We have an ipsec vpn tunnel between a Cisco ASA and PA firewall.  The tunnel is fully functional as far as passing traffic in both directiosn but from the PA side I cannot ping the inside interface (default gateway for local networks) on the ASA and we need to be able to do so.  Below is the config:   ASA Version 9.1(7)23 ! hostname XXXXXXXXXXX domain-name XXXXXXXXX enable password XXXXXXXXX encrypted xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain passwd XXXXXXXXXXX encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 10.100.14.1 255.255.255.128 ! interface Vlan2 nameif outside security-level 0 ip address XX.XX.XX.XX 255.255.255.248 ! boot system disk0:/asa917-23-k8.bin ftp mode passive dns server-group DefaultDNS domain-name XXXXXXXXXX object network obj-10.100.0.0 subnet 10.100.0.0 255.255.0.0 object network obj_any subnet 0.0.0.0 0.0.0.0 object network obj-0.0.0.0 host 0.0.0.0 object network obj-10.100.14.0 subnet 10.100.14.0 255.255.255.128 object network obj-10.100..0 object-group network DM_INLINE_NETWORK_1 network-object 10.100.6.0 255.255.255.0 network-object 10.100.95.0 255.255.255.192 network-object 10.100.5.0 255.255.255.0 access-list vpn extended permit ip 10.100.14.0 255.255.255.128 object-group DM_INLINE_NETWORK_1 access-list inside_nat0_outbound extended permit ip 10.100.14.0 255.255.255.128 10.100.0.0 255.255.0.0 pager lines 24 mtu inside 1500 mtu outside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-792.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,any) source static obj-10.100.14.0 obj-10.100.14.0 destination static obj-10.100.0.0 obj-10.100.0.0 no-proxy-arp route-lookup ! object network obj_any nat (inside,outside) dynamic obj-0.0.0.0 object network obj-10.100.14.0 nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 XX.XX.XX.XXX 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL http server enable 8080 http server idle-timeout 30 http 10.100.14.0 255.255.255.128 inside http 10.100.95.0 255.255.255.0 inside http 10.100.6.23 255.255.255.255 inside http 71.181.12.192 255.255.255.224 outside snmp-server host inside 10.100.5.114 poll community ***** version 2c snmp-server host inside 10.100.5.40 poll community ***** version 2c snmp-server host inside 10.100.95.50 community ***** version 2c snmp-server location Arlington snmp-server contact City IT snmp-server enable traps syslog snmp-server enable traps entity config-change crypto ipsec ikev1 transform-set Trans1 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set Trans2 esp-aes esp-sha-hmac crypto ipsec security-association pmtu-aging infinite crypto map vpnmap 10 match address vpn crypto map vpnmap 10 set peer XX.XX.XX.XXX crypto map vpnmap 10 set ikev1 transform-set Trans2 crypto map vpnmap 10 set security-association lifetime seconds 14400 crypto map vpnmap interface outside crypto ca trustpool policy crypto ikev1 enable outside crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 5 lifetime 28800 telnet timeout 5 ssh stricthostkeycheck ssh 10.100.6.23 255.255.255.255 inside ssh 10.100.95.0 255.255.255.0 inside ssh 10.100.5.34 255.255.255.255 inside ssh 10.100.14.0 255.255.255.128 inside ssh XX.XX.XX.XXX 255.255.255.224 outside ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd dns 10.100.5.11 10.100.6.4 dhcpd lease 7200 ! dhcpd address 10.100.14.50-10.100.14.81 inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept username admin password Eoye1oGYHaZPfpfC encrypted tunnel-group XX.XXX.XX.XXX type ipsec-l2l tunnel-group XX.XXX.XX.XXX ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:83cda4102f25185d01dd356ebbe8cc5f : end ... View more

