ASA Version 9.8(4)35 ! names name 192.168.68.0 Net-NY10-SERVERS name 192.168.168.64 Net-NY10-NETWORK name 192.168.168.80 Network1 name 192.168.168.84 Network2 name 207.237.144.58 Net-TradeInfo1 name 65.51.211.2 Net-TradeInfo2 name 192.168.68.100 NS1 name 69.184.252.34 HostEx1 name 69.184.252.50 HostEx2 name 192.168.168.82 HostEx-inside1 name 192.168.168.86 HostEx-inside2 name 192.168.68.101 NS2 name 192.168.68.98 NY10-WIN-JUMPBOX name 192.168.68.90 NY10-vsyslog1 name 192.168.168.88 Network3 name 192.168.168.92 Network4 name 192.168.168.90 HostEx-inside3 name 192.168.168.94 HostEx-inside4 name 69.184.252.82 HostEx4 name 69.184.252.66 HostEx3 no mac-address auto ip local pool temppool 192.168.0.1-192.168.0.254 mask 255.255.255.0 ! interface GigabitEthernet1/1 description Trunk for providers, dmz1 and outside speed 1000 duplex full nameif outside security-level 0 ip address 163.75.18.6 255.255.255.252 ! interface GigabitEthernet1/2 description Inside-Interface speed 1000 duplex full nameif inside security-level 100 ip address 192.168.168.65 255.255.255.240 standby 192.168.168.68 ! interface GigabitEthernet1/2.68 vlan 68 nameif inside-68 security-level 100 ip address 192.168.68.253 255.255.255.0 standby 192.168.68.254 ! interface GigabitEthernet1/2.201 vlan 201 nameif segment-a security-level 55 ip address 192.168.168.81 255.255.255.252 ! interface GigabitEthernet1/2.202 vlan 202 nameif segment-b security-level 55 ip address 192.168.168.85 255.255.255.252 ! interface GigabitEthernet1/2.203 vlan 203 nameif segment-c security-level 55 ip address 192.168.168.89 255.255.255.252 ! interface GigabitEthernet1/2.204 vlan 204 nameif segment-d security-level 55 ip address 192.168.168.93 255.255.255.252 ! interface Management1/1 management-only no nameif no security-level no ip address ! boot system disk0:/asa984-35-lfbff-k8.SPA ftp mode passive clock timezone EST -5 clock summer-time EDT recurring dns domain-lookup outside dns domain-lookup inside-68 dns server-group DefaultDNS name-server 8.8.8.8 inside-68 name-server 8.8.4.4 outside name-server 1.1.1.1 domain-name tradeinformatics.com same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network NETWORK_OBJ_192.168.0.8_29 subnet 192.168.0.8 255.255.255.248 object network NETWORK_OBJ_192.168.0.0_24 subnet 192.168.0.0 255.255.255.0 object network obj-192.168.68.0 subnet 192.168.68.0 255.255.255.0 object-group network allSegments network-object Network1 255.255.255.252 network-object Network2 255.255.255.252 network-object Network3 255.255.255.252 network-object Network4 255.255.255.252 object-group service TradeInfo-Common tcp port-object eq ssh port-object eq telnet object-group network TI-DNS network-object host NS1 network-object host NS2 object-group service web tcp port-object eq www port-object eq https object-group service standard-start-tcp-udp tcp-udp port-object range 22 23 port-object range 9080 9083 port-object range 9090 9093 port-object range 12345 12349 port-object eq www port-object eq 443 port-object eq 8080 port-object eq 9443 port-object eq 9194 object-group network AllSegmentHosts network-object host HostEx1 network-object host HostEx2 network-object host 69.184.252.18 network-object host HostEx4 object-group protocol TCPUDP protocol-object udp protocol-object tcp access-list inside_access_out extended permit ip any4 any4 access-list split-tunnel standard permit 192.168.68.0 255.255.255.0 pager lines 24 logging enable logging timestamp no logging hide username logging standby logging emblem logging buffer-size 1048576 logging asdm-buffer-size 200 logging monitor informational logging buffered warnings logging trap informational logging history warnings logging asdm informational logging host inside-68 NY10-vsyslog1 mtu outside 1500 mtu dmz1 1500 mtu inside 1500 mtu inside-68 1500 mtu segment-a 1500 mtu segment-b 1500 mtu itg 1500 mtu outside2 1500 mtu segment-c 1500 mtu segment-d 1500 failover failover lan unit secondary failover lan interface folink GigabitEthernet1/8 failover polltime unit 1 holdtime 3 failover polltime interface 3 holdtime 15 failover key ***** failover replication http failover interface ip folink 192.168.2.1 255.255.255.0 standby 192.168.2.2 no failover wait-disable icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-7121.bin asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 16384 nat (inside-68,outside) source static obj-192.168.68.0 obj-192.168.68.0 destination static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 no-proxy-arp route-lookup nat (dmz1,outside) source static REDI_LOCAL REDI_LOCAL destination static REDI_REMOTE REDI_REMOTE