Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About CiscoBlueBelt
Online
CiscoBlueBelt
Member since
09-06-2016
Contributor
Created by
CiscoBlueBelt
in VPN and AnyConnect
in VPN and AnyConnect
04-18-2019
07:16 AM
04-18-2019
07:16 AM
Here you go. ASA# sh running-config logging logging enable logging timestamp logging buffer-size 16384 logging asdm-buffer-size 300 logging monitor debugging logging buffered informational logging trap notifications logging asdm debugging logging facility 17 logging queue 2048 logging device-id hostname logging host management X.X.X.X logging host management X.X.X.X logging host management X.X.X.X logging host management X.X.X.X logging host management X.X.X.X no logging message 106015 no logging message 313001 no logging message 313008 no logging message 106023 no logging message 710003 no logging message 106100 no logging message 302015 no logging message 302014 no logging message 302013 no logging message 302018 no logging message 302017 no logging message 302016 no logging message 302021 no logging message 302020 logging rate-limit 1000 2 level 1 logging rate-limit 1000 2 level 2 logging rate-limit 500 2 level 4 logging rate-limit 500 2 level 5 logging rate-limit 1000 2 level 6 logging rate-limit 500 2 level 7
... View more
Created by
CiscoBlueBelt
in VPN and AnyConnect
in VPN and AnyConnect
04-18-2019
06:27 AM
04-18-2019
06:27 AM
Yes it has log at end of statement. I though Real-time viewer will show all traffic passing through any of your interfaces on the FW?
... View more
Created by
CiscoBlueBelt
in VPN and AnyConnect
in VPN and AnyConnect
04-17-2019
08:56 AM
04-17-2019
08:56 AM
So many times when I know for sure something is blocked via ACL on the ASA, I don't see denied logs when that same applicable traffic is attempting to pass through the ASA and am wondering why. Logging is configured for such see below. Any help guys/gals? sh logg Syslog logging: enabled Facility: 17 Timestamp logging: enabled Hide Username logging: enabled Standby logging: disabled Debug-trace logging: disabled Console logging: disabled Monitor logging: level debugging, 1203550847 messages logged Buffer logging: level informational, 1158404665 messages logged
... View more
Labels:
Created by
CiscoBlueBelt
in Firewalls
in Firewalls
04-16-2019
10:38 AM
04-16-2019
10:38 AM
So I am just testing connectivity via IPs and Ports that I know for sure are allowed out on a VPN that has a ACL. The VPN exits the Outside interface however I get reverse-path failed when choosing the Inside interface (where source address would be coming from) and "denied by configured rule" on Outside ACL when Outside interface is chosen. Does it make any difference in Packet-Tracer if what you are trying to test is VPN source/destination subnets?
... View more
04-11-2019
08:37 AM
Thanks! So I don't quite have the ISAKMP option - I was going to set a condition to show only debug for the trouble VPN. Shall I choose ikev2? See below: ASA# debug crypto ? ca Set PKI debug levels condition Set IPSec/ISAKMP debug filters engine Set crypto engine debug levels goid Set crypto map GOID debug levels ike-common Set IKE common debug levels ikev1 Set IKEV1 debug levels ikev2 Set IKEV2 debug levels ipsec Set IPSec debug levels ss-api Set Crypto Secure Socket API debug levels vpnclient Set EasyVPN client debug levels
... View more
04-10-2019
07:17 PM
Yes it sent it but perhaps I am overlooking but nothing shows up when doing show run | grep keep or similar type searches. I will double check. Third party has never tried. Help desk typically calls me and I bring it up. I will have to try and check to see if it is configured for respond/answer only. Not sure about the config so I have to look it up I guess.
... View more
04-10-2019
11:54 AM
Per my message to Richard, just to help you clarify all peer addresses are static. I am the only one who brings the tunnel back up as I don't handle the remote end device, so getting debugs on that end is not easy at this point. There are no manually configured dpd/keep-alives for the tunnel on my end so I assume it is just the default timers?? I do know the remote router has: dpd 10 2 on-demand - could that play a factor? Yes I could run a debug for isakmp I will get back on that.
... View more
04-10-2019
11:51 AM
Awesome RIchard! No all peer addresses are static. To clarify, I am the only one who brings the tunnel back up as I don't handle the remote end device, so getting debugs on that end is not easy at this point. There are no manually configured dpd/keep-alives for the tunnel on my end so I assume it is just the default timers?? I do know the remote router has: dpd 10 2 on-demand - could that play a factor? Yes I could run a debug for isakmp I will get back on that.