I am having an issue setting up an ASA behind a Comcast Gateway box for internet access and a ipsec vpn tunnel.  I have placed the Comcast box in bridge mode and configured the ASA but cannot get out to the internet.  Here is the info .  The WAN IP on the ASA is 50.208.131.41/29. The default gateway is 50.208.131.46.  DNS servers are 75.75.75.75 and 75.75.75.76.  On the inside interface of the ASA the IP is 10.100.14.1/25 with DHCP enabled for LAN clients.  The VPN tunnel needs to provide access from the 10.100.14.0/25 network on this end to networks 10.100.95.0/24, 10.100.5.0/24 and 10.100.6.0/24 on the other end where there is a Palo Alto 3020.  With eth0/0 plugged intot the Comcast box I cannot even get out to the internet let alone bring up the tunnel.  I am confused how to configure DNS properly on the ASA to pass along to clients on the inside.  We want the clients to be able to resolve both internet and network resources on the inside of the other side of the VPN.  So do I use public DNS or private DNS that lives on servers on the other side of the tunnel?  I currently have it configured to use the private DNS servers but I did hardcode the clients with the public DNS and still didnt work.  below is the ASA config.  I appreciate the help.  I want to get internet connectivity working then the vpn tunnel.   XXXXXXXX-ASA# sh run : Saved : : Serial Number: JMX1426Z048 : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.1(7)23 ! hostname XXXXXXXXX-ASA domain-name XXXXX enable password XXXXXXXXXXX encrypted xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain passwd a17y3PDNg5MOaAxQ encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 10.100.14.1 255.255.255.128 ! interface Vlan2 nameif outside security-level 0 ip address 50.208.131.41 255.255.255.248 ! boot system disk0:/asa917-23-k8.bin ftp mode passive dns server-group DefaultDNS domain-name nashua.city object network obj-10.100.0.0 subnet 10.100.0.0 255.255.0.0 object network obj_any subnet 0.0.0.0 0.0.0.0 object network obj-0.0.0.0 host 0.0.0.0 object network obj-10.100.14.0 subnet 10.100.14.0 255.255.255.128 object network obj-10.100..0 object-group network DM_INLINE_NETWORK_1 network-object 10.100.6.0 255.255.255.0 network-object 10.100.95.0 255.255.255.192 network-object 10.100.5.0 255.255.255.0 access-list vpn extended permit ip 10.100.14.0 255.255.255.128 object-group DM_INLINE_NETWORK_1 access-list inside_nat0_outbound extended permit ip 10.100.14.0 255.255.255.128 10.100.0.0 255.255.0.0 pager lines 24 mtu inside 1500 mtu outside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-792.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,any) source static obj-10.100.14.0 obj-10.100.14.0 destination static obj-10.100.0.0 obj-10.100.0.0 no-proxy-arp route-lookup ! object network obj_any nat (inside,outside) dynamic obj-0.0.0.0 object network obj-10.100.14.0 nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 50.208.131.46 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL http server enable 8080 http server idle-timeout 30 http 10.100.14.0 255.255.255.128 inside http 10.100.95.0 255.255.255.0 inside http 10.100.6.23 255.255.255.255 inside http 71.181.12.192 255.255.255.224 outside snmp-server host inside 10.100.5.114 poll community ***** version 2c snmp-server host inside 10.100.5.40 poll community ***** version 2c snmp-server host inside 10.100.95.50 community ***** version 2c snmp-server location Arlington snmp-server contact City IT snmp-server enable traps syslog snmp-server enable traps entity config-change crypto ipsec ikev1 transform-set Trans1 esp-aes esp-md5-hmac crypto ipsec ikev1 transform-set Trans2 esp-aes esp-sha-hmac crypto ipsec security-association pmtu-aging infinite crypto map vpnmap 10 match address vpn crypto map vpnmap 10 set peer 71.181.12.194 crypto map vpnmap 10 set ikev1 transform-set Trans2 crypto map vpnmap 10 set security-association lifetime seconds 14400 crypto map vpnmap interface outside crypto ca trustpool policy crypto ikev1 enable outside crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 5 lifetime 28800 telnet timeout 5 ssh stricthostkeycheck ssh 10.100.6.23 255.255.255.255 inside ssh 10.100.95.0 255.255.255.0 inside ssh 10.100.5.34 255.255.255.255 inside ssh 10.100.14.0 255.255.255.128 inside ssh 71.181.12.192 255.255.255.224 outside ssh timeout 5 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd dns 10.100.5.11 10.100.6.4 dhcpd lease 7200 ! dhcpd address 10.100.14.50-10.100.14.81 inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept username admin password Eoye1oGYHaZPfpfC encrypted tunnel-group 71.181.12.194 type ipsec-l2l tunnel-group 71.181.12.194 ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:83cda4102f25185d01dd356ebbe8cc5f   ... View more

