01-17-2015 07:40 PM - edited 03-11-2019 10:21 PM
I am setting up vpn on an asa and I am receiving issue on the vpn client log and not able to connect.
Cisco Systems VPN Client Version 5.0.07.0290
Copyright (C) 1998-2010 Cisco Systems, Inc. All Rights Reserved.
Client Type(s): Windows, WinNT
Running on: 6.1.7601 Service Pack 1
529 22:33:31.510 01/17/15 Sev=Info/4 CM/0x63100002
Begin connection process
530 22:33:31.510 01/17/15 Sev=Info/4 CM/0x63100004
Establish secure connection
531 22:33:31.510 01/17/15 Sev=Info/4 CM/0x63100024
Attempt connection with server "209.156.70.82"
532 22:33:31.520 01/17/15 Sev=Info/6 IKE/0x6300003B
Attempting to establish a connection with 209.156.70.82.
533 22:33:31.520 01/17/15 Sev=Info/4 IKE/0x63000001
Starting IKE Phase 1 Negotiation
534 22:33:31.530 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 209.156.70.82
535 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
536 22:33:31.560 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from 209.156.70.82
537 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x63000001
Peer is a Cisco-Unity compliant peer
538 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x63000001
Peer supports XAUTH
539 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x63000001
Peer supports DPD
540 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x63000001
Peer supports NAT-T
541 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x63000001
Peer supports IKE fragmentation payloads
542 22:33:31.560 01/17/15 Sev=Info/6 IKE/0x63000001
IOS Vendor ID Contruction successful
543 22:33:31.560 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 209.156.70.82
544 22:33:31.560 01/17/15 Sev=Info/6 IKE/0x63000055
Sent a keepalive on the IPSec SA
545 22:33:31.560 01/17/15 Sev=Info/4 IKE/0x63000083
IKE Port in use - Local Port = 0xE2D5, Remote Port = 0x1194
546 22:33:31.560 01/17/15 Sev=Info/5 IKE/0x63000072
Automatic NAT Detection Status:
Remote end is NOT behind a NAT device
This end IS behind a NAT device
547 22:33:31.560 01/17/15 Sev=Info/4 CM/0x6310000E
Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
548 22:33:31.590 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
549 22:33:31.590 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 209.156.70.82
550 22:33:31.600 01/17/15 Sev=Info/6 GUI/0x63B00012
Authentication request attributes is 6h.
551 22:33:31.590 01/17/15 Sev=Info/4 CM/0x63100015
Launch xAuth application
552 22:33:31.810 01/17/15 Sev=Info/4 IPSEC/0x63700008
IPSec driver successfully started
553 22:33:31.810 01/17/15 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
554 22:33:38.452 01/17/15 Sev=Info/4 CM/0x63100017
xAuth application returned
555 22:33:38.452 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 209.156.70.82
556 22:33:38.492 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
557 22:33:38.492 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 209.156.70.82
558 22:33:38.492 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 209.156.70.82
559 22:33:38.492 01/17/15 Sev=Info/4 CM/0x6310000E
Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system
560 22:33:38.492 01/17/15 Sev=Info/5 IKE/0x6300005E
Client sending a firewall request to concentrator
561 22:33:38.492 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 209.156.70.82
562 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
563 22:33:38.522 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 209.156.70.82
564 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 10.33.1.10
565 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.255
566 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 192.168.9.49
567 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x63000010
MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 192.168.9.70
568 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000000
569 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SPLIT_INCLUDE (# of split_nets), value = 0x00000009
570 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #1
subnet = 10.100.10.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
571 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #2
subnet = 10.100.20.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
572 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #3
subnet = 10.100.99.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
573 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #4
subnet = 10.100.100.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
574 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #5
subnet = 192.168.9.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
575 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #6
subnet = 10.97.0.0
mask = 255.255.0.0
protocol = 0
src port = 0
dest port=0
576 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #7
subnet = 10.98.0.0
mask = 255.255.0.0
protocol = 0
src port = 0
dest port=0
577 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #8
subnet = 10.100.90.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
578 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000F
SPLIT_NET #9
subnet = 192.168.5.0
mask = 255.255.255.0
protocol = 0
src port = 0
dest port=0
579 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000E
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = dekalb.local
580 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000
581 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000E
MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5520 Version 9.1(5) built by builders on Thu 27-Mar-14 09:36
582 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001
583 22:33:38.522 01/17/15 Sev=Info/5 IKE/0x6300000D
MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194
584 22:33:38.522 01/17/15 Sev=Info/4 CM/0x63100019
Mode Config data received
585 22:33:38.532 01/17/15 Sev=Info/4 IKE/0x63000056
Received a key request from Driver: Local IP = 10.33.1.10, GW IP = 209.156.70.82, Remote IP = 0.0.0.0
586 22:33:38.532 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 209.156.70.82
587 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
588 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 209.156.70.82
589 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x63000045
RESPONDER-LIFETIME notify has value of 86400 seconds
590 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x63000047
This SA has already been alive for 7 seconds, setting expiry to 86393 seconds from now
591 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
592 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO (FRAG) from 209.156.70.82
593 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
594 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO (FRAG) from 209.156.70.82
595 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
596 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO (FRAG) from 209.156.70.82
597 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x63000073
All fragments received.
