Hello everybody,
I have configured a ASA 5510 firewall with a default route 0.0.0.0 to 78.142.163.129
Outside Interface ip is 78.142.163.131
All hosts in my subnet are going out this outside interface about NAT with 78.142.163.140.
All is working perfectly.
But, now i want to make an special DMZ with five hosts with public IP-Adresses. So that every host has his own public IP-Adress. I want to configure on the host the public IP-Adress and go through the firewall without natting.
I have made a network(DMZ) with the public IPs: 86.59.104.224 255.255.255.240
The DMZ interface has the ip adress 86.59.104.226.
I have configured a second default route to 86.59.104.225 (Gate to the ISP).
I am not really sure how to configure nat, that the PCs can go out through the firewall with their own public ip adresses.
So i have nothing configured on the nat, because I don`t want a translated ip adress.
So the problem ist, my hosts cannot connect to the internet. PacketTracer in ASA says no problem. All packets are allowed, in and outgoing.
When i monitor the client i get the message:
An ICMP session is removed in the fast-path when stateful ICMP is enabled using the inspect icmp command
but i don`t know what the message is about?
I have also tested to give the dmz a private IP-Adress-network of 172.18.0.0 /24 and translate them in nat to one ipadress:
86.59.104.227, but also this isn`t working.
So i am frustrated and hope anybody can understand what I have written (not the best in english ;-) ) and can help me with a solution.
Here is my config:
I have configured a ASA 5510 firewall with a default route 0.0.0.0 to 78.142.163.129
Outside Interface ip is 78.142.163.131
All hosts in my subnet are going out this outside interface about NAT with 78.142.163.140.
All is working perfectly.
But, now i want to make an special DMZ with five hosts with public IP-Adresses. So that every host has his own public IP-Adress. I want to configure on the host the public IP-Adress and go through the firewall without natting.
I have made a network(DMZ) with the public IPs: 86.59.104.224 255.255.255.240
The DMZ interface has the ip adress 86.59.104.226.
I have configured a second default route to 86.59.104.225 (Gate to the ISP).
I am not really sure how to configure nat, that the PCs can go out through the firewall with their own public ip adresses.
So i have nothing configured on the nat, because I don`t want a translated ip adress.
So the problem ist, my hosts cannot connect to the internet. PacketTracer in ASA says no problem. All packets are allowed, in and outgoing.
When i monitor the client i get the message:
An ICMP session is removed in the fast-path when stateful ICMP is enabled using the inspect icmp command
but i don`t know what the message is about?
I have also tested to give the dmz a private IP-Adress-network of 172.18.0.0 /24 and translate them in nat to one ipadress:
86.59.104.227, but also this isn`t working.
So i am frustrated and hope anybody can understand what I have written (not the best in english ;-) ) and can help me with a solution.
Here is my config:
Code:
: Saved
:
ASA Version 9.1(3)
!
hostname ASA
domain-name hofburg-vie.local
enable password kvce8nG3DYyYgEJF encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd kvce8nG3DYyYgEJF encrypted
names
name 10.0.0.0 RFC1918 description interne Netze
name 10.2.0.0 client-vpn-user description User VPN
name 213.129.232.1 DNS-Server_Silverserver
name 87.230.90.208 allowed-external
name 78.142.163.140 extern-NAT
name 85.115.32.0 websense1 description websense1
name 116.50.56.0 websense3 description websense3
name 208.87.232.0 websense4 description websense4
name 78.142.163.142 extern_newsletter
name 128.130.149.0 temp_motor
name 78.142.163.132 extern_ebms
name 78.142.163.141 wlc.hofburg.com description wlc.hofburg.com
name 87.106.139.57 [URL unfurl="true"]www.markeding.at[/URL]
name 86.111.220.0 websense5 description websense5
name 103.1.196.0 websense6 description websense6
name 177.39.96.0 websense7 description websense7
name 196.216.238.0 websense8 description websense8
name 176.52.247.13 markeding.at
name 54.194.39.37 eu_aws_[URL unfurl="true"]www2.hofburg.com[/URL]
ip local pool client-vpn1 10.2.0.1-10.2.0.10 mask 255.255.255.0
ip local pool client-vpn 10.1.0.1-10.1.0.10 mask 255.255.255.0
!
interface Ethernet0/0
description outside-ISP_LAN
nameif outside
security-level 0
ip address 78.142.163.131 255.255.255.240
!
interface Ethernet0/1
description Verwaltungsnetz
nameif inside
security-level 100
ip address 10.0.0.249 255.255.255.0
!
interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Ethernet0/2.20
description Veranstaltungsnetz 2Mbit
vlan 20
nameif 2Mbit_20
security-level 20
ip address 10.20.0.1 255.255.252.0
!
interface Ethernet0/2.21
description Veranstaltungsnetz 2Mbit
vlan 21
nameif 2Mbit_21
security-level 20
ip address 10.21.0.1 255.255.252.0
!
interface Ethernet0/2.22
description Veranstaltungsnetz 2Mbit
vlan 22
nameif 2Mbit_22
security-level 20
ip address 10.22.0.1 255.255.252.0
!
interface Ethernet0/2.23
description Veranstaltungsnetz 2Mbit
vlan 23
nameif 2Mbit_23
security-level 20
ip address 10.23.0.1 255.255.252.0
!
interface Ethernet0/2.40
description Veranstaltungsnetz 4Mbit
vlan 40
nameif 4Mbit_40
security-level 20
ip address 10.40.0.1 255.255.252.0
!
interface Ethernet0/2.41
description Veranstaltungsnetz 4Mbit
vlan 41
nameif 4Mbit_41
security-level 20
ip address 10.41.0.1 255.255.252.0
!
interface Ethernet0/2.42
description Veranstaltungsnetz 4Mbit
vlan 42
nameif 4Mbit_42
security-level 20
ip address 10.42.0.1 255.255.252.0
!
interface Ethernet0/2.43
description Veranstaltungsnetz 4Mbit
vlan 43
nameif 4Mbit_43
security-level 20
ip address 10.43.0.1 255.255.252.0
!
interface Ethernet0/2.44
vlan 44
nameif 4Mbit_44
security-level 20
ip address 10.44.0.1 255.255.252.0
!
interface Ethernet0/2.45
description Veranstaltungsnetz 4Mbit
vlan 45
nameif 4Mbit_45
security-level 20
ip address 10.45.0.1 255.255.252.0
!
interface Ethernet0/2.46
description Veranstaltungsnetz 4Mbit
vlan 46
nameif 4Mbit_46
security-level 20
ip address 10.46.0.1 255.255.252.0
!
interface Ethernet0/2.47
description Veranstaltungsnetz 4Mbit
vlan 47
nameif 4Mbit_47
security-level 40
ip address 10.47.0.1 255.255.252.0
!
interface Ethernet0/2.60
description Veranstaltungsnetz 6Mbit
vlan 60
nameif 6Mbit_60
security-level 20
ip address 10.60.0.1 255.255.252.0
!
interface Ethernet0/2.61
description Veranstaltungsnetz 6Mbit
vlan 61
nameif 6Mbit_61
security-level 20
ip address 10.61.0.1 255.255.252.0
!
interface Ethernet0/2.62
description Veranstaltungsnetz 6Mbit
vlan 62
nameif 6Mbit_62
security-level 20
ip address 10.62.0.1 255.255.252.0
!
