Hola Juan, Espero que estés bien! Básicamente, basado en la descripción del problema yo podría sugerirte el ASA 5512-X o el ASA 5515-X. Eso depende de la cantidad de conexiones simultaneas que el ASA va a manejar. También tiene como usted menciono el numero de VPN peers soportado en estos ASAs es de 250. Pero eso también depende del numero de licencias que usted adquiera. Por defecto el ASA trae 2 licencias premium que significa que usted puede usar AnyConnect y WebVPN. Con estas licencias usted puede probar diferentes funciones y opciones de configuración para los clientes remotos. Ahora que menciono lo de las licencias recuerde que usted podría adquirir licencias premium (AnyConnect y WebVPN) , o solo licencias para AnyConnect (significa que no puede utilizar ninguna función de WebVPN).    Estas son las versiones de Linux OS soportadas  por la ultima versión del AnyConnect:   http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect31/release/notes/anyconnect31rn.html#pgfId-44220   Este es un cuadro de comparación donde usted puede ver la diferencia entre la nueva generación de ASAs comparada a las los ASAs viejos:   http://www.cisco.com/c/en/us/products/security/asa-5500-series-next-generation-firewalls/models-comparison.html   Espero que esto le ayude.   Éxitos!    Luis.         ... View more

Hi, I hope you're doing great   The messages that you are getting mean that t he security appliance has received a duplicate of a previous Phase 1 packet, and will transmit the last message. This message could indicate a network performance or connectivity issue where the peer is not receiving sent packets in a timely manner. You need to make sure that the remote peer ip address is correct and the pre-shared key is matching exactly the same on both sites. Also, make sure that there is not anything in the middle blocking isakmp (UDP 500). Please try to collect the following information:   Are you able to get the debugs from the remote site? Please send the VPN configuration of both sites for this specific tunnel. Do you have any other L2L tunnel active on the ASA? Please let me know if both sites are directly connected to the Internet and also if they have static or dynamic IP address on the outside. Please also try to take a “show crypto ikev1 sa” to see what message is the ASA waiting for. You could also take a capture from peer to peer on the outside to check if there is bidirectional communication. For instance: capture vpn interface (outside) match ip host (local peer) host (remote peer). Then you initiate the VPN tunnel and collect the output with the command “show capture vpn”. You also import it into Wireshark to get more details. Please get back to me if you have any question.   Luis.   ... View more

Hello Sealy, I hope you're doing great Based on your description you are using PAT (Port Address Translation) which is a one way NAT. Meaning that it will only work from inside to outside or from outside to inside, but not for both directions. In order to make this server accessible from the outside we would need to use a static NAT or port forwarding. For the first option you will need an extra Public IP address, however, for the second option you can use the External IP address of the ASA. Port forwarding or port redirection is a useful feature where the outside users try to access an internal server on a specific port. In order to achieve this, the internal server, which has a private IP address, will be translated to a public IP address which in turn is allowed access for the specific port. For example, let’s say that the users want to access server "C" on port 443 using the Outside IP address of the ASA:​ These will be the requirements:   - Allow Inside users to access the Internet. - Allow Inside Web server to serve https services to the Internet. - Allow Outside users to visit your Web server.   NAT configuration on ASA: 1-This configuration will redirect HTTPS requests for the ASA outside interface address to C.C.C.C internal host: hostname(config)# static (inside,outside) tcp interface https C.C.C.C https netmask 255.255.255.255   2-You could also redirect for example HTTP requests on port 8080 for the ASA outside interface to C.C.C.C port 80 by entering the following command:   hostname(config)# static (inside,outside) tcp interface 8080 C.C.C.C www netmask 255.255.255.255   Hope this helps! Luis.   ... View more

