Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
854
Views
0
Helpful
6
Replies

VPN Issue (going in circles)

Desmond Smith
Level 1
Level 1

‎01-17-2015 07:40 PM - edited ‎03-11-2019 10:21 PM

I am setting up vpn on an asa and I am receiving issue on the vpn client log and not able to connect.

 

Cisco Systems VPN Client Version 5.0.07.0290
Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 6.1.7601 Service Pack 1

529    22:33:31.510  01/17/15  Sev=Info/4 CM/0x63100002
Begin connection process

530    22:33:31.510  01/17/15  Sev=Info/4 CM/0x63100004
Establish secure connection

531    22:33:31.510  01/17/15  Sev=Info/4 CM/0x63100024
Attempt connection with server "209.156.70.82"

532    22:33:31.520  01/17/15  Sev=Info/6 IKE/0x6300003B
Attempting to establish a connection with 209.156.70.82.

533    22:33:31.520  01/17/15  Sev=Info/4 IKE/0x63000001
Starting IKE Phase 1 Negotiation

534    22:33:31.530  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 209.156.70.82

535    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

536    22:33:31.560  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from 209.156.70.82

537    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x63000001
Peer is a Cisco-Unity compliant peer

538    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x63000001
Peer supports XAUTH

539    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x63000001
Peer supports DPD

540    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x63000001
Peer supports NAT-T

541    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x63000001
Peer supports IKE fragmentation payloads

542    22:33:31.560  01/17/15  Sev=Info/6 IKE/0x63000001
IOS Vendor ID Contruction successful

543    22:33:31.560  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 209.156.70.82

544    22:33:31.560  01/17/15  Sev=Info/6 IKE/0x63000055
Sent a keepalive on the IPSec SA

545    22:33:31.560  01/17/15  Sev=Info/4 IKE/0x63000083
IKE Port in use - Local Port =  0xE2D5, Remote Port = 0x1194

546    22:33:31.560  01/17/15  Sev=Info/5 IKE/0x63000072
Automatic NAT Detection Status:
   Remote end is NOT behind a NAT device
   This   end IS behind a NAT device

547    22:33:31.560  01/17/15  Sev=Info/4 CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

548    22:33:31.590  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

549    22:33:31.590  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 209.156.70.82

550    22:33:31.600  01/17/15  Sev=Info/6 GUI/0x63B00012
Authentication request attributes is 6h.

551    22:33:31.590  01/17/15  Sev=Info/4 CM/0x63100015
Launch xAuth application

552    22:33:31.810  01/17/15  Sev=Info/4 IPSEC/0x63700008
IPSec driver successfully started

553    22:33:31.810  01/17/15  Sev=Info/4 IPSEC/0x63700014
Deleted all keys

554    22:33:38.452  01/17/15  Sev=Info/4 CM/0x63100017
xAuth application returned

555    22:33:38.452  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 209.156.70.82

556    22:33:38.492  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

557    22:33:38.492  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 209.156.70.82

558    22:33:38.492  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 209.156.70.82

559    22:33:38.492  01/17/15  Sev=Info/4 CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

560    22:33:38.492  01/17/15  Sev=Info/5 IKE/0x6300005E
Client sending a firewall request to concentrator

561    22:33:38.492  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 209.156.70.82

562    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

563    22:33:38.522  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 209.156.70.82

564    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.33.1.10

565    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.255

566    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 192.168.9.49

567    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 192.168.9.70

568    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000

569    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000009

570    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #1
 subnet = 10.100.10.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

571    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #2
 subnet = 10.100.20.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

572    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #3
 subnet = 10.100.99.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

573    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #4
 subnet = 10.100.100.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

574    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #5
 subnet = 192.168.9.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

575    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #6
 subnet = 10.97.0.0
 mask = 255.255.0.0
 protocol = 0
 src port = 0
 dest port=0

576    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #7
 subnet = 10.98.0.0
 mask = 255.255.0.0
 protocol = 0
 src port = 0
 dest port=0

577    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #8
 subnet = 10.100.90.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

578    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000F
SPLIT_NET #9
 subnet = 192.168.5.0
 mask = 255.255.255.0
 protocol = 0
 src port = 0
 dest port=0

579    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000E
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = dekalb.local

580    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000

581    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000E
MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5520 Version 9.1(5) built by builders on Thu 27-Mar-14 09:36

582    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001

583    22:33:38.522  01/17/15  Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194

584    22:33:38.522  01/17/15  Sev=Info/4 CM/0x63100019
Mode Config data received

585    22:33:38.532  01/17/15  Sev=Info/4 IKE/0x63000056
Received a key request from Driver: Local IP = 10.33.1.10, GW IP = 209.156.70.82, Remote IP = 0.0.0.0

586    22:33:38.532  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 209.156.70.82

587    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

588    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 209.156.70.82

589    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x63000045
RESPONDER-LIFETIME notify has value of 86400 seconds

590    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x63000047
This SA has already been alive for 7 seconds, setting expiry to 86393 seconds from now

591    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

592    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO (FRAG) from 209.156.70.82

593    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

594    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO (FRAG) from 209.156.70.82

595    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

596    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO (FRAG) from 209.156.70.82

597    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x63000073
All fragments received.

