Current configuration : 2312 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname customer ! boot-start-marker boot-end-marker ! ! no aaa new-model ! resource policy ! ! ! ip cef ! ! ! ! ! voice-card 0 no dspfarm ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! track 1 rtr 1 reachability ! track 10 rtr 2 reachability ! ! crypto isakmp policy 1 encr aes 256 authentication pre-share group 5 crypto isakmp key cisco123! address 2.2.2.2 no-xauth crypto isakmp key cisco123! address 2.2.2.22 no-xauth ! ! crypto ipsec transform-set VPN esp-aes 256 esp-sha-hmac ! crypto map VPN 1 ipsec-isakmp set peer 2.2.2.2 set peer 2.2.2.22 set transform-set VPN set pfs group5 match address VPNACL ! ! ! ! ! interface Loopback1 description inside test server ip address 192.168.8.1 255.255.255.255 ip nat inside ip virtual-reassembly ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet0/1 description outside ip address 1.1.1.1 255.255.255.0 ip nat outside ip virtual-reassembly duplex auto speed auto crypto map VPN ! ip route 10.40.0.1 255.255.255.255 2.2.2.2 track 1 ip route 2.2.2.2 255.255.255.255 FastEthernet0/1 ip route 2.2.2.22 255.255.255.255 FastEthernet0/1 ip route 10.40.0.1 255.255.255.255 2.2.2.22 254 ! ! no ip http server no ip http secure-server ip nat inside source route-map NONAT interface FastEthernet0/1 overload ! ip access-list extended NONAT remark This is the access-list that controls what goes across the vpn tunnel and what goes across the inter remark This is the access-list that controls what goes across the vpn tunnel and what goes across the inter remark This is the access-list that controls what goes across the vpn tunnel and what doesnt remark This is the access-list that controls what goes across the vpn tunnel and what doesn't. deny ip host 192.168.8.1 host 10.40.0.1 permit ip any any ip access-list extended VPNACL permit ip host 192.168.8.1 host 10.40.0.1 ! ip sla 1 icmp-echo 2.2.2.2 timeout 1000 threshold 2 frequency 3 ip sla schedule 1 life forever start-time now ! ! ! route-map nonat permit 10 match ip address NONAT ! ! ! ! control-plane ! ! ! ! ! ! ! ! ! ! ! line con 0 line aux 0 line vty 0 4 login ! scheduler allocate 20000 1000 ! end
ASA Version 8.3(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 2.2.2.2 255.255.255.0 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.0.0.40 255.255.255.0 ! interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif man security-level 0 ip address 8.8.8.8 255.255.255.0 ! ftp mode passive same-security-traffic permit intra-interface object network VPNLOCAL host 10.40.0.1 object network VPNREMOTE host 192.168.8.1 access-list VPN_LIST extended permit ip host 10.40.0.1 host 192.168.8.1 access-list TEST extended permit ip any any log access-list TEST extended permit udp any any log access-list TEST extended permit esp any any log access-list TEST extended permit tcp any any log access-list InsideIN extended permit icmp any any access-list OutsideOut extended permit ip any any access-list OutsideOut extended permit icmp any any pager lines 24 logging console debugging logging buffered debugging logging trap notifications logging asdm informational mtu outside 1500 mtu inside 1500 mtu man 1500 no failover icmp unreachable rate-limit 1 burst-size 1 icmp permit any outside icmp permit any inside no asdm history enable arp timeout 14400 nat (inside,outside) source static VPNLOCAL VPNLOCAL destination static VPNREMOTE VPNREMOTE access-group OutsideOut in interface outside access-group TEST out interface outside access-group TEST in interface inside access-group InsideIN out interface inside ! router ospf 1 network 10.0.0.0 255.255.255.0 area 0 log-adj-changes ! route outside 1.1.1.0 255.255.255.0 2.2.2.2 1 route outside 2.2.2.0 255.255.255.0 1.1.1.1 1 route outside 192.168.8.0 255.255.255.0 1.1.1.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set VPN_STANDARD esp-aes-256 esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map VPN 1 match address VPN_LIST crypto map VPN 1 set pfs group5 crypto map VPN 1 set peer 1.1.1.1 crypto map VPN 1 set transform-set VPN_STANDARD crypto map VPN interface outside crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption aes-256 hash sha group 5 lifetime 86400 telnet timeout 5 ssh 0.0.0.0 0.0.0.0 man ssh timeout 60 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept username cisco password 3USUcOPFUiMCO4Jk encrypted tunnel-group 1.1.1.1 type ipsec-l2l tunnel-group 1.1.1.1 ipsec-attributes pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global prompt hostname context call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:ca9ac9a937814e7c7944458cc8923fd9 : end
: ASA Version 8.3(2) ! hostname ciscoasa enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 2.2.2.22 255.255.255.0 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 10.0.0.240 255.255.255.0 ! interface GigabitEthernet0/2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet0/3 shutdown no nameif no security-level no ip address ! interface Management0/0 nameif man security-level 0 ip address 8.8.8.88 255.0.0.0 ! boot system disk0:/asa832-k8.bin ftp mode passive same-security-traffic permit intra-interface object network VPNLOCAL host 10.40.0.1 object network VPNREMOTE host 192.168.8.1 access-list VPN_LIST extended permit ip host 10.40.0.1 host 192.168.8.1 access-list TEST extended permit ip any any log access-list TEST extended permit udp any any log access-list TEST extended permit esp any any log access-list TEST extended permit tcp any any log access-list InsideIN extended permit icmp any any access-list OutsideOut extended permit ip any any access-list OutsideOut extended permit icmp any any pager lines 24 logging enable logging console debugging logging buffered debugging logging trap notifications logging asdm informational mtu man 1500 mtu outside 1500 mtu inside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 icmp permit any outside no asdm history enable arp timeout 14400 nat (inside,outside) source static VPNLOCAL VPNLOCAL destination static VPNREMOTE VPNREMOTE access-group OutsideOut in interface outside access-group TEST out interface outside ! router ospf 1 network 10.0.0.0 255.255.255.0 area 0 log-adj-changes ! route outside 1.1.1.1 255.255.255.255 2.2.2.22 1 route outside 2.2.2.0 255.255.255.0 1.1.1.1 1 route outside 192.168.8.0 255.255.255.0 1.1.1.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL http server enable no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set VPN_STANDARD esp-aes-256 esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto map VPN 1 match address VPN_LIST crypto map VPN 1 set pfs group5 crypto map VPN 1 set peer 1.1.1.1 crypto map VPN 1 set transform-set VPN_STANDARD crypto map VPN interface outside crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption aes-256 hash sha group 5 lifetime 86400 telnet timeout 5 ssh 0.0.0.0 0.0.0.0 man ssh timeout 60 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept username cisco password 3USUcOPFUiMCO4Jk encrypted tunnel-group 1.1.1.1 type ipsec-l2l tunnel-group 1.1.1.1 ipsec-attributes pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect ip-options ! service-policy global_policy global prompt hostname context call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:3233c60cf617a6cb6a923b55656f848f : end %ASA-7-111009: User 'enable_15' executed cmd: show running-config
Bl8ckr0uter wrote: » Well I ended up switching out the Firewalls for two 2901s. Route based VPN for the win! Now I just need to get rsa-encry going and we will be all set. I'll probably post some configs later just for concluding the thread.
unclerico wrote: » You took my advice ...much better than the old policy-based way of doing things!!