598 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:INVALID_ID_INFO) from 209.156.70.82
599 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 209.156.70.82
600 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000049
Discarding IPsec SA negotiation, MsgID=EDCE11BF
601 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion (I_Cookie=84BEB19D3CEAD901 R_Cookie=26AA0A16C77539DB) reason = DEL_REASON_IKE_NEG_FAILED
602 22:33:38.562 01/17/15 Sev=Info/5 IKE/0x6300002F
Received ISAKMP packet: peer = 209.156.70.82
603 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000058
Received an ISAKMP message for a non-active SA, I_Cookie=84BEB19D3CEAD901 R_Cookie=26AA0A16C77539DB
604 22:33:38.562 01/17/15 Sev=Info/4 IKE/0x63000014
RECEIVING <<< ISAKMP OAK INFO *(Dropped) from 209.156.70.82
605 22:33:39.402 01/17/15 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
606 22:33:41.958 01/17/15 Sev=Info/4 IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=84BEB19D3CEAD901 R_Cookie=26AA0A16C77539DB) reason = DEL_REASON_IKE_NEG_FAILED
607 22:33:41.958 01/17/15 Sev=Info/4 CM/0x63100012
Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_IKE_NEG_FAILED". 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system
608 22:33:41.958 01/17/15 Sev=Info/5 CM/0x63100025
Initializing CVPNDrv
609 22:33:42.963 01/17/15 Sev=Info/6 CM/0x63100046
Set tunnel established flag in registry to 0.
610 22:33:42.963 01/17/15 Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection
611 22:33:42.973 01/17/15 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
612 22:33:42.973 01/17/15 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
613 22:33:42.973 01/17/15 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
614 22:33:42.973 01/17/15 Sev=Info/4 IPSEC/0x6370000A
IPSec driver successfully stopped
The abbreviated asa configuration is posted below:
crypto ipsec ikev1 transform-set VPNSET esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df OUTSIDE
crypto dynamic-map dynmap 10 set ikev1 transform-set VPNSET
crypto dynamic-map dynmap 10 set security-association lifetime seconds 28800
crypto dynamic-map dynmap 10 set security-association lifetime kilobytes 4608000
crypto map outside_map 2 match address outside_cryptomap_100
crypto map outside_map 2 set peer 208.52.150.212
crypto map outside_map 2 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map interface OUTSIDE
crypto ca trustpool policy
crypto isakmp identity address
crypto isakmp nat-traversal 19
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable OUTSIDE
crypto ikev1 enable OUTSIDE
crypto ikev1 enable podmgmt
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 35
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 28800
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 12.51.122.128 255.255.255.192 OUTSIDE
ssh 192.168.9.0 255.255.255.0 INSIDE
ssh 10.100.100.0 255.255.255.0 INSIDE
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 5
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 198.72.72.10
ntp server 131.144.4.9
webvpn
anyconnect-essentials
group-policy GroupPolicy_208.52.150.212 internal
group-policy GroupPolicy_208.52.150.212 attributes
vpn-tunnel-protocol ikev1
group-policy vpnclient internal
group-policy vpnclient attributes
dns-server value 192.168.9.49 192.168.9.70
vpn-idle-timeout 30
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLITTUNNEL
default-domain value dekalb.local
username desmond password e7vgeY2I.sLIZh42 encrypted
username dekalbclient password SqfhIEPdpx8xB2Wy encrypted
username DEKALBCLIENT password o/MUvFtAnDdZ14fy encrypted
username datacentricit password hzinLBkPZj/KKdq6 encrypted privilege 15
username admin password Gg0pyMC0m46RB7Jr encrypted privilege 15
tunnel-group vpnclient type remote-access
tunnel-group vpnclient general-attributes
address-pool VPNUSERS
authentication-server-group (OUTSIDE) LOCAL
default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DEKALBCLIENT type remote-access
tunnel-group DEKALBCLIENT general-attributes
address-pool VPNUSERS
authentication-server-group (OUTSIDE) NT LOCAL
default-group-policy vpnclient
tunnel-group DEKALBCLIENT ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group 208.52.150.212 type ipsec-l2l
tunnel-group 208.52.150.212 general-attributes
default-group-policy GroupPolicy_208.52.150.212
tunnel-group 208.52.150.212 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
!
class-map http-mss-map
match access-list http-mss-permit
class-map IPS
match access-list IPS
class-map inspection_default
match default-inspection-traffic
class-map class-conn-param-tcp-01
match access-list acl-conn-param-tcp-01
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map policy-conn-param-INSIDE
class class-conn-param-tcp-01
set connection per-client-embryonic-max 100
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect netbios
inspect rsh
inspect rtsp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect icmp
inspect icmp error
inspect ip-options
class http-mss-map
set connection advanced-options mss-map
class IPS
ips inline fail-open
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:84320a97cc93e055b72c77a14ef6868e
: end
Any help is appreciated!