XB/IpvYaATP.2QYm encrypted
    username Noelle attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Eanna password vXILR9ZZQIsd1Naw encrypted privilege 0
    username Eanna attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Michael password qpbleUqUEchRrgQX encrypted
    username Michael attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Danny password .7fEXdzESUk6S/cC encrypted privilege 0
    username Danny attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username niamh password MlFlIlEiy8vismE0 encrypted
    username niamh attributes
    service-type admin
    username Aileen password tytrelqvV5VRX2pz encrypted privilege 0
    username Aileen attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Aidan password aDu6YH0V5XaxpEPg encrypted privilege 0
    username Aidan attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    username shane.c password iqGMoWOnfO6YKXbw encrypted
    username shane.c attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Shane password yQeVtvLLKqapoUje encrypted privilege 0
    username Shane attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username James password TdYPv1pvld/hPM0d encrypted
    username James attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username mark password yruxpddqfyNb.qFn encrypted
    username mark attributes
    service-type admin
    username Mary password XND5FTEiyu1L1zFD encrypted
    username Mary attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    username Massimo password vs65MMo4rM0l4rVu encrypted privilege 0
    username Massimo attributes
    vpn-group-policy Payback_VPN
    service-type remote-access
    tunnel-group Payback_VPN type remote-access
    tunnel-group Payback_VPN general-attributes
    address-pool VPN1
    default-group-policy Payback_VPN
    tunnel-group Payback_VPN ipsec-attributes
    ikev1 pre-shared-key *****
    tunnel-group 84.39.233.50 type ipsec-l2l
    tunnel-group 84.39.233.50 general-attributes
    default-group-policy GroupPolicy_84.39.233.50
    tunnel-group 84.39.233.50 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map global-class
    match default-inspection-traffic
    policy-map global-policy
    class global-class
      inspect dns
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect pptp
      inspect rsh
      inspect rtsp
      inspect sip
      inspect snmp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect xdmcp
      inspect icmp error
      inspect icmp
    service-policy global-policy global
    smtp-server 192.168.20.21
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:83fa7ce1d93375645205f6e79b526381
    ASA2:
    ASA Version 9.0(1)
    hostname Payback-CIX
    enable password HSMurh79NVmatjY0 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    description This port connects to VLAN 100
    switchport access vlan 100
    interface Ethernet0/2
    interface Ethernet0/3
    switchport access vlan 100
    interface Ethernet0/4
    switchport access vlan 100
    interface Ethernet0/5
    switchport access vlan 100
    interface Ethernet0/6
    switchport access vlan 100
    interface Ethernet0/7
    switchport access vlan 100
    interface Vlan2
    nameif outside
    security-level 0
    ip address X.X.X.X 255.255.255.240
    interface Vlan100
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    banner login line Welcome to Payback Loyalty - CIX
    ftp mode passive
    clock timezone GMT 0
    clock summer-time gmt/idt recurring last Sun Mar 1:00 last Sun Oct 2:00
    dns domain-lookup outside
    dns domain-lookup inside
    dns server-group defaultDNS
    name-server 8.8.8.8
    name-server 8.8.4.4
    same-security-traffic permit inter-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network CIX-Host-1
    host 192.168.100.2
    description This is the host machine of the VM servers
    object network External_CIX-Host-1
    host 84.39.233.51
    description This is the external IP address of the host server for the VM server
    object service RDP
    service tcp source range 1 65535 destination eq 3389
    object network Payback_Office
    host 92.51.193.158
    object service MSQL
    service tcp destination eq 1433
    object network Development_OLTP
    host 192.168.100.10
    description VM for Eiresoft
    object network External_Development_OLTP
    host 84.39.233.52
    description This is the external IP address for the VM for Eiresoft
    object network External_TMC_Web
    host 84.39.233.53
    description Public Address of TMC Webserver
    object network TMC_Webserver
    host 192.168.100.19
    description Internal Address of TMC Webserver
    object network External_TMC_OLTP
    host 84.39.233.54
    description Targets OLTP external IP
    object network TMC_OLTP
    host 192.168.100.18
    description Targets interal IP address
    object network External_OLTP_Failover
    host 84.39.233.55
    description Public IP of OLTP Failover
    object network OLTP_Failover
    host 192.168.100.60
    description Server for OLTP failover
    object network Servers
    subnet 192.168.20.0 255.255.255.0
    object network Wired
    subnet 192.168.10.0 255.255.255.0
    object network Wireless
    subnet 192.168.40.0 255.255.255.0
    object network NETWORK_OBJ_192.168.100.0_24
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.10.0_24
    subnet 192.168.10.0 255.255.255.0
    object network Eiresoft_2nd
    host 137.117.217.29
    description Eiresoft 2nd IP
    object network Dev_Test_Webserver
    host 192.168.100.12
    description Dev Test Webserver Internal Address
    object network External_Dev_Test_Webserver
    host 84.39.233.56
    description This is the PB Dev Test Webserver
    object network NETWORK_OBJ_192.168.1.0_24
    subnet 192.168.1.0 255.255.255.0
    object network LAN
    subnet 192.168.100.0 255.255.255.0
    object network REMOTE-LAN
    subnet 192.168.10.0 255.255.255.0
    object network TargetMC
    host 83.71.194.145
    description This is Target Location that will be accessing the Webserver
    object network Rackspace_OLTP
    host 162.13.34.56
    description This is the IP address of production OLTP
    object service DB
    service tcp destination eq 5022
    object network Topaz_Target_VM
    host 82.198.151.168
    description This is Topaz IP that will be accessing Targets VM
    object service DB_2
    service tcp destination eq 5023
    object network EireSoft_NEW_IP
    host 146.66.161.3
    description Eiresoft latest IP form ISP DHCP
    object-group service DM_INLINE_SERVICE_1
    service-object object MSQL
    service-object object RDP
    service-object icmp echo
    service-object icmp echo-reply
    object-group service DM_INLINE_SERVICE_2
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_4
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object tcp destination eq www
    object-group service DM_INLINE_SERVICE_5
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_6
    service-object object MSQL
    service-object object RDP
    object-group network Payback_Intrernal
    network-object object Servers
    network-object object Wired
    network-object object Wireless
    object-group service DM_INLINE_SERVICE_8
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_9
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_10
    service-object object MSQL
    service-object object RDP
    service-object tcp destination eq ftp
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    object-group service DM_INLINE_SERVICE_11
    service-object object RDP
    service-object tcp destination eq ftp
    object-group service DM_INLINE_SERVICE_12
    service-object object MSQL
    service-object icmp echo
    service-object icmp echo-reply
    service-object object DB
    service-object object DB_2
    object-group service DM_INLINE_SERVICE_13
    service-object object MSQL
    service-object object RDP
    object-group service DM_INLINE_SERVICE_14
    service-object object MSQL
    service-object object RDP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object Payback_Office object CIX-Host-1
    access-list outside_access_in remark Development OLTP from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object Payback_Office object Development_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object Payback_Office object TMC_Webserver
    access-list outside_access_in remark Access to OLTP for target from Payback Office
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 object Payback_Office object TMC_OLTP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_6 object Payback_Office object OLTP_Failover
    access-list outside_access_in remark Access for the 2nd IP from Eiresoft
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_8 object Eiresoft_2nd object Development_OLTP
    access-list outside_access_in remark Access from the 2nd Eiresoft IP
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_9 object Eiresoft_2nd object OLTP_Failover
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_10 object Payback_Office object Dev_Test_Webserver
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_11 object Payback_Office object External_TMC_OLTP
    access-list outside_access_in remark Access rules from Traget to CIX for testing
    access-list outside_access_in extended permit tcp object TargetMC object TMC_Webserver eq www
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_12 object Rackspace_OLTP object OLTP_Failover
    access-list outside_access_in remark Topaz access to Target VM
    access-list outside_access_in extended permit tcp object Topaz_Target_VM object TMC_Webserver eq www
    access-list outside_access_in remark Opened up for Target for the weekend. Closing on Monday 20th
    access-list outside_access_in extended permit tcp any object TMC_Webserver eq www
    access-list outside_access_in remark Access for Eiresoft after their ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_13 object EireSoft_NEW_IP object Development_OLTP
    access-list outside_access_in remark Eiresoft Access after ISP changed their IP Address
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_14 object EireSoft_NEW_IP object OLTP_Failover
    access-list outside_cryptomap extended permit ip 192.168.100.0 255.255.255.0 object-group Payback_Intrernal
    pager lines 24
    logging enable
    logging console debugging
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 destination static Payback_Intrernal Payback_Intrernal no-proxy-arp route-lookup
    nat (inside,outside) source static CIX-Host-1 External_CIX-Host-1
    nat (inside,outside) source static Development_OLTP External_Development_OLTP
    nat (inside,outside) source static TMC_Webserver External_TMC_Web
    nat (inside,outside) source static TMC_OLTP External_TMC_OLTP
    nat (inside,outside) source static OLTP_Failover External_OLTP_Failover
    nat (inside,outside) source static Dev_Test_Webserver External_Dev_Test_Webserver
    nat (inside,outside) source dynamic LAN interface
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 84.39.233.49 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http X.X.X.X 255.255.255.252 outside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer X.X.X.X
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh X.X.X.X  255.255.255.240 outside
    ssh X.X.X.X 255.255.255.252 outside
    ssh 192.168.40.0 255.255.255.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    group-policy GroupPolicy_92.51.193.158 internal
    group-policy GroupPolicy_92.51.193.158 attributes
    vpn-tunnel-protocol ikev1 ikev2
    username gordon password 6e6Djaz3W/XH59zX encrypted privilege 15
    tunnel-group 92.51.193.158 type ipsec-l2l
    tunnel-group 92.51.193.158 general-attributes
    default-group-policy GroupPolicy_92.51.193.158
    tunnel-group 92.51.193.158 ipsec-attributes
    ikev1 pre-shared-key *****
    ikev2 remote-authentication pre-shared-key *****
    ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:78a7b9ccec2fa048306092eb29a2b769

