Here is what I have so far, most of it has been done on ASDM:
!
hostname shiny
enable password
names
no mac-address auto
ip local pool shinypool 192.168.1.16-192.168.1.31 mask 255.255.255.240
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/2
bridge-group 1
nameif inside_1
security-level 100
!
interface GigabitEthernet1/3
bridge-group 1
nameif inside_2
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif inside_3
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif inside_4
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif inside_5
security-level 100
!
interface GigabitEthernet1/7
bridge-group 1
nameif inside_6
security-level 100
!
interface GigabitEthernet1/8
bridge-group 1
nameif inside_7
security-level 100
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
interface BVI1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
boot system disk0:/asa983-8-lfbff-k8.SPA
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
name-server 142.165.21.5 inside
name-server 142.165.200.5 inside
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any1
subnet 0.0.0.0 0.0.0.0
object network obj_any2
subnet 0.0.0.0 0.0.0.0
object network obj_any3
subnet 0.0.0.0 0.0.0.0
object network obj_any4
subnet 0.0.0.0 0.0.0.0
object network obj_any5
subnet 0.0.0.0 0.0.0.0
object network obj_any6
subnet 0.0.0.0 0.0.0.0
object network obj_any7
subnet 0.0.0.0 0.0.0.0
object network obj-inside
subnet 192.168.1.0 255.255.255.0
description inside network
object network obj-anyconnectpool
subnet 192.168.2.0 255.255.255.227
object network NETWORK_OBJ_192.168.2.0_24
subnet 192.168.2.0 255.255.255.0
object network NETWORK_OBJ_192.168.1.0_24
subnet 192.168.1.0 255.255.255.0
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
access-list AnyConnect_Client_Local_Print remark Windows' printing port
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353
access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355
access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns
access-list outside_access_in remark vpn access
access-list outside_access_in extended permit udp any any
access-list outside_access_in remark vpn access
access-list outside_access_in extended permit tcp any any
access-list outside_access_in remark vpn access
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit ip any any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit object-group TCPUDP any any
access-list inside_access_in remark vpn access
access-list inside_access_in extended permit udp any4 any
access-list inside_access_in extended permit tcp any any
access-list outside_cryptomap_65535.65535 extended permit object-group TCPUDP object obj-anyconnectpool 192.168.1.0 255.255.255.0
access-list Internal-LAN extended permit ip 192.168.1.0 255.255.255.0 any
access-list Local_Lan_Access extended permit ip host 0.0.0.0 any
access-list inside_1_access_in remark vpn access
access-list inside_1_access_in extended permit udp any any
access-list inside_1_access_in remark Implicit rule: Permit all traffic to less secure networks
access-list inside_1_access_in extended permit ip any any
access-list inside_2_access_in extended permit ip any any
access-list inside_2_access_in extended permit object-group TCPUDP any any
access-list global_access extended permit ip object obj-anyconnectpool 192.168.1.0 255.255.255.0
access-list outside_access_in_2 extended permit object-group TCPUDP any any
access-list outside_access_in_2 extended permit ip any any
access-list ouside_access_in1 extended permit ip object obj-anyconnectpool any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside_1 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside_6 1500
mtu inside_7 1500
no failover
no monitor-interface inside
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-792-152.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (outside,outside) source static obj-anyconnectpool obj-anyconnectpool destination static obj-anyconnectpool obj-anyconnectpool
access-group outside_access_in_2 in interface outside
access-group inside_1_access_in in interface inside_1
access-group inside_2_access_in in interface inside_2
access-group inside_access_in in interface inside
access-group global_access global
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside_1
http 192.168.1.0 255.255.255.0 inside_2
http 192.168.1.0 255.255.255.0 inside_3
http 192.168.1.0 255.255.255.0 inside_4
http 192.168.1.0 255.255.255.0 inside_5
http 192.168.1.0 255.255.255.0 inside_6
http 192.168.1.0 255.255.255.0 inside_7
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 match address outside_cryptomap_65535.65535
