Internal Host Issue on ASA 5510

[tdmelvin]

ASA Version 8.0(4)
!
hostname lhc-fw01
domain-name chandom.internal
enable password dcbvmiVNKth1v4Xn encrypted
passwd dcbvmiVNKth1v4Xn encrypted
names
name 192.168.200.0 dmz description DMZ Interface
name 192.168.10.0 management description Management Interface
dns-guard
!
I have an issue, regarding the ASA 5510. I have an MPLS network, with an ASA. The internal network is 10.10.x.x/21 with a default GW of 10.10.0.252 [Inside Interface of ASA]. The next hop router for us is 10.10.0.254. I have 4 other sites on the MPLS network with 10.11.x.x/21 - 10.14.x.x/21, with each of their default GW's being 10.11.0.254, etc.. I need to open up our internal hosts to all of these other locations [i.e. Windows servers, HTTP, ICMP, etc.]. I can ping all of these locations from the ASA. I can also ping from those other locations to the 10.10.0.254, but that's it. I thought it was implied that inside could see inside? What am I missing?

Thanks in advance!

interface Ethernet0/0
description Outside Interface
nameif outside
security-level 0
ip address X.X.X.X 255.255.255.248
!
interface Ethernet0/1
description Inside Ethernet Interface
nameif inside
security-level 100
ip address 10.10.0.252 255.255.248.0 standby 10.10.0.253
!
interface Ethernet0/2
description DMZ Interface
nameif dmz
security-level 50
ip address 192.168.200.1 255.255.255.0 standby 192.168.200.2
!
interface Ethernet0/3
description LAN/STATE Failover Interface
!
interface Management0/0
description Management Interface
nameif management
security-level 100
ip address 192.168.10.1 255.255.255.0 standby 192.168.10.2
management-only
!
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 10.10.1.1
name-server 10.10.1.2
name-server 64.192.64.140
name-server 64.140.193.60
domain-name chandom.internal
object-group service DM_INLINE_TCP_4 tcp
port-object eq ftp
port-object eq www
port-object eq pop3
port-object eq smtp
port-object eq https
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object udp
protocol-object tcp
object-group service IMR tcp
port-object range 2440 2444
object-group service IMS tcp
port-object range 2400 2403
object-group service Millbrook tcp
port-object eq 2500
object-group service DM_INLINE_SERVICE_2
service-object icmp
service-object tcp eq www
object-group network DM_INLINE_NETWORK_1
network-object 10.12.0.0 255.255.248.0
network-object 10.13.0.0 255.255.248.0
network-object 192.168.1.0 255.255.255.0
network-object 192.168.2.0 255.255.255.0
network-object 192.168.5.0 255.255.255.0
network-object 192.168.7.0 255.255.255.0
network-object 192.168.9.0 255.255.255.0
network-object 10.11.0.0 255.255.248.0
object-group service DM_INLINE_TCP_1 tcp
group-object IMR
group-object IMS
group-object Millbrook
port-object eq https
port-object eq www
access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.248.0 object-group DM_INLINE_NETWORK_1
access-list nonat extended permit ip any 192.168.100.0 255.255.255.0
access-list 100 extended permit ip any 192.168.100.0 255.255.255.0
access-list 100 extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list 100 extended permit ip management 255.255.255.0 192.168.100.0 255.255.255.0
access-list 100 extended permit tcp any host X.X.X.X eq www
access-list 100 extended permit tcp any host X.X.X.X eq www
access-list 100 extended permit tcp any host X.X.X.X.45 eq smtp
access-list 100 extended permit tcp any host X.X.X.X eq smtp
access-list 100 extended permit tcp any host X.X.X.X eq https
access-list 100 extended permit tcp any host X.X.X.X eq https
access-list 100 extended permit tcp any host X.X.X.X eq https
access-list 100 extended permit tcp any host X.X.X.X object-group DM_INLINE_TCP_1
access-list management_nat0_outbound extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list management_nat0_outbound extended permit ip management 255.255.255.0 192.168.100.0 255.255.255.0
access-list management_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_2 192.168.100.0 255.255.255.0 10.10.0.0 255.255.248.0
access-list management_nat0_outbound extended permit icmp 10.10.0.0 255.255.248.0 any
access-list inside_access_in extended permit ip any any
access-list CHANREMOTEVPN_splitTunnelAcl standard permit 10.10.0.0 255.255.248.0
access-list global_mpc extended permit tcp any any object-group DM_INLINE_TCP_4
access-list outside_2_cryptomap extended permit ip 10.10.0.0 255.255.248.0 192.168.5.0 255.255.255.0
access-list CHANVPN09_splitTunnelAcl standard permit 10.10.0.0 255.255.248.0
access-list CHANVPN09_splitTunnelAcl remark Inside Corporate Network
access-list nonat-in extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging from-address fwadmin@domain.org
logging recipient-address user@domain.org level errors
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
ip local pool lhcchanpool 192.168.100.2-192.168.100.254 mask 255.255.255.0
failover
failover lan unit primary
failover lan interface asa_primary Ethernet0/3
failover key *****
failover link asa_primary Ethernet0/3
failover interface ip asa_primary 10.1.10.2 255.255.255.248 standby 10.1.10.3
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm-615.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 0 access-list nonat
nat (inside) 101 X.X.X.X 255.255.255.248
nat (inside) 101 0.0.0.0 0.0.0.0
static (dmz,outside) X.X.X.X 192.168.200.10 netmask 255.255.255.255
static (inside,outside) X.X.X.X 10.10.1.11 netmask 255.255.255.255
static (inside,dmz) 192.168.200.10 10.10.1.35 netmask 255.255.255.255
static (inside,outside) X.X.X.X 10.10.1.36 netmask 255.255.255.255
static (inside,outside) X.X.X.X 10.10.1.12 netmask 255.255.255.255
access-group 100 in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 X.X.X.X 1
route inside 10.1.1.0 255.255.255.0 10.10.0.252 10
route inside 10.10.0.0 255.255.248.0 10.10.0.254 1
route inside 10.11.0.0 255.255.248.0 10.10.0.254 10
route inside 10.12.0.0 255.255.248.0 10.10.0.254 10
route inside 10.13.0.0 255.255.248.0 10.10.0.254 10
route inside 172.20.20.0 255.255.255.0 10.10.0.254 10
route inside 192.168.1.0 255.255.255.0 10.10.0.254 10
route inside 192.168.2.0 255.255.255.0 10.10.0.254 10
route inside 192.168.5.0 255.255.255.0 10.10.0.252 10
route inside 192.168.7.0 255.255.255.0 10.10.0.254 10
route inside 192.168.9.0 255.255.255.0 10.10.0.254 10
route inside 192.168.100.0 255.255.255.0 192.168.100.1 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server CHANDOM protocol nt
aaa-server CHANDOM (inside) host 10.10.1.1
timeout 5
nt-auth-domain-controller 10.10.1.1
aaa-server CHANDOM (inside) host 10.10.1.2
timeout 5
nt-auth-domain-controller 10.10.1.1
aaa-server CHANDOM (inside) host 10.1.1.60
nt-auth-domain-controller mother
aaa-server CHANDOM (inside) host 10.1.1.128
nt-auth-domain-controller 10.1.1.60
http server enable
http management 255.255.255.0 management
http 10.10.0.0 255.255.248.0 management
http 10.1.1.0 255.255.255.0 inside
http 10.10.0.0 255.255.248.0 inside
http 192.168.100.0 255.255.255.0 management
http redirect outside 80
snmp-server host inside 10.10.1.11 community private version 2c udp-port 161
no snmp-server location
no snmp-server contact
snmp-server community private
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set FirsSet esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set pfs group1
crypto dynamic-map dyn1 1 set transform-set FirsSet
crypto dynamic-map dyn1 1 set security-association lifetime seconds 28800
crypto dynamic-map dyn1 1 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto map management_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map management_map interface management
crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap 2 match address outside_2_cryptomap
crypto map mymap 2 set pfs group1
crypto map mymap 2 set peer X.X.X.X
crypto map mymap 2 set transform-set ESP-3DES-SHA
crypto map mymap 2 set security-association lifetime seconds 28800
crypto map mymap 2 set security-association lifetime kilobytes 4608000
crypto map mymap interface outside
crypto ca trustpoint ASDM_TrustPoint0
revocation-check ocsp crl none
enrollment terminal