  • ASA 5505 rookie - can't ping remote site or vice versa

    Hi, I'm trying to setup an ipsec from an ASA 5505 (8.4) to a Sophos UTM (9.2)
    Internet etc is up and accessible. Ipsec tunnel is up also but I can't pass traffic through it.
    I get this message in the logs:
    3
    Aug 05 2014
    22:38:52
    81.111.111.156
    82.222.222.38
    Deny inbound protocol 50 src outside:81.111.111.156 dst outside:82.222.222.38
    SITE A (ASA 5505) = 82.222.222.38
    SITE B (UTM 9) = 81.111.111.156
    Any pointers would be good as this is the first time I've tried this. Thank you.
    Running config below:
    hostname ciscoasa
    enable password 8Ry2YjIyt7RRXU24 encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.1.1 255.255.255.0
    interface Vlan2
     description Zen Internet
     nameif outside
     security-level 0
     pppoe client vpdn group Zen
     ip address 82.222.222.38 255.255.255.255 pppoe setroute
    boot system disk0:/asa922-k8.bin
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
     name-server 8.8.8.8
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network MY-LAN
     subnet 192.168.1.0 255.255.255.0
    object network THIER-LAN
     subnet 192.168.30.0 255.255.255.0
    object network NETWORK_OBJ_192.168.1.0_24
     subnet 192.168.1.0 255.255.255.0
    object network NETWORK_OBJ_192.168.30.0_24
     subnet 192.168.30.0 255.255.255.0
    object network THIER_VPN
     host 81.111.111.156
     description THIER VPN 
    object service Sophos_Admin
     service tcp destination eq 4444
    object-group protocol DM_INLINE_PROTOCOL_1
     protocol-object ip
     protocol-object icmp
     protocol-object esp
    object-group protocol DM_INLINE_PROTOCOL_2
     protocol-object ip
     protocol-object icmp
     protocol-object esp
    object-group protocol DM_INLINE_PROTOCOL_3
     protocol-object ip
     protocol-object icmp
     protocol-object esp
    object-group service DM_INLINE_SERVICE_1
     service-object icmp
     service-object udp destination eq domain
     service-object object Sophos_Admin
     service-object tcp destination eq www
     service-object tcp destination eq https
     service-object esp
    object-group service DM_INLINE_SERVICE_2
     service-object icmp
     service-object object Sophos_Admin
     service-object esp
     service-object icmp echo-reply
    object-group service DM_INLINE_SERVICE_3
     service-object ip
     service-object esp
     service-object icmp echo-reply
    object-group service DM_INLINE_SERVICE_4
     service-object object Sophos_Admin
     service-object icmp echo
     service-object icmp echo-reply
    access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_3 object MY-LAN object THIER-LAN
    access-list outside_cryptomap_1 extended permit object-group DM_INLINE_PROTOCOL_2 object MY-LAN object THIER-LAN
    access-list inside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 object THIER-LAN object MY-LAN
    access-list outside_access_out extended permit object-group DM_INLINE_SERVICE_3 object THIER_VPN host 82.222.222.38
    access-list outside_access_out extended permit object-group DM_INLINE_SERVICE_1 any any
    access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 object THIER_VPN host 82.222.222.38
    access-list inside_access_out extended permit object-group DM_INLINE_SERVICE_4 object MY-LAN object THIER-LAN
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-722.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    object network obj_any
     nat (inside,outside) dynamic interface
    access-group inside_access_out out interface inside
    access-group outside_access_in in interface outside
    access-group outside_access_out out interface outside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 81.111.111.156
    crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA
    crypto map outside_map 1 set ikev2 ipsec-proposal AES
    crypto map outside_map 2 match address outside_cryptomap_1
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer 81.111.111.156
    crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 2 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 2
     prf sha
     lifetime seconds 7800
    crypto ikev2 enable outside
    crypto ikev1 enable outside
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 7800
    telnet timeout 5
    ssh scopy enable
    ssh stricthostkeycheck
    ssh 192.168.1.0 255.255.255.0 inside
    ssh timeout 30
    ssh version 2
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    vpdn group Zen request dialout pppoe
    vpdn group Zen localname MYISP@zen
    vpdn group Zen ppp authentication chap
    vpdn username MYISP@zen password ***** store-local
    dhcpd auto_config outside
    dhcpd address 192.168.1.5-192.168.1.36 inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    dynamic-filter updater-client enable
    dynamic-filter use-database
    dynamic-filter enable interface outside
    dynamic-filter drop blacklist interface outside
    webvpn
     anyconnect-essentials
    group-policy GroupPolicy_81.111.111.156 internal
    group-policy GroupPolicy_81.111.111.156 attributes
     vpn-tunnel-protocol ikev1
    username admin password JsE9Hv42G/zRUcG4 encrypted privilege 15
    username bob password lTKS32e90Yo5l2L/ encrypted
    tunnel-group 81.111.111.156 type ipsec-l2l
    tunnel-group 81.111.111.156 general-attributes
     default-group-policy GroupPolicy_81.111.111.156
    tunnel-group 81.111.111.156 ipsec-attributes
     ikev1 pre-shared-key *****
     ikev2 remote-authentication pre-shared-key *****
     ikev2 local-authentication pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect dns preset_dns_map dynamic-filter-snoop
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    hpm topN enable
    Cryptochecksum:9430c8a44d330d2b55f981274599a67e
    : end
    ciscoasa#

    Hi,
    I started again and used various combinations of encryption etc but they all come back the same so I'm at a loss.
    output of debug crypto ipsec 128
    IPSEC: New embryonic SA created @ 0xcdbaeff8,
        SCB: 0xCDC33C70,
        Direction: inbound
        SPI      : 0x6699A5F8
        Session ID: 0x00006000
        VPIF num  : 0x00000003
        Tunnel type: l2l
        Protocol   : esp
        Lifetime   : 240 seconds
    IPSEC: New embryonic SA created @ 0xcdc76048,
        SCB: 0xCDB97B98,
        Direction: outbound
        SPI      : 0xB4E5EBD5
        Session ID: 0x00006000
        VPIF num  : 0x00000003
        Tunnel type: l2l
        Protocol   : esp
        Lifetime   : 240 seconds
    IPSEC: Completed host OBSA update, SPI 0xB4E5EBD5
    IPSEC: Creating outbound VPN context, SPI 0xB4E5EBD5
        Flags: 0x00000005
        SA   : 0xcdc76048
        SPI  : 0xB4E5EBD5
        MTU  : 1492 bytes
        VCID : 0x00000000
        Peer : 0x00000000
        SCB  : 0x3653C7F5
        Channel: 0xc8c234e0
    IPSEC: Completed outbound VPN context, SPI 0xB4E5EBD5
        VPN handle: 0x0003820c
    IPSEC: New outbound encrypt rule, SPI 0xB4E5EBD5
        Src addr: 192.168.1.0
        Src mask: 255.255.255.0
        Dst addr: 192.168.30.0
        Dst mask: 255.255.255.0
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 0
        Use protocol: false
        SPI: 0x00000000
        Use SPI: false
    IPSEC: Completed outbound encrypt rule, SPI 0xB4E5EBD5
        Rule ID: 0xca9505d8
    IPSEC: New outbound permit rule, SPI 0xB4E5EBD5
        Src addr: 88.222.222.38
        Src mask: 255.255.255.255
        Dst addr: 80.111.111.156
        Dst mask: 255.255.255.255
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 50
        Use protocol: true
        SPI: 0xB4E5EBD5
        Use SPI: true
    IPSEC: Completed outbound permit rule, SPI 0xB4E5EBD5
        Rule ID: 0xcdc482c8
    IPSEC: New embryonic SA created @ 0xcdbaeff8,
        SCB: 0xCDC33C70,
        Direction: inbound
        SPI      : 0x6699A5F8
        Session ID: 0x00006000
        VPIF num  : 0x00000003
        Tunnel type: l2l
        Protocol   : esp
        Lifetime   : 240 seconds
    IPSEC: Completed host IBSA update, SPI 0x6699A5F8
    IPSEC: Creating inbound VPN context, SPI 0x6699A5F8
        Flags: 0x00000006
        SA   : 0xcdbaeff8
        SPI  : 0x6699A5F8
        MTU  : 0 bytes
        VCID : 0x00000000
        Peer : 0x0003820C
        SCB  : 0x363F2BE7
        Channel: 0xc8c234e0
    IPSEC: Completed inbound VPN context, SPI 0x6699A5F8
        VPN handle: 0x00040e4c
    IPSEC: Updating outbound VPN context 0x0003820C, SPI 0xB4E5EBD5
        Flags: 0x00000005
        SA   : 0xcdc76048
        SPI  : 0xB4E5EBD5
        MTU  : 1492 bytes
        VCID : 0x00000000
        Peer : 0x00040E4C
        SCB  : 0x3653C7F5
        Channel: 0xc8c234e0
    IPSEC: Completed outbound VPN context, SPI 0xB4E5EBD5
        VPN handle: 0x0003820c
    IPSEC: Completed outbound inner rule, SPI 0xB4E5EBD5
        Rule ID: 0xca9505d8
    IPSEC: Completed outbound outer SPD rule, SPI 0xB4E5EBD5
        Rule ID: 0xcdc482c8
    IPSEC: New inbound tunnel flow rule, SPI 0x6699A5F8
        Src addr: 192.168.30.0
        Src mask: 255.255.255.0
        Dst addr: 192.168.1.0
        Dst mask: 255.255.255.0
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 0
        Use protocol: false
        SPI: 0x00000000
        Use SPI: false
    IPSEC: Completed inbound tunnel flow rule, SPI 0x6699A5F8
        Rule ID: 0xcdc35348
    IPSEC: New inbound decrypt rule, SPI 0x6699A5F8
        Src addr: 80.111.111.156
        Src mask: 255.255.255.255
        Dst addr: 88.222.222.38
        Dst mask: 255.255.255.255
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 50
        Use protocol: true
        SPI: 0x6699A5F8
        Use SPI: true
    IPSEC: Completed inbound decrypt rule, SPI 0x6699A5F8
        Rule ID: 0xc96f7cc8
    IPSEC: New inbound permit rule, SPI 0x6699A5F8
        Src addr: 80.111.111.156
        Src mask: 255.255.255.255
        Dst addr: 88.222.222.38
        Dst mask: 255.255.255.255
        Src ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Dst ports
          Upper: 0
          Lower: 0
          Op   : ignore
        Protocol: 50
        Use protocol: true
        SPI: 0x6699A5F8
        Use SPI: true
    IPSEC: Completed inbound permit rule, SPI 0x6699A5F8
        Rule ID: 0xc96f6388

  • ASA 5505. VPN Site-to-Site does not connect!