interface Ethernet0/2.63
description Veranstaltungsnetz 6Mbit
vlan 63
nameif 6Mbit_63
security-level 20
ip address 10.63.0.1 255.255.252.0
!
interface Ethernet0/2.100
description Veranstaltungsnetz 10Mbit
vlan 100
nameif 10Mbit_100
security-level 20
ip address 10.100.0.1 255.255.254.0
!
interface Ethernet0/2.140
description Veranstaltungsnetz 14Mbit
vlan 140
nameif 14Mbit_140
security-level 20
ip address 10.140.0.1 255.255.254.0
!
interface Ethernet0/2.180
description Veranstaltungsnetz 18Mbit
vlan 180
nameif 18Mbit_180
security-level 20
ip address 10.180.0.1 255.255.254.0
!
interface Ethernet0/2.201
description Managment LAN
vlan 201
nameif mgmt
security-level 90
ip address 192.168.201.1 255.255.255.0
!
interface Ethernet0/2.220
description Veranstaltungsnetz 22Mbit
vlan 220
nameif 22Mbit_220
security-level 20
ip address 10.220.0.1 255.255.254.0
!
interface Ethernet0/2.221
description Veranstaltungsnetz 22Mbit
vlan 221
nameif 22Mbit_221
security-level 20
ip address 10.221.0.1 255.255.254.0
!
interface Ethernet0/2.260
description Veranstaltungsnetz 26Mbit
vlan 260
nameif 26Mbit_260
security-level 20
ip address 10.26.0.1 255.255.240.0
!
interface Ethernet0/2.301
description DMZ1
vlan 301
nameif DMZ1
security-level 20
ip address 86.59.104.226 255.255.255.240
!
interface Ethernet0/2.302
description DMZ2
vlan 302
nameif DMZ2
security-level 20
ip address 213.129.235.34 255.255.255.240
!
interface Ethernet0/2.510
description Tontechnik Netz
shutdown
vlan 510
nameif tontechnik
security-level 50
ip address 192.168.51.1 255.255.255.0
!
interface Ethernet0/2.600
shutdown
vlan 600
nameif Videoueberwachung
security-level 20
ip address 192.168.23.1 255.255.255.0
!
interface Ethernet0/2.1026
description Lichtsteuerung
vlan 1026
nameif Lichtsteuerung
security-level 30
ip address 192.168.149.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
!
!
time-range OEHV-Kongress
absolute end 23:59 23 January 2013
!
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup outside
dns domain-lookup inside
dns domain-lookup 2Mbit_20
dns domain-lookup 2Mbit_21
dns domain-lookup 2Mbit_22
dns domain-lookup 2Mbit_23
dns domain-lookup 4Mbit_40
dns domain-lookup 4Mbit_41
dns domain-lookup 4Mbit_42
dns domain-lookup 4Mbit_43
dns domain-lookup 4Mbit_44
dns domain-lookup 4Mbit_45
dns domain-lookup 4Mbit_46
dns domain-lookup 4Mbit_47
dns domain-lookup 6Mbit_60
dns domain-lookup 6Mbit_61
dns domain-lookup 6Mbit_62
dns domain-lookup 6Mbit_63
dns domain-lookup 10Mbit_100
dns domain-lookup 14Mbit_140
dns domain-lookup 18Mbit_180
dns domain-lookup mgmt
dns domain-lookup 22Mbit_220
dns domain-lookup 22Mbit_221
dns domain-lookup 26Mbit_260
dns domain-lookup DMZ1
dns domain-lookup DMZ2
dns domain-lookup Lichtsteuerung
dns domain-lookup management
dns server-group DefaultDNS
name-server 10.0.0.1
domain-name hofburg-vie.local
same-security-traffic permit intra-interface
object network RFC1918
subnet 10.0.0.0 255.255.255.0
description Created during name migration
object network [URL unfurl="true"]www.markeding.at[/URL]
host 87.106.139.57
description Created during name migration
object network DNS-Server_Silverserver
host 213.129.232.1
description Created during name migration
object network websense6
subnet 103.1.196.0 255.255.252.0
description Created during name migration
object network websense3
subnet 116.50.56.0 255.255.248.0
description Created during name migration
object network websense7
subnet 177.39.96.0 255.255.252.0
description Created during name migration
object network websense8
subnet 196.216.238.0 255.255.254.0
description Created during name migration
object network websense4
subnet 208.87.232.0 255.255.248.0
description Created during name migration
object network websense1
subnet 85.115.32.0 255.255.224.0
description Created during name migration
object network websense5
subnet 86.111.220.0 255.255.252.0
description Created during name migration
object network eu_aws_[URL unfurl="true"]www2.hofburg.com[/URL]
host 54.194.39.37
description Created during name migration
object network obj-86.59.104.237
host 86.59.104.237
object network obj-86.59.104.227
host 86.59.104.227
object network obj-86.59.104.228
host 86.59.104.228
object network obj-86.59.104.229
host 86.59.104.229
object network obj-86.59.104.230
host 86.59.104.230
object network obj-86.59.104.231
host 86.59.104.231
object network obj-86.59.104.232
host 86.59.104.232
object network obj-86.59.104.233
host 86.59.104.233
object network obj-86.59.104.234
host 86.59.104.234
object network obj-10.1.0.0
subnet 10.1.0.0 255.255.255.240
object network client-vpn-user
subnet 10.2.0.0 255.255.255.0
object network obj-10.0.0.110
host 10.0.0.110
object network obj-10.20.32.0
subnet 10.20.32.0 255.255.248.0
object network client-vpn-user-01
subnet 10.2.0.0 255.255.255.240
object network obj-10.0.0.1
host 10.0.0.1
object network extern-NAT
host 78.142.163.140
object network obj-10.0.0.1-01
host 10.0.0.1
object network obj-10.0.0.1-02
host 10.0.0.1
object network obj-10.0.0.102
host 10.0.0.102
object network obj-10.0.0.252
host 10.0.0.252
object network obj-10.0.0.252-01
host 10.0.0.252
object network obj-10.0.0.252-02
host 10.0.0.252
object network obj-10.0.0.252-03
host 10.0.0.252
object network obj-10.0.0.252-04
host 10.0.0.252
object network obj-10.0.0.113
host 10.0.0.113
object network obj-10.0.0.1-03
host 10.0.0.1
object network obj-10.0.0.113-01
host 10.0.0.113
object network obj-10.0.0.113-02
host 10.0.0.113
object network obj-10.0.0.2
host 10.0.0.2
object network obj-10.0.0.114
host 10.0.0.114
object network extern_newsletter
host 78.142.163.142
object network obj-10.0.0.114-01
host 10.0.0.114
object network obj-10.0.0.114-02
host 10.0.0.114
object network obj-10.0.0.113-03
host 10.0.0.113
object network extern_ebms
host 78.142.163.132
object network obj-10.0.0.112
host 10.0.0.112
object network obj-10.0.0.112-01
host 10.0.0.112
object network obj-10.0.0.1-04
host 10.0.0.1
object network obj-10.0.0.113-04
host 10.0.0.113
object network obj-10.0.0.114-03
host 10.0.0.114
object network obj-10.20.0.0
subnet 10.20.0.0 255.255.252.0
object network obj-10.21.0.0
subnet 10.21.0.0 255.255.252.0
object network obj-10.22.0.0
subnet 10.22.0.0 255.255.252.0
object network obj-10.23.0.0
subnet 10.23.0.0 255.255.252.0
object network obj-10.40.0.0
subnet 10.40.0.0 255.255.252.0
object network obj-10.41.0.0
subnet 10.41.0.0 255.255.252.0
object network obj-10.42.0.0
subnet 10.42.0.0 255.255.252.0
object network obj-10.43.0.0
subnet 10.43.0.0 255.255.252.0
object network obj-10.44.0.0
subnet 10.44.0.0 255.255.252.0
object network obj-10.45.0.0
subnet 10.45.0.0 255.255.252.0
object network obj-10.46.0.0
subnet 10.46.0.0 255.255.252.0
object network obj-10.47.0.0
subnet 10.47.0.0 255.255.252.0
object network obj-10.60.0.0
subnet 10.60.0.0 255.255.252.0
object network obj-10.61.0.0
subnet 10.61.0.0 255.255.252.0
object network obj-10.62.0.0
subnet 10.62.0.0 255.255.252.0
object network obj-10.63.0.0
subnet 10.63.0.0 255.255.252.0
object network obj-10.100.0.0
subnet 10.100.0.0 255.255.254.0
object network obj-10.140.0.0
subnet 10.140.0.0 255.255.254.0
object network obj-10.180.0.0
subnet 10.180.0.0 255.255.254.0
object network obj-10.220.0.0
subnet 10.220.0.0 255.255.254.0
object network obj-10.221.0.0
subnet 10.221.0.0 255.255.254.0
object network obj-10.26.0.0
subnet 10.26.0.0 255.255.240.0
object network obj-213.129.235.35