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment self
fqdn vpn.domain.com
subject-name CN=vpn.domain.com
no client-types
crl configure
crypto ca trustpoint ASDM_TrustPoint2
enrollment terminal
no client-types
crl configure
crypto ca trustpoint ASDM_TrustPoint4
crl configure
crypto ca trustpoint ASDM_TrustPoint5
crl configure
crypto ca certificate map DefaultCertificateMap 10
crypto ca certificate chain ASDM_TrustPoint0
certificate ca 1c8b350a4a3b6e8246d628266dec1c67
30820477 3082035f a0030201 0202101c 8b350a4a 3b6e8246 d628266d ec1c6730
0d06092a 864886f7 0d010105 05003041 31183016 060a0992 268993f2 2c640119
1608696e 7465726e 616c3117 3015060a 09922689 93f22c64 01191607 6368616e
646f6d31 0c300a06 03550403 13034c48 43301e17 0d303831 31303331 33353534
395a170d 31333131 30333134 30313433 5a304131 18301606 0a099226 8993f22c
64011916 08696e74 65726e61 6c311730 15060a09 92268993 f22c6401 19160763
68616e64 6f6d310c 300a0603 55040313 034c4843 30820122 300d0609 2a864886
f70d0101 01050003 82010f00 3082010a 02820101 00b142ab 2aae1a1b 373d3916
9ee80484 ebde6cbc 30471cf2 5cf11b32 70aa1b9d 5a3927e2 ea930fd1 204cc122
4ab7c4cd cea61bcf 155c9fea 43bafd78 9b0ef395 fa67f360 2b414dc7 2acb7eb0
9f3cc006 51043cea c75b60f7 934f015c 8a92127e e33243f3 81171e94 9e425eba
ab80fb29 f943b82b 61cf7f02 8b96aca5 9818fca6 13581ba3 db60f026 02f236fa
88d0bf26 c0250759 64d7740e 45798bfe 44097039 3cd848a5 184f516b 7b8eeb22
93ada25b b55eba7d 5a32927f 73a169e9 6f5c9bcf bc3dd52a aa3c7865 2856dabc
76cfe376 bc2fa61a 67f97264 3e9edec5 f34a3f0e 4613a98c 1ecfece6 02bb17ff
9e1744c4 ed62eab5 d1e4e01d 87245e33 1b29b416 bb020301 0001a382 01693082
01653013 06092b06 01040182 37140204 061e0400 43004130 0b060355 1d0f0404
03020186 300f0603 551d1301 01ff0405 30030101 ff301d06 03551d0e 04160414
6bb9cfd1 f5076c62 46d83fe8 7ec211df 8ed87548 3081fe06 03551d1f 0481f630
81f33081 f0a081ed a081ea86 81b16c64 61703a2f 2f2f434e 3d4c4843 2c434e3d
6c68632d 77656230 312c434e 3d434450 2c434e3d 5075626c 69632532 304b6579
25323053 65727669 6365732c 434e3d53 65727669 6365732c 434e3d43 6f6e6669
67757261 74696f6e 2c44433d 6368616e 646f6d2c 44433d69 6e746572 6e616c3f
63657274 69666963 61746552 65766f63 6174696f 6e4c6973 743f6261 73653f6f
626a6563 74436c61 73733d63 524c4469 73747269 62757469 6f6e506f 696e7486
34687474 703a2f2f 6c68632d 77656230 312e6368 616e646f 6d2e696e 7465726e
616c2f43 65727445 6e726f6c 6c2f4c48 432e6372 6c301006 092b0601 04018237
15010403 02010030 0d06092a 864886f7 0d010105 05000382 0101001d ebabcf92
751786a3 4d1a3690 525465d7 96dce61f e35ad234 07c29ad8 4bbb7be9 f2e3c3fb
779955d5 098c5c5e 13ac07d8 2218e4f7 b07ef4d8 364865bc 756f3834 4cf3250a
67f6685d 1a529f27 f6b6e57d f662c36a 1393acc6 7d976c69 ff61aa1f db2d69bd
36733255 f477e384 5d575433 80a6ae07 6c94ffec e19567f6 e6e8f14d bcc807be
a5623f06 a07e08c1 f71d69a8 8ba86db7 55b75285 0ef8a310 ec226261 412398bf
f4a11b62 ad708c77 a8028b4d 93199606 2a94d87d 65b7478b e0a2141e 3a178d7a
868430c2 c37c1f97 53d73b5c 18133fba 92e75ce0 4637d5ca f12c54de 52050879
91dadcf8 2f4d9404 668daa1d 4e4e7241 3fe643c0 e7650e88 e13f87
quit
crypto ca certificate chain ASDM_TrustPoint1
certificate 31
30820214 3082017d a0030201 02020131 300d0609 2a864886 f70d0101 04050030
50312330 21060355 0403131a 6c68632d 66773031 2e6c616d 70726579 6865616c
74682e6f 72673129 30270609 2a864886 f70d0109 02161a6c 68632d66 7730312e
6c616d70 72657968 65616c74 682e6f72 67301e17 0d303831 31313031 37313431
355a170d 31383131 30383137 31343135 5a305031 23302106 03550403 131a6c68
632d6677 30312e6c 616d7072 65796865 616c7468 2e6f7267 31293027 06092a86
4886f70d 01090216 1a6c6863 2d667730 312e6c61 6d707265 79686561 6c74682e
6f726730 819f300d 06092a86 4886f70d 01010105 0003818d 00308189 02818100
a8b247cd 0df19ea3 c06ed85b b1c1f852 688987e5 9d3ecdcb 8caca861 143864e9
8342745e b24b9410 1ef64130 8303069f 87df0ab0 3e3e3091 e2e0162e d7966acc
bbd30c9f 8ea7254a 5d974faf 8ab0b30a c2640500 3b6ec4aa c66f6ec3 83b4ecd8
ae6e6944 f3acbc77 861ce178 47b021eb 1c4a094a c6c2ee30 347b7faa 344f8df5
02030100 01300d06 092a8648 86f70d01 01040500 03818100 6776b80e e843d977
eb36b874 37d9e177 e3bdd6f0 ab46effb cee095bf 642cabc3 9252ab78 141eccfe
6533ed8a 149d551c 1d2c7fd8 a98fd7cb 7b90f444 80d49a66 584dc49d b4c05b7d
ad1952c6 d9cae72c 6849cbb7 97deb3e0 af6e09f7 2f34e8f2 6f7e57e2 c0203510
e8d9b1d6 ad2e2df0 ccbe03c1 49ea4107 2fd849e4 726cee31
quit
crypto ca certificate chain ASDM_TrustPoint2
certificate ca 1c8b350a4a3b6e8246d628266dec1c67
30820477 3082035f a0030201 0202101c 8b350a4a 3b6e8246 d628266d ec1c6730
0d06092a 864886f7 0d010105 05003041 31183016 060a0992 268993f2 2c640119
1608696e 7465726e 616c3117 3015060a 09922689 93f22c64 01191607 6368616e
646f6d31 0c300a06 03550403 13034c48 43301e17 0d303831 31303331 33353534
395a170d 31333131 30333134 30313433 5a304131 18301606 0a099226 8993f22c
64011916 08696e74 65726e61 6c311730 15060a09 92268993 f22c6401 19160763
68616e64 6f6d310c 300a0603 55040313 034c4843 30820122 300d0609 2a864886
f70d0101 01050003 82010f00 3082010a 02820101 00b142ab 2aae1a1b 373d3916
9ee80484 ebde6cbc 30471cf2 5cf11b32 70aa1b9d 5a3927e2 ea930fd1 204cc122
4ab7c4cd cea61bcf 155c9fea 43bafd78 9b0ef395 fa67f360 2b414dc7 2acb7eb0
9f3cc006 51043cea c75b60f7 934f015c 8a92127e e33243f3 81171e94 9e425eba
ab80fb29 f943b82b 61cf7f02 8b96aca5 9818fca6 13581ba3 db60f026 02f236fa
88d0bf26 c0250759 64d7740e 45798bfe 44097039 3cd848a5 184f516b 7b8eeb22
93ada25b b55eba7d 5a32927f 73a169e9 6f5c9bcf bc3dd52a aa3c7865 2856dabc
76cfe376 bc2fa61a 67f97264 3e9edec5 f34a3f0e 4613a98c 1ecfece6 02bb17ff
9e1744c4 ed62eab5 d1e4e01d 87245e33 1b29b416 bb020301 0001a382 01693082
01653013 06092b06 01040182 37140204 061e0400 43004130 0b060355 1d0f0404
03020186 300f0603 551d1301 01ff0405 30030101 ff301d06 03551d0e 04160414
6bb9cfd1 f5076c62 46d83fe8 7ec211df 8ed87548 3081fe06 03551d1f 0481f630
81f33081 f0a081ed a081ea86 81b16c64 61703a2f 2f2f434e 3d4c4843 2c434e3d
6c68632d 77656230 312c434e 3d434450 2c434e3d 5075626c 69632532 304b6579
25323053 65727669 6365732c 434e3d53 65727669 6365732c 434e3d43 6f6e6669
67757261 74696f6e 2c44433d 6368616e 646f6d2c 44433d69 6e746572 6e616c3f
63657274 69666963 61746552 65766f63 6174696f 6e4c6973 743f6261 73653f6f
626a6563 74436c61 73733d63 524c4469 73747269 62757469 6f6e506f 696e7486
34687474 703a2f2f 6c68632d 77656230 312e6368 616e646f 6d2e696e 7465726e
616c2f43 65727445 6e726f6c 6c2f4c48 432e6372 6c301006 092b0601 04018237
15010403 02010030 0d06092a 864886f7 0d010105 05000382 0101001d ebabcf92
751786a3 4d1a3690 525465d7 96dce61f e35ad234 07c29ad8 4bbb7be9 f2e3c3fb
779955d5 098c5c5e 13ac07d8 2218e4f7 b07ef4d8 364865bc 756f3834 4cf3250a
67f6685d 1a529f27 f6b6e57d f662c36a 1393acc6 7d976c69 ff61aa1f db2d69bd
36733255 f477e384 5d575433 80a6ae07 6c94ffec e19567f6 e6e8f14d bcc807be
a5623f06 a07e08c1 f71d69a8 8ba86db7 55b75285 0ef8a310 ec226261 412398bf
f4a11b62 ad708c77 a8028b4d 93199606 2a94d87d 65b7478b e0a2141e 3a178d7a
868430c2 c37c1f97 53d73b5c 18133fba 92e75ce0 4637d5ca f12c54de 52050879
91dadcf8 2f4d9404 668daa1d 4e4e7241 3fe643c0 e7650e88 e13f87
quit
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp enable inside
crypto isakmp enable management
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication rsa-sig
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp nat-traversal 30
telnet 10.1.1.0 255.255.255.0 management
telnet 10.10.0.0 255.255.248.0 management
telnet management 255.255.255.0 management
telnet timeout 5
ssh 10.10.0.0 255.255.0.0 management
ssh management 255.255.255.0 management
ssh timeout 5
console timeout 0
management-access management
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 10.10.1.102 source inside prefer
tftp-server inside 10.10.3.9 XXXXX
ssl trust-point ASDM_TrustPoint1 outside
ssl trust-point ASDM_TrustPoint1 outside vpnlb-ip
webvpn
enable outside
enable inside
csd image disk0:/securedesktop-asa-3.3.0.151-k9.pkg
svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-2.1.0148-k9.pkg 2
svc enable
port-forward Citrix 2598 10.1.1.5 2598 Citrix Remote - Reliability
port-forward Citrix https 10.1.1.5 https Citrix Remote - HTTPS
port-forward Citrix citrix-ica 10.1.1.5 citrix-ica Citrix Remote - ICA
port-forward Citrix

