Also here is my config...
: Saved
:
ASA Version 8.4(2)
!
hostname ACS-000-ROU2
domain-name MYDOMAIN
enable password *******
passwd ****** encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 21
!
interface Ethernet0/3
switchport access vlan 31
!
interface Ethernet0/4
switchport access vlan 41
!
interface Ethernet0/5
switchport access vlan 100
shutdown
!
interface Ethernet0/6
switchport access vlan 100
shutdown
!
interface Ethernet0/7
switchport trunk allowed vlan 1,31
switchport mode trunk
!
interface Vlan1
description My Business Name local area network
nameif inside
security-level 100
ip address 10.71.1.1 255.255.255.0
!
interface Vlan2
description All outgoing traffic to the internet
nameif outside
security-level 0
ip address 12.12.30.30 255.255.255.224
!
interface Vlan21
description DMZed FTP server
nameif dmz_ftp
security-level 50
ip address 10.71.5.1 255.255.255.0
!
interface Vlan31
description Corporate local area network
nameif corp
security-level 10
ip address 10.71.3.1 255.255.255.0
!
interface Vlan41
description SCCA hardline to VPN on Cisco 800 series router
nameif scca
security-level 5
ip address 10.22.161.2 255.255.255.0
!
boot system disk0:/asa842-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name MYDOMAIN
same-security-traffic permit intra-interface
object network ACS-000-APB2
host 10.71.1.11
description Arvo Bowen
object service 63210
service tcp source eq 63210
description 63210
object network ASA-INSIDE
host 10.71.1.1
description ASA 5505's inside IP address
object network LAN-INSIDE
subnet 10.71.1.0 255.255.255.0
description My Business Name local area network
object network LAN-VPN
subnet 10.71.2.0 255.255.255.0
description All VPN clients
object network ASA-SCCA
host 10.22.161.2
description ASA 5505's SCCA IP address
object network LAN-SCCA
subnet 10.22.0.0 255.255.0.0
description Scca 10.22.0.0 Network
object network LAN-DALLAS
subnet 10.8.0.0 255.255.0.0
description Dallas corp network
object network ACS-000-CIS1
host 10.71.1.35
object service 4899
service tcp source eq 4899
description 4899
object-group network DM_INLINE_NETWORK_1
network-object object LAN-SCCA
network-object object LAN-INSIDE
access-list outside_access_in extended permit ip host 16.15.62.5 object LAN-VPN inactive
access-list outside_access_in remark Tracking ICMP requests (pings/echos)
access-list outside_access_in extended permit icmp any object LAN-INSIDE
access-list outside_access_in remark All All traffic to get back to the inside LAN
access-list outside_access_in extended permit ip any object LAN-INSIDE
access-list scca_access_in extended permit ip object LAN-SCCA object LAN-VPN
access-list scca_access_in remark Allow traffic to come in from the 10.22.0.0 SCCA network
access-list scca_access_in extended permit ip object LAN-SCCA 10.71.1.0 255.255.255.0
access-list inside_access_in remark Allow any traffic to go outside to the internet from the inside LAN
access-list inside_access_in extended permit ip object LAN-INSIDE any
access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 object LAN-DALLAS
access-list vpn_sitetosite_dallas_in standard permit 10.71.1.0 255.255.255.0
access-list vpn_sitetosite_dallas_in standard permit host 10.22.0.0
access-list vpn_ciscoclient_in standard permit 10.71.1.0 255.255.255.0
access-list vpn_ciscoclient_in remark FEPS website
access-list vpn_ciscoclient_in standard permit host 16.15.62.5
pager lines 24
logging enable
logging asdm notifications
mtu inside 1500
mtu outside 1500
mtu dmz_ftp 1500
mtu corp 1500
mtu scca 1500
ip local pool GRM_VPN_IP_POOL 10.71.2.2-10.71.2.253
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
nat (inside,outside) source static ACS-000-APB2 interface service 63210 63210 description Port forward to ACS-000-APB2 box
nat (inside,outside) source static ACS-000-CIS1 interface service 4899 4899 description Port forward to ACS-000-CIS1 box
nat (inside,outside) source static LAN-INSIDE LAN-INSIDE destination static LAN-DALLAS LAN-DALLAS route-lookup description Exempt NAT rule for traffic from the inside network to the Dallas network
nat (inside,outside) source static LAN-INSIDE LAN-INSIDE destination static LAN-VPN LAN-VPN route-lookup description Exempt NAT rule for traffic from the inside network to the VPN clients
nat (outside,scca) source dynamic LAN-DALLAS interface destination static LAN-SCCA LAN-SCCA
nat (outside,scca) source dynamic LAN-VPN interface destination static LAN-SCCA LAN-SCCA
nat (inside,scca) source dynamic LAN-INSIDE interface destination static LAN-SCCA LAN-SCCA description PAT traffic going from the inside LAN to the scca LAN giving the LAN the same IP as the router
nat (inside,outside) source dynamic LAN-INSIDE interface description PAT traffic going from the inside network to the internet giving the LAN the same IP as the router
nat (outside,outside) source dynamic LAN-VPN interface description PAT traffic from the VPN clients to the internet giving the VPN client the office IP address
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group scca_access_in in interface scca
route outside 0.0.0.0 0.0.0.0 12.12.30.1 255
route scca 10.22.0.0 255.255.0.0 10.22.161.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server GRM_AUTH_GROUP protocol kerberos
aaa-server GRM_AUTH_GROUP (inside) host 10.71.1.3
kerberos-realm MYDOMAIN
user-identity default-domain LOCAL
http server enable
http 10.71.1.0 255.255.255.0 inside
http 10.71.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-3DES-MD5 ESP-AES-128-SHA
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 16.0.4.5
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ACS_NORCROSS
enrollment self
subject-name O=My Business Name,C=US,St=GA,L="MyLocation"
keypair mydomainname
proxy-ldc-issuer
crl configure
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 1
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcpd auto_config outside
!
dhcpd address 10.71.1.5-10.71.1.132 inside
!
threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev2 ssl-clientless
group-policy VPN_SITETOSITE_DALLAS_POLICY internal
group-policy VPN_SITETOSITE_DALLAS_POLICY attributes
vpn-idle-timeout 30
vpn-filter value vpn_sitetosite_dallas_in
ipv6-vpn-filter none
vpn-tunnel-protocol ikev1
group-policy VPN_CISCOCLIENT_POLICY internal
group-policy VPN_CISCOCLIENT_POLICY attributes
banner none
dns-server value 10.71.1.3
vpn-idle-timeout 30
vpn-filter value vpn_ciscoclient_in
ipv6-vpn-filter none
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn_ciscoclient_in
default-domain value MYDOMAIN
split-tunnel-all-dns disable
address-pools value GRM_VPN_IP_POOL
ipv6-address-pools none
username Administrator password ******** nt-encrypted privilege 15
tunnel-group CONORCROSS type remote-access
tunnel-group CONORCROSS general-attributes
address-pool GRM_VPN_IP_POOL
authentication-server-group GRM_AUTH_GROUP
default-group-policy VPN_CISCOCLIENT_POLICY
tunnel-group CONORCROSS ipsec-attributes
ikev1 pre-shared-key *****
ikev1 trust-point ACS_NORCROSS
tunnel-group 16.0.4.5 type ipsec-l2l
tunnel-group 16.0.4.5 general-attributes
default-group-policy VPN_SITETOSITE_DALLAS_POLICY
tunnel-group 16.0.4.5 ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class class-default
user-statistics accounting
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:9a7c5e3e000c424388b56b79f4f17248
: end
asdm image disk0:/asdm-645.bin
no asdm history enable