host 213.129.235.35
object network obj-213.129.235.36
host 213.129.235.36
object network obj-213.129.235.37
host 213.129.235.37
object network obj-213.129.235.38
host 213.129.235.38
object network obj-213.129.235.39
host 213.129.235.39
object network obj-213.129.235.40
host 213.129.235.40
object network obj-213.129.235.41
host 213.129.235.41
object network obj-213.129.235.42
host 213.129.235.42
object network obj-192.168.23.0
subnet 192.168.23.0 255.255.255.0
object network obj-192.168.201.0
subnet 192.168.201.0 255.255.255.0
object network RFC1918_1
subnet 10.0.0.0 255.0.0.0
description Created during name migration
object network allowed-external
host 87.230.90.208
description Created during name migration
object network NETWORK_OBJ_10.1.0.0_28
subnet 10.1.0.0 255.255.255.240
object network Object_86.59.104.227
host 86.59.104.227
object network DMZ1-network
subnet 86.59.104.224 255.255.255.240
object network DMZ1
host 86.59.104.227
description Testing
object-group service Mail-Ports
description SMTP, SMTPS, IMAP, IMAPS, POP3, POP3S
service-object tcp destination eq imap4
service-object tcp destination eq pop3
service-object tcp destination eq smtp
service-object tcp destination eq 465
service-object tcp destination eq 587
service-object tcp destination eq 993
service-object tcp destination eq 995
object-group service VPN
description Cisco IPsec
service-object udp destination eq isakmp
service-object udp destination range 1194 1199
service-object gre
service-object esp
service-object ah
service-object tcp destination eq pptp
service-object udp destination eq 1701
service-object tcp-udp destination eq 50
service-object udp destination eq 4500
service-object tcp destination eq 1477
service-object udp destination eq 1477
service-object tcp-udp destination eq 10000
object-group service Skype
service-object tcp destination eq 16922
object-group service Internet-Services-all
description erlaubte outbound Services von Veranstaltungs-vlans ins Internet
service-object tcp destination eq ftp
service-object tcp destination eq ftp-data
service-object tcp destination eq www
service-object tcp destination eq https
service-object udp destination eq domain
group-object Mail-Ports
service-object icmp
group-object VPN
group-object Skype
service-object tcp source eq 8080 destination eq 8080
service-object tcp destination eq 3389
service-object tcp destination eq 480
service-object udp destination eq 2746
service-object tcp-udp destination eq 10443
service-object tcp-udp destination eq 691
service-object tcp destination eq sqlnet
service-object tcp destination eq ssh
service-object esp
service-object tcp-udp destination eq 161
service-object tcp destination eq 2095
service-object tcp destination eq 4125
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service externe-services
service-object tcp destination eq 3101
service-object tcp destination eq 8023
service-object tcp destination eq 8080
service-object tcp destination eq 8888
service-object tcp destination eq 9000
service-object tcp destination eq www
service-object tcp destination eq https
service-object udp destination eq 1195
service-object udp destination eq 1196
service-object udp destination eq 1197
service-object udp destination eq 1198
service-object udp destination eq 1199
service-object tcp destination eq 81
object-group service externe-services-source-limit
service-object tcp destination eq 1433
service-object udp destination eq 1434
object-group service RDP
service-object tcp destination eq 3389
object-group service websense-smtp tcp
port-object eq smtp
object-group service udp_hoch udp
port-object range 2000 65535
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object udp
protocol-object tcp
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object gre
object-group network DM_INLINE_NETWORK_1
network-object object RFC1918
network-object 192.168.201.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
network-object 213.129.235.32 255.255.255.240
network-object object RFC1918
network-object object DMZ1-network
object-group network DM_INLINE_NETWORK_3
network-object 213.129.235.32 255.255.255.240
network-object 78.142.187.240 255.255.255.248
network-object object RFC1918
network-object object DMZ1-network
object-group network DM_INLINE_NETWORK_4
network-object 192.168.149.0 255.255.255.0
network-object 192.168.201.0 255.255.255.0
network-object object RFC1918
object-group service externe-services-lockdown-mode
service-object tcp destination eq 3101
service-object tcp destination eq https
service-object udp destination eq 1195
service-object udp destination eq 1196
service-object udp destination eq 1197
service-object udp destination eq 1198
service-object udp destination eq 1199
object-group service DM_INLINE_SERVICE_2
service-object icmp timestamp-reply
service-object udp destination eq netbios-ns
object-group service fs-test
service-object tcp destination range 12000 12999
service-object tcp destination range 20000 30000
service-object tcp destination eq 8995
object-group network marke-ding-restrictions
network-object 209.85.148.0 255.255.255.0
network-object host 37.235.63.30
network-object host 78.47.198.196
network-object host 85.126.82.60
network-object object [URL unfurl="true"]www.markeding.at[/URL]
network-object host 91.227.204.35
network-object host 173.194.35.191
network-object host 173.194.67.26
network-object host 173.194.68.26
network-object host 173.194.77.26
network-object host 74.125.131.26
network-object host 74.125.134.26
network-object 74.125.227.0 255.255.255.0
network-object 173.194.35.0 255.255.255.0
network-object 176.52.247.0 255.255.255.0
network-object host 88.80.208.166
network-object object DNS-Server_Silverserver
network-object object RFC1918
object-group service DM_INLINE_SERVICE_4
service-object ip
group-object Internet-Services-all
object-group network websense-incoming
description incoming websense smtp servers
network-object object websense6
network-object object websense3
network-object object websense7
network-object object websense8
network-object object websense4
network-object object websense1
network-object 86.111.216.0 255.255.254.0
network-object object websense5
network-object object eu_aws_[URL unfurl="true"]www2.hofburg.com[/URL]
network-object object DNS-Server_Silverserver
network-object object RFC1918
network-object object [URL unfurl="true"]www.markeding.at[/URL]
object-group protocol DM_INLINE_PROTOCOL_3
protocol-object icmp
protocol-object igmp
protocol-object gre
protocol-object esp
protocol-object ah
protocol-object eigrp
object-group service TEMP-VA
service-object tcp destination eq 6000
service-object tcp destination eq 60124
object-group network DM_INLINE_NETWORK_6
network-object 213.129.235.32 255.255.255.240
network-object 78.142.187.240 255.255.255.248
network-object object DNS-Server_Silverserver
network-object object RFC1918
network-object object DMZ1-network
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object icmp
protocol-object udp
protocol-object igmp
protocol-object gre
protocol-object esp
protocol-object ah
protocol-object tcp
protocol-object eigrp
object-group service streaming-ports
service-object tcp destination eq 1935
object-group service DM_INLINE_UDP_1 udp
port-object eq 1195
port-object eq 1196
port-object eq 1197
port-object eq 1198
port-object eq 1199
object-group service DM_INLINE_TCP_1 tcp
