Hello ! Already more than a week ago, as we had a new channel of communication from MGTSa (ONT terminal Sercomm RV6688BCM, who just barely made in the " bridge" - was forced to make the provider in order to receive our white Cisco Ip- address) , and now I 'm trying too much more than a week to raise between our offices firm VPN IKEv1 IPsec Site-to-Site tunnel. Configurable and use the wizard in ASDM and handles in CLI, the result of one , the connection does not rise. Version Cisco 9.2 ( 2) , the image of Cisco asa922-k8.bin, version license Security Plus, version ASDM 7.2 ( 2). What I'll never know ... Full configuration and debug enclose below. Help, what can follow any responses , please! I was quite exhausted ! Config: Result of the command: "sh run" : Saved : : Serial Number: XXXXXXXXXXXX : Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.2(2) ! hostname gate-71 enable password F6OJ0GOws7WHxeql encrypted names ip local pool vpnpool 10.1.72.100-10.1.72.120 mask 255.255.255.0 ! interface Ethernet0/0  switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1  nameif inside  security-level 100  ip address 10.1.72.254 255.255.255.0 ! interface Vlan2  nameif outside_mgts  security-level 0  ip address 62.112.100.R1 255.255.255.252 ! ftp mode passive clock timezone MSK/MSD 3 clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup inside dns server-group MGTS  name-server 195.34.31.50 same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network obj_any  subnet 0.0.0.0 0.0.0.0 object network NET72  subnet 10.1.72.0 255.255.255.0 object network obj-0.0.0.0  host 0.0.0.0 object network Nafanya  host 10.1.72.5 object network obj-10.1.72.0  subnet 10.1.72.0 255.255.255.0 object network NET61  subnet 10.1.61.0 255.255.255.0 object network NETWORK_OBJ_10.1.72.96_27  subnet 10.1.72.96 255.255.255.224 object network NETT72  subnet 10.1.72.0 255.255.255.0 object network NET30  subnet 10.1.30.0 255.255.255.0 object network NETWORK_OBJ_10.1.72.0_24  subnet 10.1.72.0 255.255.255.0 object-group service OG-FROM-INET  service-object icmp echo  service-object icmp echo-reply  service-object icmp traceroute  service-object icmp unreachable  service-object tcp-udp destination eq echo object-group network DM_INLINE_NETWORK_1  network-object object NET30  network-object object NET72 object-group service DM_INLINE_TCP_1 tcp  port-object eq www  port-object eq https access-list inside_access_in extended permit ip object NET72 object-group DM_INLINE_NETWORK_1 access-list inside_access_in extended permit ip 10.1.72.0 255.255.255.0 any access-list inside_access_in extended permit ip object Nafanya any inactive access-list inside_access_in extended permit object-group OG-FROM-INET any any access-list inside_access_in extended permit ip any any access-list inside_access_in extended deny ip any any log alerts access-list outside_mgts_access_in extended permit object-group OG-FROM-INET any any access-list outside_mgts_access_in extended permit tcp any any object-group DM_INLINE_TCP_1 access-list outside_mgts_access_in extended deny ip any any log alerts access-list outside_mgts_cryptomap extended permit ip 10.1.72.0 255.255.255.0 object NET61 access-list VPN-ST_splitTunnelAcl standard permit 10.1.72.0 255.255.255.0 pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside_mgts 1500 ip verify reverse-path interface outside_mgts no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,outside_mgts) source static NET72 NET72 destination static NETWORK_OBJ_10.1.72.96_27 NETWORK_OBJ_10.1.72.96_27 no-proxy-arp route-lookup nat (inside,outside_mgts) source static NETWORK_OBJ_10.1.72.0_24 NETWORK_OBJ_10.1.72.0_24 destination static NET61 NET61 no-proxy-arp route-lookup ! object network obj_any  nat (inside,outside_mgts) dynamic obj-0.0.0.0 object network NET72  nat (inside,outside_mgts) dynamic interface dns access-group inside_access_in in interface inside access-group outside_mgts_access_in in interface outside_mgts route outside_mgts 0.0.0.0 0.0.0.0 62.112.100.R 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy no user-identity