http://www 10.1.1.5

http://www Citrix

Remote - HTTP
tunnel-group-list enable
certificate-group-map DefaultCertificateMap 10 SSLClientProfile
group-policy SSLClientPolicy internal
group-policy SSLClientPolicy attributes
wins-server value 10.1.1.60 10.1.1.128
dns-server value 10.1.1.60 10.1.1.128
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-network-list value CHANVPN09_splitTunnelAcl
default-domain value chandom.internal
address-pools value lhcchanpool
webvpn
url-list value SSLVPN
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy CHANREMOTEVPN internal
group-policy CHANREMOTEVPN attributes
wins-server value 10.10.1.1
dns-server value 10.10.1.1 10.10.1.2
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CHANREMOTEVPN_splitTunnelAcl
default-domain value chandom.internal
username testuser password H71CX14jHcYCmb5d encrypted privilege 0
username testuser attributes
vpn-group-policy CHANREMOTEVPN
username admin password 3CNayybjSxVPCxWO encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
authentication-server-group CHANDOM
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group CHANDOM
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
authentication-server-group CHANDOM
authentication-server-group (inside) CHANDOM
default-group-policy SSLClientPolicy
tunnel-group SSLClientProfile webvpn-attributes
hic-fail-group-policy SSLClientPolicy
nbns-server 10.1.1.60 timeout 2 retry 2
nbns-server 10.10.1.128 timeout 2 retry 2
group-alias SSLVPNClient enable
tunnel-group CHANREMOTEVPN type remote-access
tunnel-group CHANREMOTEVPN general-attributes
address-pool lhcchanpool
default-group-policy CHANREMOTEVPN
tunnel-group CHANREMOTEVPN ipsec-attributes
pre-shared-key *
tunnel-group CHAN-MCHC type ipsec-l2l
tunnel-group CHAN-MCHC ipsec-attributes
pre-shared-key *
!
class-map global-class
match access-list global_mpc
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect icmp error
class global-class
csc fail-open
policy-map group_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
smtp-server 10.1.1.60 10.10.1.1
prompt hostname context
Cryptochecksum:788451e5a0bbd6d90fabd13f87a78320
: end
asdm image disk0:/asdm-615.bin
asdm location 10.10.1.35 255.255.255.255 inside
asdm location ASA Version 8.0(4)
!
hostname lhc-fw01
domain-name chandom.internal
enable password dcbvmiVNKth1v4Xn encrypted
passwd dcbvmiVNKth1v4Xn encrypted
names
name 192.168.200.0 dmz description DMZ Interface
name 192.168.10.0 management description Management Interface
dns-guard
!
interface Ethernet0/0
description Outside Interface
nameif outside
security-level 0
ip address X.X.X.X 255.255.255.248
!
interface Ethernet0/1
description Inside Ethernet Interface
nameif inside
security-level 100
ip address 10.10.0.252 255.255.248.0 standby 10.10.0.253
!
interface Ethernet0/2
description DMZ Interface
nameif dmz
security-level 50
ip address 192.168.200.1 255.255.255.0 standby 192.168.200.2
!
interface Ethernet0/3
description LAN/STATE Failover Interface
!
interface Management0/0
description Management Interface
nameif management
security-level 100
ip address 192.168.10.1 255.255.255.0 standby 192.168.10.2
management-only
!
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 10.10.1.1
name-server 10.10.1.2
name-server 64.192.64.140
name-server 64.140.193.60
domain-name chandom.internal
object-group service DM_INLINE_TCP_4 tcp
port-object eq ftp
port-object eq www
port-object eq pop3
port-object eq smtp
port-object eq https
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object udp
protocol-object tcp
object-group service IMR tcp
port-object range 2440 2444
object-group service IMS tcp
port-object range 2400 2403
object-group service Millbrook tcp
port-object eq 2500
object-group service DM_INLINE_SERVICE_2
service-object icmp
service-object tcp eq www
object-group network DM_INLINE_NETWORK_1
network-object 10.12.0.0 255.255.248.0
network-object 10.13.0.0 255.255.248.0
network-object 192.168.1.0 255.255.255.0
network-object 192.168.2.0 255.255.255.0
network-object 192.168.5.0 255.255.255.0
network-object 192.168.7.0 255.255.255.0
network-object 192.168.9.0 255.255.255.0
network-object 10.11.0.0 255.255.248.0
object-group service DM_INLINE_TCP_1 tcp
group-object IMR
group-object IMS
group-object Millbrook
port-object eq https
port-object eq www
access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.248.0 object-group DM_INLINE_NETWORK_1
access-list nonat extended permit ip any 192.168.100.0 255.255.255.0
access-list 100 extended permit ip any 192.168.100.0 255.255.255.0
access-list 100 extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list 100 extended permit ip management 255.255.255.0 192.168.100.0 255.255.255.0
access-list 100 extended permit tcp any host X.X.X.X eq www
access-list 100 extended permit tcp any host X.X.X.X eq www
access-list 100 extended permit tcp any host X.X.X.X.45 eq smtp
access-list 100 extended permit tcp any host X.X.X.X eq smtp
access-list 100 extended permit tcp any host X.X.X.X eq https
access-list 100 extended permit tcp any host X.X.X.X eq https
access-list 100 extended permit tcp any host X.X.X.X eq https
access-list 100 extended permit tcp any host X.X.X.X object-group DM_INLINE_TCP_1
access-list management_nat0_outbound extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list management_nat0_outbound extended permit ip management 255.255.255.0 192.168.100.0 255.255.255.0
access-list management_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_2 192.168.100.0 255.255.255.0 10.10.0.0 255.255.248.0
access-list management_nat0_outbound extended permit icmp 10.10.0.0 255.255.248.0 any
access-list inside_access_in extended permit ip any any
access-list CHANREMOTEVPN_splitTunnelAcl standard permit 10.10.0.0 255.255.248.0
access-list global_mpc extended permit tcp any any object-group DM_INLINE_TCP_4
access-list outside_2_cryptomap extended permit ip 10.10.0.0 255.255.248.0 192.168.5.0 255.255.255.0