Hello Kakkouche, I hope you're doing great   You could use either version. It will also depend if the remote site supports ikev2. Most of the devices work with ikev1. Below you will find some of the difference between ikev1 and ikev2:   https://learningnetwork.cisco.com/docs/DOC-16892   Configuration examples:   http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/vpn_site2site.html http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113597-ptn-113597.html   Hope this helps!   Luis. ... View more

Hi Troosters, I hope you're doing great Could you please attach the current running configuration of  the new ASA? I noticed that you are missing some information but I would need to verify the configuration first. You could also take some debugs to see why the connection is not working. Please use the following debugs: debug crypto condition peer x.x.x.x >>>> Public IP address where the client is connecting from (You can use whatismyip.com to find that out.  debug crypto ikev1 200 debug crypto ipsec 200   Regards,   Luis.     ... View more

Hello Jon, Thanks for the information!   I did not know that you changed the ip local pool. In that case you just need to make sure that the NAT exemption rule is included before the permit ip 10.70.0.0 0.0.255.255 any. On the ACLs attached on the comment before you did not include the access-list 130 deny   ip 10.70.0.0 0.0.255.255 10.99.99.0 0.0.0.255. The only ACL rule referring to the 10.99.99.0/24 network was access-list 130 deny   ip 10.70.2.0 0.0.0.255 10.99.99.0 0.0.0.255, which is only allowing the 10.70.2.0/24 network to communicate with the VPN clients. Please make sure that the ACL is added like the one on the previous comment, and as I said before the permit.   host(config)#ip access-list ext 130 host(config-ext-nacl)# 1 deny ip 10.70.0.0 0.0.255.255 10.99.99.0 0.0.0.255   After that we should be good on the router site. If the problem continues please check any device on between and make sure it is forwarding the packets back to the router. You could also place an access-group on the inside interface of the router for incoming packets, that will help you to see if the packets are really coming back from the server. For instance:   host(config)#ip access-list ext 111 host(config-ext-nacl)#10 permit ip host 10.70.4.17 10.99.99.0 0.0.0.255 log host(config-ext-nacl)#20 permit ip any any host(config)#int G0/1 host(config-if)#ip access-group 111 in   Then, if the packets are really coming back to the Router you should see hit counts on the ACL rule with the command show access-list 111.   I hope this helps,   Luis.  ... View more

Hello Jon, Thanks for the information! Based on the capture we could see that the VPN client is getting the ip address 10.70.4.17 which is not part of the range specified on the ip local pool (10.70.12.1-50), this is definitely related to the subnet mask. I also noticed that you are trying to reach the 10.99.99.3 host, which means that we need a NAT exemption rule for the packets coming back from 10.99.99.0/24 to 10.70.12.0/24. Please specify the subnet mask that you would like to use under the crypto isakmp client configuration. Below you will find the outputs:   crytpo isakmp client configuration group VPNCLIENTGROUP  netmask 255.255.255.0   Also, please add the NAT exemption rule for the 10.99.99.0/24 network.   host(config)#ip access-list ext 130 host(config-ext-nacl)# 5 deny 10.99.99.0 0.0.0.255 10.70.12.0 0.0.0.255   Then reconnect the VPN client and check the mask, that should be a /24 mask. If that's correct please try to reach the 10.99.99.3 host again.   I hope this helps,   Luis.      ... View more

Hello Andy,   Great to hear that everything is working properly now. Please rate the question if you found useful our information in order to continue helping others. Thanks,   Luis. ... View more