    Hello!
    Already more than a week ago, as we had a new channel of communication from MGTSa (ONT terminal Sercomm RV6688BCM, who just barely made in the "bridge" - was forced to make the provider in order to receive our white Cisco Ip-address), and now I'm trying too much more than a week to raise between our offices firm VPN IKEv1 IPsec Site-to-Site tunnel.
    Configurable and use the wizard in ASDM and handles in CLI, the result of one, the connection does not rise.
    Version Cisco 9.2 (2), the image of Cisco asa922-k8.bin, version license Security Plus, version ASDM 7.2 (2).
    What I'll never know ...
    Full configuration and debug enclose below.
    Help, what can follow any responses, please! I was quite exhausted!
    Config:
    Result of the command: "sh run"
    : Saved
    : Serial Number: XXXXXXXXXXXX
    : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
    ASA Version 9.2(2)
    hostname gate-71
    enable password F6OJ0GOws7WHxeql encrypted
    names
    ip local pool vpnpool 10.1.72.100-10.1.72.120 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     nameif inside
     security-level 100
     ip address 10.1.72.254 255.255.255.0
    interface Vlan2
     nameif outside_mgts
     security-level 0
     ip address 62.112.100.R1 255.255.255.252
    ftp mode passive
    clock timezone MSK/MSD 3
    clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00
    dns domain-lookup inside
    dns server-group MGTS
     name-server 195.34.31.50
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network obj_any
     subnet 0.0.0.0 0.0.0.0
    object network NET72
     subnet 10.1.72.0 255.255.255.0
    object network obj-0.0.0.0
     host 0.0.0.0
    object network Nafanya
     host 10.1.72.5
    object network obj-10.1.72.0
     subnet 10.1.72.0 255.255.255.0
    object network NET61
     subnet 10.1.61.0 255.255.255.0
    object network NETWORK_OBJ_10.1.72.96_27
     subnet 10.1.72.96 255.255.255.224
    object network NETT72
     subnet 10.1.72.0 255.255.255.0
    object network NET30
     subnet 10.1.30.0 255.255.255.0
    object network NETWORK_OBJ_10.1.72.0_24
     subnet 10.1.72.0 255.255.255.0
    object-group service OG-FROM-INET
     service-object icmp echo
     service-object icmp echo-reply
     service-object icmp traceroute
     service-object icmp unreachable
     service-object tcp-udp destination eq echo
    object-group network DM_INLINE_NETWORK_1
     network-object object NET30
     network-object object NET72
    object-group service DM_INLINE_TCP_1 tcp
     port-object eq www
     port-object eq https
    access-list inside_access_in extended permit ip object NET72 object-group DM_INLINE_NETWORK_1
    access-list inside_access_in extended permit ip 10.1.72.0 255.255.255.0 any
    access-list inside_access_in extended permit ip object Nafanya any inactive
    access-list inside_access_in extended permit object-group OG-FROM-INET any any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in extended deny ip any any log alerts
    access-list outside_mgts_access_in extended permit object-group OG-FROM-INET any any
    access-list outside_mgts_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
    access-list outside_mgts_access_in extended deny ip any any log alerts
    access-list outside_mgts_cryptomap extended permit ip 10.1.72.0 255.255.255.0 object NET61
    access-list VPN-ST_splitTunnelAcl standard permit 10.1.72.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside_mgts 1500
    ip verify reverse-path interface outside_mgts
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside_mgts) source static NET72 NET72 destination static NETWORK_OBJ_10.1.72.96_27 NETWORK_OBJ_10.1.72.96_27 no-proxy-arp route-lookup
    nat (inside,outside_mgts) source static NETWORK_OBJ_10.1.72.0_24 NETWORK_OBJ_10.1.72.0_24 destination static NET61 NET61 no-proxy-arp route-lookup
    object network obj_any
     nat (inside,outside_mgts) dynamic obj-0.0.0.0
    object network NET72
     nat (inside,outside_mgts) dynamic interface dns
    access-group inside_access_in in interface inside
    access-group outside_mgts_access_in in interface outside_mgts
    route outside_mgts 0.0.0.0 0.0.0.0 62.112.100.R 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    no user-identity enable
    user-identity default-domain LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 10.1.72.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_mgts_map 1 match address outside_mgts_cryptomap
    crypto map outside_mgts_map 1 set pfs group1
    crypto map outside_mgts_map 1 set peer 91.188.180.42
    crypto map outside_mgts_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_mgts_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_mgts_map interface outside_mgts
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
     enrollment self
     email [email protected]
     subject-name CN=gate-71
     serial-number
     ip-address 62.112.100.42
     proxy-ldc-issuer
     crl configure
    crypto ca trustpoint ASDM_TrustPoint1
     enrollment self
     keypair ASDM_TrustPoint1
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
     certificate eff26954
        30820395 3082027d a0030201 020204ef f2695430 0d06092a 864886f7 0d010105
        019
        6460ae26 ec5f301d 0603551d 0e041604 14c9a3f2 d70e6789 38fa4b01 465d1964
        60ae26ec 5f300d06 092a8648 86f70d01 01050500 03820101 00448753 7baa5c77
        62857b65 d05dc91e 3edfabc6 7b3771af bbedee14 673ec67d 3d0c2de4 b7a7ac05
        5f203a8c 98ab52cf 076401e5 1a2c6cb9 3f7afcba 52c617a5 644ece10 d6e1fd7d
        28b57d8c aaf49023 2037527e 9fcfa218 9883191f 60b221bf a561f2be d6882091
        0222b7a3 3880d6ac 49328d1f 2e085b15 6d1c1141 5f850e5c b6cb3e67 0e373591
        94a82781 44493217 38097952 003d5552 5c445f1f 92f04039 a23fba20 b9d51b13
        f511f311 d1feb2bb 6d056a15 7e63cc1b 1f134677 8124c024 3af56b97 51af8253
        486844bc b1954abe 8acd7108 5e4212df 193b8167 db835d76 98ffdb2b 8c8ab915
        0db3dd54 c8346b96 c4f4eff7 1e7cd576 a8b1f86e 3b868a6e 89
      quit
    crypto ca certificate chain ASDM_TrustPoint1
     certificate a39a2b54
        30820377 3082025f a0030201 020204a3 9a2b5430 0d06092a 864886f7 0d010105
        0500304b 3110300e 06035504 03130767 6174652d 36313137 30120603 55040513
        c084dcd9 d250e194 abcb3eb8 1da93bd0 fb0dba1a b1c35b43 d547a841 5d4ee1a4
        14bdb207 7dd790a4 0cd70471 5f3a896a 07bd56dc ea01b3dd 254cde88 e1490e97
        f3e54c05 551adde0 66aa3782 c85880c2 b162ec29 4e49346a df71062d 6d6d8f49
        62b9de93 ba07b4f7 a50e77e1 8f54b32b 6627cb27 e982b36f 362973a0 88de3272
        9bd6d4d2 8ca1e11f 214f20a9 78bdea95 78fdc45c d6d45674 6acb9bcb d0bd930e
        638eedfe cd559ab1 e1205c48 3ee9616f e631db55 e82b623c 434ffdc1 11020301
        0001a363 3061300f 0603551d 130101ff 04053003 0101ff30 0e060355 1d0f0101
        ff040403 02018630 1f060355 1d230418 30168014 0cea70bf 0d0e0c4b eb34a0b1
        8242a549 5183ccf9 301d0603 551d0e04 1604140c ea70bf0d 0e0c4beb 34a0b182
        42a54951 83ccf930 0d06092a 864886f7 0d010105 05000382 0101004e 7bfe054a
        d434a27c 1d3dce15 529bdc5f 70a2dff1 98975de9 96077966 2a97333b 05a8e9ef
        bf320cbd ecec3819 ade20a86 9aeb5bde bd129c7b 29341e4b edf91473 f2bf235d
        9aaeae21 a629ccc6 3c79200b b9a89b08 4745a411 bf38afb6 ea56b957 4430f692
        34d71fad 588e4e18 2b2d97af b2aae6b9 b6a22350 d031615b 49ea9b9f 2fdd82e6
        ebd4dccd df93c17e deceb796 f268abf1 bd5f7b69 89183841 881409b5 f484f0e7
        ebf7481c faf69d3e 9d24df6e 9c2b0791 785019f7 a0d20e95 2ef35799 66ffc819
        4a77cdf2 c6fb4380 fe94c13c d4261655 7bf3d6ba 6289dc8b f9aad4e1 bd918fb7
        32916fe1 477666ab c2a3d591 a84dd435 51711f6e 93e2bd84 89884c
      quit
    crypto isakmp identity address
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable outside_mgts client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    crypto ikev1 enable inside
    crypto ikev1 enable outside_mgts
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    no ssh stricthostkeycheck
    ssh 10.1.72.0 255.255.255.0 inside
    ssh timeout 60
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    vpnclient server 91.188.180.X
    vpnclient mode network-extension-mode
    vpnclient nem-st-autoconnect
    vpnclient vpngroup VPN-L2L password *****
    vpnclient username aradetskayaL password *****
    dhcpd auto_config outside_mgts
    dhcpd update dns both override interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 inside
    ssl trust-point ASDM_TrustPoint0 outside_mgts
    webvpn
     enable outside_mgts
    group-policy GroupPolicy_91.188.180.X internal
    group-policy GroupPolicy_91.188.180.X attributes
     vpn-tunnel-protocol ikev1
    group-policy VPN-ST internal
    group-policy VPN-ST attributes
     dns-server value 195.34.31.50 8.8.8.8
     vpn-tunnel-protocol ikev1
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value VPN-ST_splitTunnelAcl
     default-domain none
    username aradetskayaL password HR3qeva85hzXT6KK encrypted privilege 15
    tunnel-group 91.188.180.X type ipsec-l2l
    tunnel-group 91.188.180.X general-attributes
     default-group-policy GroupPolicy_91.188.180.42
    tunnel-group 91.188.180.X ipsec-attributes
     ikev1 pre-shared-key *****
     ikev2 remote-authentication pre-shared-key *****
     ikev2 remote-authentication certificate
     ikev2 local-authentication pre-shared-key *****
    tunnel-group VPN-ST type remote-access
    tunnel-group VPN-ST general-attributes
     address-pool vpnpool
     default-group-policy VPN-ST
    tunnel-group VPN-ST ipsec-attributes
     ikev1 pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:212e4f5035793d1c219fed57751983d8
    : end
    gate-71# sh crypto ikev1 sa
    There are no IKEv1 SAs
    gate-71# sh crypto ikev2 sa
    There are no IKEv2 SAs
    gate-71# sh crypto ipsec sa
    There are no ipsec sas
    gate-71# sh crypto isakmp
    There are no IKEv1 SAs
    There are no IKEv2 SAs
    Global IKEv1 Statistics
      Active Tunnels:              0
      Previous Tunnels:            0
      In Octets:                   0
      In Packets:                  0
      In Drop Packets:             0
      In Notifys:                  0
      In P2 Exchanges:             0
      In P2 Exchange Invalids:     0
      In P2 Exchange Rejects:      0
      In P2 Sa Delete Requests:    0
      Out Octets:                  0
      Out Packets:                 0
      Out Drop Packets:            0
      Out Notifys:                 0
      Out P2 Exchanges:            0
      Out P2 Exchange Invalids:    0
      Out P2 Exchange Rejects:     0
      Out P2 Sa Delete Requests:   0
      Initiator Tunnels:           0
      Initiator Fails:             0
      Responder Fails:             0
      System Capacity Fails:       0
      Auth Fails:                  0
      Decrypt Fails:               0
      Hash Valid Fails:            0
      No Sa Fails:                 0
    IKEV1 Call Admission Statistics
      Max In-Negotiation SAs:                 25
      In-Negotiation SAs:                      0
      In-Negotiation SAs Highwater:            0
      In-Negotiation SAs Rejected:             0
    Global IKEv2 Statistics
      Active Tunnels:                          0
      Previous Tunnels:                        0
      In Octets:                               0
      In Packets:                              0
      In Drop Packets:                         0
      In Drop Fragments:                       0
      In Notifys:                              0
      In P2 Exchange:                          0
      In P2 Exchange Invalids:                 0
      In P2 Exchange Rejects:                  0
      In IPSEC Delete:                         0
      In IKE Delete:                           0
      Out Octets:                              0
      Out Packets:                             0
      Out Drop Packets:                        0
      Out Drop Fragments:                      0
      Out Notifys:                             0
      Out P2 Exchange:                         0
      Out P2 Exchange Invalids:                0
      Out P2 Exchange Rejects:                 0
      Out IPSEC Delete:                        0
      Out IKE Delete:                          0
      SAs Locally Initiated:                   0
      SAs Locally Initiated Failed:            0
      SAs Remotely Initiated:                  0
      SAs Remotely Initiated Failed:           0
      System Capacity Failures:                0
      Authentication Failures:                 0
      Decrypt Failures:                        0
      Hash Failures:                           0
      Invalid SPI:                             0
      In Configs:                              0
      Out Configs:                             0
      In Configs Rejects:                      0
      Out Configs Rejects:                     0
      Previous Tunnels:                        0
      Previous Tunnels Wraps:                  0
      In DPD Messages:                         0
      Out DPD Messages:                        0
      Out NAT Keepalives:                      0
      IKE Rekey Locally Initiated:             0
      IKE Rekey Remotely Initiated:            0
      CHILD Rekey Locally Initiated:           0
      CHILD Rekey Remotely Initiated:          0
    IKEV2 Call Admission Statistics
      Max Active SAs:                   No Limit
      Max In-Negotiation SAs:                 50
      Cookie Challenge Threshold:          Never
      Active SAs:                              0
      In-Negotiation SAs:                      0
      Incoming Requests:                       0
      Incoming Requests Accepted:              0
      Incoming Requests Rejected:              0
      Outgoing Requests:                       0
      Outgoing Requests Accepted:              0
      Outgoing Requests Rejected:              0
      Rejected Requests:                       0
      Rejected Over Max SA limit:              0
      Rejected Low Resources:                  0
      Rejected Reboot In Progress:             0
      Cookie Challenges:                       0
      Cookie Challenges Passed:                0
      Cookie Challenges Failed:                0
    Global IKEv1 IPSec over TCP Statistics
    Embryonic connections: 0
    Active connections: 0
    Previous connections: 0
    Inbound packets: 0
    Inbound dropped packets: 0
    Outbound packets: 0
    Outbound dropped packets: 0
    RST packets: 0
    Recevied ACK heart-beat packets: 0
    Bad headers: 0
    Bad trailers: 0
    Timer failures: 0
    Checksum errors: 0
    Internal errors: 0
    gate-71# sh crypto protocol statistics all
    [IKEv1 statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [IKEv2 statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [IPsec statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [SSL statistics]
       Encrypt packet requests: 19331
       Encapsulate packet requests: 19331
       Decrypt packet requests: 437
       Decapsulate packet requests: 437
       HMAC calculation requests: 19768
       SA creation requests: 178
       SA rekey requests: 0
       SA deletion requests: 176
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [SSH statistics are not supported]
    [SRTP statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 0
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 0
       Failed requests: 0
    [Other statistics]
       Encrypt packet requests: 0
       Encapsulate packet requests: 0
       Decrypt packet requests: 0
       Decapsulate packet requests: 0
       HMAC calculation requests: 6238
       SA creation requests: 0
       SA rekey requests: 0
       SA deletion requests: 0
       Next phase key allocation requests: 0
       Random number generation requests: 76
       Failed requests: 9
    gate-71# sh crypto ca trustpoints
    Trustpoint ASDM_TrustPoint0:
        Configured for self-signed certificate generation.
    Trustpoint ASDM_TrustPoint1:
        Configured for self-signed certificate generation.
    If you need something more, then lay out!
    Please explain why it is I do not want to work?