... View more
04-10-2019
08:25 AM
Have an ISPEC tunnel between an ASA and Router that will go down periodically and not be able to be brought back up and/or both sites can't reach each other unless the SAs are manually renegotiated on my end. Below is debug for platform/protocol 127 (changed IPs for security). I am also looking for good docs in regards to reading IPSEC debugs or logs in general to be more familiar with the IPSEC commication process. # IKEv2-PROTO-7: (27628): Timer expired, Sending DPD IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000001 CurState: READY Event: EV_SEND_DPD IKEv2-PROTO-7: (27628): Action: Action_Null IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000001 CurState: INFO_I_BLD_INFO Event: EV_SEND_DPD IKEv2-PROTO-4: (27628): Sending DPD/liveness query IKEv2-PROTO-4: (27628): Building packet for encryption. IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000001 CurState: INFO_I_BLD_INFO Event: EV_ENCRYPT_MSG IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000001 CurState: INFO_I_BLD_INFO Event: EV_NO_EVENT IKEv2-PLAT-4: (27628): Encrypt success status returned via ipc 1 IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000001 CurState: INFO_I_BLD_INFO Event: EV_OK_ENCRYPT_RESP IKEv2-PROTO-7: (27628): Action: Action_Null IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000001 CurState: INFO_I_BLD_INFO Event: EV_TRYSEND IKEv2-PROTO-4: (27628): Checking if request will fit in peer window (27628): IKEv2-PROTO-4: (27628): Sending Packet [To 100.1.1.1:500/From 200.1.1.1:500/VRF i0:f0] (27628): Initiator SPI : B537105995B57695 - Responder SPI : 65C53893C7ED92A9 Message id: 337 (27628): IKEv2 INFORMATIONAL Exchange REQUESTIKEv2-PROTO-5: (27628): Next payload: ENCR, version: 2.0 (27628): Exchange type: INFORMATIONAL, flags: INITIATOR (27628): Message id: 337, length: 88(27628): Payload contents: (27628): ENCR(27628): Next payload: NONE, reserved: 0x0, length: 60 (27628): Encrypted data: 56 bytes (27628): IKEv2-PLAT-5: (27628): SENT PKT [INFORMATIONAL] [200.1.1.1]:500->[100.1.1.1]:500 InitSPI=0xb537105995b57695 RespSPI=0x65c53893c7ed92a9 MID=00000151 IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: INFO_I_BLD_INFO Event: EV_CHK_INFO_TYPE IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: INFO_I_WAIT Event: EV_NO_EVENT (27628): IKEv2-PROTO-4: (27628): Received Packet [From 100.1.1.1:500/To 200.1.1.1:500/VRF i0:f0] (27628): Initiator SPI : B537105995B57695 - Responder SPI : 65C53893C7ED92A9 Message id: 337 (27628): IKEv2 INFORMATIONAL Exchange RESPONSEIKEv2-PROTO-5: (27628): Next payload: ENCR, version: 2.0 (27628): Exchange type: INFORMATIONAL, flags: RESPONDER MSG-RESPONSE (27628): Message id: 337, length: 88(27628): Payload contents: (27628): (27628): Decrypted packet:(27628): Data: 88 bytes IKEv2-PLAT-4: (27628): Decrypt success status returned via ipc 1 (27628): REAL Decrypted packet:(27628): Data: 0 bytes IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: INFO_I_WAIT Event: EV_RECV_INFO_ACK IKEv2-PROTO-4: (27628): Processing ACK to informational exchange IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: INFO_I_WAIT Event: EV_CHK_INFO_TYPE IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: EXIT Event: EV_CHK_PENDING IKEv2-PROTO-7: (27628): Processed response with message id 337, Requests can be sent from range 338 to 342 IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: EXIT Event: EV_NO_EVENT IKEv2-PROTO-7: (27628): SM Trace-> SA: I_SPI=B537105995B57695 R_SPI=65C53893C7ED92A9 (I) MsgID = 00000151 CurState: EXIT Event: EV_FREE_NEG IKEv2-PROTO-7: (27628): Deleting negotiation context for my message ID: 0x151
... View more
Labels:
04-03-2019
06:21 PM