I setup a Cisco ASA vpn tunnel a while back with a PA firewall on the other end where the ASA was behind a comcast modem that had a block of 5 public static IPs so the Comcast modem had one fromthe block and I was able to use another fromthe block for the outside interface on the ASA.  I am setting another VPN tunnel up but the ASA at this site is behind a Comcast modem with only a single DHCP IP so what do I use for the IP on the outside int of the ASA? ... View more

Currently we have logging level set to 7 debugging on our switches and we're seeing mostly interface up/down messages coming through to our syslog server.  I have been asked to setup logging so that we also see traps sent any time a user logs into a switch in  our syslog server.  Is this possible to do and which logging level should I set to accomplish this? ... View more

I have a vpn tunnel between a Cisco ASA 5505 and a Palo Alto 3020 that is up but I cannot ping the local networks back and forth.  I consulted with Palo Alto tech support and they verified that everything is set up properly on that device so I need assistance with the Cisco side.   The public IP on the ASA is 50.78.26.236 and the inside network is 172.128.32.32/29.  The inside interface is 172.128.32.33.   On the Palo Alto the public is 71.181.12.194 and the inside networks are 10.100.95.0/26, 10.100.6.0/24 and 10.100.160.0   We need all inside networks talking to each other obviously.  Right now I cannot ping the inside interface on the ASA, 172.128.32.33 from the Palo Alto firewall or hosts behind it.  There are no hosts on the Cisco side yet so I've just been pinging the inside interface.   I have pasted the ASA config below.   AMR-ASA-5505# sh run : Saved : : Serial Number: JMX181841P3 : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.1(7)23 ! hostname AMR-ASA-5505 domain-name XXXXXXXXXX enable password uY4VaCoUUoZVpQcc encrypted xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain passwd 2KFQnbNIdI.2KYOU encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 172.128.32.33 255.255.255.248 ! interface Vlan2 nameif outside security-level 0 ip address 50.78.26.236 255.255.255.248 ! boot system disk0:/disk0/asa917-23-k8.bin boot system disk0:/flash/asa917-23-k8.bin boot system disk0:/asa917-23-k8.bin ftp mode passive dns server-group DefaultDNS domain-name XXXXXXXXXXX object network obj_any subnet 0.0.0.0 0.0.0.0 object network Inside-Network subnet 172.128.32.32 255.255.255.248 object network obj-0.0.0.0 host 0.0.0.0 object network obj-10.100.0.0 subnet 10.100.0.0 255.255.0.0 object-group network City-Networks network-object 10.100.95.0 255.255.255.192 network-object 10.100.160.0 255.255.255.0 network-object 10.100.6.0 255.255.255.0 access-list vpn extended permit ip 172.128.32.32 255.255.255.248 object-group City-Networks pager lines 24 mtu inside 1500 mtu outside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-792.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,outside) source static Inside-Network Inside-Network destination static obj-10.100.0.0 obj-10.100.0.0 no-proxy-arp ! object network obj_any nat (inside,outside) dynamic obj-0.0.0.0 object network Inside-Network nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 50.78.26.238 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL aaa authentication ssh console LOCAL http server enable 8080 http server idle-timeout 30 http 10.100.95.0 255.255.255.0 inside http 10.100.6.23 255.255.255.255 inside http 10.100.160.0 255.255.255.0 inside http 172.128.32.32 255.255.255.248 inside no