    When I launched a packet tracer from the CLI connection has gone! Hooray!
    I just do not understand why it had not launched with the same settings?
    As I understood MGTS finally required ports began to miss!

  • Minecraft server script (run minecraft server as a daemon in Arch)

    Hey all, I just finished editing and setting up a nice script to run a Minecraft server at boot in Arch. This is based on the original script on the minecraft wiki here. I've edited it to be suitable to place in your /etc/rc.d/ folder with the name "minecraft" (/etc/rc.d/minecraft).
    This requires a user "minecraft" with the home directory /home/minecraft to work by default.
    I decided I wanted to run the server entirely in RAM so I store all my files in /home/minecraft/backup while the server is offline. When it starts up it makes a tmpfs mount at /home/minecraft/minecraft and copies all the files there and runs from there. It makes an hourly backup using /etc/rc.d/backup stored in /home/minecraft/onlinebackup, first erasing the current backup and creating a new one. This is simply to save space. In the event of a crash without proper stopping of the daemon you will have a backup from your previous reboot (or restart of your minecraft server) in /home/minecraft/backup and one from within the previous hour in /home/minecraft/onlinebackup which I figure ought to be enough. You can manually backup at any time by restarting the daemon.
    All paths can be altered. You can run this game under your normal user if you wish, just change the Settings section at the top of the file. RAM amounts may need to be increased for both the server and for the tmpfs, depending on how large your files are (mine are tiny and I have not heard of over 48MB for a game world, but you never know). Just check up on df -h every now and again to make sure your tmpfs has plenty of space, or just increase the allocated maximum size from the start. If you have low RAM you can always change the script to simply not use tmpfs.
    If anyone wants, just ask and I can put up a version without tmpfs (should be easy enough to remove yourself but if you're not sure I'll do it for you)
    All you need to start off with (if starting your server for the first time, using the scrip as is) is the user minecraft created, with the folders backup, onlinebackup and minecraft in the folder /home/minecraft, your minecraft_server.jar file in /home/minecraft/backup and your oninebackup file in /home/minecraft/backup.
    NOTE: onlinebackup file runs from /home/minecraft/minecraft so that if your system crashes, the cron job to run the backups will fail because the link will point to a non-existant file until server is started again.
    You can use these commands to with the server: /etc/rc.d/minecraft {start|stop|restart|update|backup}
    The backup system is designed to wipe all previous sessions' backups upon starting the server, so do not set it to start the server at boot.
    /etc/rc.d/minecraft
    #!/bin/bash
    # /etc/rc.d/minecraft
    . /etc/rc.conf
    . /etc/rc.d/functions
    #Uncomment line below if using Sun JRE
    #. /etc/profile
    #Settings
    SERVICE='minecraft_server.jar'
    USERNAME="minecraft"
    MCPATH='/home/minecraft/minecraft'
    MCOFFLINEPATH='/home/minecraft/backup'
    INVOCATION='java -Xmx768M -Xms768M -jar minecraft_server.jar nogui'
    BACKUPPATH='/home/minecraft/onlinebackup'
    ME=`whoami`
    as_user() {
    if [ "$ME" == "$USERNAME" ] ; then
    bash -c "$1"
    else
    su -c - $USERNAME "$1"
    fi
    mc_start() {
    stat_busy "Starting Minecraft Server"
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "Tried to start but $SERVICE was already running!"
    else
    echo "$SERVICE was not running... starting."
    #Move minecraft from backup folder to ram
    mount -t tmpfs tmpfs -o size=50m $MCPATH
    cp -a $MCOFFLINEPATH/* $MCPATH
    echo "Files moved to RAM."
    cd $MCPATH
    as_user "cd $MCPATH && screen -dmS minecraft $INVOCATION"
    sleep 7
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is now running."
    #Create hourly backups while running
    ln -s $MCPATH/onlinebackup /etc/cron.hourly/minecraftonlinebackup
    echo "Hourly backups initiated."
    else
    echo "Could not start $SERVICE."
    umount $MCPATH
    fi
    fi
    add_daemon minecraft
    stat_done
    mc_saveoff() {
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running... suspending saves."
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"say SERVER BACKUP STARTING. Server going readonly...\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-off\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-all\"\015'"
    sync
    sleep 10
    else
    echo "$SERVICE was not running. Not suspending saves."
    fi
    mc_saveon() {
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running... re-enabling saves."
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-on\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"say SERVER BACKUP ENDED. Server going read-write...\"\015'"
    else
    echo "$SERVICE was not running. Not resuming saves."
    fi
    mc_stop() {
    stat_busy "Stopping Minecraft Server"
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running... stopping."
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"say SERVER SHUTTING DOWN IN 10 SECONDS. Saving map...\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-all\"\015'"
    sleep 10
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"stop\"\015'"
    sleep 7
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE could not be shut down... still running."
    else
    echo "$SERVICE is shut down."
    #Stop hourly backups
    rm /etc/cron.hourly/minecraftonlinebackup
    echo "Hourly backup halted."
    #Unmount tmpfs
    cp -a $MCPATH/* $MCOFFLINEPATH
    umount $MCPATH
    echo "Files copied to HDD."
    fi
    else
    echo "$SERVICE was not running."
    fi
    rm_daemon minecraft
    stat_done
    mc_update() {
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running! Will not start update."
    else
    MC_SERVER_URL=http://minecraft.net/`wget -q -O - http://www.minecraft.net/download.jsp | grep minecraft_server.jar\</a\> | cut -d \" -f 2`
    as_user "cd $MCPATH && wget -q -O $MCPATH/minecraft_server.jar.update $MC_SERVER_URL"
    if [ -f $MCPATH/minecraft_server.jar.update ]
    then
    if `diff $MCPATH/minecraft_server.jar $MCPATH/minecraft_server.jar.update >/dev/null`
    then
    echo "You are already running the latest version of $SERVICE."
    else
    as_user "mv $MCPATH/minecraft_server.jar.update $MCPATH/minecraft_server.jar"
    echo "Minecraft successfully updated."
    fi
    else
    echo "Minecraft update could not be downloaded."
    fi
    fi
    mc_backup() {
    echo "Backing up minecraft world"
    if [ -d $BACKUPPATH/world_`date "+%m.%d.%Y"` ]
    then
    for i in 1 2 3 4 5 6
    do
    if [ -d $BACKUPPATH/world_`date "+%m.%d.%Y"`-$i ]
    then
    continue
    else
    as_user "cd $MCPATH && cp -r world $BACKUPPATH/world_`date "+%m.%d.%Y"`-$i"
    break
    fi
    done
    else
    as_user "cd $MCPATH && cp -r world $BACKUPPATH/world_`date "+%m.%d.%Y"`"
    echo "Backed up world"
    fi
    echo "Backing up the minecraft server executable"
    if [ -f "$BACKUPPATH/minecraft_server_`date "+%m.%d.%Y"`.jar" ]
    then
    for i in 1 2 3 4 5 6
    do
    if [ -f "$BACKUPPATH/minecraft_server_`date "+%m.%d.%Y"`-$i.jar" ]
    then
    continue
    else
    as_user "cd $MCPATH && cp minecraft_server.jar \"$BACKUPPATH/minecraft_server_`date "+%m.%d.%Y"`-$i.jar\""
    break
    fi
    done
    else
    as_user "cd $MCPATH && cp minecraft_server.jar \"$BACKUPPATH/minecraft_server_`date "+%m.%d.%Y"`.jar\""
    fi
    echo "Backup complete"
    #Start-Stop here
    case "$1" in
    start)
    mc_start
    stop)
    mc_stop
    restart)
    mc_stop
    mc_start
    update)
    mc_stop
    mc_backup
    mc_update
    mc_start
    backup)
    mc_saveoff
    mc_backup
    mc_saveon
    status)
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running."
    else
    echo "$SERVICE is not running."
    fi
    echo "Usage: /etc/rc.d/minecraft {start|stop|update|backup|status|restart}"
    exit 1
    esac
    exit 0
    /home/minecraft/backup/onlinebackup
    #!/bin/bash
    # /home/minecraft/backup/onlinebackup
    rm -rf /home/minecraft/onlinebackup/*
    /etc/rc.d/minecraft backup
    UPDATE:
    rationalOgre has created an alternate script with a different backup system, which will keep compressed copies of your world indefinitely, along with a working update function. https://bbs.archlinux.org/viewtopic.php … 97#p944797
    Last edited by PIMPinator (2011-06-08 14:00:54)