598    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:INVALID_ID_INFO) from 209.156.70.82

599    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 209.156.70.82

600    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000049
Discarding IPsec SA negotiation, MsgID=EDCE11BF

601    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=84BEB19D3CEAD901 R_Cookie=26AA0A16C77539DB) reason = DEL_REASON_IKE_NEG_FAILED

602    22:33:38.562  01/17/15  Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82

603    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000058
Received an ISAKMP message for a non-active SA, I_Cookie=84BEB19D3CEAD901 R_Cookie=26AA0A16C77539DB

604    22:33:38.562  01/17/15  Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(Dropped) from 209.156.70.82

605    22:33:39.402  01/17/15  Sev=Info/4 IPSEC/0x63700014
Deleted all keys

606    22:33:41.958  01/17/15  Sev=Info/4 IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=84BEB19D3CEAD901 R_Cookie=26AA0A16C77539DB) reason = DEL_REASON_IKE_NEG_FAILED

607    22:33:41.958  01/17/15  Sev=Info/4 CM/0x63100012
Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_IKE_NEG_FAILED".  0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

608    22:33:41.958  01/17/15  Sev=Info/5 CM/0x63100025
Initializing CVPNDrv

609    22:33:42.963  01/17/15  Sev=Info/6 CM/0x63100046
Set tunnel established flag in registry to 0.

610    22:33:42.963  01/17/15  Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection

611    22:33:42.973  01/17/15  Sev=Info/4 IPSEC/0x63700014
Deleted all keys

612    22:33:42.973  01/17/15  Sev=Info/4 IPSEC/0x63700014
Deleted all keys

613    22:33:42.973  01/17/15  Sev=Info/4 IPSEC/0x63700014
Deleted all keys

614    22:33:42.973  01/17/15  Sev=Info/4 IPSEC/0x6370000A
IPSec driver successfully stopped

 

 

 

 

 

 

The abbreviated asa configuration is posted below:

 

 

crypto ipsec ikev1 transform-set VPNSET esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df OUTSIDE
crypto dynamic-map dynmap 10 set ikev1 transform-set VPNSET
crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
crypto map outside_map 2 match address outside_cryptomap_100
crypto map outside_map 2 set peer 208.52.150.212
crypto map outside_map 2 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map interface OUTSIDE
crypto ca trustpool policy
crypto isakmp identity address
crypto isakmp nat-traversal 19
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable OUTSIDE
crypto ikev1 enable OUTSIDE
crypto ikev1 enable podmgmt
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 35
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 28800
crypto ikev1 policy 40
 authentication crack
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 50
 authentication rsa-sig
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 60
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 70
 authentication crack
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 80
 authentication rsa-sig
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 90
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 100
 authentication crack
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 110
 authentication rsa-sig
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 120
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 12.51.122.128 255.255.255.192 OUTSIDE
ssh 192.168.9.0 255.255.255.0 INSIDE
ssh 10.100.100.0 255.255.255.0 INSIDE
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 5
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 198.72.72.10
ntp server 131.144.4.9
webvpn
 anyconnect-essentials
group-policy GroupPolicy_208.52.150.212 internal
group-policy GroupPolicy_208.52.150.212 attributes
 vpn-tunnel-protocol ikev1
group-policy vpnclient internal
group-policy vpnclient attributes
 dns-server value 192.168.9.49 192.168.9.70
 vpn-idle-timeout 30
 vpn-tunnel-protocol ikev1
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value SPLITTUNNEL
 default-domain value dekalb.local
username desmond password e7vgeY2I.sLIZh42 encrypted
username dekalbclient password SqfhIEPdpx8xB2Wy encrypted
username DEKALBCLIENT password o/MUvFtAnDdZ14fy encrypted
username datacentricit password hzinLBkPZj/KKdq6 encrypted privilege 15
username admin password Gg0pyMC0m46RB7Jr encrypted privilege 15
tunnel-group vpnclient type remote-access
tunnel-group vpnclient general-attributes
 address-pool VPNUSERS
 authentication-server-group (OUTSIDE) LOCAL
 default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group DEKALBCLIENT type remote-access
tunnel-group DEKALBCLIENT general-attributes
 address-pool VPNUSERS
 authentication-server-group (OUTSIDE) NT LOCAL
 default-group-policy vpnclient
tunnel-group DEKALBCLIENT ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group 208.52.150.212 type ipsec-l2l
tunnel-group 208.52.150.212 general-attributes
 default-group-policy GroupPolicy_208.52.150.212
tunnel-group 208.52.150.212 ipsec-attributes
 ikev1 pre-shared-key *****
 ikev2 remote-authentication pre-shared-key *****
 ikev2 local-authentication pre-shared-key *****
!
class-map http-mss-map
 match access-list http-mss-permit
class-map IPS
 match access-list IPS
class-map inspection_default
 match default-inspection-traffic
class-map class-conn-param-tcp-01
 match access-list acl-conn-param-tcp-01
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map policy-conn-param-INSIDE
 class class-conn-param-tcp-01
  set connection per-client-embryonic-max 100
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect xdmcp
  inspect icmp
  inspect icmp error
  inspect ip-options
 class http-mss-map
  set connection advanced-options mss-map
 class IPS
  ips inline fail-open
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:84320a97cc93e055b72c77a14ef6868e
: end
 

Any help is appreciated!