Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
3351
Views
0
Helpful
14
Replies

IPsec Client to Client ?

cworsham80
Level 1
Level 1

‎06-14-2011 08:56 AM - edited ‎02-21-2020 05:24 PM

I have a new ASA 5505, I have setup the basics for interfaces, vpn etc.

all clients using vpn client software5.0+

Inside guys can ping vpn guys

vpn guys cannot ping inside guys

vpn guys cannot ping one another

i need all machines to talk equally

I've attempted to open up as much as possible, not concerned with the security at this point, i just need it to work, boss dropped it on my plate to get it done with a short time line and i'm over my head at this point!

PLEASE HELP!!!

Result of the command: "sh run"

: Saved
:
ASA Version 8.2(1)
!
hostname DemoASA
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.10.20.0 VPN_Pool description Assigned when coming from outside world
!
interface Vlan1
description Inside
nameif inside
security-level 100
ip address 192.168.3.1 255.255.255.0
!
interface Vlan2
description Outside
nameif outside
security-level 0
ip address 206.248.243.101 255.0.0.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 216.12.23.231
name-server 209.145.84.131
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_5
protocol-object ip
protocol-object icmp
protocol-object udp
protocol-object tcp
access-list demo_splitTunnelAcl standard permit VPN_Pool 255.255.255.0
access-list demo_splitTunnelAcl standard permit host 0.0.0.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_1 VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_4 any VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_2 192.168.3.0 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_3 any 192.168.3.0 255.255.255.0
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_5 any any
access-list inside_nat0_outbound_1 extended permit ip 192.168.3.0 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip any 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
access-list nonat extended permit ip any VPN_Pool 255.255.255.0
access-list nonat extended permit ip any 192.168.3.0 255.255.255.0
access-list nonat extended permit ip VPN_Pool 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool VPN_Pool 10.10.20.100-10.10.20.149 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 206.248.243.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.3.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto isakmp enable outside
crypto isakmp enable inside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
dhcpd update dns both
!
dhcpd address 192.168.3.100-192.168.3.149 inside
dhcpd dns 209.145.84.131 216.12.23.231 interface inside
dhcpd lease 86400 interface inside
dhcpd enable inside
!

no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy demo internal
group-policy demo attributes
dns-server value 192.168.3.1 209.145.84.131
vpn-tunnel-protocol IPSec
split-tunnel-policy excludespecified
split-tunnel-network-list value inside_nat0_outbound
username demo password XjFBA5DVYjFLLcDW encrypted privilege 0
username demo attributes
vpn-group-policy demo
tunnel-group demo type remote-access
tunnel-group demo general-attributes
address-pool VPN_Pool
default-group-policy demo
tunnel-group demo ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:768cb6604e42a62b2edbb3699354f9e2
: end

Labels:
0 Helpful
14 Replies 14

fgasimzade
Level 8
Level 8

‎06-14-2011 09:12 AM

First, get rid of this line

crypto map inside_map interface inside

You need crypto map only on outside interface

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-14-2011 10:03 AM

Result of the command: "sh run"

: Saved
:
ASA Version 8.2(1)
!
hostname DemoASA
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.10.20.0 VPN_Pool description Assigned when coming from outside world
!
interface Vlan1
description Inside
nameif inside
security-level 100
ip address 192.168.3.1 255.255.255.0
!
interface Vlan2
description Outside
nameif outside
security-level 0
ip address 206.248.243.101 255.0.0.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 216.12.23.231
name-server 209.145.84.131
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_5
protocol-object ip
protocol-object icmp
protocol-object udp
protocol-object tcp
access-list demo_splitTunnelAcl standard permit VPN_Pool 255.255.255.0
access-list demo_splitTunnelAcl standard permit host 0.0.0.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_1 VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_4 any VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_2 192.168.3.0 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_3 any 192.168.3.0 255.255.255.0
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_5 any any
access-list inside_nat0_outbound_1 extended permit ip 192.168.3.0 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip any 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
access-list nonat extended permit ip any VPN_Pool 255.255.255.0
access-list nonat extended permit ip any 192.168.3.0 255.255.255.0
access-list nonat extended permit ip VPN_Pool 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool VPN_Pool 10.10.20.100-10.10.20.149 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 206.248.243.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.3.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp enable inside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
dhcpd update dns both
!
dhcpd address 192.168.3.100-192.168.3.149 inside
dhcpd dns 209.145.84.131 216.12.23.231 interface inside
dhcpd lease 86400 interface inside
dhcpd enable inside
!

no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy demo internal
group-policy demo attributes
dns-server value 192.168.3.1 209.145.84.131
vpn-tunnel-protocol IPSec
split-tunnel-policy excludespecified
split-tunnel-network-list value inside_nat0_outbound
username demo password XjFBA5DVYjFLLcDW encrypted privilege 0
username demo attributes
vpn-group-policy demo
tunnel-group demo type remote-access
tunnel-group demo general-attributes
address-pool VPN_Pool
default-group-policy demo
tunnel-group demo ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:768cb6604e42a62b2edbb3699354f9e2
: end

0 Helpful

fgasimzade
Level 8
Level 8
In response to cworsham80

‎06-14-2011 10:05 AM

Can you check now if the pings are ok?

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-14-2011 10:24 AM

the pings are great now thnx...

but i'm using an application that lives on tcp messaging packets and udp audio packets

inside machine can send packets to outside machine but not the other way around

0 Helpful

fgasimzade
Level 8
Level 8
In response to cworsham80

‎06-14-2011 10:30 AM

You would need a static NAT for this

static (inside, outside) 206.248.243.101 192.168.3.0 netmask 255.255.255.0

See if it works, if yes, we will define tcp and udp ports exactly

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-14-2011 10:46 AM

ERROR: Static PAT using the interface requires the use of the 'interface' keyword instead of the interface IP address?