port-object eq 8080
port-object eq www
port-object eq https
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp destination eq 1433
service-object tcp destination eq www
service-object tcp destination eq 3101
object-group service DM_INLINE_SERVICE_3
service-object icmp
service-object tcp destination eq www
service-object tcp destination eq smtp
service-object tcp-udp destination eq 8044
object-group network DM_INLINE_NETWORK_7
network-object 213.129.235.32 255.255.255.240
network-object object DMZ1-network
object-group service DM_INLINE_SERVICE_5
service-object ip
group-object Internet-Services-all
object-group service DM_INLINE_SERVICE_7
service-object ip
group-object Internet-Services-all
access-list 4Mbit_42_access_in extended permit udp 10.42.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_42_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_42_access_in extended permit object-group Internet-Services-all 10.42.0.0 255.255.252.0 any4
access-list 4Mbit_42_access_in extended deny ip 10.42.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_42_access_in extended permit ip 10.42.0.0 255.255.255.240 any4
access-list 4Mbit_46_access_in extended permit udp 10.46.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_46_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_46_access_in extended permit object-group Internet-Services-all 10.46.0.0 255.255.252.0 any4
access-list 4Mbit_46_access_in extended permit ip 10.46.0.0 255.255.252.0 178.248.208.0 255.255.248.0
access-list 4Mbit_46_access_in extended permit ip 10.46.0.0 255.255.252.0 213.152.4.0 255.255.255.0
access-list 4Mbit_46_access_in extended permit ip 10.46.0.0 255.255.252.0 83.167.35.0 255.255.255.0
access-list 4Mbit_46_access_in extended deny ip 10.46.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_46_access_in extended permit ip 10.46.0.0 255.255.255.240 any4
access-list 6Mbit_61_access_in extended permit udp 10.61.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 6Mbit_61_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 6Mbit_61_access_in extended permit object-group Internet-Services-all 10.61.0.0 255.255.252.0 any4
access-list 6Mbit_61_access_in extended deny ip 10.61.0.0 255.255.255.240 object RFC1918
access-list 6Mbit_61_access_in extended permit ip 10.61.0.0 255.255.255.240 any4
access-list 22Mbit_221_access_in extended permit udp 10.221.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 22Mbit_221_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 22Mbit_221_access_in extended permit object-group Internet-Services-all 10.221.0.0 255.255.254.0 any4
access-list 22Mbit_221_access_in extended deny ip 10.221.0.0 255.255.255.240 object RFC1918
access-list 22Mbit_221_access_in extended permit ip 10.221.0.0 255.255.255.240 any4
access-list 10Mbit_101_access_in extended permit udp 10.101.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 10Mbit_101_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 10Mbit_101_access_in extended permit object-group Internet-Services-all 10.101.0.0 255.255.254.0 any4
access-list 10Mbit_101_access_in extended deny ip 10.101.0.0 255.255.255.240 object RFC1918
access-list 10Mbit_101_access_in extended permit ip 10.101.0.0 255.255.255.240 any4
access-list 4Mbit_45_access_in extended permit udp 10.45.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_45_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_45_access_in extended permit object-group Internet-Services-all 10.45.0.0 255.255.252.0 any4
access-list 4Mbit_45_access_in extended deny ip 10.45.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_45_access_in extended permit ip 10.45.0.0 255.255.255.240 any4
access-list 4Mbit_45_access_in extended permit ip any4 any4
access-list 6Mbit_60_access_in extended permit udp 10.60.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 6Mbit_60_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 6Mbit_60_access_in extended permit object-group Internet-Services-all 10.60.0.0 255.255.252.0 any4
access-list 6Mbit_60_access_in extended deny ip 10.60.0.0 255.255.255.240 object RFC1918
access-list 6Mbit_60_access_in extended permit ip 10.60.0.0 255.255.255.240 any4
access-list 2Mbit_21_access_in extended permit udp 10.21.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 2Mbit_21_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 2Mbit_21_access_in extended permit object-group Internet-Services-all 10.21.0.0 255.255.252.0 any4
access-list 2Mbit_21_access_in extended deny ip 10.21.0.0 255.255.255.240 object RFC1918
access-list 2Mbit_21_access_in extended permit ip 10.21.0.0 255.255.255.240 any4
access-list 2Mbit_23_access_in extended permit udp 10.23.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 2Mbit_23_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 2Mbit_23_access_in extended permit object-group Internet-Services-all 10.23.0.0 255.255.252.0 any4
access-list 2Mbit_23_access_in extended deny ip 10.23.0.0 255.255.255.240 object RFC1918
access-list 2Mbit_23_access_in extended permit object-group DM_INLINE_PROTOCOL_2 10.23.0.0 255.255.255.240 any4
access-list 18Mbit_180_access_in extended permit udp 10.180.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 18Mbit_180_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 18Mbit_180_access_in extended permit object-group Internet-Services-all 10.180.0.0 255.255.254.0 any4
access-list 18Mbit_180_access_in extended deny ip 10.180.0.0 255.255.255.240 object RFC1918
access-list 18Mbit_180_access_in extended permit ip 10.180.0.0 255.255.255.240 any4
access-list 2Mbit_20_access_in extended permit udp 10.20.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 2Mbit_20_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 2Mbit_20_access_in extended permit object-group Internet-Services-all 10.20.0.0 255.255.252.0 any4
access-list 2Mbit_20_access_in extended deny ip 10.20.0.0 255.255.255.240 object RFC1918
access-list 2Mbit_20_access_in extended permit ip 10.20.0.0 255.255.255.240 any4
access-list 2Mbit_20_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any4 any4 inactive
access-list 18Mbit_181_access_in extended permit udp 10.181.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 18Mbit_181_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 18Mbit_181_access_in extended permit object-group Internet-Services-all 10.181.0.0 255.255.254.0 any4
access-list 18Mbit_181_access_in extended deny ip 10.181.0.0 255.255.255.240 object RFC1918
access-list 18Mbit_181_access_in extended permit ip 10.181.0.0 255.255.255.240 any4
access-list 10Mbit_100_access_in extended permit udp 10.100.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 10Mbit_100_access_in extended deny ip 10.100.0.0 255.255.255.240 object RFC1918
access-list 10Mbit_100_access_in extended permit ip 10.100.0.0 255.255.255.240 any4 inactive
access-list 10Mbit_100_access_in extended permit object-group Internet-Services-all 10.100.0.0 255.255.254.0 object-group marke-ding-restrictions
access-list 10Mbit_100_access_in extended permit object-group Internet-Services-all 10.100.0.0 255.255.254.0 any4 inactive
access-list 10Mbit_100_access_in extended permit ip any4 any4
access-list 2Mbit_22_access_in extended permit udp 10.22.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 2Mbit_22_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 2Mbit_22_access_in extended permit ip 10.22.0.0 255.255.252.0 any4 time-range OEHV-Kongress