snmp-server location no snmp-server contact crypto ipsec ikev1 transform-set Trans2 esp-aes esp-sha-hmac crypto ipsec ikev1 transform-set Trans1 esp-aes esp-md5-hmac crypto ipsec security-association pmtu-aging infinite crypto map outside_map0 10 match address vpn crypto map outside_map0 10 set peer 71.181.12.194 crypto map outside_map0 10 set ikev1 transform-set Trans2 crypto map outside_map0 10 set security-association lifetime seconds 14400 crypto map outside_map0 interface outside crypto ca trustpool policy crypto ikev1 enable outside crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 5 lifetime 28800 telnet timeout 5 ssh stricthostkeycheck ssh 10.100.95.0 255.255.255.0 inside ssh 10.100.6.23 255.255.255.255 inside ssh 10.100.5.34 255.255.255.255 inside ssh 172.128.32.32 255.255.255.248 inside ssh 71.181.12.192 255.255.255.224 outside ssh 23.30.0.0 255.255.0.0 outside ssh timeout 25 ssh version 2 ssh key-exchange group dh-group14-sha1 console timeout 0 management-access inside threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless username admin password jcsXO4ULZyhpuLOW encrypted privilege 15 tunnel-group 71.181.12.194 type ipsec-l2l tunnel-group 71.181.12.194 ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect icmp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:064ec215ce88d94dd6838a55f3a17736 : end AMR-ASA-5505#           ... View more

So here's the setup.  An associate of our's who we're trying to setup a VPN tunnel with has a Comcast box that has been provisioned with two public IPs.  If I plug into the port that is configured with the IP that is dedicated for this VPN connection with my laptop and set the laptop IP to the public Ip that I'm using as the outside interface on the ASA, 50.78.26.236, I can reach the  internet without issue.  However when I put the ASA in place behind the Comcast box and tryo to get out I cannot.  The ASA has 50.78.26.236/29 configured on the outside with a gateway on the Comcast box of 50.78.26.236.  The inside interface on the ASA is 172.128.32.33/29 with no DHCP setup.  We  will have a single statically assigne dhost hanging off the ASA.  When I try to get from that host to the internet I can't even though I can reach the wan gateway 50.78.26.236 from it and resolve web addresses.  I entered a route outside 0.0.0.0 0.0.0.0 50.78.26.236 route in the ASA but when I do show route it says the gateway of last resort set and there ar eno routes in the route table.  Below is the ASA config.       AMR-ASA-5505# sh run : Saved : : Serial Number: JMX181841P3 : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz : ASA Version 9.1(7)23 ! hostname AMR-ASA-5505 domain-name XXXXXXXXXX enable password uY4VaCoUUoZVpQcc encrypted xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain passwd 2KFQnbNIdI.2KYOU encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 172.128.32.33 255.255.255.248 ! interface Vlan2 nameif outside security-level 0 ip address 50.78.26.236 255.255.255.248 ! boot system disk0:/disk0/asa917-23-k8.bin boot system disk0:/flash/asa917-23-k8.bin boot system disk0:/asa917-23-k8.bin ftp mode passive dns server-group DefaultDNS domain-name XXXXXXXXXXXX object network 10.100.6.0 subnet 10.100.6.0 255.255.255.0 object network obj_any subnet 0.0.0.0 0.0.0.0 object network Inside-Network subnet 172.128.32.32 255.255.255.248 object network obj-0.0.0.0 host 0.0.0.0 object-group network City-Networks network-object 10.100.95.0 255.255.255.192 network-object 10.100.160.0 255.255.255.0 network-object object 10.100.6.0 object-group network DM_INLINE_NETWORK_1 network-object 10.100.160.0 255.255.255.0 network-object 10.100.95.0 255.255.255.192 network-object object 10.100.6.0 access-list vpn extended permit ip object Inside-Network object-group City-Networks access-list outside_cryptomap extended permit ip object Inside-Network object-group DM_INLINE_NETWORK_1 access-list outside_access_in extended permit ip any any pager lines 24 mtu inside 1500 mtu outside 