0 Helpful

fgasimzade
Level 8
Level 8
In response to cworsham80

‎06-14-2011 10:51 AM

oops, sorry

Try this

static (inside, outside) interface 192.168.3.0 netmask 255.255.255.0

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-14-2011 11:01 AM

WARNING: All traffic destined to the IP address of the outside interface is being redirected.

WARNING: Users will not be able to access any service enabled on the outside interface.

ERROR: Invalid netmask with interface option

0 Helpful

fgasimzade
Level 8
Level 8
In response to cworsham80

‎06-14-2011 11:05 AM

What is the IP address of the inside machine, that need to receive traffic from the outside

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-14-2011 11:07 AM

eventually there will be multiple machines on the inside and multiple ones on the outside but for now my one unit inside addy is 192.168.3.100

0 Helpful

fgasimzade
Level 8
Level 8
In response to cworsham80

‎06-14-2011 11:10 AM

Can you check please of it works without any static nat configured, because it seems to me the config is ok

If no, I will try to spend more time on it

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-14-2011 11:24 AM

with no static declared

192.168.3.100 (inside pc)

10.10.20.101  (vpn client pc inside address)

192.168.3.100 sends tcp and udp audio flow to 10.10.20.101 no worries

10.10.20.101 cannot send tcp or udp flow to inside

0 Helpful

fgasimzade
Level 8
Level 8
In response to cworsham80

‎06-15-2011 12:30 AM

You dont need static, sorry, my bad, was very busy yesterday.

Can you make sure there is no firewall blocking traffic on 192.168.3.100?

0 Helpful

cworsham80
Level 1
Level 1
In response to fgasimzade

‎06-17-2011 11:05 AM

Sorry for the delayed response... The 100 box was behind a different firewall... still having some troubles though

As long as everyone was coming dynamically i had no worries, but I've been trying to set up some user accounts to be static IPs and still have other users dynamic.  I'm beating my head against the desk at this point. Having my "source application" coming in dynamically was hosing mmy software up when i tried to patch "sources" together because the addresses could change.  So i want my "server app" to login as fleet, he should get ip 10.10.20.130. I want to patch him to a pc behind the firewall, 192.168.3.99.  I still want the clients be able to log in using demo and get a dhcp address.  From what i have below I can get authenticated and get appropriate ip address, but demos can ping fleet but not the other way around. inside 3.99 guy can ping fleet but not the other way around....

what am i missing

Result of the command: "sh run"

: Saved
:
ASA Version 8.2(1)
!
hostname DemoASA
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.10.20.0 VPN_Pool description Assigned when coming from outside world
!
interface Vlan1
description Inside
nameif inside
security-level 100
ip address 192.168.3.1 255.255.255.0
!
interface Vlan2
description Outside
nameif outside
security-level 0
ip address 206.248.243.101 255.0.0.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 216.12.23.231
name-server 209.145.84.131
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_5
protocol-object ip
protocol-object icmp
protocol-object udp
protocol-object tcp
access-list demo_splitTunnelAcl standard permit VPN_Pool 255.255.255.0
access-list demo_splitTunnelAcl standard permit host 0.0.0.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_1 VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_4 any VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_2 192.168.3.0 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_3 any 192.168.3.0 255.255.255.0
access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_5 any any
access-list inside_nat0_outbound_1 extended permit ip 192.168.3.0 255.255.255.0 VPN_Pool 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip any 192.168.3.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
access-list nonat extended permit ip any VPN_Pool 255.255.255.0
access-list nonat extended permit ip any 192.168.3.0 255.255.255.0
access-list nonat extended permit ip VPN_Pool 255.255.255.0 192.168.3.0 255.255.255.0
access-list nonat extended permit ip VPN_Pool 255.255.255.0 VPN_Pool 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPN_Pool 10.10.20.100-10.10.20.149 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 206.248.243.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.3.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
vpn-addr-assign local reuse-delay 5
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
dhcpd update dns both
!
dhcpd address 192.168.3.100-192.168.3.149 inside
dhcpd dns 209.145.84.131 216.12.23.231 interface inside
dhcpd lease 86400 interface inside
dhcpd enable inside
!

no threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy demo internal
group-policy demo attributes
dns-server value 192.168.3.1 209.145.84.131
vpn-tunnel-protocol IPSec
split-tunnel-policy excludespecified
split-tunnel-network-list value inside_nat0_outbound
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec webvpn
group-policy StaticGroupPolicy internal
group-policy StaticGroupPolicy attributes
dns-server value 192.168.3.1 209.145.84.131
vpn-tunnel-protocol IPSec
split-tunnel-policy excludespecified
split-tunnel-network-list value inside_nat0_outbound
username demo password XjFBA5DVYjFLLcDW encrypted privilege 0
username demo attributes
vpn-group-policy demo
username fleet password sDCT4W0GjcdKsxZZ encrypted privilege 0
username fleet attributes
vpn-group-policy demo
vpn-framed-ip-address 10.10.20.130 255.255.255.0
username chris password EBjiypjrtLaG.WFn encrypted privilege 0
username chris attributes
vpn-group-policy demo
vpn-framed-ip-address 10.10.20.20 255.255.255.0
tunnel-group demo type remote-access
tunnel-group demo general-attributes
address-pool VPN_Pool
default-group-policy demo
tunnel-group demo ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:f68ca938e40935e937c625e1f9984530
: end

0 Helpful
Customers Also Viewed These Support Documents