enable user-identity default-domain LOCAL aaa authentication http console LOCAL aaa authentication ssh console LOCAL http server enable http 10.1.72.0 255.255.255.0 inside no snmp-server location no snmp-server contact crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport crypto ipsec ikev2 ipsec-proposal AES256  protocol esp encryption aes-256  protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES192  protocol esp encryption aes-192  protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal AES  protocol esp encryption aes  protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal 3DES  protocol esp encryption 3des  protocol esp integrity sha-1 md5 crypto ipsec ikev2 ipsec-proposal DES  protocol esp encryption des  protocol esp integrity sha-1 md5 crypto ipsec security-association pmtu-aging infinite crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES crypto map outside_mgts_map 1 match address outside_mgts_cryptomap crypto map outside_mgts_map 1 set pfs group1 crypto map outside_mgts_map 1 set peer 91.188.180.42 crypto map outside_mgts_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_mgts_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_mgts_map interface outside_mgts crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map inside_map interface inside crypto ca trustpoint ASDM_TrustPoint0  enrollment self  email felix1988@mail.ru  subject-name CN=gate-71  serial-number  ip-address 62.112.100.42  proxy-ldc-issuer  crl configure crypto ca trustpoint ASDM_TrustPoint1  enrollment self  keypair ASDM_TrustPoint1  crl configure crypto ca trustpool policy crypto ca certificate chain ASDM_TrustPoint0  certificate eff26954     30820395 3082027d a0030201 020204ef f2695430 0d06092a 864886f7 0d010105     019     6460ae26 ec5f301d 0603551d 0e041604 14c9a3f2 d70e6789 38fa4b01 465d1964     60ae26ec 5f300d06 092a8648 86f70d01 01050500 03820101 00448753 7baa5c77     62857b65 d05dc91e 3edfabc6 7b3771af bbedee14 673ec67d 3d0c2de4 b7a7ac05     5f203a8c 98ab52cf 076401e5 1a2c6cb9 3f7afcba 52c617a5 644ece10 d6e1fd7d     28b57d8c aaf49023 2037527e 9fcfa218 9883191f 60b221bf a561f2be d6882091     0222b7a3 3880d6ac 49328d1f 2e085b15 6d1c1141 5f850e5c b6cb3e67 0e373591     94a82781 44493217 38097952 003d5552 5c445f1f 92f04039 a23fba20 b9d51b13     f511f311 d1feb2bb 6d056a15 7e63cc1b 1f134677 8124c024 3af56b97 51af8253     486844bc b1954abe 8acd7108 5e4212df 193b8167 db835d76 98ffdb2b 8c8ab915     0db3dd54 c8346b96 c4f4eff7 1e7cd576 a8b1f86e 3b868a6e 89   quit crypto ca certificate chain ASDM_TrustPoint1  certificate a39a2b54     30820377 3082025f a0030201 020204a3 9a2b5430 0d06092a 864886f7 0d010105     0500304b 3110300e 06035504 03130767 6174652d 36313137 30120603 55040513         c084dcd9 d250e194 abcb3eb8 1da93bd0 fb0dba1a b1c35b43 d547a841 5d4ee1a4     14bdb207 7dd790a4 0cd70471 5f3a896a 07bd56dc ea01b3dd 254cde88 e1490e97     f3e54c05 551adde0 66aa3782 c85880c2 b162ec29 4e49346a df71062d 6d6d8f49     62b9de93 ba07b4f7 a50e77e1 8f54b32b 6627cb27 e982b36f 362973a0 88de3272     9bd6d4d2 8ca1e11f 214f20a9 78bdea95 78fdc45c d6d45674 6acb9bcb d0bd930e     638eedfe cd559ab1 e1205c48 3ee9616f e631db55 e82b623c 434ffdc1 11020301     0001a363 3061300f 0603551d 130101ff 04053003 0101ff30 0e060355 1d0f0101     ff040403 02018630 1f060355 1d230418 30168014 0cea70bf 0d0e0c4b eb34a0b1     8242a549 5183ccf9 301d0603 551d0e04 1604140c ea70bf0d 0e0c4beb 34a0b182     42a54951 83ccf930 0d06092a 864886f7 0d010105 05000382 0101004e 7bfe054a     d434a27c 1d3dce15 529bdc5f 70a2dff1 98975de9 96077966 2a97333b 05a8e9ef     bf320cbd ecec3819 ade20a86 9aeb5bde bd129c7b 29341e4b edf91473 f2bf235d     9aaeae21 a629ccc6 3c79200b b9a89b08 4745a411 bf38afb6 ea56b957 4430f692     34d71fad 588e4e18 2b2d97af b2aae6b9 b6a22350 d031615b 49ea9b9f 2fdd82e6     ebd4dccd df93c17e deceb796 f268abf1 bd5f7b69 89183841 881409b5 f484f0e7     ebf7481c faf69d3e 9d24df6e 9c2b0791 785019f7 a0d20e95 2ef35799 66ffc819     4a77cdf2 c6fb4380 fe94c13c d4261655 7bf3d6ba 6289dc8b f9aad4e1 bd918fb7     32916fe1 477666ab c2a3d591 a84dd435 51711f6e 