1500 icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-792.bin no asdm history enable arp timeout 14400 no arp permit-nonconnected ! object network Inside-Network nat (inside,outside) dynamic interface access-group outside_access_in in interface outside route outside 0.0.0.0 0.0.0.0 50.78.26.238 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable 8080 http server idle-timeout 30 http 10.100.95.0 255.255.255.0 inside http 10.100.6.23 255.255.255.255 inside http 10.100.160.0 255.255.255.0 inside http 172.128.32.32 255.255.255.248 inside no snmp-server location no snmp-server contact crypto ipsec ikev1 transform-set Trans2 esp-aes esp-sha-hmac crypto ipsec security-association pmtu-aging infinite crypto map outside_map0 10 match address outside_cryptomap crypto map outside_map0 10 set peer 71.181.12.194 crypto map outside_map0 10 set ikev1 transform-set Trans2 crypto map outside_map0 interface outside crypto ca trustpool policy crypto ikev1 enable outside crypto ikev1 policy 10 authentication pre-share encryption aes hash sha group 5 lifetime 28800 telnet timeout 5 ssh stricthostkeycheck ssh timeout 5 ssh version 2 ssh key-exchange group dh-group1-sha1 console timeout 0 management-access inside threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless username admin password jcsXO4ULZyhpuLOW encrypted privilege 15 tunnel-group 50.78.26.236 type ipsec-l2l tunnel-group 50.78.26.236 ipsec-attributes ikev1 pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:9f54b338078ed7658c42730b1187e363 : end AMR-ASA-5505# ... View more

We have a 4 member port channel setup.  the port channel is up but two of the member interfaces are showing up/down.  On the other side is not a Cisco switch but a PAlo Alto firewall and all interfaces on that end are configured correctly to be in the same aggregated link.   Here are some show outputs:     CH-CORE-6807-XL#sh etherchannel 20 sum Flags:  D - down        P - bundled in port-channel         I - stand-alone s - suspended         H - Hot-standby (LACP only)         R - Layer3      S - Layer2         U - in use      N - not in use, no aggregation         f - failed to allocate aggregator         M - not in use, no aggregation due to minimum links not met         m - not in use, port not aggregated due to minimum links not met         u - unsuitable for bundling         d - default port         w - waiting to be aggregated Number of channel-groups in use: 8 Number of aggregators:           8 Group  Port-channel  Protocol    Ports ------+-------------+-----------+----------------------------------------------- 20     Po20(SU)        LACP      Gi1/5/27(P)    Gi1/5/28(P)    Gi2/5/25(D)                                      Gi2/5/26(D)              CH-CORE-6807-XL#sh lacp 20 internal Flags:  S - Device is requesting Slow LACPDUs         F - Device is requesting Fast LACPDUs         A - Device is in Active mode       P - Device is in Passive mode      Channel group 20                              LACP port     Admin    Oper     Port     Port Port         Flags   State   Priority      Key      Key      Number   State Gi1/5/27     SA      bndl    32768         0x14     0x14     0x151C   0x3D   Gi1/5/28     SA      bndl    32768         0x14     0x14     0x151D   0x3D   Gi2/5/25     FA      down    32768         0x14     0x14     0x251A   0x47   Gi2/5/26     FA      down    32768         0x14     0x14     0x251B   0x47        CH-CORE-6807-XL#sh run int gi1/5/25 Building configuration... Current configuration : 185 bytes ! interface GigabitEthernet1/5/25  description CityPA1 Gi1 Po20  switchport  switchport mode trunk  switchport trunk allowed vlan 250,800,805,820,830  channel-group 20 mode active end CH-CORE-6807-XL#sh run int gi1/5/26 Building configuration... Current configuration : 185 bytes ! interface GigabitEthernet1/5/26  description CityPA1 Gi2 Po20  switchport  switchport mode trunk  switchport trunk allowed vlan 250,800,805,820,830  channel-group 20 mode active ... View more