I have set this up in a lab and it worked fine but can't seem to get it working in a production ASA. Only difference is that in the production ASA they are using ldap. He is my scrubbed config and the screen shot of the windows error.
Fernley-ASA(config)# sho run
: Saved
:
ASA Version 8.0(4)
!
hostname
names
!
interface Ethernet0/0
description Outside Interface
nameif Outside
security-level 0
ip address x.x.x.x 255.255.255.224
!
interface Ethernet0/1
description Inside Interface
nameif Inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
!
time-range Restricted
absolute start 02:21 02 February 2009 end 02:21 04 February 2009
periodic daily 0:00 to 23:59
!
banner motd **** WELCOME ****
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup Outside
dns domain-lookup Inside
same-security-traffic permit intra-interface
access-list 100 extended permit icmp any any
access-list 100 extended permit ip host x.x.x.x any
access-list 100 extended permit ip host x.x.x.x any
access-list 100 extended permit ip host x.x.x.x any
access-list 100 extended permit udp any host x.x.x.x
access-list 100 extended permit tcp any host x.x.x.x
access-list 100 extended permit ip host x.x.x.x host x.x.x.x
access-list 100 extended permit udp any eq ntp any
access-list 100 extended permit tcp any host x.x.x.x eq 2200
access-list 100 extended permit udp any host x.x.x.x eq 2200
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit tcp any host x.x.x.x eq smtp
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit udp any host x.x.x.x eq 143
access-list 100 extended permit tcp any host x.x.x.x eq imap4
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit tcp any host x.x.x.x eq domain
access-list 100 extended permit tcp any host x.x.x.x eq pptp
access-list 100 extended permit gre any host x.x.x.x
access-list 100 extended permit tcp any host x.x.x.x eq pptp
access-list 100 extended permit gre any host x.x.x.x
access-list 100 extended permit ip x.x.x.x 255.255.255.0 any
access-list 100 extended permit ip x.x.x.x 255.255.255.0 any
access-list 100 extended permit tcp any host x.x.x.x eq 2200
access-list 100 extended permit udp any host x.x.x.x eq 2200
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 host 192.168.200.151
access-list NONAT extended permit ip 192.168.2.0 255.255.255.0 host 192.168.200.151
access-list Tunnel_list standard permit 192.168.1.0 255.255.255.0
access-list Tunnel_list standard permit host 192.168.200.151
access-list 101 extended permit ip 192.168.1.0 255.255.255.0 host 192.168.200.151
access-list 101 extended permit ip 192.168.2.0 255.255.255.0 host 192.168.200.151
pager lines 24
logging enable
logging timestamp
logging buffer-size 10000
logging buffered informational
logging trap debugging
logging history informational
logging mail informational
logging host Outside x.x.x.x
logging permit-hostdown
mtu Outside 1500
mtu Inside 1500
ip local pool VPN-Pool-1 192.168.2.1-192.168.2.200 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-61551.bin
no asdm history enable
arp timeout 14400
global (Outside) 100 interface
nat (Inside) 0 access-list NONAT
nat (Inside) 100 192.168.0.0 255.255.0.0
static (Inside,Outside) x.x.x.x 192.168.1.192 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.13 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.14 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.15 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.17 netmask 255.255.255.255
access-group 100 in interface Outside
route Outside 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
ldap attribute-map DefaultRAGroup
map-name memberOf IETF-Radius-Class
map-value memberOf CN=VPN-USERS,CN=Users,DC=BVN,DC=local DefaultRAGroup
ldap attribute-map asa-group-1
map-name memberOf IETF-Radius-Class
map-value memberOf CN=VPN-USERS,CN=Users,DC=BVN,DC=local asa-group-1
dynamic-access-policy-record DfltAccessPolicy
aaa-server LDAP-TO-DC protocol ldap
aaa-server LDAP-TO-DC (Inside) host 192.168.1.16
ldap-base-dn DC=fernley,DC=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn asa
server-type microsoft
ldap-attribute-map asa-group-1
aaa-server LDAP-TO-DC2 protocol ldap
aaa-server LDAP-TO-DC2 (Inside) host 192.168.1.16
ldap-base-dn DC=fernley,DC=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn asa
server-type microsoft
ldap-attribute-map DefaultRAGroup
http server enable
http 192.168.0.0 255.255.0.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set VPN_CLIENT esp-des esp-sha-hmac
crypto ipsec transform-set VPN_CLIENT mode transport
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 VPN_CLIENT
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address 101
crypto map outside_map 20 set peer x.x.x.x
crypto map outside_map 20 set transform-set ESP-3DES-MD5 ESP-3DES-SHA