93e2bd84 89884c   quit crypto isakmp identity address crypto ikev2 policy 1  encryption aes-256  integrity sha  group 5 2  prf sha  lifetime seconds 86400 crypto ikev2 policy 10  encryption aes-192  integrity sha  group 5 2  prf sha  lifetime seconds 86400 crypto ikev2 policy 20  encryption aes  integrity sha  group 5 2  prf sha  lifetime seconds 86400 crypto ikev2 policy 30  encryption 3des  integrity sha  group 5 2  prf sha  lifetime seconds 86400 crypto ikev2 policy 40  encryption des  integrity sha  group 5 2  prf sha  lifetime seconds 86400 crypto ikev2 enable outside_mgts client-services port 443 crypto ikev2 remote-access trustpoint ASDM_TrustPoint0 crypto ikev1 enable inside crypto ikev1 enable outside_mgts crypto ikev1 policy 10  authentication crack  encryption aes-256  hash sha  group 2  lifetime 86400 crypto ikev1 policy 20  authentication rsa-sig  encryption aes-256  hash sha  group 2  lifetime 86400 crypto ikev1 policy 30  authentication pre-share  encryption aes-256  hash sha  group 2  lifetime 86400 crypto ikev1 policy 40  authentication crack  encryption aes-192  hash sha  group 2  lifetime 86400 crypto ikev1 policy 50  authentication rsa-sig  encryption aes-192  hash sha  group 2  lifetime 86400 crypto ikev1 policy 60  authentication pre-share  encryption aes-192  hash sha  group 2  lifetime 86400 crypto ikev1 policy 70  authentication crack  encryption aes  hash sha  group 2  lifetime 86400 crypto ikev1 policy 80  authentication rsa-sig  encryption aes  hash sha  group 2  lifetime 86400 crypto ikev1 policy 90  authentication pre-share  encryption aes  hash sha  group 2  lifetime 86400 crypto ikev1 policy 100  authentication crack  encryption 3des  hash sha  group 2  lifetime 86400 crypto ikev1 policy 110  authentication rsa-sig  encryption 3des  hash sha  group 2  lifetime 86400 crypto ikev1 policy 120  authentication pre-share  encryption 3des  hash sha  group 2  lifetime 86400 crypto ikev1 policy 130  authentication crack  encryption des  hash sha  group 2  lifetime 86400 crypto ikev1 policy 140  authentication rsa-sig  encryption des  hash sha  group 2  lifetime 86400 crypto ikev1 policy 150  authentication pre-share  encryption des  hash sha  group 2  lifetime 86400 telnet timeout 5 no ssh stricthostkeycheck ssh 10.1.72.0 255.255.255.0 inside ssh timeout 60 ssh key-exchange group dh-group1-sha1 console timeout 0 vpnclient server 91.188.180.X vpnclient mode network-extension-mode vpnclient nem-st-autoconnect vpnclient vpngroup VPN-L2L password ***** vpnclient username aradetskayaL password ***** dhcpd auto_config outside_mgts ! dhcpd update dns both override interface inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept ssl trust-point ASDM_TrustPoint0 inside ssl trust-point ASDM_TrustPoint0 outside_mgts webvpn  enable outside_mgts group-policy GroupPolicy_91.188.180.X internal group-policy GroupPolicy_91.188.180.X attributes  vpn-tunnel-protocol ikev1 group-policy VPN-ST internal group-policy VPN-ST attributes  dns-server value 195.34.31.50 8.8.8.8  vpn-tunnel-protocol ikev1  split-tunnel-policy tunnelspecified  split-tunnel-network-list value VPN-ST_splitTunnelAcl  default-domain none username aradetskayaL password HR3qeva85hzXT6KK encrypted privilege 15 tunnel-group 91.188.180.X type ipsec-l2l tunnel-group 91.188.180.X general-attributes  default-group-policy GroupPolicy_91.188.180.42 tunnel-group 91.188.180.X ipsec-attributes  ikev1 pre-shared-key *****  ikev2 remote-authentication pre-shared-key *****  ikev2 remote-authentication certificate  ikev2 local-authentication pre-shared-key ***** tunnel-group VPN-ST type remote-access tunnel-group VPN-ST general-attributes  address-pool vpnpool  default-group-policy VPN-ST tunnel-group VPN-ST ipsec-attributes  ikev1 pre-shared-key ***** ! class-map inspection_default  match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map  parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy  class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options   inspect icmp   inspect icmp error ! service-policy global_policy