Solved: Re: Problem with Remote Access VPN on ASA 5505

matt020191 · ‎12-11-2012

I am currently having an issue configuring an ASA 5505 to connect via remote access VPN using the Cisco VPN Client 5.0.07.0440 running on Windows 8 Pro x64. The VPN client prompts for the username and password during the connect process, but fails soon after.

The VPN client logs are as follows:

---------------------------------------------------------------------------------------------------------------------------------------

Cisco Systems VPN Client Version 5.0.07.0440

Client Type(s): Windows, WinNT

Running on: 6.2.9200

2 15:09:21.240 12/11/12 Sev=Info/4 CM/0x63100002

Begin connection process

3 15:09:21.287 12/11/12 Sev=Info/4 CM/0x63100004

Establish secure connection

4 15:09:21.287 12/11/12 Sev=Info/4 CM/0x63100024

Attempt connection with server "**.**.***.***"

5 15:09:21.287 12/11/12 Sev=Info/6 IKE/0x6300003B

Attempting to establish a connection with **.**.***.***.

6 15:09:21.287 12/11/12 Sev=Info/4 IKE/0x63000001

Starting IKE Phase 1 Negotiation

7 15:09:21.303 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to **.**.***.***

8 15:09:21.365 12/11/12 Sev=Info/6 GUI/0x63B00012

Authentication request attributes is 6h.

9 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

10 15:09:21.334 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?)) from **.**.***.***

11 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x63000001

Peer is a Cisco-Unity compliant peer

12 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x63000001

Peer supports XAUTH

13 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x63000001

Peer supports DPD

14 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x63000001

Peer supports NAT-T

15 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x63000001

Peer supports IKE fragmentation payloads

16 15:09:21.334 12/11/12 Sev=Info/6 IKE/0x63000001

IOS Vendor ID Contruction successful

17 15:09:21.334 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to **.**.***.***

18 15:09:21.334 12/11/12 Sev=Info/6 IKE/0x63000055

Sent a keepalive on the IPSec SA

19 15:09:21.334 12/11/12 Sev=Info/4 IKE/0x63000083

IKE Port in use - Local Port = 0xFBCE, Remote Port = 0x1194

20 15:09:21.334 12/11/12 Sev=Info/5 IKE/0x63000072

Automatic NAT Detection Status:

Remote end is NOT behind a NAT device

This end IS behind a NAT device

21 15:09:21.334 12/11/12 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

22 15:09:21.365 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

23 15:09:21.365 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from **.**.***.***

24 15:09:21.365 12/11/12 Sev=Info/4 CM/0x63100015

Launch xAuth application

25 15:09:21.474 12/11/12 Sev=Info/4 IPSEC/0x63700008

IPSec driver successfully started

26 15:09:21.474 12/11/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

27 15:09:27.319 12/11/12 Sev=Info/4 CM/0x63100017

xAuth application returned

28 15:09:27.319 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to **.**.***.***

29 15:09:27.365 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

30 15:09:27.365 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from **.**.***.***

31 15:09:27.365 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to **.**.***.***

32 15:09:27.365 12/11/12 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

33 15:09:27.365 12/11/12 Sev=Info/5 IKE/0x6300005E

Client sending a firewall request to concentrator

34 15:09:27.365 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to **.**.***.***

35 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

36 15:09:27.397 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from **.**.***.***

37 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS: , value = 192.168.2.70

38 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK: , value = 255.255.255.0

39 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(1): , value = 192.168.2.1

40 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS(2): , value = 8.8.8.8

41 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD: , value = 0x00000001

42 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN: , value = NCHCO

43 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS: , value = 0x00000000

44 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc ASA5505 Version 8.2(5) built by builders on Fri 20-May-11 16:00

45 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT: , value = 0x00000001

46 15:09:27.397 12/11/12 Sev=Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = Received and using NAT-T port number , value = 0x00001194

47 15:09:27.397 12/11/12 Sev=Info/4 CM/0x63100019

Mode Config data received

48 15:09:27.412 12/11/12 Sev=Info/4 IKE/0x63000056

Received a key request from Driver: Local IP = 192.168.2.70, GW IP = **.**.***.***, Remote IP = 0.0.0.0

49 15:09:27.412 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to **.**.***.***

50 15:09:27.444 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

51 15:09:27.444 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from **.**.***.***

52 15:09:27.444 12/11/12 Sev=Info/5 IKE/0x63000045

RESPONDER-LIFETIME notify has value of 86400 seconds

53 15:09:27.444 12/11/12 Sev=Info/5 IKE/0x63000047

This SA has already been alive for 6 seconds, setting expiry to 86394 seconds from now