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map 20 set security-association lifetime kilobytes 4608000
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface Outside
crypto map VENDOR 20 set security-association lifetime seconds 28800
crypto map VENDOR 20 set security-association lifetime kilobytes 4608000
crypto isakmp identity address
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 40
authentication pre-share
encryption des
hash md5
group 1
lifetime 86400
crypto isakmp policy 50
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 70
authentication pre-share
encryption 3des
hash sha
group 5
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet x.x.x.x 255.255.0.0 Outside
telnet 192.168.0.0 255.255.0.0 Inside
telnet timeout 5
ssh x.x.x.x 255.255.0.0 Outside
ssh x.x.x.x 255.255.0.0 Outside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
wins-server value 192.168.1.15
dns-server value 192.168.1.15 192.168.1.14
vpn-tunnel-protocol l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Tunnel_list
group-policy asa-group1 internal
group-policy asa-group1 attributes
banner value Welcome to Fernley & Fernley VPN access
wins-server value 192.168.1.15
dns-server value 192.168.1.15 192.168.1.14
vpn-access-hours none
vpn-tunnel-protocol IPSec l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Tunnel_list
default-domain value fernley.com
intercept-dhcp 255.255.255.0 enable
group-policy DfltGrpPolicy attributes
banner value Access Denied
vpn-access-hours value Restricted
username test2 password test2 nt-encrypted
username test password DLaUiAX3l78qgoB5c7iVNw== nt-encrypted
username administrator password kG7oOP2W.F2VOZGH encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
address-pool VPN-Pool-1
authentication-server-group LDAP-TO-DC2
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
isakmp keepalive disable
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
authentication ms-chap-v2
tunnel-group VPN1 type remote-access
tunnel-group VPN1 general-attributes
address-pool VPN-Pool-1
authentication-server-group LDAP-TO-DC
default-group-policy asa-group1
tunnel-group VPN1 ipsec-attributes
pre-shared-key *
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *
tunnel-group vpn1 type ipsec-l2l
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect pptp
inspect ipsec-pass-thru
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:ac98d4c56356cafca36cd1bb544dbba5
: end
Fernley-ASA(config)#
Fernley-ASA(config)#
Fernley-ASA(config)# sho run
: Saved
:
ASA Version 8.0(4)
!
hostname
names
!
interface Ethernet0/0
description Outside Interface
nameif Outside
security-level 0
ip address x.x.x.x 255.255.255.224
!
interface Ethernet0/1
description Inside Interface
nameif Inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
!
time-range Restricted
absolute start 02:21 02 February 2009 end 02:21 04 February 2009
periodic daily 0:00 to 23:59
!
banner motd **** WELCOME ****
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup Outside
dns domain-lookup Inside
same-security-traffic permit intra-interface
access-list 100 extended permit icmp any any
access-list 100 extended permit ip host x.x.x.x any
access-list 100 extended permit ip host x.x.x.x any
access-list 100 extended permit ip host x.x.x.x any
access-list 100 extended permit udp any host x.x.x.x
access-list 100 extended permit tcp any host x.x.x.x
access-list 100 extended permit ip host x.x.x.x host x.x.x.x
access-list 100 extended permit udp any eq ntp any
access-list 100 extended permit tcp any host x.x.x.x eq 2200
access-list 100 extended permit udp any host x.x.x.x eq 2200
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit tcp any host x.x.x.x eq smtp
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit udp any host x.x.x.x eq 143
access-list 100 extended permit tcp any host x.x.x.x eq imap4
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit tcp any host x.x.x.x eq domain
access-list 100 extended permit tcp any host x.x.x.x eq pptp
access-list 100 extended permit gre any host x.x.x.x
access-list 100 extended permit tcp any host x.x.x.x eq pptp
access-list 100 extended permit gre any host x.x.x.x
access-list 100 extended permit ip x.x.x.x 255.255.255.0 any
access-list 100 extended permit ip x.x.x.x 255.255.255.0 any
access-list 100 extended permit tcp any host x.x.x.x eq 2200
access-list 100 extended permit udp any host x.x.x.x eq 2200
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list NONAT extended permit ip 192.168.1.0 255.255.255.0 host 192.168.200.151
access-list NONAT extended permit ip 192.168.2.0 255.255.255.0 host 192.168.200.151
access-list Tunnel_list standard permit 192.168.1.0 255.255.255.0
access-list Tunnel_list standard permit host 192.168.200.151
access-list 101 extended permit ip 192.168.1.0 255.255.255.0 host 192.168.200.151