    @PIMPinator - Weird. On mine, if I don't source /etc/profile it won't work. No clue what the difference is. I tested it after I got it up and running, removing different elements to see if one or the other was the problem. Without it all in place it just didn't work.
    I made some modifications to your script today. Fixed "update" so it works properly. (You had it running mc_backup after mc_stop, which never worked on my system.) I basically reworked it so it runs the backup, then stops the server and performs the update in the ~/backup directory, then restarts the server. I also completely overhauled the "backup" system. (for this to work you have to comment out the rm -rf ~/onlinebackup/* directive in the onlinebackup script.) Now, it creates 4 rolling backups of the server, in tar.gz format. What this means is that over time, you will accumulate the last 4 backups for each day in your ~/onlinebackup folder. I thought about creating a cleanup function to cull anything over 2 days old but to be honest, even if your world was > 50MB, zipped up it's going to be about ~20mb which means you can have 50 of them and only be taking up a gig of server space. Anyway, here's the code if you are interested.
    #!/bin/bash
    # /etc/init.d/minecraft
    . /etc/rc.conf
    . /etc/rc.d/functions
    #Comment out the following if using OpenJDK
    . /etc/profile
    #Settings
    SERVICE='minecraft_server.jar'
    USERNAME="minecraft"
    MCPATH='/home/minecraft/minecraft'
    MCOFFLINEPATH='/home/minecraft/backup'
    INVOCATION='java -Xmx768M -Xms768M -jar minecraft_server.jar nogui'
    BACKUPPATH='/home/minecraft/onlinebackup'
    ME=`whoami`
    as_user() {
    if [ "$ME" == "$USERNAME" ] ; then
    bash -c "$1"
    else
    su -c - $USERNAME "$1"
    fi
    mc_start() {
    stat_busy "Starting Minecraft Server"
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "Tried to start but $SERVICE was already running!"
    else
    echo "$SERVICE was not running... starting."
    #Move minecraft from backup folder to ram
    mount -t tmpfs tmpfs -o size=50m $MCPATH
    cp -a $MCOFFLINEPATH/* $MCPATH
    echo "Files moved to RAM."
    cd $MCPATH
    as_user "cd $MCPATH && screen -dmS minecraft $INVOCATION"
    sleep 7
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is now running."
    #Create hourly backups while running
    ln -s $MCPATH/onlinebackup /etc/cron.hourly/minecraftonlinebackup
    echo "Hourly backups initiated."
    else
    echo "Could not start $SERVICE."
    umount $MCPATH
    fi
    fi
    add_daemon minecraft
    stat_done
    mc_saveoff() {
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running... suspending saves."
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"say SERVER BACKUP STARTING. Server going readonly...\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-off\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-all\"\015'"
    sync
    sleep 10
    else
    echo "$SERVICE was not running. Not suspending saves."
    fi
    mc_saveon() {
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running... re-enabling saves."
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-on\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"say SERVER BACKUP ENDED. Server going read-write...\"\015'"
    else
    echo "$SERVICE was not running. Not resuming saves."
    fi
    mc_stop() {
    stat_busy "Stopping Minecraft Server"
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running... stopping."
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"say SERVER SHUTTING DOWN IN 10 SECONDS. Saving map...\"\015'"
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"save-all\"\015'"
    sleep 10
    as_user "screen -p 0 -S minecraft -X eval 'stuff \"stop\"\015'"
    sleep 7
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE could not be shut down... still running."
    else
    echo "$SERVICE is shut down."
    #Stop hourly backups
    rm /etc/cron.hourly/minecraftonlinebackup
    echo "Hourly backup halted."
    #Unmount tmpfs
    cp -a $MCPATH/* $MCOFFLINEPATH
    umount $MCPATH
    echo "Files copied to HDD."
    fi
    else
    echo "$SERVICE was not running."
    fi
    rm_daemon minecraft
    stat_done
    mc_update() {
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running! Will not start update."
    else
    MC_SERVER_URL=http://minecraft.net/`wget -q -O - http://www.minecraft.net/download.jsp | grep minecraft_server.jar\</a\> | cut -d \" -f 2`
    as_user "cd $MCOFFLINEPATH && wget -q -O $MCOFFLINEPATH/minecraft_server.jar.update $MC_SERVER_URL"
    if [ -f $MCOFFLINEPATH/minecraft_server.jar.update ]
    then
    if `diff $MCOFFLINEPATH/minecraft_server.jar $MCOFFLINEPATH/minecraft_server.jar.update >/dev/null`
    then
    echo "You are already running the latest version of $SERVICE."
    rm $MCOFFLINEPATH/minecraft_server.jar.update
    else
    as_user "mv $MCOFFLINEPATH/minecraft_server.jar.update $MCOFFLINEPATH/minecraft_server.jar"
    echo "Minecraft successfully updated."
    fi
    else
    echo "Minecraft update could not be downloaded."
    fi
    fi
    mc_backup() {
    echo "Backing up minecraft world"
    local COUNTER=
    if [ -f $BACKUPPATH/co ]
    then
    COUNTER=`cat $BACKUPPATH/co`
    if [ $COUNTER -gt 4 ]
    then
    #Loop back to 1 if greater than the max number of desired saves (4 hardcoded)
    as_user "echo 1 > $BACKUPPATH/co"
    COUNTER=1
    fi
    else
    COUNTER=1
    as_user "echo 1 > $BACKUPPATH/co"
    fi
    if [ -f $BACKUPPATH/world_`date "+%m.%d.%Y"`-$COUNTER.tar.gz ]
    then
    as_user "rm $BACKUPPATH/world_`date "+%m.%d.%Y"`-$COUNTER.tar.gz"
    fi
    as_user "cd $MCPATH && tar -czf $BACKUPPATH/world_`date "+%m.%d.%Y"`-$COUNTER.tar.gz world"
    #now to update the counter
    as_user "echo $(($COUNTER + 1)) > $BACKUPPATH/co"
    echo "Backup complete..."
    #Start-Stop here
    case "$1" in
    start)
    mc_start
    stop)
    mc_stop
    restart)
    mc_stop
    mc_start
    update)
    mc_saveoff
    mc_backup
    mc_saveon
    mc_stop
    mc_update
    mc_start
    backup)
    mc_saveoff
    mc_backup
    mc_saveon
    status)
    if ps ax | grep -v grep | grep -v -i SCREEN | grep $SERVICE > /dev/null
    then
    echo "$SERVICE is running."
    else
    echo "$SERVICE is not running."
    fi
    echo "Usage: /etc/rc.d/minecraft {start|stop|update|backup|status|restart}"
    exit 1
    esac
    exit 0
    I hope you don't mind.
    EDIT: Made a small change later that I came back and put in. If you are currently at the latest release it removes the .update file it created.
    Last edited by rationalOgre (2011-06-07 23:05:58)