So when entering the Outside int IP Anyconnect is configured for the generic Cisco ASDM page just shows and not the Anyconnect login page. Not sure what else to check. Here is config of my Lab ASA. I am trying to connect from a machine outside of the Outside interface with a 192.168.1.X address which is the subnet I excluded for Split Tunnel. ======================================= ASA# sh run : Saved : : Serial Number: JMX184940D6 : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.1(7) ! hostname SiteP-ASA enable password kqNsU0EdOEv8n9Op encrypted names ip local pool AnyConnect_Pool 192.168.15.11-192.168.15.20 mask 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 shutdown ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 switchport access vlan 15 ! interface Ethernet0/6 switchport access vlan 15 ! interface Ethernet0/7 shutdown ! interface Vlan1 no nameif no security-level no ip address ! interface Vlan2 nameif outside security-level 0 ip address 192.168.1.2 255.255.255.0 ! interface Vlan10 no forward interface Vlan2 nameif management security-level 100 ip address 10.1.1.1 255.255.255.0 ! interface Vlan15 nameif inside security-level 100 ip address 192.168.15.254 255.255.255.0 ! ftp mode passive object network Internal_Lan subnet 192.168.15.0 255.255.255.0 object network Dellr610_Srv host 192.168.15.1 description Dellr610_Srv on Inside object network Virtual_Environment_192.168.15.0 range 192.168.15.0 192.168.15.255 description Virtual_Environment_192.168.15.0 on inside_LAN object network Outside_HP_Upstairs_WS host 192.168.1.217 description Outside HP Upstairs WS object service Server_Port_3080 service tcp source eq 3080 destination eq 3080 description Port needed to access servers object network Site_P_Outside_Lan range 192.168.1.1 192.168.1.254 description Site_P_Outside_Lan object service DNS service udp source eq domain destination eq domain description Domain Name Service object service DNS_TCP service tcp source eq domain destination eq domain description Domain Name Service TCP object service DNS_Tcp service udp source eq domain destination eq domain object-group network Internal_Subnets description Internal_Subnets network-object object Dellr610_Srv network-object object Virtual_Environment_192.168.15.0 object-group icmp-type ICMP_Connectivity_Testing icmp-object echo icmp-object echo-reply icmp-object time-exceeded icmp-object traceroute icmp-object information-reply icmp-object information-request icmp-object unreachable object-group service Web_Ports description Web_Ports needed to access the internet NOT WORKING service-object tcp-udp destination eq www service-object tcp destination eq https service-object object DNS service-object object DNS_TCP service-object tcp destination eq ssh service-object icmp service-object tcp destination eq domain service-object tcp destination eq 2598 object-group network Site_P_Outside_Lan_Mgmt_Hosts description Outside_Lan hosts allowed to inside servers network-object object Outside_HP_Upstairs_WS object-group service Server_Ports description Ports needed to access servers from Outside/Inside service-object object Server_Port_3080 object-group network DM_INLINE_NETWORK_2 network-object object Internal_Lan network-object object Virtual_Environment_192.168.15.0 object-group network DM_INLINE_NETWORK_1 network-object object Site_P_Outside_Lan group-object Site_P_Outside_Lan_Mgmt_Hosts object-group network DM_INLINE_NETWORK_5 group-object Internal_Subnets network-object object Virtual_Environment_192.168.15.0 object-group network DM_INLINE_NETWORK_6 network-object object Internal_Lan network-object object Virtual_Environment_192.168.15.0 object-group network DM_INLINE_NETWORK_7 group-object Internal_Subnets network-object object Virtual_Environment_192.168.15.0 object-group protocol TCPUDP protocol-object udp protocol-object tcp object-group network DM_INLINE_NETWORK_9 network-object object Internal_Lan network-object object Virtual_Environment_192.168.15.0 access-list outside_access_in extended permit ip object Site_P_Outside_Lan object-group DM_INLINE_NETWORK_2 access-list outside_access_in extended permit icmp any object Internal_Lan object-group ICMP_Connectivity_Testing access-list Inside extended permit ip 192.168.15.0 255.255.255.0 any log inactive access-list Inside extended permit ip any any log inactive access-list Inside