access-list 2Mbit_22_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 2Mbit_22_access_in extended permit object-group Internet-Services-all 10.22.0.0 255.255.252.0 any4
access-list 2Mbit_22_access_in extended deny ip 10.22.0.0 255.255.255.240 object RFC1918
access-list 2Mbit_22_access_in extended permit ip 10.22.0.0 255.255.255.240 any4
access-list 6Mbit_62_access_in extended permit udp 10.62.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 6Mbit_62_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 6Mbit_62_access_in extended permit object-group Internet-Services-all 10.62.0.0 255.255.252.0 any4
access-list 6Mbit_62_access_in extended deny ip 10.62.0.0 255.255.255.240 object RFC1918
access-list 6Mbit_62_access_in extended permit ip 10.62.0.0 255.255.255.240 any4
access-list 4Mbit_40_access_in extended permit udp 10.40.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_40_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_40_access_in extended permit object-group Internet-Services-all 10.40.0.0 255.255.252.0 any4
access-list 4Mbit_40_access_in extended deny ip 10.40.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_40_access_in extended permit ip 10.40.0.0 255.255.255.240 any4
access-list 4Mbit_47_access_in extended deny icmp object RFC1918 any4 timestamp-reply inactive
access-list 4Mbit_47_access_in extended permit udp 10.47.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain inactive
access-list 4Mbit_47_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_47_access_in extended permit object-group Internet-Services-all 10.47.0.0 255.255.252.0 any4 inactive
access-list 4Mbit_47_access_in extended permit ip host 10.0.0.1 10.47.0.0 255.255.252.0 inactive
access-list 4Mbit_47_access_in extended permit ip 10.47.0.0 255.255.252.0 host 10.0.0.1 inactive
access-list 4Mbit_47_access_in extended deny ip 10.47.0.0 255.255.252.0 object RFC1918 inactive
access-list 4Mbit_47_access_in extended permit ip 10.47.0.0 255.255.252.0 any4
access-list 4Mbit_47_access_in extended permit udp 10.47.0.0 255.255.252.0 any4 eq ntp inactive
access-list 14Mbit_140_access_in remark openmail test
access-list 14Mbit_140_access_in extended permit tcp any4 any4 eq 5767
access-list 14Mbit_140_access_in remark testssl
access-list 14Mbit_140_access_in extended permit tcp any4 any4 eq 993
access-list 14Mbit_140_access_in remark testssl
access-list 14Mbit_140_access_in extended permit tcp any4 any4 eq 587
access-list 14Mbit_140_access_in remark testssl
access-list 14Mbit_140_access_in extended permit tcp any4 any4 eq 421
access-list 14Mbit_140_access_in remark testssl
access-list 14Mbit_140_access_in extended permit tcp any4 any4 eq 465
access-list 14Mbit_140_access_in remark testssl
access-list 14Mbit_140_access_in extended permit tcp any4 any4 eq 995
access-list 14Mbit_140_access_in extended permit udp 10.140.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 14Mbit_140_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 14Mbit_140_access_in extended permit object-group Internet-Services-all 10.140.0.0 255.255.254.0 any4
access-list 14Mbit_140_access_in extended deny ip 10.140.0.0 255.255.255.240 object RFC1918
access-list 14Mbit_140_access_in extended permit ip 10.140.0.0 255.255.255.240 any4
access-list 6Mbit_63_access_in extended permit udp 10.63.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 6Mbit_63_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 6Mbit_63_access_in extended permit object-group Internet-Services-all 10.63.0.0 255.255.252.0 any4
access-list 6Mbit_63_access_in extended deny ip 10.62.0.0 255.255.255.240 object RFC1918
access-list 6Mbit_63_access_in extended permit ip 10.62.0.0 255.255.255.240 any4
access-list 4Mbit_43_access_in extended permit udp 10.43.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_43_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_43_access_in extended permit ip 10.43.0.0 255.255.252.0 any4
access-list 4Mbit_43_access_in extended deny ip 10.43.0.0 255.255.252.0 object RFC1918
access-list 4Mbit_43_access_in extended permit ip 10.43.0.0 255.255.255.240 any4
access-list 4Mbit_43_access_in extended deny ip 10.43.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_44_access_in extended permit udp 10.44.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_44_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_44_access_in extended permit object-group Internet-Services-all 10.44.0.0 255.255.252.0 any4
access-list 4Mbit_44_access_in extended deny ip 10.44.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_44_access_in extended permit ip 10.44.0.0 255.255.255.240 any4
access-list 14Mbit_141_access_in extended permit udp 10.141.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 14Mbit_141_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 14Mbit_141_access_in extended permit object-group Internet-Services-all 10.141.0.0 255.255.254.0 any4
access-list 14Mbit_141_access_in extended deny ip 10.141.0.0 255.255.255.240 object RFC1918
access-list 14Mbit_141_access_in extended permit ip 10.141.0.0 255.255.255.240 any4
access-list 4Mbit_41_access_in extended permit udp 10.41.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_41_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_41_access_in extended permit object-group Internet-Services-all 10.41.0.0 255.255.252.0 any4
access-list 4Mbit_41_access_in extended deny ip 10.41.0.0 255.255.252.0 object RFC1918
access-list 4Mbit_41_access_in extended deny ip 10.41.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_41_access_in extended permit ip 10.41.0.0 255.255.252.0 any4
access-list 4Mbit_41_access_in extended permit ip 10.41.0.0 255.255.255.240 any4
access-list 26Mbit_260_access_in extended permit udp 10.26.0.0 255.255.240.0 object DNS-Server_Silverserver eq domain
access-list 26Mbit_260_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 26Mbit_260_access_in extended permit object-group Internet-Services-all 10.26.0.0 255.255.240.0 any4
access-list 26Mbit_260_access_in extended deny ip 10.26.0.0 255.255.255.240 object RFC1918
access-list 26Mbit_260_access_in extended permit ip 10.26.0.0 255.255.255.240 any4
access-list 26Mbit_260_access_in extended permit ip any4 any4 inactive
access-list 26Mbit_260_access_in extended permit object-group TCPUDP any4 any4
access-list 22Mbit_220_access_in extended permit udp 10.220.0.0 255.255.254.0 object DNS-Server_Silverserver eq domain
access-list 22Mbit_220_access_in remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 22Mbit_220_access_in extended permit object-group Internet-Services-all 10.220.0.0 255.255.254.0 any4
access-list 22Mbit_220_access_in extended deny ip 10.220.0.0 255.255.255.240 object RFC1918
access-list 22Mbit_220_access_in extended permit ip 10.220.0.0 255.255.255.240 any4
access-list hofburg_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
access-list hofburg_splitTunnelAcl standard permit 192.168.201.0 255.255.255.0
access-list management_nat0_outbound extended permit ip object RFC1918 10.1.0.0 255.255.255.240
access-list management_nat0_outbound extended permit ip 192.168.201.0 255.255.255.0 10.1.0.0 255.255.255.240
access-list 20-out extended deny ip object RFC1918 10.20.0.0 255.255.252.0
access-list 20-out extended permit ip any4 10.20.0.0 255.255.252.0