Buenas,   Hay varias opciones para hacer que un grupo determinado de usuarios puedan conectar, pero eso depende del tipo de protocolo de autenticación que estés usando. Si estas usando LDAP podrías crear un grupo en el AD server específico para los clientes de VPN, y a cada cliente lo haces miembro de ese grupo. En el ASA tenemos la opción de configurar LDAP attribute mapping, lo que significa que usuarios van a ser mapeados a un group-policy especifico basado en el atributo memberOf. Por ejemplo si un usuario pertenece a “X” grupo déjelo conectar sino la conexión va a ser denegada.  Con RADIUS también puede utilizar el atributo 25 para asignar group policies específicos para ciertos usuarios o grupos. Aquí va a encontrar ejemplos de la configuración:   Para LDAP: Como comentamos anteriormente el attribute-map nos va a permitir el acceso al grupo específico de usuarios que queremos permitir que conecten. Por ejemplo quiero que cada usuario que es parte del grupo "vpngroup"  tenga acceso remoto:   1- Primero necesitamos encontrar el camino de ese grupo.  En el servidor lo podemos encontrar haciendo un dsquery para ese grupo:   C:\Documents and Settings\admin>dsquery group -samid vpngroup "CN=vpngroup,CN=Users,DC=vpn,DC=com"   2- Una vez que tengamos el dsquery, vamos a utilizar esa información para el LDAP attribute map, el group policy que vamos a asignar a los usuarios en este ejemplo va a ser CISCO: ldap attribute-map mymap   map-name  memberOf IETF-Radius-Class   map-value memberOf CN= vpngroup,CN=Users,DC=vpn,DC=com CISCO  <<group policy   3- En este group policy tenemos que especificar todos los parámetros para los usuarios que van a conectar, en este caso yo solo voy a especificar el más importante para efectos del ejemplo: group-policy CISCO internal group-policy CISCO attributes   vpn-simultaneous-logins 3   4- Después tenemos que crear el group-policy que va a denegar la conexión en el caso que el usuario no sea miembro del grupo VPN del LDAP server: group-policy NO_ACCESO internal group-policy NO_ACCESO attributes   vpn-simultaneous-logins 0   “Una nota importante es que tenemos que asegurarnos de mantener los vpn-simultaneous logins 3 en el group policy que vamos a asignar a los usuarios miembros del grupo VPN (CISCO). De lo contrario ese valor va ser tomado del default group policy asignado al tunnel group al que vamos a conectar, el cual va ser el group-policy que va a denegar el acceso basado en vpn-simulteneos logins 0 (NO_ACCESO)”  6- Despues tenemos que aplicar el attribute mapping configurado anteriormente dentro de la configuracion de LDAP: aaa-server LDAPSERVER protocol ldap aaa-server LDAPSERVER (outside) host 2.2.2.2  ldap-base-dn DC=vpn,DC=com  ldap-scope subtree  ldap-naming-attribute sAMAccountName  ldap-login-password letmein  ldap-login-dn CN=ASALDAP,CN=Users,DC=VPN,DC=com  server-type microsoft  ldap-attribute-map mymap   5- Una vez que tenemos todo configurado debemos aplicar el group policy NO_ACCESO en el tunnel-group que estamos conectando: tunnel-group VPN type remote-access tunnel-group VPN general-attributes  authentication-server-group LDAPSERVER  default-group-policy NO_ACCESO   En resumen con la configuración aplicada los usuarios que sean miembros del grupo VPN del LDAP server van a usar el group policy CISCO, si el usuario no es miembro de ese grupo va a obtener el default group policy aplicado en el tunnel-group (NO_ACCESO), el cual tiene configurado simultaneos logins 0, lo que va a causar que la conexión sea denegada.    Link de referencia: http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98634-asa-ldap-group-pol.html   Para RADIUS la mayoría de la configuración va ser en el servidor, en el ASA solo tenemos que especificar el servidor de autenticación y configurar los group-policies que vamos a asignar a los usuarios. Aquí me encontré un link que le puede ayudar en el Windows server, también hay un ejemplo para Cisco ACS que le puede servir de referencia: Windows: https://supportforums.cisco.com/document/144061/steps-configure-group-lock-vpn-users-microsoft-radius-server#   ACS: http://www.cisco.com/c/en/us/support/docs/security/secure-access-control-server-windows/98608-radius-assign-group-policy.html   Espero que esto le ayude,   Luis.  ... View more