remark Internal_Subnets allowed to Internet access-list Inside extended permit ip object-group Internal_Subnets any inactive access-list Inside remark Ports needed for testing access-list Inside extended permit icmp object-group DM_INLINE_NETWORK_7 any object-group ICMP_Connectivity_Testing access-list Inside remark Ports needed to access internet web pages access-list Inside extended permit ip object-group DM_INLINE_NETWORK_5 any access-list Inside remark Ports needed from connectivity testing access-list Inside extended permit icmp object-group DM_INLINE_NETWORK_1 object-group Internal_Subnets object-group ICMP_Connectivity_Testing inactive access-list Inside extended permit ip object Outside_HP_Upstairs_WS object-group DM_INLINE_NETWORK_9 inactive access-list Inside extended permit ip object-group DM_INLINE_NETWORK_6 object Outside_HP_Upstairs_WS inactive access-list AC_Exclude standard permit 192.168.1.0 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu management 1500 mtu inside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-717.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected access-group outside_access_in in interface outside access-group Inside in interface inside route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication http console LOCAL aaa authentication ssh console LOCAL http server enable http 192.168.1.217 255.255.255.255 outside http 192.168.15.10 255.255.255.255 inside no snmp-server location no snmp-server contact crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev2 ipsec-proposal DES protocol esp encryption des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES protocol esp encryption 3des protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES protocol esp encryption aes protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192 protocol esp encryption aes-192 protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES256 protocol esp encryption aes-256 protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto ca trustpoint ASDM_TrustPoint0 enrollment self subject-name CN=SiteP-ASA keypair RSA crl configure crypto ca trustpool policy crypto ca certificate chain ASDM_TrustPoint0 certificate c110905c 308201d3 3082013c a0030201 020204c1 10905c30 0d06092a 864886f7 0d010105 0500302e 31123010 06035504 03130953 69746550 2d415341 31183016 06092a86 4886f70d 01090216 09536974 65502d41 5341301e 170d3139 30343033 32333033 35355a17 0d323930 33333132 33303335 355a302e 31123010 06035504 03130953 69746550 2d415341 31183016 06092a86 4886f70d 01090216 09536974 65502d41 53413081 9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100a1 d41d4346 8170160b a7f12ffa 776b14db 870a59b8 83e35998 95ca9842 0c107ef0 019bff5e 0a4f827b 88e70adc 835c0e7c 109e505d b2b96b76 b4523d08 5936e5db 1fbd8244 92faeba2 269e7f3f b403aa44 5b93ab70 ccd3187c d33e0f73 10751c85 526035cc a3f57a06 f5be9e5b adc10f45 0c6f58af baacf4e5 313f297c 45a07f02 03010001 300d0609 2a864886 f70d0101 05050003 81810008 2a840625 47f4f3a5 e4202ec6 2e0473d4 86843152 4ae58030 43372c88 bf0b04b5 aa81f812 923bb25f f0bfea3b 0661494f 414f3153 1434079e 832358b7 729a0db1 6a63bccd 7397c92d a8f35272 e1f19822 c1210cd3 4fa8275d 6db63ddd d1aa4a5e 62be74b3 49f7b875 88fb918e 55646eb7 4a1dc223 cf2dde24 96a9c2c5 17b196 quit crypto ikev2 policy 1 encryption aes-256 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 10 encryption aes-192 integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 20 encryption aes integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 30 encryption 3des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 policy 40 encryption des integrity sha group 5 2 prf sha lifetime seconds 86400 crypto ikev2 enable outside client-services port 443 crypto ikev2 remote-access trustpoint ASDM_TrustPoint0 crypto ikev1 policy 10 authentication crack encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 30 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto ikev1 policy 40 authentication crack encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 60 