  • Unable to access secondary subnet via VPN

    I am having a problem with clients accessing a secondary subnet via VPN.
    Clients on VPN are given the address on the 192.168.15.0 subnet. Once connected they can access 192.168.16.0 (Production subnet) fine, but are unable to access the 192.168.8.0 secondary subnet. If you are on the 192.168.16.0 subnet in the office you can access 192.168.8.0 subnet fine. The traffic is coming in via an ASA 5510 then traverses a Juniper firewall and a MPLS router to the secondary subnet. I'm not sure if it's a nat issue or not. Any help would be helpful.
    Below is the config of the ASA. Thank you in advance
    ASA Version 8.2(5)
    hostname charlotte
    domain-name tg.local
    enable password v4DuEgO1ZTlkUiaA encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.254.0 Peak10 description Peak10
    name 192.168.116.0 Charlotte_Phones description Charlotte_Phones
    name 192.168.15.0 Charlotte_SSL_VPN_Clients description Charlotte_SSL_VPN_Client                                                                                                                                                             s
    name 192.168.17.0 Charlotte_Wireless_Data description Charlotte_Wireless_Data
    name 192.168.117.0 Charlotte_Wireless_Phones description Charlotte_Wireless_Phon                                                                                                                                                             es
    name 192.168.5.0 Huntersville description Huntersville
    name 192.168.16.1 SRX_Gateway description Juniper_SRX
    name 192.168.108.0 Canton_Data description Canton_Data
    name 192.168.8.0 Canton_Phones description Canton_Phones
    name 192.168.9.0 Canton_Wireless_Data description Canton_Wireless_Data
    name 192.168.109.0 Canton_Wireless_Phones description Canton_Wireless_Phones
    name 192.168.16.4 TEST_IP description TEST_IP
    name 192.168.16.2 CantonGW description Canton GW 192.168.16.2
    name 192.168.5.1 HuntersvilleGW
    name 10.176.0.0 RS_Cloud description 10.176.0.0/12
    name 172.16.8.0 RS_172.16.8.0
    name 172.16.48.0 RS_172.16.48.0
    name 172.16.52.0 RS_172.16.52.0
    name 10.208.0.0 RS_Cloud_New
    name 10.178.0.0 RS_10.178.0.0 description Rackspace DEV servers
    name 10.178.0.6 RS_10.178.0.6
    name 172.16.20.0 RS_172.16.20.0
    interface Ethernet0/0
    nameif Outside
    security-level 0
    ip address 70.63.165.219 255.255.255.248
    interface Ethernet0/1
    nameif Inside
    security-level 100
    ip address 192.168.16.202 255.255.255.0
    interface Ethernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface Ethernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 100
    ip address 192.168.1.1 255.255.255.0
    management-only
    banner login ASA Login - Unauthorized access is prohibited
    banner login ASA Login - Unauthorized access is prohibited
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns domain-lookup Outside
    dns domain-lookup Inside
    dns domain-lookup management
    dns server-group DefaultDNS
    name-server 192.168.16.122
    name-server 8.8.8.8
    domain-name tg.local
    dns server-group defaultdns
    name-server 192.168.16.122
    domain-name tg.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object-group network DM_INLINE_NETWORK_2
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_3
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object Huntersville 255.255.255.0
    object-group network DM_INLINE_NETWORK_4
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object Huntersville 255.255.255.0
    object-group network DM_INLINE_NETWORK_10
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.48.0 255.255.252.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_7
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.48.0 255.255.240.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_8
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_9
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    object-group network DM_INLINE_NETWORK_11
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_12
    network-object RS_Cloud 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    object-group network DM_INLINE_NETWORK_13
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_14
    network-object RS_Cloud 255.240.0.0
    network-object RS_172.16.48.0 255.255.252.0
    network-object RS_172.16.52.0 255.255.252.0
    network-object RS_Cloud_New 255.240.0.0
    network-object RS_10.178.0.0 255.255.0.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object 172.16.0.0 255.255.252.0
    object-group network DM_INLINE_NETWORK_5
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    network-object 192.168.16.0 255.255.255.0
    network-object Charlotte_Wireless_Data 255.255.255.0
    network-object Canton_Phones 255.255.255.0
    network-object Canton_Data 255.255.255.0
    network-object Canton_Wireless_Data 255.255.255.0
    object-group network DM_INLINE_NETWORK_6
    network-object RS_Cloud 255.240.0.0
    network-object RS_Cloud_New 255.240.0.0
    network-object 172.16.0.0 255.255.252.0
    network-object RS_172.16.8.0 255.255.252.0
    network-object RS_172.16.20.0 255.255.252.0
    network-object 172.16.0.0 255.255.0.0
    network-object Canton_Phones 255.255.255.0
    object-group network tgnc074.tg.local
    object-group icmp-type DM_INLINE_ICMP_1
    icmp-object echo
    icmp-object echo-reply
    icmp-object traceroute
    icmp-object unreachable
    object-group service DM_INLINE_SERVICE_1
    service-object ip
    service-object tcp eq https
    object-group icmp-type DM_INLINE_ICMP_2
    icmp-object echo
    icmp-object echo-reply
    icmp-object traceroute
    icmp-object unreachable
    object-group service DM_INLINE_SERVICE_2
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_3
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    object-group network DM_INLINE_NETWORK_1
    network-object Charlotte_SSL_VPN_Clients 255.255.255.0
    object-group service DM_INLINE_SERVICE_4
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_5
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group network DM_INLINE_NETWORK_15
    network-object Canton_Data 255.255.255.0
    network-object host CantonGW
    object-group service DM_INLINE_SERVICE_6
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    object-group service DM_INLINE_SERVICE_7
    service-object ip
    service-object icmp echo
    service-object icmp echo-reply
    service-object icmp traceroute
    service-object icmp unreachable
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_2 Ch                                                                                                                                                             arlotte_SSL_VPN_Clients 255.255.255.0 any
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_5 ho                                                                                                                                                             st SRX_Gateway Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_7 Ch                                                                                                                                                             arlotte_SSL_VPN_Clients 255.255.255.0 host SRX_Gateway
    access-list Inside_access_in extended permit icmp any any object-group DM_INLINE                                                                                                                                                             _ICMP_1
    access-list Inside_access_in remark Permit all in Char_ORD_VPN
    access-list Inside_access_in extended permit ip object-group DM_INLINE_NETWORK_7                                                                                                                                                              object-group DM_INLINE_NETWORK_8
    access-list Inside_access_in remark Permit all out Char_ORD_VPN
    access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_1 ob                                                                                                                                                             ject-group DM_INLINE_NETWORK_9 object-group DM_INLINE_NETWORK_10
    access-list Inside_access_in extended permit ip Charlotte_SSL_VPN_Clients 255.25                                                                                                                                                             5.255.0 any
    access-list Inside_access_in remark Permit all in Char_ORD_VPN
    access-list Inside_access_in remark Permit all out Char_ORD_VPN
    access-list Inside_access_in extended permit ip object-group DM_INLINE_NETWORK_9                                                                                                                                                              object-group DM_INLINE_NETWORK_10 log disable
    access-list Tunneled_Network_List standard permit 192.168.16.0 255.255.255.0
    access-list Tunneled_Network_List standard permit Charlotte_Phones 255.255.255.0                                                                                                                                                            
    access-list Tunneled_Network_List standard permit Charlotte_Wireless_Data 255.25                                                                                                                                                             5.255.0
    access-list Tunneled_Network_List standard permit Charlotte_Wireless_Phones 255.                                                                                                                                                             255.255.0
    access-list Tunneled_Network_List standard permit Peak10 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Data 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Phones 255.255.255.0
    access-list Tunneled_Network_List standard permit Canton_Wireless_Data 255.255.2                                                                                                                                                             55.0
    access-list Tunneled_Network_List standard permit Canton_Wireless_Phones 255.255                                                                                                                                                             .255.0
    access-list Tunneled_Network_List standard permit Huntersville 255.255.255.0
    access-list Tunneled_Network_List standard permit 172.16.0.0 255.255.252.0
    access-list Tunneled_Network_List standard permit RS_172.16.8.0 255.255.252.0
    access-list Tunneled_Network_List standard permit RS_Cloud 255.240.0.0
    access-list Tunneled_Network_List standard permit RS_Cloud_New 255.240.0.0
    access-list Tunneled_Network_List standard permit RS_172.16.20.0 255.255.252.0
    access-list Tunneled_Network_List standard permit Charlotte_SSL_VPN_Clients 255.                                                                                                                                                             255.255.0
    access-list Tunneled_Network_List standard permit 172.16.0.0 255.255.0.0
    access-list Inside_nat0_outbound extended permit ip Charlotte_SSL_VPN_Clients 25                                                                                                                                                             5.255.255.0 object-group DM_INLINE_NETWORK_2
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_11 object-group DM_INLINE_NETWORK_12
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_5 object-group DM_INLINE_NETWORK_6
    access-list Inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWO                                                                                                                                                             RK_1 object-group DM_INLINE_NETWORK_2
    access-list Limited_Access extended permit ip Charlotte_SSL_VPN_Clients 255.255.                                                                                                                                                             255.0 host TEST_IP
    access-list Limited__VPN_Acccess_List standard permit host 192.168.16.123
    access-list Limited__VPN_Acccess_List standard permit Huntersville 255.255.255.0                                                                                                                                                            
    access-list Limited__VPN_Acccess_List standard permit host 192.168.16.124
    access-list Limited__VPN_Acccess_List standard permit 192.168.16.0 255.255.255.0                                                                                                                                                            
    access-list Limited__VPN_Acccess_List standard permit host 172.16.8.52
    access-list Limited__VPN_Acccess_List standard permit Canton_Phones 255.255.255.                                                                                                                                                             0
    access-list Limited__VPN_Acccess_List remark ORD-VM-DEV1
    access-list Limited__VPN_Acccess_List standard permit host RS_10.178.0.6
    access-list Limited__VPN_Acccess_List remark ORD-VM-DEV2
    access-list Limited__VPN_Acccess_List standard permit host 10.178.192.103
    access-list Limited__VPN_Acccess_List standard permit host 192.168.8.10
    access-list Limited__VPN_Acccess_List standard permit RS_172.16.8.0 255.255.252.                                                                                                                                                             0
    access-list Limited__VPN_Acccess_List standard permit 172.16.0.0 255.255.0.0
    access-list Limited__VPN_Acccess_List standard permit host 10.178.133.26
    access-list Limited__VPN_Acccess_List standard permit RS_Cloud_New 255.240.0.0
    access-list Limited__VPN_Acccess_List standard permit host CantonGW
    access-list Limited__VPN_Acccess_List standard permit host SRX_Gateway
    access-list Limited__VPN_Acccess_List standard permit host 192.168.8.1
    access-list Limited__VPN_Acccess_List standard permit RS_Cloud 255.240.0.0
    access-list Limited__VPN_Acccess_List standard permit any
    access-list Limited__VPN_Acccess_List remark TGTFS
    access-list Limited__VPN_Acccess_List remark TGDEV
    access-list Limited__VPN_Acccess_List remark TGTFS
    access-list Limited__VPN_Acccess_List remark TGDEV
    access-list Outside_cryptomap extended permit ip 192.168.16.0 255.255.255.0 Huntersville 255.255.255.0
    access-list Outside_cryptomap extended permit ip Huntersville 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 Huntersville 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Huntersville 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Canton_Phones 255.255.255.0 Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Huntersville_nat_outbound extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 Canton_Phones 255.255.255.0
    access-list Outside_2_cryptomap extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
    access-list Outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_13 object-group DM_INLINE_NETWORK_14
    access-list Outside_access_in extended permit icmp any any object-group DM_INLINE_ICMP_2 log disable
    access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any Charlotte_SSL_VPN_Clients 255.255.255.0
    access-list Outside_access_in extended permit ip Huntersville 255.255.255.0 any log disable
    access-list Outside_access_in extended permit ip Charlotte_SSL_VPN_Clients 255.255.255.0 any log disable
    access-list Outside_access_in extended permit object-group DM_INLINE_SERVICE_4 host SRX_Gateway Charlotte_SSL_VPN_Clients 255.255.255.0 inactive
    access-list Outside_cryptomap_2 extended permit ip object-group DM_INLINE_NETWORK_5 object-group DM_INLINE_NETWORK_6
    access-list Outside_cryptomap_2 extended permit ip 192.168.16.0 255.255.255.0 RS_172.16.20.0 255.255.252.0
    access-list Canton_nat_outbound extended permit object-group DM_INLINE_SERVICE_6 Charlotte_SSL_VPN_Clients 255.255.255.0 object-group DM_INLINE_NETWORK_15
    access-list splitacl standard permit 192.168.16.0 255.255.255.0
    pager lines 24
    logging enable
    logging console emergencies
    logging monitor informational
    logging asdm informational
    mtu Outside 1500
    mtu Inside 1500
    mtu management 1500
    ip local pool SSL_VPN_Pool 192.168.15.10-192.168.15.254 mask 255.255.255.0
    ip local pool New_VPN_Pool 192.168.16.50-192.168.16.200 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any Inside
    no asdm history enable
    arp timeout 14400
    nat (Outside) 0 access-list Huntersville_nat_outbound
    nat (Inside) 0 access-list Inside_nat0_outbound
    access-group Outside_access_in in interface Outside
    access-group Inside_access_in in interface Inside
    route Outside 0.0.0.0 0.0.0.0 70.63.165.217 1
    route Inside Canton_Phones 255.255.255.0 CantonGW 1
    route Inside Canton_Wireless_Data 255.255.255.0 CantonGW 1
    route Inside Charlotte_SSL_VPN_Clients 255.255.255.0 SRX_Gateway 1
    route Inside Charlotte_Wireless_Data 255.255.255.0 SRX_Gateway 1
    route Inside Canton_Data 255.255.255.0 CantonGW 1
    route Inside Canton_Wireless_Phones 255.255.255.0 CantonGW 1
    route Inside Charlotte_Phones 255.255.255.0 SRX_Gateway 1
    route Inside 192.168.116.219 255.255.255.255 CantonGW 1
    route Inside Charlotte_Wireless_Phones 255.255.255.0 SRX_Gateway 1
    route Inside Peak10 255.255.255.0 SRX_Gateway 1
    timeout xlate 3:00:00
    timeout conn 8:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    dynamic-access-policy-record TGAD_AccessPolicy
    aaa-server TGAD protocol ldap
    aaa-server TGAD (Inside) host 192.168.16.122
    ldap-base-dn DC=tg,DC=local
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=vpn user,CN=Users,DC=tg,DC=local
    server-type microsoft
    aaa authentication ssh console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication http console LOCAL
    aaa authentication serial console LOCAL
    aaa authentication telnet console LOCAL
    aaa local authentication attempts max-fail 10
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.168.16.0 255.255.255.0 Inside
    http Charlotte_SSL_VPN_Clients 255.255.255.0 Inside
    no snmp-server location
    no snmp-server contact
    snmp-server community *****
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 1 match address Outside_cryptomap
    crypto map Outside_map0 1 set pfs
    crypto map Outside_map0 1 set peer 74.218.175.168
    crypto map Outside_map0 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 2 match address Outside_cryptomap_2
    crypto map Outside_map0 2 set peer 192.237.229.119
    crypto map Outside_map0 2 set transform-set ESP-3DES-MD5
    crypto map Outside_map0 3 match address Outside_cryptomap_1
    crypto map Outside_map0 3 set peer 174.143.192.65
    crypto map Outside_map0 3 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map Outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Outside_map0 interface Outside
    crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map Inside_map interface Inside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    subject-name CN=charlotte
    crl configure
    crypto ca trustpoint ASDM_TrustPoint1
    enrollment self
    subject-name CN=charlotte
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint1
    certificate 48676150
        3082024c 308201b5 a0030201 02020448 67615030 0d06092a 864886f7 0d010105
        05003038 31123010 06035504 03130963 6861726c 6f747465 31223020 06092a86
        4886f70d 01090216 13636861 726c6f74 74652e74 68696e6b 67617465 301e170d
        31323039 32353038 31373333 5a170d32 32303932 33303831 3733335a 30383112
        30100603 55040313 09636861 726c6f74 74653122 30200609 2a864886 f70d0109
        02161363 6861726c 6f747465 2e746869 6e6b6761 74653081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181008e d3e1ac63 a8a39dab 02170491
        2bf104d2 732c7fd7 7065758b 03bb9772 c8ab9faf 0e5e9e93 bfb57eea a849c875
        7899d261 8d426c37 9749d3d7 c86ca8e0 1d978069 3d43e7c5 569bb738 37e9bb31
        0ebd5065 01eb7a05 87933d2d 786a722e 8eee16e7 3207510b f5e7e704 cbddbda2
        a6b9ae45 efaba898 b8c921b6 2b05c0fb 1b0a9b02 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 8014fb93 35da7dd5 15d8e2ad 8e05ccf7 b5c333cc 95ac301d
        0603551d 0e041604 14fb9335 da7dd515 d8e2ad8e 05ccf7b5 c333cc95 ac300d06
        092a8648 86f70d01 01050500 03818100 6851ae52 5383c6f6 9e3ea714 85b2c5a0
        fd720959 a0b91899 806bad7a 08e2208e de22cad0 6692b09a 7152b21e 3bbfce68
        cc9f1391 8c460a04 a15e1a9e b18f829d 6d42d9bd ed5346bd 73a402f7 21e0c746
        02757fb6 b60405a9 ac3b9070 8c0f2fba d12f157b 85dd0a8b 2e9cf830 90a19412
        c7af1667 37b5ed8e c023ea4d 0c434609
      quit
    crypto isakmp enable Outside
    crypto isakmp enable Inside
    crypto isakmp policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 170
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    no vpn-addr-assign aaa
    no vpn-addr-assign dhcp
    vpn-addr-assign local reuse-delay 5
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 Outside
    ssh 172.221.228.164 255.255.255.255 Outside
    ssh Charlotte_SSL_VPN_Clients 255.255.255.0 Inside
    ssh 192.168.16.0 255.255.255.0 Inside
    ssh timeout 5
    console timeout 0
    management-access Inside
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ssl trust-point ASDM_TrustPoint1 Outside
    webvpn
    enable Outside
    enable Inside
    anyconnect-essentials
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1 regex "Windows NT"
    svc enable
    group-policy DfltGrpPolicy attributes
    dns-server value 192.168.16.122 8.8.8.8
    vpn-idle-timeout none
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Limited__VPN_Acccess_List
    default-domain value tg.local
    split-dns value tg.local
    group-policy LimitedAccessGroupPolicy internal
    group-policy LimitedAccessGroupPolicy attributes
    wins-server none
    dns-server value 192.168.16.122 8.8.8.8
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value Limited__VPN_Acccess_List
    default-domain value thinkgate.local
    split-tunnel-all-dns disable
    group-policy GroupPolicy2 internal
    group-policy GroupPolicy2 attributes
    vpn-tunnel-protocol IPSec
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    wins-server none
    dns-server value 192.168.16.122 8.8.8.8
    vpn-tunnel-protocol svc
    default-domain value tg.local
    group-policy Site-to-Site_Policy internal
    group-policy Site-to-Site_Policy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec
    tunnel-group DefaultRAGroup general-attributes
    default-group-policy LimitedAccessGroupPolicy
    tunnel-group DefaultWEBVPNGroup general-attributes
    address-pool SSL_VPN_Pool
    tunnel-group LimitedAccessTunnelGroup type remote-access
    tunnel-group LimitedAccessTunnelGroup general-attributes
    address-pool SSL_VPN_Pool
    default-group-policy LimitedAccessGroupPolicy
    tunnel-group 208.104.76.178 type ipsec-l2l
    tunnel-group 208.104.76.178 ipsec-attributes
    pre-shared-key *****
    tunnel-group 74.218.175.168 type ipsec-l2l
    tunnel-group 74.218.175.168 ipsec-attributes
    pre-shared-key *****
    tunnel-group TGAD_ConnectionProfile type remote-access
    tunnel-group TGAD_ConnectionProfile general-attributes
    authentication-server-group TGAD
    default-group-policy GroupPolicy1
    tunnel-group 174.143.192.65 type ipsec-l2l
    tunnel-group 174.143.192.65 general-attributes
    default-group-policy GroupPolicy2
    tunnel-group 174.143.192.65 ipsec-attributes
    pre-shared-key *****
    tunnel-group 192.237.229.119 type ipsec-l2l
    tunnel-group 192.237.229.119 ipsec-attributes
    pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:ef741b4905b43dc36d0f621e06508840
    : end
    charlotte#