global prompt hostname context no call-home reporting anonymous Cryptochecksum:212e4f5035793d1c219fed57751983d8 : end   gate-71# sh crypto ikev1 sa There are no IKEv1 SAs   gate-71# sh crypto ikev2 sa There are no IKEv2 SAs   gate-71# sh crypto ipsec sa There are no ipsec sas   gate-71# sh crypto isakmp There are no IKEv1 SAs There are no IKEv2 SAs Global IKEv1 Statistics   Active Tunnels:              0   Previous Tunnels:            0   In Octets:                   0   In Packets:                  0   In Drop Packets:             0   In Notifys:                  0   In P2 Exchanges:             0   In P2 Exchange Invalids:     0   In P2 Exchange Rejects:      0   In P2 Sa Delete Requests:    0   Out Octets:                  0   Out Packets:                 0   Out Drop Packets:            0   Out Notifys:                 0   Out P2 Exchanges:            0   Out P2 Exchange Invalids:    0   Out P2 Exchange Rejects:     0   Out P2 Sa Delete Requests:   0   Initiator Tunnels:           0   Initiator Fails:             0   Responder Fails:             0   System Capacity Fails:       0   Auth Fails:                  0   Decrypt Fails:               0   Hash Valid Fails:            0   No Sa Fails:                 0 IKEV1 Call Admission Statistics   Max In-Negotiation SAs:                 25   In-Negotiation SAs:                      0   In-Negotiation SAs Highwater:            0   In-Negotiation SAs Rejected:             0 Global IKEv2 Statistics   Active Tunnels:                          0   Previous Tunnels:                        0   In Octets:                               0   In Packets:                              0   In Drop Packets:                         0   In Drop Fragments:                       0   In Notifys:                              0   In P2 Exchange:                          0   In P2 Exchange Invalids:                 0   In P2 Exchange Rejects:                  0   In IPSEC Delete:                         0   In IKE Delete:                           0   Out Octets:                              0   Out Packets:                             0   Out Drop Packets:                        0   Out Drop Fragments:                      0   Out Notifys:                             0   Out P2 Exchange:                         0   Out P2 Exchange Invalids:                0   Out P2 Exchange Rejects:                 0   Out IPSEC Delete:                        0   Out IKE Delete:                          0   SAs Locally Initiated:                   0   SAs Locally Initiated Failed:            0   SAs Remotely Initiated:                  0   SAs Remotely Initiated Failed:           0   System Capacity Failures:                0   Authentication Failures:                 0   Decrypt Failures:                        0   Hash Failures:                           0   Invalid SPI:                             0   In Configs:                              0   Out Configs:                             0   In Configs Rejects:                      0   Out Configs Rejects:                     0   Previous Tunnels:                        0   Previous Tunnels Wraps:                  0   In DPD Messages:                         0   Out DPD Messages:                        0   Out NAT Keepalives:                      0   IKE Rekey Locally Initiated:             0   IKE Rekey Remotely Initiated:            0   CHILD Rekey Locally Initiated:           0   CHILD Rekey Remotely Initiated:          0 IKEV2 Call Admission Statistics   Max Active SAs:                   No Limit   Max In-Negotiation SAs:                 50   Cookie Challenge Threshold:          Never   Active SAs:                              0   In-Negotiation SAs:                      0   Incoming Requests:                       0   Incoming Requests Accepted:              0   Incoming Requests Rejected:              0   Outgoing Requests:                       0   Outgoing Requests Accepted:              0   Outgoing Requests Rejected:              0   Rejected Requests:                       0   Rejected Over Max SA limit:              0   Rejected Low