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto ikev1 policy 70 authentication crack encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 90 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto ikev1 policy 100 authentication crack encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto ikev1 policy 130 authentication crack encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 140 authentication rsa-sig encryption des hash sha group 2 lifetime 86400 crypto ikev1 policy 150 authentication pre-share encryption des hash sha group 2 lifetime 86400 telnet timeout 5 ssh stricthostkeycheck ssh 192.168.1.217 255.255.255.255 outside ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 2 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn enable outside anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1 anyconnect profiles Site_P_HP_client_profile disk0:/Site_P_HP_client_profile.xml anyconnect enable tunnel-group-list enable cache disable group-policy GroupPolicy_Site_P_HP internal group-policy GroupPolicy_Site_P_HP attributes wins-server none dns-server value 192.168.1.1 vpn-tunnel-protocol ikev1 ssl-client split-tunnel-policy excludespecified split-tunnel-network-list value AC_Exclude default-domain value SitePNet webvpn anyconnect profiles value Site_P_HP_client_profile type user username acneteng password onm5.DAlZFov0RWJ encrypted username cisco password 3USUcOPFUiMCO4Jk encrypted username neteng password bzvbyY6YRFaansCf encrypted tunnel-group Site_P_HP type remote-access tunnel-group Site_P_HP general-attributes address-pool AnyConnect_Pool default-group-policy GroupPolicy_Site_P_HP tunnel-group Site_P_HP webvpn-attributes group-alias Site_P_HP enable ! ! prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:f34f054c706e716e110f86ccfdf3ca3b : end
... View more
Labels:
Created by
CiscoBlueBelt
in Firewalls
in Firewalls
04-02-2019
08:01 AM
04-02-2019
08:01 AM
Just looknig for some advise in regards to keeping ACLs, objects, etc. clean and manageable. I know in a large prod environmnet, constantly adding IPs to block, adding rules, etc. can lead to a messy harder to understand ASA with rules on top of each other (unessessary) etc. Any help guys and gals?
... View more
Created by
CiscoBlueBelt
in Firewalls
in Firewalls
03-28-2019
06:52 PM
03-28-2019
06:52 PM
I was able to get everything working, but not quite sure what the problem(s) were as I removed all group policy configs, vpn-filters, and added sysopt connection permit-vpn config. I just made new crypto map names and vpn acl names but did not change any objects or object-groups. So I don't really need a group-policy I could just configure a vpn-filter and reference it under my tunnel-group? Group policy best if I have multiple tunnels between the ASAs correct? See new config below. SiteA-ASA-Prim# sh run : Saved : : Serial Number: 9AFU2NTVJEC : Hardware: ASAv, 2048 MB RAM, CPU Pentium II 2660 MHz : ASA Version 9.7(1) ! hostname SiteA-ASA-Prim enable password $sha512$5000$YF7YzJonS4gTjTvuzS/+kg==$oI0x1nuPDRjVX8fIBb+t+A== pbkdf2 xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain names ! interface GigabitEthernet0/0 description Inside_to_LAN nameif Inside security-level 100 ip address 192.168.10.254 255.255.255.0 ! interface GigabitEthernet0/1 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/6 description Outside_to_WAN nameif Outside security-level 0 ip address 10.10.10.10 255.255.255.0 ! interface Management0/0 shutdown no nameif no security-level no ip address ! ftp mode passive object network Virtual_Environment_GNS range 192.168.30.0 192.168.30.255 object network SiteA_Admin_Users range 192.168.31.0 192.168.31.255 object network SiteA_CrSw_Prim range 192.168.10.0 192.168.10.255 object network SiteB_Internal_Lan range 172.16.0.0 172.16.255.255 object-group network Internal_LAN network-object object Virtual_Environment_GNS network-object object SiteA_Admin_Users network-object object SiteA_CrSw_Prim access-list Inside_Out extended permit ip object-group Internal_LAN any log