54 15:09:27.459 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

55 15:09:27.459 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:NO_PROPOSAL_CHOSEN) from **.**.***.***

56 15:09:27.459 12/11/12 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to **.**.***.***

57 15:09:27.459 12/11/12 Sev=Info/4 IKE/0x63000049

Discarding IPsec SA negotiation, MsgID=CE99A8A8

58 15:09:27.459 12/11/12 Sev=Info/4 IKE/0x63000017

Marking IKE SA for deletion (I_Cookie=A3A341F1C7606AD5 R_Cookie=F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

59 15:09:27.459 12/11/12 Sev=Info/5 IKE/0x6300002F

Received ISAKMP packet: peer = **.**.***.***

60 15:09:27.459 12/11/12 Sev=Info/4 IKE/0x63000058

Received an ISAKMP message for a non-active SA, I_Cookie=A3A341F1C7606AD5 R_Cookie=F1F403018625E924

61 15:09:27.459 12/11/12 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(Dropped) from **.**.***.***

62 15:09:27.490 12/11/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

63 15:09:30.475 12/11/12 Sev=Info/4 IKE/0x6300004B

Discarding IKE SA negotiation (I_Cookie=A3A341F1C7606AD5 R_Cookie=F1F403018625E924) reason = DEL_REASON_IKE_NEG_FAILED

64 15:09:30.475 12/11/12 Sev=Info/4 CM/0x63100012

Phase 1 SA deleted before first Phase 2 SA is up cause by "DEL_REASON_IKE_NEG_FAILED". 0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

65 15:09:30.475 12/11/12 Sev=Info/5 CM/0x63100025

Initializing CVPNDrv

66 15:09:30.475 12/11/12 Sev=Info/6 CM/0x63100046

Set tunnel established flag in registry to 0.

67 15:09:30.475 12/11/12 Sev=Info/4 IKE/0x63000001

IKE received signal to terminate VPN connection

68 15:09:30.475 12/11/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

69 15:09:30.475 12/11/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

70 15:09:30.475 12/11/12 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

71 15:09:30.475 12/11/12 Sev=Info/4 IPSEC/0x6370000A

IPSec driver successfully stopped

---------------------------------------------------------------------------------------------------------------------------------------

The running configuration is as follows (there is a site-to-site VPN set up as well to another ASA 5505, but that is working flawlessly):

: Saved

:

ASA Version 8.2(5)

!

hostname NCHCO

enable password hTjwXz/V8EuTw9p9 encrypted

passwd hTjwXz/V8EuTw9p9 encrypted

names

name 192.168.2.0 NCHCO description City Offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Ethernet0/0

switchport access vlan 2

speed 100

duplex full

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address **.**.***.*** 255.255.255.248

!

boot system disk0:/asa825-k8.bin

ftp mode passive

access-list outside_nat0_outbound extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip any 192.168.2.64 255.255.255.224

access-list outside_1_cryptomap extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list outside_1_cryptomap_1 extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list LAN_Access standard permit NCHCO 255.255.255.0

access-list LAN_Access standard permit 0.0.0.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool VPN_Pool VPN_Start-VPN_End mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-645.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

nat (outside) 0 access-list outside_nat0_outbound

route outside 0.0.0.0 0.0.0.0 74.219.208.49 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

network-acl outside_nat0_outbound

webvpn

svc ask enable default svc

http server enable

http 192.168.1.0 255.255.255.0 inside

http **.**.***.*** 255.255.255.255 outside

http 74.218.158.238 255.255.255.255 outside

http NCHCO 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set l2tp-transform esp-3des esp-sha-hmac

crypto ipsec transform-set l2tp-transform mode transport

crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport

crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto dynamic-map dyn-map 10 set pfs group1

crypto dynamic-map dyn-map 10 set transform-set l2tp-transform vpn-transform

crypto dynamic-map dyn-map 10 set reverse-route

crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 74.219.208.50

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map inside_map interface inside

crypto map vpn-map 1 match address outside_1_cryptomap_1

crypto map vpn-map 1 set pfs group1

crypto map vpn-map 1 set peer 74.219.208.50

crypto map vpn-map 1 set transform-set ESP-3DES-SHA

crypto map vpn-map 10 ipsec-isakmp dynamic dyn-map

crypto isakmp identity address

crypto isakmp enable inside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 15