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_1_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map0 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map0 interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=shiny
keypair ASDM_LAUNCHER
proxy-ldc-issuer
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment self
subject-name CN=shiny
keypair ASDM_LAUNCHER
proxy-ldc-issuer
crl configure
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
enrollment self
fqdn none
subject-name CN=192.168.1.1,CN=shiny
keypair ASDM_LAUNCHER
crl configure
crypto ca trustpoint ASDM_TrustPoint2
enrollment terminal
crl configure
crypto ca trustpoint shinycert
enrollment terminal
fqdn -------------
subject-name CN=-------,OU=---,C=--,St=--,L=-----
keypair SSL-Keypair
crl configure
crypto ca trustpoint ASDM_shiny
enrollment self
subject-name CN=shinycert,OU=---,O=---,C=--,St=--,L=----
keypair ASDM_LAUNCHER
proxy-ldc-issuer
crl configure
crypto ca trustpool policy
crypto ca certificate map DefaultCertificateMap 10
crypto ca certificate map DefaultCertificateMap 20
crypto ca certificate chain ASDM_TrustPoint0
certificate
quit
crypto ca certificate chain ASDM_TrustPoint1
certificate
quit
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
certificate
quit
crypto ca certificate chain ASDM_shiny
certificate
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 enable inside_1
crypto ikev2 enable inside
crypto ikev2 remote-access trustpoint ASDM_Launcher_Access_TrustPoint_0
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 4
dhcp-client client-id interface outside
dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.254 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint1
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 outside
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_1
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_2
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_3
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_4
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_5
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_6
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside_7
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
webvpn
enable outside
enable inside_1
enable inside_2
enable inside_3
enable inside
anyconnect image disk0:/anyconnect-win-4.6.03049-webdeploy-k9.pkg 1
anyconnect profiles shiny1_client_profile disk0:/shiny1_client_profile.xml
anyconnect profiles shiny_client_profile disk0:/shiny_client_profile.xml
anyconnect enable
tunnel-group-list enable
internal-password enable
keepout "Service out temporarily."
cache
disable
error-recovery disable
ssl-server-check warn-on-failure
group-policy GroupPolicy_shiny internal
group-policy GroupPolicy_shiny attributes
wins-server none
dns-server value 142.165.21.5 142.165.200.5
vpn-simultaneous-logins 6
vpn-idle-timeout 30
vpn-session-timeout 600
vpn-session-timeout alert-interval 10
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value outside_access_in
default-domain none
webvpn
anyconnect profiles value shiny_client_profile type user
group-policy GroupPolicy_shiny1 internal
group-policy GroupPolicy_shiny1 attributes
wins-server none
dns-server value 142.165.21.5 142.165.200.5
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
default-domain none
webvpn
anyconnect profiles value shiny1_client_profile type user
group-policy shiny internal
group-policy shiny attributes
dns-server value 142.165.21.5
vpn-simultaneous-logins 6
vpn-idle-timeout 30
vpn-session-timeout 600
vpn-session-timeout alert-interval 10
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value outside_access_in
webvpn
anyconnect profiles value shiny_client_profile type unknown
dynamic-access-policy-record DfltAccessPolicy
username test password
username test attributes
vpn-idle-timeout 30
vpn-idle-timeout alert-interval 30
vpn-session-timeout 600
vpn-session-timeout alert-interval 10
service-type admin
username admin password
tunnel-group shiny type remote-access
tunnel-group shiny general-attributes
address-pool shinypool
default-group-policy GroupPolicy_shiny
tunnel-group shiny webvpn-attributes
group-alias shiny enable
tunnel-group shiny1 type remote-access
tunnel-group shiny1 general-attributes
address-pool shinypool
default-group-policy GroupPolicy_shiny1
tunnel-group shiny1 webvpn-attributes
group-alias shiny1 enable
tunnel-group-map DefaultCertificateMap 10 shiny
tunnel-group-map DefaultCertificateMap 20 shiny1
!
!
prompt hostname context
no call-home reporting anonymous
Cryptochecksum
: end