no-proxy-arp nat (inside,outside) source dynamic any interface nat (inside-68,outside) source dynamic any interface nat (inside-68,inside) source dynamic any interface nat (inside,inside-68) source dynamic any interface nat (inside,outside2) source dynamic any interface nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.0.8_29 NETWORK_OBJ_192.168.0.8_29 no-proxy-arp route-lookup nat (inside-68,outside) source static any any destination static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 no-proxy-arp route-lookup nat (outside,dmz1) source dynamic any interface nat (outside2,dmz1) source dynamic any interface nat (inside-68,outside2) source dynamic any interface nat (inside,outside2) source static any any destination static NETWORK_OBJ_192.168.0.8_29 NETWORK_OBJ_192.168.0.8_29 no-proxy-arp route-lookup nat (inside-68,outside2) source static any any destination static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 no-proxy-arp route-lookup nat (dmz1,segment-a) source dynamic any interface nat (dmz1,segment-b) source dynamic any interface nat (segment-a,dmz1) source dynamic any interface nat (segment-b,dmz1) source dynamic any interface nat (dmz1,segment-c) source dynamic any interface nat (dmz1,segment-d) source dynamic any interface nat (segment-c,dmz1) source dynamic any interface nat (segment-d,dmz1) source dynamic any interface ! nat (dmz1,outside) after-auto source dynamic any interface nat (dmz1,outside2) after-auto source dynamic any interface access-group outside_access_in in interface outside access-group dmz_access_in in interface dmz1 access-group inside_access_out in interface inside access-group inside_access_out in interface inside-68 access-group outside_access_in in interface outside2 route outside 0.0.0.0 0.0.0.0 149.97.188.5 1 route segment-c 69.184.252.18 255.255.255.255 HostEx-inside3 1 route segment-a HostEx1 255.255.255.255 HostEx-inside1 1 route segment-b HostEx2 255.255.255.255 HostEx-inside2 1 route segment-d HostEx4 255.255.255.255 HostEx-inside4 1 route inside 192.168.168.0 255.255.255.0 192.168.168.66 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa authentication http console LOCAL aaa authentication login-history http server enable http 192.168.1.0 255.255.255.0 inside http Net-NY10-NETWORK 255.255.255.240 inside http Net-NY10-SERVERS 255.255.255.0 inside-68 http Net-NY10-SERVERS 255.255.255.0 inside http 192.168.0.0 255.255.255.0 inside-68 no snmp-server location no snmp-server contact service sw-reset-button telnet timeout 5 ssh stricthostkeycheck ssh 192.168.0.0 255.255.0.0 inside ssh Net-NY10-NETWORK 255.255.255.240 inside ssh Net-NY10-SERVERS 255.255.255.0 inside-68 ssh 192.168.0.0 255.255.0.0 inside-68 ssh timeout 30 ssh version 2 ssh key-exchange group dh-group1-sha1 console timeout 0 management-access inside-68 dhcpd dns 8.8.8.8 8.8.4.4 dhcpd lease 86400 ! dhcpd address 192.168.168.70-192.168.168.74 inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept tftp-server inside 10.10.10.5 / ssl trust-point ASDM_TrustPoint1 inside-68 webvpn enable outside hsts enable max-age 31536000 include-sub-domains no preload anyconnect image disk0:/anyconnect-win.pkg 1 anyconnect profiles AnyConnect1_client_profile disk1:/AnyConnect1_client_profile.xml anyconnect enable tunnel-group-list enable cache disable error-recovery disable group-policy DefaultRAGroup internal group-policy DefaultRAGroup attributes dns-server value 8.8.8.8 8.8.4.4 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec default-domain value tradeinformatics.com group-policy DfltGrpPolicy attributes dns-server value 8.8.8.8 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec default-domain value tradeinformatics.com group-policy GroupPolicy_AnyConnect1 internal group-policy GroupPolicy_AnyConnect1 attributes wins-server none dns-server value 8.8.8.8 8.8.4.4 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value split-tunnel default-domain value tradeinformatics.com webvpn anyconnect keep-installer installed anyconnect ssl rekey time 30 anyconnect ssl rekey method ssl anyconnect profiles value AnyConnect1_client_profile type user anyconnect ask none default anyconnect dynamic-access-policy-record DfltAccessPolicy network-acl inside_access_out webvpn http-proxy enable url-entry enable username admin password privilege 15 service-type nas-prompt ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect ip-options inspect icmp inspect tftp ! service-policy global_policy global prompt hostname priority state no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:781e51ccafa643fb5ae43d2d4cd3ead4 : end NY10-asa/sec/act#