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 35

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp ipsec-over-tcp port 10000

client-update enable

telnet 192.168.1.0 255.255.255.0 inside

telnet NCHCO 255.255.255.0 inside

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh NCHCO 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd address 192.168.2.150-192.168.2.225 inside

dhcpd dns 216.68.4.10 216.68.5.10 interface inside

dhcpd lease 64000 interface inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 192.168.2.1

vpn-tunnel-protocol IPSec l2tp-ipsec

default-domain value nchco.local

group-policy DfltGrpPolicy attributes

dns-server value 192.168.2.1

vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn

password-storage enable

ipsec-udp enable

intercept-dhcp 255.255.255.0 enable

address-pools value VPN_Pool

group-policy NCHVPN internal

group-policy NCHVPN attributes

dns-server value 192.168.2.1 8.8.8.8

vpn-tunnel-protocol IPSec l2tp-ipsec

default-domain value NCHCO

username admin password LbMiJuAJjDaFb2uw encrypted privilege 15

username 8njferg password yB1lHEVmHZGj5C2Z encrypted privilege 15

username NCHvpn99 password QhZZtJfwbnowceB7 encrypted

tunnel-group DefaultRAGroup general-attributes

address-pool (inside) VPN_Pool

address-pool VPN_Pool

authentication-server-group (inside) LOCAL

authentication-server-group (outside) LOCAL

authorization-server-group LOCAL

authorization-server-group (inside) LOCAL

authorization-server-group (outside) LOCAL

default-group-policy DefaultRAGroup

strip-realm

strip-group

tunnel-group DefaultRAGroup ipsec-attributes

pre-shared-key *****

peer-id-validate nocheck

tunnel-group DefaultRAGroup ppp-attributes

no authentication chap

no authentication ms-chap-v1

authentication ms-chap-v2

tunnel-group DefaultWEBVPNGroup ppp-attributes

authentication pap

authentication ms-chap-v2

tunnel-group 74.219.208.50 type ipsec-l2l

tunnel-group 74.219.208.50 ipsec-attributes

pre-shared-key *****

tunnel-group NCHVPN type remote-access

tunnel-group NCHVPN general-attributes

address-pool VPN_Pool

default-group-policy NCHVPN

tunnel-group NCHVPN ipsec-attributes

pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:15852745977ff159ba808c4a4feb61fa

: end

asdm image disk0:/asdm-645.bin

asdm location VPN_Start 255.255.255.255 inside

asdm location VPN_End 255.255.255.255 inside

no asdm history enable

Anyone have any idea why this is happening?

Thanks!

Muhammed Safwan · ‎12-18-2012

Also add, crypto dynamic-map outside_dyn_map 20 set reverse-route.

With Regards,

Safwan

View solution in original post

Muhammed Safwan · ‎12-11-2012

Try by removing crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5

and add crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA. It should solve the problem

with Regards,

Safwan

Don't forget to rate helpful posts.

matt020191 · ‎12-11-2012

Thank you very much, that fixed the connection problem!

However, the connection is not working 100%. I have it set up for split tunneling so the Internet can be accessed concurrently with the LAN behind the ASA, however, even though I do have internet access, I cannot access the LAN behind the ASA at all. Any idea why that is happening?

Here is the new running configuration:

: Saved

:

ASA Version 8.2(5)

!

hostname NCHCO

enable password hTjwXz/V8EuTw9p9 encrypted

passwd hTjwXz/V8EuTw9p9 encrypted

names

name 192.168.2.0 NCHCO description City Offices

name 192.168.2.80 VPN_End

name 192.168.2.70 VPN_Start

!

interface Ethernet0/0

switchport access vlan 2

speed 100

duplex full

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.2.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address **.**.***.*** 255.255.255.248

!

boot system disk0:/asa825-k8.bin

ftp mode passive

access-list outside_nat0_outbound extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip any 192.168.2.64 255.255.255.224

access-list inside_nat0_outbound extended permit ip 0.0.0.0 255.255.255.0 192.168.2.64 255.255.255.224

access-list outside_1_cryptomap extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list outside_1_cryptomap_1 extended permit ip NCHCO 255.255.255.0 192.168.1.0 255.255.255.0

access-list LAN_Access standard permit NCHCO 255.255.255.0

access-list LAN_Access standard permit 0.0.0.0 255.255.255.0

access-list NCHCO_splitTunnelAcl standard permit 0.0.0.0 255.255.255.0

access-list NCHCO_splitTunnelAcl_1 standard permit 0.0.0.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool VPN_Pool VPN_Start-VPN_End mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-645.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0

nat (outside) 0 access-list outside_nat0_outbound

route outside 0.0.0.0 0.0.0.0 74.219.208.49 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

network-acl outside_nat0_outbound

webvpn

svc ask enable default svc

http server enable

http 192.168.1.0 255.255.255.0 inside

http **.**.***.*** 255.255.255.255 outside

http **.***.***.*** 255.255.255.255 outside