    What does the packet-tracer say, what does the IPsec associations say (packets encrypted/decrypted)?
    This might be faster that going through your hundreds of lines of config.

  • Problem in weblogic sip server 3.1 ( Giving ssl exception )

    Hi All ,
    I am facing some issue while trying to run weblogic server it is saying "WLSTException: 'Error occured while performing nmConnect : Cannot connect to Node Manager.[Security:090542]Certificate chain received from" , I also tried the options -Dweblogic.security.TrustKeyStore=DemoTrust but nothing is helping , Below are the logs please help.
    wls:/offline> wls:/offline> Launching NodeManager ...
    Properties: {NodeManagerHome=/opt/bea/sipserver311/common/nodemanager,}
    Command: /opt/bea/jrockit-R27.5.0-jdk1.5.0_14/jre/bin/java -classpath /opt/bea/jrockit-R27.5.0-jdk1.5.0_14/jre/lib/rt.jar:/opt/bea/jrockit-R27.5.0-jdk1.5.0_14/jre/lib/i18n.jar:/opt/bea/patch_weblogic311/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/opt/bea/jrockit-R27.5.0-jdk1.5.0_14/lib/tools.jar:/opt/bea/sipserver311/server/lib/weblogic_sp.jar:/opt/bea/sipserver311/server/lib/weblogic.jar:/opt/bea/sipserver311/server/lib/wlss/sipservlet.jar:/opt/bea/sipserver311/server/lib/wlss/wlss.jar:/opt/bea/sipserver311/server/lib/wlss/wlss-descriptor-binding.jar:/opt/bea/sipserver311/server/lib/wlss/profile-service-descriptor-binding.jar:/opt/bea/sipserver311/server/lib/wlss/wlss-mbeaninfo.jar:/opt/bea/sipserver311/server/lib/wlss/wlss_i18n.jar:/opt/bea/sipserver311/server/lib/wlss/wlssechosvr.jar:/opt/bea/sipserver311/server/lib/wlss/wlssdiameter.jar:/opt/bea/sipserver311/server/lib/wlss/sctp.jar:/opt/bea/sipserver311/server/lib/webservices.jar weblogic.NodeManager
    NMProcess: <Apr 8, 2009 3:19:40 AM> <INFO> <Loading domains file: /opt/bea/sipserver311/common/nodemanager/nodemanager.domains>
    NMProcess: <Apr 8, 2009 3:19:43 AM> <INFO> <Loading identity key store: FileName=/opt/saurabh.jks, Type=jks, PassPhraseUsed=true>
    NMProcess: <Apr 8, 2009 3:19:44 AM> <INFO> <Loaded node manager configuration properties from '/opt/bea/sipserver311/common/nodemanager/nodemanager.properties'>
    NMProcess: <Apr 8, 2009 3:19:46 AM> <INFO> <Secure socket listener started on port 5556, host ari23bems>
    Successfully launched the Node Manager.
    The Node Manager process is running independent of the WLST process.
    Exiting WLST will not stop the Node Manager process. Please refer
    to the Node Manager logs for more information.
    The Node Manager logs will be under /opt/bea/sipserver311/common/nodemanager
    wls:/offline> Connecting to Node Manager ...
    <Apr 8, 2009 3:19:53 AM CDT> <Warning> <Security> <BEA-090542> <Certificate chain received from ari23bems - 10.82.23.11 was not trusted causing SSL handshake failure. Check the certificate chain to determine if it should be trusted or not. If it should be trusted, then update the client trusted CA configuration to trust the CA certificate that signed the peer certificate chain. If you are connecting to a WLS server that is using demo certificates (the default WLS server behavior), and you want this client to trust demo certificates, then specify -Dweblogic.security.TrustKeyStore=DemoTrust on the command line for this client.>
    Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 1379, in nmConnect
    WLSTException: 'Error occured while performing nmConnect : Cannot connect to Node Manager.[Security:090542]Certificate chain received from ari23bems - 10.82.23.11 was not trusted causing SSL handshake failure. Check the certificate chain to determine if it should be trusted or not. If it should be trusted, then update the client trusted CA configuration to trust the CA certificate that signed the peer certificate chain. If you are connecting to a WLS server that is using demo certificates (the default WLS server behavior), and you want this client to trust demo certificates, then specify -Dweblogic.security.TrustKeyStore=DemoTrust on the command line for this client. Use dumpStack() to view the full stacktrace'
    wls:/offline> NMProcess: <Apr 8, 2009 3:19:54 AM CDT> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from ari23bems - 10.82.23.11. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.>
    Not connected to Node Manager
    wls:/offline> NMProcess: <Apr 8, 2009 3:19:54 AM> <Warning> <Uncaught exception in server handler: javax.net.ssl.SSLKeyException: [Security:090482]BAD_CERTIFICATE alert was received from ari23bems - 10.82.23.11. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.>
    NMProcess: javax.net.ssl.SSLKeyException: [Security:090482]BAD_CERTIFICATE alert was received from ari23bems - 10.82.23.11. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.
    NMProcess: at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireException(Unknown Source)
    NMProcess: at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireAlertReceived(Unknown Source)
    NMProcess: at com.certicom.tls.record.alert.AlertHandler.handle(Unknown Source)
    NMProcess: at com.certicom.tls.record.alert.AlertHandler.handleAlertMessages(Unknown Source)
    NMProcess: at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
    NMProcess: at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
    NMProcess: at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.read(Unknown Source)
    NMProcess: at com.certicom.io.InputSSLIOStreamWrapper.read(Unknown Source)
    NMProcess: at sun.nio.cs.StreamDecoder$CharsetSD.readBytes(StreamDecoder.java:411)
    NMProcess: at sun.nio.cs.StreamDecoder$CharsetSD.implRead(StreamDecoder.java:453)
    NMProcess: at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:183)
    NMProcess: at java.io.InputStreamReader.read(InputStreamReader.java:167)
    NMProcess: at java.io.BufferedReader.fill(BufferedReader.java:136)
    NMProcess: at java.io.BufferedReader.readLine(BufferedReader.java:299)
    NMProcess: at java.io.BufferedReader.readLine(BufferedReader.java:362)
    NMProcess: at weblogic.nodemanager.server.Handler.run(Handler.java:66)
    NMProcess: at java.lang.Thread.run(Thread.java:595)
    NMProcess:
    Connecting to t3s://ari23bems:7002 with userid saurabhAdmin ...
    Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 22, in connect
    WLSTException: 'Error occured while performing connect : Error getting the initial context. There is no server running at t3s://ari23bems:7002 Use dumpStack() to view the full stacktrace'
    wls:/offline> Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 1250, in start
    WLSTException: 'Error occured while performing start : Error starting the serverError occured while performing start : You should be connected to an admin server or a NM to start a server Use dumpStack() to view the full stacktrace'
    wls:/offline> Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 1250, in start
    WLSTException: 'Error occured while performing start : Error starting the serverError occured while performing start : You should be connected to an admin server or a NM to start a server Use dumpStack() to view the full stacktrace'
    wls:/offline>
    Exiting WebLogic Scripting Tool.