access-list CHANVPN09_splitTunnelAcl standard permit 10.10.0.0 255.255.248.0
access-list CHANVPN09_splitTunnelAcl remark Inside Corporate Network
access-list nonat-in extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging from-address fwadmin@domain.org
logging recipient-address user@domain.org level errors
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
ip local pool lhcchanpool 192.168.100.2-192.168.100.254 mask 255.255.255.0
failover
failover lan unit primary
failover lan interface asa_primary Ethernet0/3
failover key *****
failover link asa_primary Ethernet0/3
failover interface ip asa_primary 10.1.10.2 255.255.255.248 standby 10.1.10.3
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm image disk0:/asdm-615.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 0 access-list nonat
nat (inside) 101 X.X.X.X 255.255.255.248
nat (inside) 101 0.0.0.0 0.0.0.0
static (dmz,outside) X.X.X.X 192.168.200.10 netmask 255.255.255.255
static (inside,outside) X.X.X.X 10.10.1.11 netmask 255.255.255.255
static (inside,dmz) 192.168.200.10 10.10.1.35 netmask 255.255.255.255
static (inside,outside) X.X.X.X 10.10.1.36 netmask 255.255.255.255
static (inside,outside) X.X.X.X 10.10.1.12 netmask 255.255.255.255
access-group 100 in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 X.X.X.X 1
route inside 10.1.1.0 255.255.255.0 10.10.0.252 10
route inside 10.10.0.0 255.255.248.0 10.10.0.254 1
route inside 10.11.0.0 255.255.248.0 10.10.0.254 10
route inside 10.12.0.0 255.255.248.0 10.10.0.254 10
route inside 10.13.0.0 255.255.248.0 10.10.0.254 10
route inside 172.20.20.0 255.255.255.0 10.10.0.254 10
route inside 192.168.1.0 255.255.255.0 10.10.0.254 10
route inside 192.168.2.0 255.255.255.0 10.10.0.254 10
route inside 192.168.5.0 255.255.255.0 10.10.0.252 10
route inside 192.168.7.0 255.255.255.0 10.10.0.254 10
route inside 192.168.9.0 255.255.255.0 10.10.0.254 10
route inside 192.168.100.0 255.255.255.0 192.168.100.1 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server CHANDOM protocol nt
aaa-server CHANDOM (inside) host 10.10.1.1
timeout 5
nt-auth-domain-controller 10.10.1.1
aaa-server CHANDOM (inside) host 10.10.1.2
timeout 5
nt-auth-domain-controller 10.10.1.1
aaa-server CHANDOM (inside) host 10.1.1.60
nt-auth-domain-controller mother
aaa-server CHANDOM (inside) host 10.1.1.128
nt-auth-domain-controller 10.1.1.60
http server enable
http management 255.255.255.0 management
http 10.10.0.0 255.255.248.0 management
http 10.1.1.0 255.255.255.0 inside
http 10.10.0.0 255.255.248.0 inside
http 192.168.100.0 255.255.255.0 management
http redirect outside 80
snmp-server host inside 10.10.1.11 community private version 2c udp-port 161
no snmp-server location
no snmp-server contact
snmp-server community private
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set FirsSet esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set pfs group1
crypto dynamic-map dyn1 1 set transform-set FirsSet
crypto dynamic-map dyn1 1 set security-association lifetime seconds 28800
crypto dynamic-map dyn1 1 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto map management_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map management_map interface management
crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap 2 match address outside_2_cryptomap
crypto map mymap 2 set pfs group1
crypto map mymap 2 set peer X.X.X.X
crypto map mymap 2 set transform-set ESP-3DES-SHA
crypto map mymap 2 set security-association lifetime seconds 28800
crypto map mymap 2 set security-association lifetime kilobytes 4608000
crypto map mymap interface outside
crypto ca trustpoint ASDM_TrustPoint0
revocation-check ocsp crl none
enrollment terminal
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment self
fqdn vpn.domain.com
subject-name CN=vpn.domain.com
no client-types
crl configure
crypto ca trustpoint ASDM_TrustPoint2
enrollment terminal
no client-types
crl configure
crypto ca trustpoint ASDM_TrustPoint4
crl configure
crypto ca trustpoint ASDM_TrustPoint5
crl configure
crypto ca certificate map DefaultCertificateMap 10
crypto ca certificate chain ASDM_TrustPoint0
certificate ca 1c8b350a4a3b6e8246d628266dec1c67
30820477 3082035f a0030201 0202101c 8b350a4a 3b6e8246 d628266d ec1c6730
0d06092a 864886f7 0d010105 05003041 31183016 060a0992 268993f2 2c640119
1608696e 7465726e 616c3117 3015060a 09922689 93f22c64 01191607 6368616e
646f6d31 0c300a06 03550403 13034c48 43301e17 0d303831 31303331 33353534
395a170d 31333131 30333134 30313433 5a304131 18301606 0a099226 8993f22c
64011916 08696e74 65726e61 6c311730 15060a09 92268993 f22c6401 19160763
68616e64 6f6d310c 300a0603 55040313 034c4843 30820122 300d0609 2a864886
f70d0101 01050003 82010f00 3082010a 02820101 00b142ab 2aae1a1b 373d3916
9ee80484 ebde6cbc 30471cf2 5cf11b32 70aa1b9d 5a3927e2 ea930fd1 204cc122
4ab7c4cd cea61bcf 155c9fea 43bafd78 9b0ef395 fa67f360 2b414dc7 2acb7eb0
9f3cc006 51043cea c75b60f7 934f015c 8a92127e e33243f3 81171e94 9e425eba
ab80fb29 f943b82b 61cf7f02 8b96aca5 9818fca6 13581ba3 db60f026 02f236fa
88d0bf26 c0250759 64d7740e 45798bfe 44097039 3cd848a5 184f516b 7b8eeb22
93ada25b b55eba7d 5a32927f 73a169e9 6f5c9bcf bc3dd52a aa3c7865 2856dabc
76cfe376 bc2fa61a 67f97264 3e9edec5 f34a3f0e 4613a98c 1ecfece6 02bb17ff
9e1744c4 ed62eab5 d1e4e01d 87245e33 1b29b416 bb020301 0001a382 01693082
01653013 06092b06 01040182 37140204 061e0400 43004130 0b060355 1d0f0404
03020186 300f0603 551d1301 01ff0405 30030101 ff301d06 03551d0e 04160414
6bb9cfd1 f5076c62 46d83fe8 7ec211df 8ed87548 3081fe06 03551d1f 0481f630
81f33081 f0a081ed a081ea86 81b16c64 61703a2f 2f2f434e 3d4c4843 2c434e3d
6c68632d 77656230 312c434e 3d434450 2c434e3d 5075626c 69632532 304b6579
25323053 65727669 6365732c 434e3d53 65727669 6365732c 434e3d43 6f6e6669
67757261 74696f6e 2c44433d 6368616e 646f6d2c 44433d69 6e746572 6e616c3f
63657274 69666963 61746552 65766f63 6174696f 6e4c6973 743f6261 73653f6f