access-list Outside_In extended permit ip 10.10.10.0 255.255.255.0 object-group Internal_LAN access-list Outside_In extended permit ip 20.20.20.0 255.255.255.0 object-group Internal_LAN access-list Outside_In extended permit ip object SiteB_Internal_Lan object-group Internal_LAN access-list VPN_SiteB_ACL extended permit ip object-group Internal_LAN object SiteB_Internal_Lan log pager lines 23 mtu Inside 1500 mtu Outside 1500 no failover no monitor-interface service-module icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 8192 access-group Inside_Out in interface Inside access-group Outside_In in interface Outside route Outside 0.0.0.0 0.0.0.0 10.10.10.1 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL no snmp-server location no snmp-server contact crypto ipsec ikev2 ipsec-proposal PH-2 protocol esp encryption aes-256 protocol esp integrity sha-1 crypto ipsec security-association pmtu-aging infinite crypto map ASA1-MAP_SiteB 1 match address VPN_SiteB_ACL crypto map ASA1-MAP_SiteB 1 set peer 20.20.20.20 crypto map ASA1-MAP_SiteB 1 set ikev2 ipsec-proposal PH-2 crypto map ASA1-MAP_SiteB interface Outside crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpool policy auto-import crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 18dad19e267de8bb4a2158cdcc6b3b4a 308204d3 308203bb a0030201 02021018 dad19e26 7de8bb4a 2158cdcc 6b3b4a30 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d30 36313130 38303030 3030305a 170d3336 30373136 32333539 35395a30 81ca310b 30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20 496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65 74776f72 6b313a30 38060355 040b1331 28632920 32303036 20566572 69536967 6e2c2049 6e632e20 2d20466f 72206175 74686f72 697a6564 20757365 206f6e6c 79314530 43060355 0403133c 56657269 5369676e 20436c61 73732033 20507562 6c696320 5072696d 61727920 43657274 69666963 6174696f 6e204175 74686f72 69747920 2d204735 30820122 300d0609 2a864886 f70d0101 01050003 82010f00 3082010a 02820101 00af2408 08297a35 9e600caa e74b3b4e dc7cbc3c 451cbb2b e0fe2902 f95708a3 64851527 f5f1adc8 31895d22 e82aaaa6 42b38ff8 b955b7b1 b74bb3fe 8f7e0757 ecef43db 66621561 cf600da4 d8def8e0 c362083d 5413eb49 ca595485 26e52b8f 1b9febf5 a191c233 49d84363 6a524bd2 8fe87051 4dd18969 7bc770f6 b3dc1274 db7b5d4b 56d396bf 1577a1b0 f4a225f2 af1c9267 18e5f406 04ef90b9 e400e4dd 3ab519ff 02baf43c eee08beb 378becf4 d7acf2f6 f03dafdd 75913319 1d1c40cb 74241921 93d914fe ac2a52c7 8fd50449 e48d6347 883c6983 cbfe47bd 2b7e4fc5 95ae0e9d d4d143c0 6773e314 087ee53f 9f73b833 0acf5d3f 3487968a ee53e825 15020301 0001a381 b23081af 300f0603 551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 06306d06 082b0601 05050701 0c046130 5fa15da0 5b305930 57305516 09696d61 67652f67 69663021 301f3007 06052b0e 03021a04 148fe5d3 1a86ac8d 8e6bc3cf 806ad448 182c7b19 2e302516 23687474 703a2f2f 6c6f676f 2e766572 69736967 6e2e636f 6d2f7673 6c6f676f 2e676966 301d0603 551d0e04 1604147f d365a7c2 ddecbbf0 3009f343 39fa02af 33313330 0d06092a 864886f7 0d010105 05000382 01010093 244a305f 62cfd81a 982f3dea dc992dbd 77f6a579 2238ecc4 a7a07812 ad620e45 7064c5e7 97662d98 097e5faf d6cc2865 f201aa08 1a47def9 f97c925a 0869200d d93e6d6e 3c0d6ed8 e6069140 18b9f8c1 eddfdb41 aae09620 c9cd6415 3881c994 eea28429 0b136f8e db0cdd25 02dba48b 1944d241 7a05694a 584f60ca 7e826a0b 02aa2517 39b5db7f e784652a 958abd86 de5e8116 832d10cc defda882 2a6d281f 0d0bc4e5 e71a2619 e1f4116f 10b595fc e7420532 dbce9d51 5e28b69e 85d35bef a57d4540 728eb70e 6b0e06fb 33354871 b89d278b c4655f0d 86769c44 7af6955c f65d3208 33a454b6 183f685c f2424a85 3854835f d1e82cf2 ac11d6a8 ed636a quit crypto ikev2 policy 1 encryption aes integrity sha group 5 prf sha lifetime seconds 86400 crypto ikev2 enable Outside telnet timeout 5 ssh stricthostkeycheck ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-access-policy-record DfltAccessPolicy tunnel-group 20.20.20.20 type ipsec-l2l tunnel-group 20.20.20.20 ipsec-attributes ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily profile License destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination transport-method http Cryptochecksum:53e43ac16c68f87bacaec5e8b1d98152 : end ========================================================== SiteB-ASA-Prim# sh run : Saved : : Serial Number: 9AJ1J827XA0 : Hardware: ASAv, 2048 MB RAM, CPU Pentium II 2660 MHz : ASA Version 9.7(1) ! hostname SiteB-ASA-Prim enable password $sha512$5000$syhSI79+Xvt5sF0iY+5NOA==$3lyjpygpNB6roEwEACB8IQ== pbkdf2 xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain names ! interface GigabitEthernet0/0 nameif Inside security-level 100 ip address 172.16.10.254 255.255.255.0 ! interface GigabitEthernet0/1 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/5 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/6 nameif Outside security-level 0 ip address 20.20.20.20 255.255.255.0 ! interface Management0/0 shutdown no nameif no security-level no ip address ! ftp mode passive object network Virtual_Environment_SiteB_GNS range 172.16.30.0 172.16.30.255 object network Dell_Servers host 172.16.30.52 object network Internal_Users_SiteB range 172.16.11.0 172.16.11.255 object network SiteA_Subnets subnet 192.168.0.0 255.255.0.0 object network Internal_LAN_SiteA range 192.168.0.0 192.168.255.255 object network SiteB_CrSw_Prim range 172.16.10.0 172.16.10.255 object-group network Internal_LAN_SiteB network-object object Internal_Users_SiteB network-object object Dell_Servers network-object object Virtual_Environment_SiteB_GNS network-object object SiteB_CrSw_Prim access-list Inside_Out extended permit ip object-group Internal_LAN_SiteB any log access-list Outside_In extended permit ip 20.20.20.0 255.255.255.0 object-group Internal_LAN_SiteB access-list Outside_In extended permit ip object Internal_LAN_SiteA object-group Internal_LAN_SiteB access-list Outside_In extended permit ip 10.10.10.0 255.255.255.0 object-group Internal_LAN_SiteB access-list VPN_SiteA_ACL extended permit ip object-group Internal_LAN_SiteB object Internal_LAN_SiteA log pager lines 23 mtu Inside 1500 mtu Outside 1500 no failover no monitor-interface service-module icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 8192 access-group Inside_Out in interface Inside access-group Outside_In in interface Outside route Outside 0.0.0.0 0.0.0.0 20.20.20.1 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL no snmp-server location no snmp-server contact crypto ipsec ikev2 ipsec-proposal PH protocol esp encryption aes-256 protocol esp integrity sha-1 crypto ipsec security-association pmtu-aging infinite crypto map ASA2-MAP_SiteB 2 match address VPN_SiteA_ACL crypto map ASA2-MAP_SiteB 2 set peer 10.10.10.10 crypto map ASA2-MAP_SiteB 2 set ikev2 ipsec-proposal PH crypto map ASA2-MAP_SiteB interface Outside crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure crypto ca trustpool policy auto-import crypto ca certificate chain _SmartCallHome_ServerCA certificate ca 18dad19e267de8bb4a2158cdcc6b3b4a 308204d3 308203bb a0030201 02021018 dad19e26 7de8bb4a 2158cdcc 6b3b4a30 0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117 30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b 13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504 0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72 20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56 65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043 65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d30 36313130 38303030 3030305a 170d3336 30373136 32333539 35395a30 81ca310b 30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20 496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65 74776f72 6b313a30 38060355 040b1331 28632920 32303036 20566572 69536967 6e2c2049 6e632e20 2d20466f 72206175 74686f72 697a6564 20757365 206f6e6c 79314530 43060355 0403133c 56657269 5369676e 20436c61 73732033 20507562 6c696320 5072696d 61727920 43657274 69666963 6174696f 6e204175 74686f72 69747920 2d204735 30820122 300d0609 2a864886 f70d0101 01050003 82010f00 3082010a 02820101 00af2408 08297a35 9e600caa e74b3b4e dc7cbc3c 451cbb2b e0fe2902 f95708a3 