Resources:                  0   Rejected Reboot In Progress:             0   Cookie Challenges:                       0   Cookie Challenges Passed:                0   Cookie Challenges Failed:                0 Global IKEv1 IPSec over TCP Statistics -------------------------------- Embryonic connections: 0 Active connections: 0 Previous connections: 0 Inbound packets: 0 Inbound dropped packets: 0 Outbound packets: 0 Outbound dropped packets: 0 RST packets: 0 Recevied ACK heart-beat packets: 0 Bad headers: 0 Bad trailers: 0 Timer failures: 0 Checksum errors: 0 Internal errors: 0   gate-71# sh crypto protocol statistics all [IKEv1 statistics]    Encrypt packet requests: 0    Encapsulate packet requests: 0    Decrypt packet requests: 0    Decapsulate packet requests: 0    HMAC calculation requests: 0    SA creation requests: 0    SA rekey requests: 0    SA deletion requests: 0    Next phase key allocation requests: 0    Random number generation requests: 0    Failed requests: 0 [IKEv2 statistics]    Encrypt packet requests: 0    Encapsulate packet requests: 0    Decrypt packet requests: 0    Decapsulate packet requests: 0    HMAC calculation requests: 0    SA creation requests: 0    SA rekey requests: 0    SA deletion requests: 0    Next phase key allocation requests: 0    Random number generation requests: 0    Failed requests: 0 [IPsec statistics]    Encrypt packet requests: 0    Encapsulate packet requests: 0    Decrypt packet requests: 0    Decapsulate packet requests: 0    HMAC calculation requests: 0    SA creation requests: 0    SA rekey requests: 0    SA deletion requests: 0    Next phase key allocation requests: 0    Random number generation requests: 0    Failed requests: 0 [SSL statistics]    Encrypt packet requests: 19331    Encapsulate packet requests: 19331    Decrypt packet requests: 437    Decapsulate packet requests: 437    HMAC calculation requests: 19768    SA creation requests: 178    SA rekey requests: 0    SA deletion requests: 176    Next phase key allocation requests: 0    Random number generation requests: 0    Failed requests: 0 [SSH statistics are not supported] [SRTP statistics]    Encrypt packet requests: 0    Encapsulate packet requests: 0    Decrypt packet requests: 0    Decapsulate packet requests: 0    HMAC calculation requests: 0    SA creation requests: 0    SA rekey requests: 0    SA deletion requests: 0    Next phase key allocation requests: 0    Random number generation requests: 0    Failed requests: 0 [Other statistics]    Encrypt packet requests: 0    Encapsulate packet requests: 0    Decrypt packet requests: 0    Decapsulate packet requests: 0    HMAC calculation requests: 6238    SA creation requests: 0    SA rekey requests: 0    SA deletion requests: 0    Next phase key allocation requests: 0    Random number generation requests: 76    Failed requests: 9 gate-71# sh crypto ca trustpoints Trustpoint ASDM_TrustPoint0:     Configured for self-signed certificate generation. Trustpoint ASDM_TrustPoint1:     Configured for self-signed certificate generation.   If you need something more , then lay out ! Please explain why it is I do not want to work ? ... View more

Hello, everyone ! Then put the puzzle bosses to make sure that users are logged in using AD and went to the internet . Given Cisco ASA 5505. On the domain controller should AD agent ( which is saying dc - up and client - up), ASA quietly takes user logins . IP- addresses on the network are distributed by DHCP, which is raised on a domain controller .       