626a6563 74436c61 73733d63 524c4469 73747269 62757469 6f6e506f 696e7486
34687474 703a2f2f 6c68632d 77656230 312e6368 616e646f 6d2e696e 7465726e
616c2f43 65727445 6e726f6c 6c2f4c48 432e6372 6c301006 092b0601 04018237
15010403 02010030 0d06092a 864886f7 0d010105 05000382 0101001d ebabcf92
751786a3 4d1a3690 525465d7 96dce61f e35ad234 07c29ad8 4bbb7be9 f2e3c3fb
779955d5 098c5c5e 13ac07d8 2218e4f7 b07ef4d8 364865bc 756f3834 4cf3250a
67f6685d 1a529f27 f6b6e57d f662c36a 1393acc6 7d976c69 ff61aa1f db2d69bd
36733255 f477e384 5d575433 80a6ae07 6c94ffec e19567f6 e6e8f14d bcc807be
a5623f06 a07e08c1 f71d69a8 8ba86db7 55b75285 0ef8a310 ec226261 412398bf
f4a11b62 ad708c77 a8028b4d 93199606 2a94d87d 65b7478b e0a2141e 3a178d7a
868430c2 c37c1f97 53d73b5c 18133fba 92e75ce0 4637d5ca f12c54de 52050879
91dadcf8 2f4d9404 668daa1d 4e4e7241 3fe643c0 e7650e88 e13f87
quit
crypto ca certificate chain ASDM_TrustPoint1
certificate 31
30820214 3082017d a0030201 02020131 300d0609 2a864886 f70d0101 04050030
50312330 21060355 0403131a 6c68632d 66773031 2e6c616d 70726579 6865616c
74682e6f 72673129 30270609 2a864886 f70d0109 02161a6c 68632d66 7730312e
6c616d70 72657968 65616c74 682e6f72 67301e17 0d303831 31313031 37313431
355a170d 31383131 30383137 31343135 5a305031 23302106 03550403 131a6c68
632d6677 30312e6c 616d7072 65796865 616c7468 2e6f7267 31293027 06092a86
4886f70d 01090216 1a6c6863 2d667730 312e6c61 6d707265 79686561 6c74682e
6f726730 819f300d 06092a86 4886f70d 01010105 0003818d 00308189 02818100
a8b247cd 0df19ea3 c06ed85b b1c1f852 688987e5 9d3ecdcb 8caca861 143864e9
8342745e b24b9410 1ef64130 8303069f 87df0ab0 3e3e3091 e2e0162e d7966acc
bbd30c9f 8ea7254a 5d974faf 8ab0b30a c2640500 3b6ec4aa c66f6ec3 83b4ecd8
ae6e6944 f3acbc77 861ce178 47b021eb 1c4a094a c6c2ee30 347b7faa 344f8df5
02030100 01300d06 092a8648 86f70d01 01040500 03818100 6776b80e e843d977
eb36b874 37d9e177 e3bdd6f0 ab46effb cee095bf 642cabc3 9252ab78 141eccfe
6533ed8a 149d551c 1d2c7fd8 a98fd7cb 7b90f444 80d49a66 584dc49d b4c05b7d
ad1952c6 d9cae72c 6849cbb7 97deb3e0 af6e09f7 2f34e8f2 6f7e57e2 c0203510
e8d9b1d6 ad2e2df0 ccbe03c1 49ea4107 2fd849e4 726cee31
quit
crypto ca certificate chain ASDM_TrustPoint2
certificate ca 1c8b350a4a3b6e8246d628266dec1c67
30820477 3082035f a0030201 0202101c 8b350a4a 3b6e8246 d628266d ec1c6730
0d06092a 864886f7 0d010105 05003041 31183016 060a0992 268993f2 2c640119
1608696e 7465726e 616c3117 3015060a 09922689 93f22c64 01191607 6368616e
646f6d31 0c300a06 03550403 13034c48 43301e17 0d303831 31303331 33353534
395a170d 31333131 30333134 30313433 5a304131 18301606 0a099226 8993f22c
64011916 08696e74 65726e61 6c311730 15060a09 92268993 f22c6401 19160763
68616e64 6f6d310c 300a0603 55040313 034c4843 30820122 300d0609 2a864886
f70d0101 01050003 82010f00 3082010a 02820101 00b142ab 2aae1a1b 373d3916
9ee80484 ebde6cbc 30471cf2 5cf11b32 70aa1b9d 5a3927e2 ea930fd1 204cc122
4ab7c4cd cea61bcf 155c9fea 43bafd78 9b0ef395 fa67f360 2b414dc7 2acb7eb0
9f3cc006 51043cea c75b60f7 934f015c 8a92127e e33243f3 81171e94 9e425eba
ab80fb29 f943b82b 61cf7f02 8b96aca5 9818fca6 13581ba3 db60f026 02f236fa
88d0bf26 c0250759 64d7740e 45798bfe 44097039 3cd848a5 184f516b 7b8eeb22
93ada25b b55eba7d 5a32927f 73a169e9 6f5c9bcf bc3dd52a aa3c7865 2856dabc
76cfe376 bc2fa61a 67f97264 3e9edec5 f34a3f0e 4613a98c 1ecfece6 02bb17ff
9e1744c4 ed62eab5 d1e4e01d 87245e33 1b29b416 bb020301 0001a382 01693082
01653013 06092b06 01040182 37140204 061e0400 43004130 0b060355 1d0f0404
03020186 300f0603 551d1301 01ff0405 30030101 ff301d06 03551d0e 04160414
6bb9cfd1 f5076c62 46d83fe8 7ec211df 8ed87548 3081fe06 03551d1f 0481f630
81f33081 f0a081ed a081ea86 81b16c64 61703a2f 2f2f434e 3d4c4843 2c434e3d
6c68632d 77656230 312c434e 3d434450 2c434e3d 5075626c 69632532 304b6579
25323053 65727669 6365732c 434e3d53 65727669 6365732c 434e3d43 6f6e6669
67757261 74696f6e 2c44433d 6368616e 646f6d2c 44433d69 6e746572 6e616c3f
63657274 69666963 61746552 65766f63 6174696f 6e4c6973 743f6261 73653f6f
626a6563 74436c61 73733d63 524c4469 73747269 62757469 6f6e506f 696e7486
34687474 703a2f2f 6c68632d 77656230 312e6368 616e646f 6d2e696e 7465726e
616c2f43 65727445 6e726f6c 6c2f4c48 432e6372 6c301006 092b0601 04018237
15010403 02010030 0d06092a 864886f7 0d010105 05000382 0101001d ebabcf92
751786a3 4d1a3690 525465d7 96dce61f e35ad234 07c29ad8 4bbb7be9 f2e3c3fb
779955d5 098c5c5e 13ac07d8 2218e4f7 b07ef4d8 364865bc 756f3834 4cf3250a
67f6685d 1a529f27 f6b6e57d f662c36a 1393acc6 7d976c69 ff61aa1f db2d69bd
36733255 f477e384 5d575433 80a6ae07 6c94ffec e19567f6 e6e8f14d bcc807be
a5623f06 a07e08c1 f71d69a8 8ba86db7 55b75285 0ef8a310 ec226261 412398bf
f4a11b62 ad708c77 a8028b4d 93199606 2a94d87d 65b7478b e0a2141e 3a178d7a
868430c2 c37c1f97 53d73b5c 18133fba 92e75ce0 4637d5ca f12c54de 52050879
91dadcf8 2f4d9404 668daa1d 4e4e7241 3fe643c0 e7650e88 e13f87
quit
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp enable inside
crypto isakmp enable management
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication rsa-sig
encryption 3des
hash md5
group 2
lifetime 86400
crypto isakmp nat-traversal 30
telnet 10.1.1.0 255.255.255.0 management
telnet 10.10.0.0 255.255.248.0 management
telnet management 255.255.255.0 management
telnet timeout 5
ssh 10.10.0.0 255.255.0.0 management
ssh management 255.255.255.0 management
ssh timeout 5
console timeout 0
management-access management
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 10.10.1.102 source inside prefer
tftp-server inside 10.10.3.9 XXXXX
ssl trust-point ASDM_TrustPoint1 outside
ssl trust-point ASDM_TrustPoint1 outside vpnlb-ip
webvpn
enable outside
enable inside
csd image disk0:/securedesktop-asa-3.3.0.151-k9.pkg
svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-2.1.0148-k9.pkg 2
svc enable
port-forward Citrix 2598 10.1.1.5 2598 Citrix Remote - Reliability
port-forward Citrix https 10.1.1.5 https Citrix Remote - HTTPS
port-forward Citrix citrix-ica 10.1.1.5 citrix-ica Citrix Remote - ICA
port-forward Citrix