access-list 21-out extended deny ip object RFC1918 10.21.0.0 255.255.252.0
access-list 21-out extended permit ip any4 10.21.0.0 255.255.252.0
access-list 22-out extended deny ip object RFC1918 10.22.0.0 255.255.252.0
access-list 22-out extended permit ip any4 10.22.0.0 255.255.252.0
access-list 23-out extended deny ip object RFC1918 10.23.0.0 255.255.252.0
access-list 23-out extended permit ip any4 10.23.0.0 255.255.252.0
access-list 20-in extended deny ip 10.20.0.0 255.255.252.0 object RFC1918
access-list 20-in extended permit ip 10.20.0.0 255.255.252.0 any4
access-list 21-in extended deny ip 10.21.0.0 255.255.252.0 object RFC1918
access-list 21-in extended permit ip 10.21.0.0 255.255.252.0 any4
access-list 22-in extended deny ip 10.22.0.0 255.255.252.0 object RFC1918
access-list 22-in extended permit ip 10.22.0.0 255.255.252.0 any4
access-list 23-in extended deny ip 10.23.0.0 255.255.252.0 object RFC1918
access-list 23-in extended permit ip 10.23.0.0 255.255.252.0 any4
access-list 40-out extended deny ip object RFC1918 10.40.0.0 255.255.252.0
access-list 40-out extended permit ip any4 10.40.0.0 255.255.252.0
access-list 41-out extended deny ip object RFC1918 10.41.0.0 255.255.252.0
access-list 41-out extended permit ip any4 10.41.0.0 255.255.252.0
access-list 42-out extended deny ip object RFC1918 10.42.0.0 255.255.252.0
access-list 42-out extended permit ip any4 10.42.0.0 255.255.252.0
access-list 43-out extended deny ip object RFC1918 10.43.0.0 255.255.252.0
access-list 43-out extended permit ip any4 10.43.0.0 255.255.252.0
access-list 44-out extended deny ip object RFC1918 10.44.0.0 255.255.252.0
access-list 44-out extended permit ip any4 10.44.0.0 255.255.252.0
access-list 4Mbit_45_mpc extended deny ip object RFC1918 10.45.0.0 255.255.252.0
access-list 4Mbit_45_mpc extended permit ip any4 10.45.0.0 255.255.252.0
access-list 46-out extended deny ip object RFC1918 10.46.0.0 255.255.252.0
access-list 46-out extended permit ip any4 10.46.0.0 255.255.252.0
access-list 47-out extended deny ip object RFC1918 10.47.0.0 255.255.252.0
access-list 47-out extended permit ip any4 10.47.0.0 255.255.252.0
access-list 40-in extended deny ip 10.40.0.0 255.255.252.0 object RFC1918
access-list 40-in extended permit ip 10.40.0.0 255.255.252.0 any4
access-list 41-in extended deny ip 10.41.0.0 255.255.252.0 object RFC1918
access-list 41-in extended permit ip 10.41.0.0 255.255.252.0 any4
access-list 10-out extended permit ip host 10.0.0.113 any4
access-list 10-in extended permit ip any4 host 10.0.0.113
access-list client-vpn-user remark Lichtsteuerung netz
access-list client-vpn-user standard permit host 192.168.149.0
access-list client-vpn-user-rest standard permit 10.0.0.0 255.255.255.0
access-list client-vpn-user-rest-1 standard permit 10.0.0.0 255.255.255.0
access-list client-vpn-user-rest-1 standard permit host 192.168.149.0
access-list inside_nat0_outbound remark Retour Traffic ins ClientVPN netz Umgehung zu HideNAT
access-list inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_1 10.1.0.0 255.255.255.240
access-list inside_nat0_outbound remark Retour Traffic Hide-NAT Ausnahme!
access-list inside_nat0_outbound extended permit ip object RFC1918 object client-vpn-user
access-list inside_nat0_outbound extended permit ip any4 10.1.0.0 255.255.255.240
access-list inside_nat0_outbound extended permit ip host 10.0.0.110 10.20.32.0 255.255.248.0
access-list inside_nat0_outbound extended permit ip any4 object client-vpn-user-01
access-list 110 extended deny ip object RFC1918_1 object RFC1918
access-list 110 extended deny ip 192.168.0.0 255.255.0.0 object RFC1918
access-list 110 extended permit ip any4 object RFC1918
access-list 111 extended deny ip object RFC1918 192.168.0.0 255.255.0.0
access-list 111 extended deny ip object RFC1918 object RFC1918_1
access-list 111 extended permit ip object RFC1918 any4
access-list 42-in extended deny ip 10.42.0.0 255.255.252.0 object RFC1918
access-list 42-in extended permit ip 10.42.0.0 255.255.252.0 any4
access-list 43-in extended deny ip 10.43.0.0 255.255.252.0 object RFC1918
access-list 43-in extended permit ip 10.43.0.0 255.255.252.0 any4
access-list 44-in extended deny ip 10.44.0.0 255.255.252.0 object RFC1918
access-list 44-in extended permit ip 10.44.0.0 255.255.252.0 any4
access-list 45-in extended deny ip 10.45.0.0 255.255.252.0 object RFC1918
access-list 45-in extended permit ip 10.45.0.0 255.255.252.0 any4
access-list 46-in extended deny ip 10.46.0.0 255.255.252.0 object RFC1918
access-list 46-in extended permit ip 10.46.0.0 255.255.252.0 any4
access-list 47-in extended deny ip 10.47.0.0 255.255.252.0 object RFC1918
access-list 47-in extended permit ip 10.47.0.0 255.255.252.0 any4
access-list 60-out extended deny ip object RFC1918 10.60.0.0 255.255.252.0
access-list 60-out extended permit ip any4 10.60.0.0 255.255.252.0
access-list 61-out extended deny ip object RFC1918 10.61.0.0 255.255.252.0 inactive
access-list 61-out extended permit ip any4 10.61.0.0 255.255.252.0 inactive
access-list 62-out extended deny ip object RFC1918 10.62.0.0 255.255.252.0
access-list 62-out extended permit ip any4 10.62.0.0 255.255.252.0
access-list 63-out extended deny ip object RFC1918 10.63.0.0 255.255.252.0
access-list 63-out extended permit ip any4 10.63.0.0 255.255.252.0
access-list 60-in extended deny ip object RFC1918 10.60.0.0 255.255.252.0
access-list 60-in extended permit ip 10.60.0.0 255.255.252.0 any4
access-list 61-in extended deny ip object RFC1918 10.61.0.0 255.255.252.0 inactive
access-list 61-in extended permit ip 10.61.0.0 255.255.252.0 any4 inactive
access-list 62-in extended deny ip object RFC1918 10.62.0.0 255.255.252.0
access-list 62-in extended permit ip 10.62.0.0 255.255.252.0 any4
access-list 63-in extended deny ip object RFC1918 10.63.0.0 255.255.252.0
access-list 63-in extended permit ip 192.168.0.0 255.255.252.0 any4
access-list 100-out extended deny ip object RFC1918 10.100.0.0 255.255.254.0
access-list 100-out extended permit ip any4 10.100.0.0 255.255.254.0
access-list 101-out extended deny ip object RFC1918 10.101.0.0 255.255.254.0
access-list 101-out extended permit ip any4 10.101.0.0 255.255.254.0
access-list 100-in extended deny ip 10.100.0.0 255.255.254.0 object RFC1918
access-list 100-in extended permit ip 10.100.0.0 255.255.254.0 any4
access-list 101-in extended deny ip 10.101.0.0 255.255.254.0 object RFC1918
access-list 101-in extended permit ip 10.101.0.0 255.255.254.0 any4
access-list 140-out extended deny ip object RFC1918 10.140.0.0 255.255.254.0
access-list 140-out extended permit ip any4 10.140.0.0 255.255.254.0
access-list 140-out extended deny ip 10.140.0.0 255.255.254.0 object RFC1918
access-list 141-out extended deny ip object RFC1918 10.141.0.0 255.255.254.0
access-list 141-out extended permit ip any4 10.141.0.0 255.255.254.0
access-list 141-out extended deny ip 10.141.0.0 255.255.254.0 object RFC1918
access-list 140-in extended permit ip 10.140.0.0 255.255.254.0 any4
access-list 141-in extended permit ip 10.141.0.0 255.255.254.0 any4
access-list 180-out extended deny ip object RFC1918 10.180.0.0 255.255.254.0
access-list 180-out extended permit ip any4 10.180.0.0 255.255.254.0
access-list 181-out extended deny ip object RFC1918 10.181.0.0 255.255.254.0
access-list 181-out extended permit ip any4 10.181.0.0 255.255.254.0
access-list 180-in extended deny ip 10.180.0.0 255.255.254.0 object RFC1918