The essence of the problem is that after the user authentication online falls off after a certain time . That is, the user logged on the computer , and then open the browser, opened a couple of sites, then passed from the 5 and 7 minutes of inactivity and then Internet is not available. Internet appears when the user relogin to the computer , or at some time turn off "Network LAN connection " for 1 minute. You can not have to dig? This configuration on the ASA as follows: object-group user ACTIVE_ALLOW  user-group DCU\\CASA61_Allow  user DCU\User1  user DCU\User2 access-list inside_access_in_1 extended permit ip object-group-user ACTIVE_ALLOW 192.168.1.0 255.255.255.0 any log debugging aaa-server ADA protocol radius  ad-agent-mode  interim-accounting-update  reactivation-mode depletion deadtime 1  merge-dacl after-avpair aaa-server ADA (inside) host dc61-01  key *****  radius-common-pw *****  no mschapv2-capable aaa-server AD protocol ldap  reactivation-mode depletion deadtime 1 aaa-server AD (inside) host dc61-01  ldap-base-dn dc=DCU,dc=local  ldap-scope subtree  ldap-naming-attribute sAMAccountName  ldap-login-password *****  ldap-login-dn CN=CISCOASA61,OU=Users_MC,dc=DCU,dc=local  server-type microsoft user-identity domain DCU aaa-server AD user-identity domain DC61-01 aaa-server AD user-identity default-domain DCU user-identity action domain-controller-down DCU disable-user-identity-rule no user-identity action mac-address-mismatch remove-user-ip no user-identity inactive-user-timer user-identity logout-probe netbios local-system probe-time minutes 60 retry-interval seconds 5 retry-count 5 match-any user-identity poll-import-user-group-timer hours 12 user-identity ad-agent active-user-database full-download user-identity ad-agent aaa-server ADA user-identity user-not-found enable At this point, while writing this message here (20 min) , 1 time from the Internet thrown out .   ... View more

Здравствуйте все! Поставило тут задачку начальство сделать так, чтобы пользователи авторизировались с помощью AD и ходили в интернет. Дано Cisco ASA 5505. На контроллере домена стоит AD agent (который говорит что dc - up и client - up), АСА спокойно забирает логины пользователей. IP-адреса в сети раздаются по DHCP, который поднят на контроллере домена. Суть проблемы такова, что после ауторизации пользователя интернет отваливается спустя некоторое время. То есть Пользователь зашел на комп, потом открыл браузер, открыл пару сайтов, потом прошло от 5 и 7 минут простоя и далее интернет недоступен. Интернет появляется тиогда, когда пользователь заново перезайдёт на компьютер, либо на некоторое время выключит "Сетевое подключение по локальной сети" на 1 минуту. Куда тут копать? Конфиг сего безобразия на АСЕ таков: object-group user ACTIVE_ALLOW  user-group DCU\\CASA61_Allow  user DCU\User1  user DCU\User2 access-list inside_access_in_1 extended permit ip object-group-user ACTIVE_ALLOW 192.168.1.0 255.255.255.0 any log debugging aaa-server ADA protocol radius  ad-agent-mode  interim-accounting-update  reactivation-mode depletion deadtime 1  merge-dacl after-avpair aaa-server ADA (inside) host dc61-01  key *****  radius-common-pw *****  no mschapv2-capable aaa-server AD protocol ldap  reactivation-mode depletion deadtime 1 aaa-server AD (inside) host dc61-01  ldap-base-dn dc=DCU,dc=local  ldap-scope subtree  ldap-naming-attribute sAMAccountName  ldap-login-password *****  ldap-login-dn CN=CISCOASA61,OU=Users_MC,dc=DCU,dc=local  server-type microsoft user-identity domain DCU aaa-server AD user-identity domain DC61-01 aaa-server AD user-identity default-domain DCU user-identity action domain-controller-down DCU disable-user-identity-rule no user-identity action mac-address-mismatch remove-user-ip no user-identity inactive-user-timer user-identity logout-probe netbios local-system probe-time minutes 60 retry-interval seconds 5 retry-count 5 match-any user-identity poll-import-user-group-timer hours 12 user-identity ad-agent active-user-database full-download user-identity ad-agent aaa-server ADA user-identity user-not-found enable   В данный момент времени пока писала это сообщение сюда (20 мин), 1 раз из интернета вышвернуло.   ... View more

Я имею ASA 5505. Как настроить переключение с резервного канала на основной с задержкой (например 5 мин) с помощью SLA monitor? Моя конфигурация на текущий момент: My configuration for SLA monitor: sla monitor 123  type echo protocol ipIcmpEcho IP_GATEWAY_MAIN interface outside_cifra  num-packets 3  timeout 3000  frequency 10 sla monitor schedule 123 life forever start-time now track 1 rtr 123 reachability Спасибо!     ... View more