http://www 10.1.1.5

http://www Citrix

Remote - HTTP
tunnel-group-list enable
certificate-group-map DefaultCertificateMap 10 SSLClientProfile
group-policy SSLClientPolicy internal
group-policy SSLClientPolicy attributes
wins-server value 10.1.1.60 10.1.1.128
dns-server value 10.1.1.60 10.1.1.128
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-network-list value CHANVPN09_splitTunnelAcl
default-domain value chandom.internal
address-pools value lhcchanpool
webvpn
url-list value SSLVPN
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy CHANREMOTEVPN internal
group-policy CHANREMOTEVPN attributes
wins-server value 10.10.1.1
dns-server value 10.10.1.1 10.10.1.2
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CHANREMOTEVPN_splitTunnelAcl
default-domain value chandom.internal
username testuser password H71CX14jHcYCmb5d encrypted privilege 0
username testuser attributes
vpn-group-policy CHANREMOTEVPN
username admin password 3CNayybjSxVPCxWO encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
authentication-server-group CHANDOM
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group CHANDOM
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
authentication-server-group CHANDOM
authentication-server-group (inside) CHANDOM
default-group-policy SSLClientPolicy
tunnel-group SSLClientProfile webvpn-attributes
hic-fail-group-policy SSLClientPolicy
nbns-server 10.1.1.60 timeout 2 retry 2
nbns-server 10.10.1.128 timeout 2 retry 2
group-alias SSLVPNClient enable
tunnel-group CHANREMOTEVPN type remote-access
tunnel-group CHANREMOTEVPN general-attributes
address-pool lhcchanpool
default-group-policy CHANREMOTEVPN
tunnel-group CHANREMOTEVPN ipsec-attributes
pre-shared-key *
tunnel-group CHAN-MCHC type ipsec-l2l
tunnel-group CHAN-MCHC ipsec-attributes
pre-shared-key *
!
class-map global-class
match access-list global_mpc
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect icmp error
class global-class
csc fail-open
policy-map group_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
smtp-server 10.1.1.60 10.10.1.1
prompt hostname context
Cryptochecksum:788451e5a0bbd6d90fabd13f87a78320
: end
asdm image disk0:/asdm-615.bin
asdm location 10.10.1.35 255.255.255.255 inside
asdm location X.X.X.X 255.255.255.255 inside
asdm location 10.1.1.136 255.255.255.255 inside
asdm location 10.10.1.1 255.255.255.255 inside
asdm location 10.10.1.12 255.255.255.255 inside
no asdm history enable 255.255.255.255 inside
asdm location 10.1.1.136 255.255.255.255 inside
asdm location 10.10.1.1 255.255.255.255 inside
asdm location 10.10.1.12 255.255.255.255 inside
no asdm history enable

 

[unclerico]

I understand that. I'm just saying that in your first post you stated that from the ASA you could get to all locations and from the remote locations you could ping the ASA. In a subsequent post you stated that changing the hosts default gateway to .254 does not allow them to reach the remote networks. These statements contradict each other so I was wondering which one it actually is. Have you tried changing a hosts default gateway to .254 and tried to ping to the remote locations?? Is there any way that you could move the internal routing to a L3 switch and off of that ASA??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[tdmelvin]

Unclerico,

I can change a host to .254, and it can reach the other sites. However, they will not be able to reach the Internet. That's the dilemma.

I may be able to change the Gateway to an L3 switch soon. At the moment, the current switch is only L2...

 

[tdmelvin]

Unclerico,

I think I see where the confusion is. From the ASA I can ping to all locations [i.e. if I telnet to the ASA, I can ping to all locations. However, hosts behind the ASA cannot. With all the changes made, the error I get now is the NAT translation. It's odd. I may need to open an event with Cisco...

 

[unclerico]

Can you post the new config??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[tdmelvin]

Unclerico,

Yes here it is....