access-list 101 extended permit ip 192.168.2.0 255.255.255.0 host 192.168.200.151
pager lines 24
logging enable
logging timestamp
logging buffer-size 10000
logging buffered informational
logging trap debugging
logging history informational
logging mail informational
logging host Outside x.x.x.x
logging permit-hostdown
mtu Outside 1500
mtu Inside 1500
ip local pool VPN-Pool-1 192.168.2.1-192.168.2.200 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-61551.bin
no asdm history enable
arp timeout 14400
global (Outside) 100 interface
nat (Inside) 0 access-list NONAT
nat (Inside) 100 192.168.0.0 255.255.0.0
static (Inside,Outside) x.x.x.x 192.168.1.192 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.13 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.14 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.15 netmask 255.255.255.255
static (Inside,Outside) x.x.x.x 192.168.1.17 netmask 255.255.255.255
access-group 100 in interface Outside
route Outside 0.0.0.0 0.0.0.0 x.x.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
ldap attribute-map DefaultRAGroup
map-name memberOf IETF-Radius-Class
map-value memberOf CN=VPN-USERS,CN=Users,DC=BVN,DC=local DefaultRAGroup
ldap attribute-map asa-group-1
map-name memberOf IETF-Radius-Class
map-value memberOf CN=VPN-USERS,CN=Users,DC=BVN,DC=local asa-group-1
dynamic-access-policy-record DfltAccessPolicy
aaa-server LDAP-TO-DC protocol ldap
aaa-server LDAP-TO-DC (Inside) host 192.168.1.16
ldap-base-dn DC=fernley,DC=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn asa
server-type microsoft
ldap-attribute-map asa-group-1
aaa-server LDAP-TO-DC2 protocol ldap
aaa-server LDAP-TO-DC2 (Inside) host 192.168.1.16
ldap-base-dn DC=fernley,DC=com
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *
ldap-login-dn asa
server-type microsoft
ldap-attribute-map DefaultRAGroup
http server enable
http 192.168.0.0 255.255.0.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set VPN_CLIENT esp-des esp-sha-hmac
crypto ipsec transform-set VPN_CLIENT mode transport
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 VPN_CLIENT
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address 101
crypto map outside_map 20 set peer x.x.x.x
crypto map outside_map 20 set transform-set ESP-3DES-MD5 ESP-3DES-SHA
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map 20 set security-association lifetime kilobytes 4608000
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface Outside
crypto map VENDOR 20 set security-association lifetime seconds 28800
crypto map VENDOR 20 set security-association lifetime kilobytes 4608000
crypto isakmp identity address
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp policy 40
authentication pre-share
encryption des
hash md5
group 1
lifetime 86400
crypto isakmp policy 50
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 60
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 70
authentication pre-share
encryption 3des
hash sha
group 5
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet x.x.x.x 255.255.0.0 Outside
telnet 192.168.0.0 255.255.0.0 Inside
telnet timeout 5
ssh x.x.x.x 255.255.0.0 Outside
ssh x.x.x.x 255.255.0.0 Outside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
wins-server value 192.168.1.15
dns-server value 192.168.1.15 192.168.1.14
vpn-tunnel-protocol l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Tunnel_list
group-policy asa-group1 internal
group-policy asa-group1 attributes
banner value Welcome to Fernley & Fernley VPN access
wins-server value 192.168.1.15
dns-server value 192.168.1.15 192.168.1.14
vpn-access-hours none
vpn-tunnel-protocol IPSec l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Tunnel_list
default-domain value fernley.com
intercept-dhcp 255.255.255.0 enable
group-policy DfltGrpPolicy attributes
banner value Access Denied
vpn-access-hours value Restricted
username test2 password test2 nt-encrypted
username test password DLaUiAX3l78qgoB5c7iVNw== nt-encrypted
username administrator password kG7oOP2W.F2VOZGH encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
address-pool VPN-Pool-1
authentication-server-group LDAP-TO-DC2
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *
isakmp keepalive disable
tunnel-group DefaultRAGroup ppp-attributes
no authentication chap
authentication ms-chap-v2
tunnel-group VPN1 type remote-access
tunnel-group VPN1 general-attributes
address-pool VPN-Pool-1
authentication-server-group LDAP-TO-DC
default-group-policy asa-group1
tunnel-group VPN1 ipsec-attributes
pre-shared-key *
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
pre-shared-key *
tunnel-group vpn1 type ipsec-l2l
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
inspect pptp
inspect ipsec-pass-thru
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:ac98d4c56356cafca36cd1bb544dbba5
: end
Fernley-ASA(config)#
Fernley-ASA(config)#