access-list 180-in extended permit ip 10.180.0.0 255.255.254.0 any4
access-list 181-in extended deny ip 10.181.0.0 255.255.254.0 object RFC1918
access-list 181-in extended permit ip 10.181.0.0 255.255.254.0 any4
access-list 220-out extended deny ip object RFC1918 10.220.0.0 255.255.254.0
access-list 220-out extended permit ip any4 10.220.0.0 255.255.254.0
access-list 221-out extended deny ip object RFC1918 10.221.0.0 255.255.254.0
access-list 221-out extended permit ip any4 10.221.0.0 255.255.254.0
access-list 220-in extended deny ip 10.220.0.0 255.255.254.0 object RFC1918
access-list 220-in extended permit ip 10.220.0.0 255.255.254.0 any4
access-list 221-in extended deny ip 10.221.0.0 255.255.254.0 object RFC1918
access-list 221-in extended permit ip 10.221.0.0 255.255.254.0 any4
access-list 260-out extended deny ip object RFC1918 10.26.0.0 255.255.240.0
access-list 260-out extended permit ip any4 10.26.0.0 255.255.240.0
access-list 260-in extended deny ip 10.26.0.0 255.255.240.0 object RFC1918
access-list 260-in extended permit ip 10.26.0.0 255.255.240.0 any4
access-list dmz-out remark OZ Modified Commited Rate
access-list dmz-out extended permit ip any4 78.142.187.240 255.255.255.248
access-list dmz-in extended deny ip 78.142.187.240 255.255.255.248 object RFC1918
access-list dmz-in remark OZ Modified Commited Rate
access-list dmz-in extended permit ip 78.142.187.240 255.255.255.248 any4
access-list inside_access_in extended deny object-group DM_INLINE_SERVICE_2 object RFC1918 object-group DM_INLINE_NETWORK_4
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended deny ip 192.168.50.0 255.255.255.0 object RFC1918
access-list inside_access_in extended deny ip object RFC1918 192.168.50.0 255.255.255.0
access-list wmcap1 extended permit tcp host 10.0.0.114 any4 eq smtp
access-list wmcap1 extended permit tcp any4 host 10.0.0.114 eq smtp
access-list wmcap1 extended permit tcp any4 object extern-NAT eq smtp
access-list wmcap1 extended permit tcp host 78.142.163.131 any4 eq smtp
access-list wmcap1 extended permit tcp any4 host 78.142.163.131 eq smtp
access-list wmcap1 extended permit tcp host 10.0.0.112 any4 eq smtp
access-list wmcap1 extended permit tcp any4 host 10.0.0.112 eq smtp
access-list wmcap1 extended permit tcp object extern-NAT any4 eq smtp
access-list Videoueberwachung_access_in extended permit ip any4 any4
access-list DMZ1_mpc remark OZ Modified Commited Rate
access-list DMZ1_mpc extended permit ip any4 object DMZ1-network
access-list DMZ1_mpc extended deny ip object RFC1918 object DMZ1-network
access-list Videoueberwachung_mpc_1 extended deny ip host 78.142.163.138 object RFC1918
access-list Videoueberwachung_mpc_1 extended permit ip host 78.142.163.138 any4
access-list DMZ1_mpc_1 remark OZ Modified Commited Rate
access-list DMZ1_mpc_1 extended permit ip object DMZ1-network any4
access-list DMZ1_mpc_1 extended deny ip object DMZ1-network object RFC1918
access-list DMZ2_mpc extended deny ip 213.129.235.32 255.255.255.240 object RFC1918
access-list DMZ2_mpc remark OZ Modified Commited Rate
access-list DMZ2_mpc extended permit ip 213.129.235.32 255.255.255.240 any4
access-list DMZ2_mpc_1 extended deny ip object RFC1918 213.129.235.32 255.255.255.240
access-list DMZ2_mpc_1 remark OZ Modified Commited Rate
access-list DMZ2_mpc_1 extended permit ip any4 213.129.235.32 255.255.255.240
access-list Videoueberwachung_mpc extended deny ip object RFC1918 host 78.142.163.138
access-list Videoueberwachung_mpc extended permit ip any4 host 78.142.163.138
access-list DMZ1_access_in remark von DMZ aus keine Einschränkungen ins Internet
access-list DMZ1_access_in extended permit ip any4 any4
access-list DMZ2_access_in remark von DMZ aus keine Einschränkungen ins Internet
access-list DMZ2_access_in extended permit object-group DM_INLINE_SERVICE_7 213.129.235.32 255.255.255.240 any4
access-list outside_nat_static extended permit ip host 86.59.104.237 any4
access-list 4Mbit_45_access_in_1 extended permit udp 10.45.0.0 255.255.252.0 object DNS-Server_Silverserver eq domain
access-list 4Mbit_45_access_in_1 remark von allen Veranstaltungs-vlans ins Internet erlaubte services
access-list 4Mbit_45_access_in_1 extended permit ip 10.45.0.0 255.255.252.0 any4
access-list 4Mbit_45_access_in_1 extended deny ip 10.45.0.0 255.255.255.240 object RFC1918
access-list 4Mbit_45_access_in_1 extended permit ip 10.45.0.0 255.255.255.240 any4
access-list only-dms remark dms
access-list only-dms standard permit host 10.0.0.121
access-list DefaultRAGroup_splitTunnelAcl standard permit any4
access-list outside_access_in remark Usiweb EBMS und co
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any4 host 10.0.0.113
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_3 any4 host 10.0.0.114
access-list outside_access_in extended permit tcp any4 host 10.0.0.1 object-group DM_INLINE_TCP_1
access-list outside_access_in remark OpenVPN
access-list outside_access_in extended permit udp any4 host 10.0.0.252 object-group DM_INLINE_UDP_1
access-list outside_access_in remark Everything is allowed for the DMZ Network
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_4 object-group DM_INLINE_NETWORK_2 any4
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_5 any4 object-group DM_INLINE_NETWORK_7
access-list outside_access_in remark Client VPN admins & remote Wartung darf überall hin
access-list outside_access_in extended permit ip 10.1.0.0 255.255.255.240 any4
access-list outside_access_in remark User dürfen per client VPN ins Lichtsteuerungsnetz
access-list outside_access_in extended permit ip object client-vpn-user 192.168.149.0 255.255.255.0
access-list outside_access_in extended permit ip object client-vpn-user object RFC1918
access-list outside_access_in remark Websense - Mailarchiva
access-list outside_access_in extended permit tcp object-group websense-incoming host 10.0.0.2 eq smtp
pager lines 24
logging enable
logging timestamp
logging emblem
logging console emergencies
logging monitor emergencies
logging buffered debugging
logging trap notifications
logging asdm informational
logging from-address asa@hofburg.com
logging recipient-address f.schrittesser@hofburg.com level errors
logging recipient-address o.zieger@hofburg.com level errors
logging host mgmt 192.168.201.7
logging debug-trace
flow-export destination inside 10.0.0.139 9996
mtu outside 1500
mtu inside 1500
mtu 2Mbit_20 1500
mtu 2Mbit_21 1500
mtu 2Mbit_22 1500
mtu 2Mbit_23 1500
mtu 4Mbit_40 1500
mtu 4Mbit_41 1500
mtu 4Mbit_42 1500
mtu 4Mbit_43 1500
mtu 4Mbit_44 1500
mtu 4Mbit_45 1500
mtu 4Mbit_46 1500
mtu 4Mbit_47 1500
mtu 6Mbit_60 1500
mtu 6Mbit_61 1500
mtu 6Mbit_62 1500
mtu 6Mbit_63 1500
mtu 10Mbit_100 1500
mtu 14Mbit_140 1500
mtu 18Mbit_180 1500
mtu mgmt 1500
mtu 22Mbit_220 1500
mtu 22Mbit_221 1500
mtu 26Mbit_260 1500
mtu DMZ1 1500
mtu DMZ2 1500
mtu tontechnik 1500
mtu Videoueberwachung 1500
mtu Lichtsteuerung 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any 2Mbit_20
icmp permit any 2Mbit_21
icmp permit any 2Mbit_22
icmp permit any 2Mbit_23
icmp permit any 4Mbit_40
icmp permit any 4Mbit_41
icmp permit any 4Mbit_42
icmp permit any 4Mbit_43
icmp permit any 4Mbit_46
icmp permit any 4Mbit_47
icmp permit any 6Mbit_60
icmp permit any 6Mbit_61
icmp permit any 6Mbit_62
icmp permit any 6Mbit_63
icmp permit any 10Mbit_100
icmp permit any 14Mbit_140
icmp permit any 18Mbit_180