****************************************
ASA Version 8.0(4)
!
hostname lhc-fw01
domain-name chandom.internal
enable password dcbvmiVNKth1v4Xn encrypted
passwd dcbvmiVNKth1v4Xn encrypted
names
name 192.168.200.0 dmz description DMZ Interface
name 192.168.10.0 management description Management Interface
dns-guard
!
interface Ethernet0/0
description Outside Interface
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.248
!
interface Ethernet0/1
description Inside Ethernet Interface
nameif inside
security-level 100
ip address 10.10.0.252 255.255.248.0 standby 10.10.0.253
!
interface Ethernet0/2
description DMZ Interface
nameif dmz
security-level 50
ip address 192.168.200.1 255.255.255.0 standby 192.168.200.2
!
interface Ethernet0/3
description LAN/STATE Failover Interface
!
interface Management0/0
description Management Interface
nameif management
security-level 100
ip address 192.168.10.1 255.255.255.0 standby 192.168.10.2
management-only
!
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 10.10.1.1
name-server 10.10.1.2
name-server 64.192.64.140
name-server 64.140.193.60
domain-name chandom.internal
same-security-traffic permit intra-interface
object-group service DM_INLINE_TCP_4 tcp
port-object eq ftp
port-object eq www
port-object eq pop3
port-object eq smtp
port-object eq https
object-group protocol DM_INLINE_PROTOCOL_2
protocol-object ip
protocol-object udp
protocol-object tcp
object-group service IMR tcp
port-object range 2440 2444
object-group service IMS tcp
port-object range 2400 2403
object-group service Millbrook tcp
port-object eq 2500
object-group service DM_INLINE_SERVICE_2
service-object icmp
service-object tcp eq www
object-group service DM_INLINE_TCP_1 tcp
group-object IMR
group-object IMS
group-object Millbrook
port-object eq https
port-object eq www
object-group service DM_INLINE_SERVICE_1
service-object tcp eq 465
service-object tcp eq 58
service-object tcp eq 995
service-object tcp eq domain
service-object tcp eq www
service-object tcp eq https
service-object tcp eq imap4
service-object tcp eq pop3
service-object tcp eq smtp
service-object udp eq 10000
service-object udp eq isakmp
service-object udp eq 4500
service-object udp eq 1000
access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list nonat extended permit ip any 192.168.100.0 255.255.255.0
access-list 100 extended permit ip any 192.168.100.0 255.255.255.0
access-list 100 extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list 100 extended permit ip management 255.255.255.0 192.168.100.0 255.255.255.0
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit tcp any host x.x.x.x eq www
access-list 100 extended permit tcp any host x.x.x.x eq smtp
access-list 100 extended permit tcp any host x.x.x.x eq smtp
access-list 100 extended permit tcp any host x.x.x.x eq https
access-list 100 extended permit tcp any host x.x.x.x eq https
access-list 100 extended permit tcp any host x.x.x.x eq https
access-list 100 extended permit tcp any host x.x.x.x object-group DM_INLINE_TCP_1
access-list management_nat0_outbound extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
access-list management_nat0_outbound extended permit ip management 255.255.255.0 192.168.100.0 255.255.255.0
access-list management_nat0_outbound extended permit object-group DM_INLINE_PROTOCOL_2 192.168.100.0 255.255.255.0 10.10.0.0 255.255.248.0
access-list management_nat0_outbound extended permit icmp 10.10.0.0 255.255.248.0 any
access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
access-list CHANREMOTEVPN_splitTunnelAcl standard permit 10.10.0.0 255.255.248.0
access-list global_mpc extended permit tcp any any object-group DM_INLINE_TCP_4
access-list outside_2_cryptomap extended permit ip 10.10.0.0 255.255.248.0 192.168.5.0 255.255.255.0
access-list CHANVPN09_splitTunnelAcl standard permit 10.10.0.0 255.255.248.0
access-list CHANVPN09_splitTunnelAcl remark Inside Corporate Network
access-list nonat-in extended permit ip 10.10.0.0 255.255.248.0 192.168.100.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging from-address fwadmin@domain.com
logging recipient-address user@domain.com level errors
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu management 1500
ip local pool lhcchanpool 192.168.100.2-192.168.100.254 mask 255.255.255.0
failover
failover lan unit primary
failover lan interface asa_primary Ethernet0/3
failover key *****
failover link asa_primary Ethernet0/3
failover interface ip asa_primary 10.1.10.2 255.255.255.248 standby 10.1.10.3
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-615.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 0 access-list nonat
nat (inside) 101 x.x.x.x 255.255.255.248
nat (inside) 101 0.0.0.0 0.0.0.0
static (dmz,outside) x.x.x.x 192.168.200.10 netmask 255.255.255.255
static (inside,outside) x.x.x.x 10.10.1.11 netmask 255.255.255.255
static (inside,dmz) 192.168.200.10 10.10.1.35 netmask 255.255.255.255
static (inside,outside) x.x.x.x 10.10.1.36 netmask 255.255.255.255
static (inside,outside) x.x.x.x 10.10.1.12 netmask 255.255.255.255
access-group 100 in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 64.140.217.41 1
route inside 10.1.1.0 255.255.255.0 10.10.0.252 10
route inside 10.10.0.0 255.255.248.0 10.10.0.254 1
route inside 10.11.0.0 255.255.248.0 10.10.0.254 10
route inside 10.12.0.0 255.255.248.0 10.10.0.254 10
route inside 10.13.0.0 255.255.248.0 10.10.0.254 10
route inside 172.20.20.0 255.255.255.0 10.10.0.254 10
route inside 192.168.1.0 255.255.255.0 10.10.0.254 10
route inside 192.168.2.0 255.255.255.0 10.10.0.254 10
route inside 192.168.5.0 255.255.255.0 10.10.0.252 10
route inside 192.168.7.0 255.255.255.0 10.10.0.254 10
route inside 192.168.9.0 255.255.255.0 10.10.0.254 10
route inside 192.168.100.0 255.255.255.0 192.168.100.1 10
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server CHANDOM protocol nt
aaa-server CHANDOM (inside) host 10.10.1.1
timeout 5
nt-auth-domain-controller 10.10.1.1
aaa-server CHANDOM (inside) host 10.10.1.2
timeout 5
nt-auth-domain-controller 10.10.1.1
aaa-server CHANDOM (inside) host 10.1.1.60
nt-auth-domain-controller mother
aaa-server CHANDOM (inside) host 10.1.1.128
nt-auth-domain-controller 10.1.1.60
http server enable
http management 255.255.255.0 management
http 10.10.0.0 255.255.248.0 management
http 10.1.1.0 255.255.255.0 inside
http 10.10.0.0 255.255.248.0 inside
http 192.168.100.0 255.255.255.0 management
http redirect outside 80
snmp-server host inside 10.10.1.11 community private version 2c udp-port 161
no snmp-server location
no snmp-server contact
snmp-server community private
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set FirsSet esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set pfs group1
crypto dynamic-map dyn1 1 set transform-set FirsSet
crypto dynamic-map dyn1 1 set security-association lifetime seconds 28800
crypto dynamic-map dyn1 1 set security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto map management_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map management_map interface management
crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap 2 match address outside_2_cryptomap
crypto map mymap 2 set pfs group1
crypto map mymap 2 set peer x.x.x.x
crypto map mymap 2 set transform-set ESP-3DES-SHA
crypto map mymap 2 set security-association lifetime seconds 28800
