ASA Version 8.2(5) ! hostname ciscoasa1 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names name 192.168.102.0 remote-network1 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.101.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address dhcp setroute ! ftp mode passive access-list outside_1_cryptomap extended permit ip 192.168.101.0 255.255.255.0 remote-network1 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.101.0 255.255.255.0 remote-network1 255.255.255.0 pager lines 24 logging asdm informational mtu inside 1500 mtu outside 1500 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 route outside remote-network1 255.255.255.0 192.168.6.15 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable http 192.168.101.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs group1 crypto map outside_map 1 set peer 192.168.6.15 crypto map outside_map 1 set transform-set ESP-3DES-SHA crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 telnet timeout 5 ssh 192.168.101.0 255.255.255.0 inside ssh timeout 60 ssh version 2 console timeout 0 dhcpd auto_config outside ! dhcpd address 192.168.101.5-192.168.101.36 inside dhcpd auto_config outside interface inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username xxx password 35w.8FGDu6vlKN9o encrypted tunnel-group 192.168.6.15 type ipsec-l2l tunnel-group 192.168.6.15 ipsec-attributes pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous Cryptochecksum:4e10ace58c98039f796e1f83adef4fa1 : end ciscoasa1# sh ip System IP Addresses: Interface Name IP address Subnet mask Method Vlan1 inside 192.168.101.1 255.255.255.0 CONFIG Vlan2 outside 192.168.6.70 255.255.255.0 DHCP Current IP Addresses: Interface Name IP address Subnet mask Method Vlan1 inside 192.168.101.1 255.255.255.0 CONFIG Vlan2 outside 192.168.6.70 255.255.255.0 DHCP ciscoasa1# sh route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is 192.168.6.1 to network 0.0.0.0 C 192.168.6.0 255.255.255.0 is directly connected, outside S remote-network1 255.255.255.0 [1/0] via 192.168.6.15, outside C 192.168.101.0 255.255.255.0 is directly connected, inside d* 0.0.0.0 0.0.0.0 [1/0] via 192.168.6.1, outside ciscoasa1# sh crypto isakmp sa Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey) Total IKE SA: 1 1 IKE Peer: 192.168.6.15 Type : L2L Role : initiator Rekey : no State : MM_ACTIVE ciscoasa1# sh crypto ipsec sa interface: outside Crypto map tag: outside_map, seq num: 1, local addr: 192.168.6.70 access-list outside_1_cryptomap extended permit ip 192.168.101.0 255.255.255.0 192.168.102.0 255.255.255.0 local ident (addr/mask/prot/port): (192.168.101.0/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (remote-network1/255.255.255.0/0/0) current_peer: 192.168.6.15 #pkts encaps: 17, #pkts encrypt: 17, #pkts digest: 17 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 17, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #send errors: 0, #recv errors: 0 local crypto endpt.: 192.168.6.70, remote crypto endpt.: 192.168.6.15 path mtu 1500, ipsec overhead 58, media mtu 1500 current outbound spi: E125C70E current inbound spi : E5DB4931 inbound esp sas: spi: 0xE5DB4931 (3856353585) transform: esp-3des esp-sha-hmac no compression in use settings ={L2L, Tunnel, PFS Group 1, } slot: 0, conn_id: 8192, crypto-map: outside_map sa timing: remaining key lifetime (kB/sec): (4374000/28628) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001 outbound esp sas: spi: 0xE125C70E (3777349390) transform: esp-3des esp-sha-hmac no compression in use settings ={L2L, Tunnel, PFS Group 1, } slot: 0, conn_id: 8192, crypto-map: outside_map sa timing: remaining key lifetime (kB/sec): (4373999/28628) IV size: 8 bytes replay detection support: Y Anti replay bitmap: 0x00000000 0x00000001