Ok, so as far as I can tell it isn't working at this moment, but it very well still may be working. The reason I say this is because right now I am sending ping requests from the remote site router to the LAN gateway on the ASA, which are failing. Therefore the ping request is coming from 10.1.1.2 (The serial int of the Router and ASA) rather than the actual LAN of 10.34.60.0. So right now it may be working fine, but I can't really test unless I have a host on the LAN of 10.34.60.0 ping a host on 10.25.102.0. Is that sound logic? I'll post the entire config below in case any other errors occur.
I see this error in sh log:
Jan 09 2012 01:08:16: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for udp src inside:10.25.102.20/59874 dst remotesite:10.34.60.106/161 denied due to NAT reverse path failure
ASA Version 8.2(2)
!
hostname ciscoasa
domain-name workgroup
enable password xxxxxxxxxxxxx
passwd xxxxxxxxxxxxxxx
names
!
interface Vlan1
nameif inside
security-level 100
ip address 10.25.102.245 255.255.255.0
!
interface Vlan783
nameif Internet
security-level 0
ip address x.x.x.194 255.255.255.252
!
interface Vlan789
nameif remotesite
security-level 100
ip address 10.1.1.1 255.255.255.252
!
interface Ethernet0/0
switchport trunk allowed vlan 783,789
switchport mode trunk
speed 10
duplex full
!
interface Ethernet0/1
!
ftp mode passive
dns server-group DefaultDNS
domain-name workgroup
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list ingress extended deny ip 0.0.0.0 0.255.255.255 any
access-list ingress extended deny ip 127.0.0.0 255.255.255.0 any
access-list ingress extended deny ip 169.254.0.0 255.255.0.0 any
access-list ingress extended deny ip 172.16.0.0 255.255.240.0 any
access-list ingress extended deny ip 192.0.2.0 255.255.255.0 any
access-list ingress extended deny ip 192.168.0.0 255.255.0.0 any
access-list ingress extended deny ip 224.0.0.0 255.255.255.224 any
access-list ingress extended permit tcp any host x.x.x.194 eq telnet
access-list ingress extended permit icmp any host x.x.x.194
access-list ingress extended deny ip any host x.x.x.194
access-list ingress extended permit ip any any
access-list inside_nat0_outbound extended permit ip 10.25.102.0 255.255.255.0 10.34.60.0 255.255.255.0
access-list egress extended permit ip any any
access-list remotesite extended permit ip any any
access-list capout extended permit ip host 10.34.60.62 any
access-list capout extended permit ip host 10.25.102.245 any
access-list capin extended permit ip host 10.25.102.60 any
pager lines 24
logging enable
logging timestamp
logging buffer-size 40960
logging monitor debugging
logging buffered debugging
logging trap informational
logging asdm informational
mtu inside 1500
mtu Internet 1500
mtu remotesite1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any Internet
icmp permit any remotesite
no asdm history enable
arp timeout 14400
global (inside) 11 interface
global (Internet) 1 interface
global (remotesite) 10 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.25.102.0 255.255.255.0
nat (inside) 1 0.0.0.0 0.0.0.0
nat (remotesite) 2 10.64.30.0 255.255.255.0
nat (remotesite) 1 0.0.0.0 0.0.0.0
static (inside,remotesite) 10.25.102.100 10.25.102.100 netmask 255.255.255.255
static (inside,remotesite) 10.1.1.100 10.1.1.100 netmask 255.255.255.255
static (remotesite,Internet) x.x.x.194 10.1.1.2 netmask 255.255.255.255
static (remotesite,remotesite) 10.34.60.0 10.34.60.0 netmask 255.255.255.0
access-group egress in interface inside
access-group ingress in interface Internet
access-group remotesite in interface remotesite
route Internet 0.0.0.0 0.0.0.0 204.186.244.193 1
route inside 10.25.102.0 255.255.255.0 10.25.102.145 1
route remotesite10.34.60.0 255.255.255.0 10.1.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
ssh x.x.x.0 255.255.255.0 Internet
ssh timeout 60
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:6d7f16bf3d9680b2b458c7ad9d6e1f62
: end