icmp permit any mgmt
icmp permit any 22Mbit_220
icmp permit any 22Mbit_221
icmp permit any 26Mbit_260
icmp permit any Lichtsteuerung
asdm image disk0:/asdm-714.bin
asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,any) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (inside,any) source static RFC1918 RFC1918 destination static client-vpn-user client-vpn-user no-proxy-arp route-lookup
nat (inside,any) source static any any destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (inside,any) source static obj-10.0.0.110 obj-10.0.0.110 destination static obj-10.20.32.0 obj-10.20.32.0 no-proxy-arp route-lookup
nat (inside,any) source static any any destination static client-vpn-user-01 client-vpn-user-01 no-proxy-arp route-lookup
nat (management,outside) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,outside) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_20) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_20) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_21) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_21) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_22) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_22) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_23) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,2Mbit_23) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_40) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_40) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_41) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_41) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_42) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_42) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_43) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_43) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_44) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_44) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_45) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_45) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_46) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_46) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_47) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,4Mbit_47) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_60) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_60) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_61) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_61) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_62) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_62) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_63) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,6Mbit_63) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,10Mbit_100) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,10Mbit_100) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,14Mbit_140) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,14Mbit_140) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,18Mbit_180) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,18Mbit_180) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,mgmt) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,mgmt) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,22Mbit_220) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,22Mbit_220) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,22Mbit_221) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,22Mbit_221) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,26Mbit_260) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,26Mbit_260) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,DMZ1) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,DMZ1) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,DMZ2) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,DMZ2) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,tontechnik) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,tontechnik) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,Videoueberwachung) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,Videoueberwachung) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,Lichtsteuerung) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,Lichtsteuerung) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,management) source static RFC1918 RFC1918 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (management,management) source static obj-192.168.201.0 obj-192.168.201.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.1.0.0_28 NETWORK_OBJ_10.1.0.0_28 no-proxy-arp route-lookup
nat (DMZ1,outside) source static any Object_86.59.104.227
!
object network RFC1918
nat (inside,outside) dynamic interface
object network obj-10.0.0.1
nat (inside,outside) static extern-NAT service tcp [URL unfurl="true"]www www[/URL]
object network obj-10.0.0.1-01
nat (inside,outside) static extern-NAT service tcp https https
object network obj-10.0.0.1-02
nat (inside,outside) static extern-NAT service tcp 8080 8080
object network obj-10.0.0.102
nat (inside,outside) static extern-NAT service tcp 8023 8023
object network obj-10.0.0.252
nat (inside,outside) static extern-NAT service udp 1195 1195
object network obj-10.0.0.252-01
nat (inside,outside) static extern-NAT service udp 1196 1196
object network obj-10.0.0.252-02
nat (inside,outside) static extern-NAT service udp 1198 1198
object network obj-10.0.0.252-03
nat (inside,outside) static extern-NAT service udp 1199 1199
object network obj-10.0.0.252-04
nat (inside,outside) static extern-NAT service udp 1197 1197
object network obj-10.0.0.113
nat (inside,outside) static extern-NAT service tcp 3101 3101
object network obj-10.0.0.1-03
nat (inside,outside) static extern-NAT service tcp 8888 8888
object network obj-10.0.0.113-01
nat (inside,outside) static extern-NAT service tcp 1433 1433
object network obj-10.0.0.113-02
nat (inside,outside) static extern-NAT service udp 1434 1434
object network obj-10.0.0.2
nat (inside,outside) static extern-NAT service tcp smtp smtp
object network obj-10.0.0.114
nat (inside,outside) static extern_newsletter service tcp smtp smtp
object network obj-10.0.0.114-01
nat (inside,outside) static extern_newsletter service tcp [URL unfurl="true"]www www[/URL]
object network obj-10.0.0.114-02
nat (inside,outside) static extern_newsletter service tcp 8080 8080
object network obj-10.0.0.113-03
nat (inside,outside) static extern_ebms service tcp [URL unfurl="true"]www www[/URL]
object network obj-10.0.0.112
nat (inside,outside) static extern-NAT service tcp 13292 13292
object network obj-10.0.0.112-01
nat (inside,outside) static extern-NAT service tcp 17100 17100
object network obj-10.0.0.1-04
nat (inside,outside) dynamic extern-NAT
object network obj-10.0.0.113-04
nat (inside,outside) dynamic extern_ebms
object network obj-10.0.0.114-03
nat (inside,outside) dynamic extern_newsletter
object network obj-10.20.0.0
nat (2Mbit_20,outside) dynamic extern_ebms
object network obj-10.21.0.0
nat (2Mbit_21,outside) dynamic extern_ebms
object network obj-10.22.0.0
nat (2Mbit_22,outside) dynamic extern_ebms
object network obj-10.23.0.0
nat (2Mbit_23,outside) dynamic extern_ebms
object network obj-10.40.0.0
nat (4Mbit_40,outside) dynamic extern_ebms
object network obj-10.41.0.0
nat (4Mbit_41,outside) dynamic extern_ebms
object network obj-10.42.0.0
nat (4Mbit_42,outside) dynamic extern_ebms
object network o