    Hi All ,
    I am facing some issue while trying to run weblogic server it is saying "WLSTException: 'Error occured while performing nmConnect : Cannot connect to Node Manager.[Security:090542]Certificate chain received from" , I also tried the options -Dweblogic.security.TrustKeyStore=DemoTrust but nothing is helping , Below are the logs please help.
    wls:/offline> wls:/offline> Launching NodeManager ...
    Properties: {NodeManagerHome=/opt/bea/sipserver311/common/nodemanager,}
    Command: /opt/bea/jrockit-R27.5.0-jdk1.5.0_14/jre/bin/java -classpath /opt/bea/jrockit-R27.5.0-jdk1.5.0_14/jre/lib/rt.jar:/opt/bea/jrockit-R27.5.0-jdk1.5.0_14/jre/lib/i18n.jar:/opt/bea/patch_weblogic311/profiles/default/sys_manifest_classpath/weblogic_patch.jar:/opt/bea/jrockit-R27.5.0-jdk1.5.0_14/lib/tools.jar:/opt/bea/sipserver311/server/lib/weblogic_sp.jar:/opt/bea/sipserver311/server/lib/weblogic.jar:/opt/bea/sipserver311/server/lib/wlss/sipservlet.jar:/opt/bea/sipserver311/server/lib/wlss/wlss.jar:/opt/bea/sipserver311/server/lib/wlss/wlss-descriptor-binding.jar:/opt/bea/sipserver311/server/lib/wlss/profile-service-descriptor-binding.jar:/opt/bea/sipserver311/server/lib/wlss/wlss-mbeaninfo.jar:/opt/bea/sipserver311/server/lib/wlss/wlss_i18n.jar:/opt/bea/sipserver311/server/lib/wlss/wlssechosvr.jar:/opt/bea/sipserver311/server/lib/wlss/wlssdiameter.jar:/opt/bea/sipserver311/server/lib/wlss/sctp.jar:/opt/bea/sipserver311/server/lib/webservices.jar weblogic.NodeManager
    NMProcess: <Apr 8, 2009 3:19:40 AM> <INFO> <Loading domains file: /opt/bea/sipserver311/common/nodemanager/nodemanager.domains>
    NMProcess: <Apr 8, 2009 3:19:43 AM> <INFO> <Loading identity key store: FileName=/opt/saurabh.jks, Type=jks, PassPhraseUsed=true>
    NMProcess: <Apr 8, 2009 3:19:44 AM> <INFO> <Loaded node manager configuration properties from '/opt/bea/sipserver311/common/nodemanager/nodemanager.properties'>
    NMProcess: <Apr 8, 2009 3:19:46 AM> <INFO> <Secure socket listener started on port 5556, host ari23bems>
    Successfully launched the Node Manager.
    The Node Manager process is running independent of the WLST process.
    Exiting WLST will not stop the Node Manager process. Please refer
    to the Node Manager logs for more information.
    The Node Manager logs will be under /opt/bea/sipserver311/common/nodemanager
    wls:/offline> Connecting to Node Manager ...
    <Apr 8, 2009 3:19:53 AM CDT> <Warning> <Security> <BEA-090542> <Certificate chain received from ari23bems - 10.82.23.11 was not trusted causing SSL handshake failure. Check the certificate chain to determine if it should be trusted or not. If it should be trusted, then update the client trusted CA configuration to trust the CA certificate that signed the peer certificate chain. If you are connecting to a WLS server that is using demo certificates (the default WLS server behavior), and you want this client to trust demo certificates, then specify -Dweblogic.security.TrustKeyStore=DemoTrust on the command line for this client.>
    Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 1379, in nmConnect
    WLSTException: 'Error occured while performing nmConnect : Cannot connect to Node Manager.[Security:090542]Certificate chain received from ari23bems - 10.82.23.11 was not trusted causing SSL handshake failure. Check the certificate chain to determine if it should be trusted or not. If it should be trusted, then update the client trusted CA configuration to trust the CA certificate that signed the peer certificate chain. If you are connecting to a WLS server that is using demo certificates (the default WLS server behavior), and you want this client to trust demo certificates, then specify -Dweblogic.security.TrustKeyStore=DemoTrust on the command line for this client. Use dumpStack() to view the full stacktrace'
    wls:/offline> NMProcess: <Apr 8, 2009 3:19:54 AM CDT> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from ari23bems - 10.82.23.11. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.>
    Not connected to Node Manager
    wls:/offline> NMProcess: <Apr 8, 2009 3:19:54 AM> <Warning> <Uncaught exception in server handler: javax.net.ssl.SSLKeyException: [Security:090482]BAD_CERTIFICATE alert was received from ari23bems - 10.82.23.11. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.>
    NMProcess: javax.net.ssl.SSLKeyException: [Security:090482]BAD_CERTIFICATE alert was received from ari23bems - 10.82.23.11. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.
    NMProcess: at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireException(Unknown Source)
    NMProcess: at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireAlertReceived(Unknown Source)
    NMProcess: at com.certicom.tls.record.alert.AlertHandler.handle(Unknown Source)
    NMProcess: at com.certicom.tls.record.alert.AlertHandler.handleAlertMessages(Unknown Source)
    NMProcess: at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
    NMProcess: at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
    NMProcess: at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
    NMProcess: at com.certicom.tls.record.ReadHandler.read(Unknown Source)
    NMProcess: at com.certicom.io.InputSSLIOStreamWrapper.read(Unknown Source)
    NMProcess: at sun.nio.cs.StreamDecoder$CharsetSD.readBytes(StreamDecoder.java:411)
    NMProcess: at sun.nio.cs.StreamDecoder$CharsetSD.implRead(StreamDecoder.java:453)
    NMProcess: at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:183)
    NMProcess: at java.io.InputStreamReader.read(InputStreamReader.java:167)
    NMProcess: at java.io.BufferedReader.fill(BufferedReader.java:136)
    NMProcess: at java.io.BufferedReader.readLine(BufferedReader.java:299)
    NMProcess: at java.io.BufferedReader.readLine(BufferedReader.java:362)
    NMProcess: at weblogic.nodemanager.server.Handler.run(Handler.java:66)
    NMProcess: at java.lang.Thread.run(Thread.java:595)
    NMProcess:
    Connecting to t3s://ari23bems:7002 with userid saurabhAdmin ...
    Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 22, in connect
    WLSTException: 'Error occured while performing connect : Error getting the initial context. There is no server running at t3s://ari23bems:7002 Use dumpStack() to view the full stacktrace'
    wls:/offline> Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 1250, in start
    WLSTException: 'Error occured while performing start : Error starting the serverError occured while performing start : You should be connected to an admin server or a NM to start a server Use dumpStack() to view the full stacktrace'
    wls:/offline> Traceback (innermost last):
    File "<console>", line 1, in ?
    File "<iostream>", line 1250, in start
    WLSTException: 'Error occured while performing start : Error starting the serverError occured while performing start : You should be connected to an admin server or a NM to start a server Use dumpStack() to view the full stacktrace'
    wls:/offline>
    Exiting WebLogic Scripting Tool.

  • Problem validate the input payload in a bpel process

    Hi
    I am trying to validate the input payload in a bpel process and need to catch the exact validation error . I am using the validate activity or validate property
    I am getting the error as
    <process>
    <main (80)>
    receiveInput (pending)
    Jun 21, 2013 12:24:57 PM Invalid data: The value for variable "inputVariable", part "payload" does not match the schema definition for this part Invalid text 'Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)Final cure time (Posn7)' in element: 'PARAM_NAME'. The invalid xml document is shown below:
    <payload>
    <catchAll (60)>
    Unable to handle the error.  Please help me if anybody handled this validation.
    Thanks in advance
    kalyani

    One of the issues with using the validate activity in BPEL is that when the error is thrown it throws it with little information.  Mediators however give much more information as they throw a remote exception and this can be caught. If you require detailed fault information to be sent back to the caller, then one solution is to use a mediator with validation as a callout (echo service etc).  Then catch the remote exception, this will give you more information in the fault payload. 

  • Issue with Axis WebService.

    Hi,
    I have written a web service, which accepts two strings as parameter(echoService method). And created WSDD file for the same and it works fine. Then I created a webservice which supports attachments, this code also works fine. When I merge this two WebServices and try to invoke "echoService" from client code, I am getting the following error.
    java.io.IOException: Type {ElementService}DataHandler is referenced but not defined.I assume, its the problem with the wsdd file "typeMapping". Please let me know if I am right or wrong? Also let me know the solution for the same.
    Regards,
    Vaishakh
    Code is below:
    ElementService.java (Web Service Code)
    public class ElementService {
        public String echoService(String command, String data) {
            System.out.println("Echo Service [" + command + "] Data [" + Data + "]");      
            return "Success;
        public Object getDimeData(DataHandler dh) throws InputValidationException, AttachmentServiceException {
            MessageContext msgContext = MessageContext.getCurrentContext();
            Message rspmsg = msgContext.getResponseMessage();
            log.info("org.apache.axis.attachments.Attachments.SEND_TYPE_DIME : " + org.apache.axis.attachments.Attachments.SEND_TYPE_DIME);
            int inputAttachmentType = rspmsg.getAttachmentsImpl().getSendType();
            log.info("inputAttachmentType : " + inputAttachmentType);
            if (inputAttachmentType != Attachments.SEND_TYPE_DIME) {
                String failMsg = "Attachment passed is not a DIME attachment, please check.";
                throw new InputValidationException("Invalid input data error : " + failMsg);
            String inputStr = getInputString(dh);
            //Do some process with the input String and construct an output String.
            //Since the processing is out of context for our disucussion,
            //just an output xml String from a file is returned.
            String result = null;
            try {
                result = "Successfully Read the input file";
            } catch (IOException e) {
                String errorMsg = "Error occured while sending the output xml in DIME format.";
                log.error(errorMsg, e);
                throw new AttachmentServiceException(errorMsg, e);
            log.info("setting the DIME type of attachment as the sender sends it as DIME.");
            rspmsg.getAttachmentsImpl().setSendType(org.apache.axis.attachments.Attachments.SEND_TYPE_DIME);
            ByteArrayDataSource dataSource = new ByteArrayDataSource(result, "UTF-8");
            dh = new DataHandler(dataSource);
            return dh;
    {code}
    deploy.wsdd file
    {code}
    <deployment xmlns="http://xml.apache.org/axis/wsdd/"  xmlns:java="http://xml.apache.org/axis/wsdd/providers/java"
                xmlns:xsi="http://www.w3.org/2000/10/XMLSchema-instance"   xmlns:apachesoap="http://xml.apache.org/xml-soap"
                xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
                xmlns:wsdlsoap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                xmlns:ns1="ElementService">
        <service name="ElementService" provider="java:RPC">
            <parameter name="alias" value="ElementService"/>
            <parameter name="className" value="com.ws.ElementService"/>
            <parameter name="allowedMethods" value="*"/>
            <parameter name="scope" value="session"/>
            <operation name="getDimeData" returnQName="returnqname" returnType="ns1:DataHandler">
                <parameter name="dh" type="ns1:DataHandler"/>
            </operation>
            <typeMapping deserializer="org.apache.axis.encoding.ser.JAFDataHandlerDeserializerFactory"
                         languageSpecificType="java:javax.activation.DataHandler" qname="ns1:DataHandler"
                         serializer="org.apache.axis.encoding.ser.JAFDataHandlerSerializerFactory"
                         encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/>
        </service>
    </deployment>
    {code}                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

    this isn't an axis forum, it is a java forum. you're probably better off asking this question in an axis specific forum.
    that said, unless you are required to use axis for this project, i'd look into using JAX-WS. it is integrated into the jdk and much simpler (IMO) to use. plus, you'll get better help in these forums if you are using it.

Maybe you are looking for

  • Error while scheduling Delta init

    Hi, I am getting following error when i schedule data What happened?     The current ABAP program had to be terminated because the     ABAP processor detected an internal system error.     The current ABAP program "SAPLRSSM" had to be terminated beca

  • 2004 eMac won't start in 10.3.9, is there a way to get 10.5 onto it from DL DVD-R?

    Hi folks. I'm trying to set up this ancient eMac for my mom. It had been running 10.3 or something, but I seem tyo recall it being wierd in that I couldn't get Safari (of all things) to run on it. So the other day, I put it in target disk mode and us

  • Non latin 1 .CSV support ?

    Hello, When I enable .csv export in my reports everything work fine with latin1 languages. For non-latin1 languages (Russian for example) the .csv export contains ¿¿ (BF hex). The APEX application displays the non-latin1 strings correctly. The "Autom

  • Video format supported - Nokia N95

    Hi, Maybe I can be wrong, but I think that I have moved a MPEG video into Nokia N95 and it worked fine. However, I tried to do the same thing with another video file (mpeg) and it didnt work, Nokia N95 didnt recognize the file. I dont know if the rea

  • It appears everybody loves the new Quick Look. I hate it. Maybe I'm wrong?

    One of my biggest gripes with Quick Look is the apparent inability to drag open the window and click through the images at their original size -- instead if the image is lower res than the size of the window it scales up and gets all pixelated. I LOV