64851527 f5f1adc8 31895d22 e82aaaa6 42b38ff8 b955b7b1 b74bb3fe 8f7e0757 ecef43db 66621561 cf600da4 d8def8e0 c362083d 5413eb49 ca595485 26e52b8f 1b9febf5 a191c233 49d84363 6a524bd2 8fe87051 4dd18969 7bc770f6 b3dc1274 db7b5d4b 56d396bf 1577a1b0 f4a225f2 af1c9267 18e5f406 04ef90b9 e400e4dd 3ab519ff 02baf43c eee08beb 378becf4 d7acf2f6 f03dafdd 75913319 1d1c40cb 74241921 93d914fe ac2a52c7 8fd50449 e48d6347 883c6983 cbfe47bd 2b7e4fc5 95ae0e9d d4d143c0 6773e314 087ee53f 9f73b833 0acf5d3f 3487968a ee53e825 15020301 0001a381 b23081af 300f0603 551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 06306d06 082b0601 05050701 0c046130 5fa15da0 5b305930 57305516 09696d61 67652f67 69663021 301f3007 06052b0e 03021a04 148fe5d3 1a86ac8d 8e6bc3cf 806ad448 182c7b19 2e302516 23687474 703a2f2f 6c6f676f 2e766572 69736967 6e2e636f 6d2f7673 6c6f676f 2e676966 301d0603 551d0e04 1604147f d365a7c2 ddecbbf0 3009f343 39fa02af 33313330 0d06092a 864886f7 0d010105 05000382 01010093 244a305f 62cfd81a 982f3dea dc992dbd 77f6a579 2238ecc4 a7a07812 ad620e45 7064c5e7 97662d98 097e5faf d6cc2865 f201aa08 1a47def9 f97c925a 0869200d d93e6d6e 3c0d6ed8 e6069140 18b9f8c1 eddfdb41 aae09620 c9cd6415 3881c994 eea28429 0b136f8e db0cdd25 02dba48b 1944d241 7a05694a 584f60ca 7e826a0b 02aa2517 39b5db7f e784652a 958abd86 de5e8116 832d10cc defda882 2a6d281f 0d0bc4e5 e71a2619 e1f4116f 10b595fc e7420532 dbce9d51 5e28b69e 85d35bef a57d4540 728eb70e 6b0e06fb 33354871 b89d278b c4655f0d 86769c44 7af6955c f65d3208 33a454b6 183f685c f2424a85 3854835f d1e82cf2 ac11d6a8 ed636a quit crypto ikev2 policy 2 encryption aes integrity sha group 5 prf sha lifetime seconds 86400 crypto ikev2 enable Outside telnet timeout 5 ssh stricthostkeycheck ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-access-policy-record DfltAccessPolicy tunnel-group 10.10.10.10 type ipsec-l2l tunnel-group 10.10.10.10 ipsec-attributes ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily profile License destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination transport-method http Cryptochecksum:49c088e3b152e49a032db4eb588ffe8f : end
... View more
Created by
CiscoBlueBelt
in VPN and AnyConnect
Thursday
Thursday
Here you go. ASA# sh running-config logginglogging enablelogging
timestamplogging buffer-size 16384l...
Created by
CiscoBlueBelt
in VPN and AnyConnect
Thursday
Thursday
Yes it has log at end of statement. I though Real-time viewer will show
all traffic passing through ...
Created by
CiscoBlueBelt
in VPN and AnyConnect
Wednesday
Wednesday
So many times when I know for sure something is blocked via ACL on the
ASA, I don't see denied logs ...
Tuesday
So I am just testing connectivity via IPs and Ports that I know for sure
are allowed out on a VPN th...
2 weeks ago
Thanks!So I don't quite have the ISAKMP option - I was going to set a
condition to show only debug f...
2 weeks ago
Yes it sent it but perhaps I am overlooking but nothing shows up when
doing show run | grep keep or ...
2 weeks ago
Per my message to Richard, just to help you clarify all peer addresses
are static. I am the only one...
2 weeks ago
Awesome RIchard!No all peer addresses are static. To clarify, I am the
only one who brings the tunne...
2 weeks ago
Have an ISPEC tunnel between an ASA and Router that will go down
periodically and not be able to be ...
3 weeks ago
So when entering the Outside int IP Anyconnect is configured for the
generic Cisco ASDM page just sh...
Created by
CiscoBlueBelt
in Firewalls
3 weeks ago
3 weeks ago
Just looknig for some advise in regards to keeping ACLs, objects, etc.
clean and manageable. I know ...
Created by
CiscoBlueBelt
in Firewalls
4 weeks ago
4 weeks ago
I was able to get everything working, but not quite sure what the
problem(s) were as I removed all g...
Public Statistics
| Date Registered | 09-06-2016 11:48 AM |
| Date Last Visited | 04-22-2019 09:55 AM |
| Total Messages Posted | 675 |
| Total Helpful Votes Received | 45 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 10 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