crypto map mymap 2 set security-association lifetime kilobytes 4608000
crypto map mymap interface outside
crypto ca trustpoint ASDM_TrustPoint0
revocation-check ocsp crl none
enrollment terminal
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment self
fqdn vpn.chan-nh.org
subject-name CN=vpn.chan-nh.org
no client-types
crl configure
crypto ca trustpoint ASDM_TrustPoint2
enrollment terminal
no client-types
crl configure
crypto ca trustpoint ASDM_TrustPoint4
crl configure
crypto ca trustpoint ASDM_TrustPoint5
crl configure
crypto ca certificate map DefaultCertificateMap 10
crypto ca certificate chain ASDM_TrustPoint0
certificate ca 1c8b350a4a3b6e8246d628266dec1c67
30820477 3082035f a0030201 0202101c 8b350a4a 3b6e8246 d628266d ec1c6730
0d06092a 864886f7 0d010105 05003041 31183016 060a0992 268993f2 2c640119
1608696e 7465726e 616c3117 3015060a 09922689 93f22c64 01191607 6368616e
646f6d31 0c300a06 03550403 13034c48 43301e17 0d303831 31303331 33353534
395a170d 31333131 30333134 30313433 5a304131 18301606 0a099226 8993f22c
64011916 08696e74 65726e61 6c311730 15060a09 92268993 f22c6401 19160763
68616e64 6f6d310c 300a0603 55040313 034c4843 30820122 300d0609 2a864886
f70d0101 01050003 82010f00 3082010a 02820101 00b142ab 2aae1a1b 373d3916
9ee80484 ebde6cbc 30471cf2 5cf11b32 70aa1b9d 5a3927e2 ea930fd1 204cc122
4ab7c4cd cea61bcf 155c9fea 43bafd78 9b0ef395 fa67f360 2b414dc7 2acb7eb0
9f3cc006 51043cea c75b60f7 934f015c 8a92127e e33243f3 81171e94 9e425eba
ab80fb29 f943b82b 61cf7f02 8b96aca5 9818fca6 13581ba3 db60f026 02f236fa
88d0bf26 c0250759 64d7740e 45798bfe 44097039 3cd848a5 184f516b 7b8eeb22
93ada25b b55eba7d 5a32927f 73a169e9 6f5c9bcf bc3dd52a aa3c7865 2856dabc
76cfe376 bc2fa61a 67f97264 3e9edec5 f34a3f0e 4613a98c 1ecfece6 02bb17ff
9e1744c4 ed62eab5 d1e4e01d 87245e33 1b29b416 bb020301 0001a382 01693082
01653013 06092b06 01040182 37140204 061e0400 43004130 0b060355 1d0f0404
03020186 300f0603 551d1301 01ff0405 30030101 ff301d06 03551d0e 04160414
6bb9cfd1 f5076c62 46d83fe8 7ec211df 8ed87548 3081fe06 03551d1f 0481f630
81f33081 f0a081ed a081ea86 81b16c64 61703a2f 2f2f434e 3d4c4843 2c434e3d
6c68632d 77656230 312c434e 3d434450 2c434e3d 5075626c 69632532 304b6579
25323053 65727669 6365732c 434e3d53 65727669 6365732c 434e3d43 6f6e6669
67757261 74696f6e 2c44433d 6368616e 646f6d2c 44433d69 6e746572 6e616c3f
63657274 69666963 61746552 65766f63 6174696f 6e4c6973 743f6261 73653f6f
626a6563 74436c61 73733d63 524c4469 73747269 62757469 6f6e506f 696e7486
34687474 703a2f2f 6c68632d 77656230 312e6368 616e646f 6d2e696e 7465726e
616c2f43 65727445 6e726f6c 6c2f4c48 432e6372 6c301006 092b0601 04018237
15010403 02010030 0d06092a 864886f7 0d010105 05000382 0101001d ebabcf92
751786a3 4d1a3690 525465d7 96dce61f e35ad234 07c29ad8 4bbb7be9 f2e3c3fb
779955d5 098c5c5e 13ac07d8 2218e4f7 b07ef4d8 364865bc 756f3834 4cf3250a
67f6685d 1a529f27 f6b6e57d f662c36a 1393acc6 7d976c69 ff61aa1f db2d69bd
36733255 f477e384 5d575433 80a6ae07 6c94ffec e19567f6 e6e8f14d bcc807be
a5623f06 a07e08c1 f71d69a8 8ba86db7 55b75285 0ef8a310 ec226261 412398bf
f4a11b62 ad708c77 a8028b4d 93199606 2a94d87d 65b7478b e0a2141e 3a178d7a
868430c2 c37c1f97 53d73b5c 18133fba 92e75ce0 4637d5ca f12c54de 52050879
91dadcf8 2f4d9404 668daa1d 4e4e7241 3fe643c0 e7650e88 e13f87
quit
crypto ca certificate chain ASDM_TrustPoint1
certificate 31
30820214 3082017d a0030201 02020131 300d0609 2a864886 f70d0101 04050030
50312330 21060355 0403131a 6c68632d 66773031 2e6c616d 70726579 6865616c
74682e6f 72673129 30270609 2a864886 f70d0109 02161a6c 68632d66 7730312e
6c616d70 72657968 65616c74 682e6f72 67301e17 0d303831 31313031 37313431
355a170d 31383131 30383137 31343135 5a305031 23302106 03550403 131a6c68
632d6677 30312e6c 616d7072 65796865 616c7468 2e6f7267 31293027 06092a86
4886f70d 01090216 1a6c6863 2d667730 312e6c61 6d707265 79686561 6c74682e
6f726730 819f300d 06092a86 4886f70d 01010105 0003818d 00308189 02818100
a8b247cd 0df19ea3 c06ed85b b1c1f852 688987e5 9d3ecdcb 8caca861 143864e9
8342745e b24b9410 1ef64130 8303069f 87df0ab0 3e3e3091 e2e0162e d7966acc
bbd30c9f 8ea7254a 5d974faf 8ab0b30a c2640500 3b6ec4aa c66f6ec3 83b4ecd8
ae6e6944 f3acbc77 861ce178 47b021eb 1c4a094a c6c2ee30 347b7faa 344f8df5
02030100 01300d06 092a8648 86f70d01 01040500 03818100 6776b80e e843d977
eb36b874 37d9e177 e3bdd6f0 ab46effb cee095bf 642cabc3 9252ab78 141eccfe
6533ed8a 149d551c 1d2c7fd8 a98fd7cb 7b90f444 80d49a66 584dc49d b4c05b7d
ad1952c6 d9cae72c 6849cbb7 97deb3e0 af6e09f7 2f34e8f2 6f7e57e2 c0203510
e8d9b1d6 ad2e2df0 ccbe03c1 49ea4107 2fd849e4 726cee31
quit
crypto ca certificate chain ASDM_TrustPoint2
certificate ca 1c8b350a4a3b6e8246d628266dec1c67
30820477 3082035f a0030201 0202101c 8b350a4a 3b6e8246 d628266d ec1c6730
0d06092a 864886f7 0d010105 05003041 31183016 060a0992 268993f2 2c640119
1608696e 7465726e 616c3117 3015060a 09922689 93f22c64 01191607 6368616e
646f6d31 0c300a06 03550403 13034c48 43301e17 0d303831 31303331 33353534
395a170d 31333131 30333134 30313433 5a304131 18301606 0a099226 8993f22c
64011916 08696e74 65726e61 6c311730 15060a09 92268993 f22c6401 19160763
68616e64 6f6d310c 300a0603 55040313 034c4843 30820122 300d0609 2a864886
f70d0101 01050003 82010f00 3082010a 02820101 00b142ab 2aae1a1b 373d3916
9ee80484 ebde6cbc 30471cf2 5cf11b32 70aa1b9d 5a3927e2 ea930fd1 204cc122
4ab7c4cd cea61bcf 155c9fea 43bafd78 9b0ef395 fa67f360 2b414dc7 2acb7eb0
9f3cc006 51043cea c75b60f7 934f015c 8a92127e e33243f3 81171e94 9e425eba
ab80fb29 f943b82b 61cf7f02 8b96aca5 9818fca6 13581ba3 db60f026 02f236fa
88d0bf26 c0250759 64d7740e 45798bfe 44097039 3cd848a5 184f516b 7b8eeb22
93ada25b b55eba7d 5a32927f 73a169e9 6f5c9bcf bc3dd52a aa3c7865 2856dabc
76cfe376 bc2fa61a 67f97264 3e9edec5 f34a3f0e 4613a98c 1ecfece6 02bb17ff
9e1744c4 ed62eab5 d1e4e01d 87245e33 1b29b416 bb020301 0001a382 01693082
01653013 06092b06 01040182 37140204 061e0400 43004130 0b060355 1d0f0404
03020186 300f0603 551d1301 01ff0405 30030101 ff301d06 03551d0e 04160414
6bb9cfd1 f5076c62 46d83fe8 7ec211df 8ed87548 3081fe06 03551d1f 0481f630
81f33081 f0a081ed a081ea86 81b16c64 61703a2f 2f2f434e 3d4c4843 2c434e3d
6c68632d 77656230 312c434e 3d434450 2c434e3d 5075626c 69632532 304b6579
25323053 65727669 6365732c 434e3d53 65727669 6365732c 434e3d43 6f6e6669
67757261 74696f6e 2c44433d 6368616e 646f6d2c 44433d69 6e746572 6e616c3f
63657274 69666963 61746552 65766f63 6174696f 6e4c6973 743f6261 73653f6f
626a6563 74436c61 73733d63 524c4469 73747269 62757469 6f6e506f 696e7486
34687474 703a2f2f 6c68632d 77656230 312e6368 616e646f 6d2e696e 7465726e
616c2f43 65727445 6e726f6c 6c2f4c48 432e6372 6c301006 092b0601 04018237
15010403 02010030 0d06092a 864886f7 0d010105 05000382 0101001d ebabcf92
751786a3 4d1a3690 525465d7 96dce61f e35ad234 07c29ad8 4bbb7be9 f2e3c3fb
779955d5 098c5c5e 13ac07d8 2218e4f7 b07ef4d8 364865bc 756f3834 4cf3250a
67f6685d 1a529f27 f6b6e57d f662c36a 1393acc6 7d976c69 ff61aa1f db2d69bd
36733255 f477e384 5d575433 80a6ae07 6c94ffec e19567f6 e6e8f14d bcc807be
a5623f06 a07e08c1 f71d69a8 8ba86db7 55b75285 0ef8a310 ec226261 412398bf
f4a11b62 ad708c77 a8028b4d 93199606 2a94d87d 65b7478b e0a2141e 3a178d7a
868430c2 c37c1f97 53d73b5c 18133fba 92e75ce0 4637d5ca f12c54de 52050879
91dadcf8 2f4d9404 668daa1d 4e4e7241 3fe643c0 e7650e88 e13f87
quit
crypto isakmp identity hostname
crypto isakmp enable outside
crypto isakmp enable inside
crypto isakmp enable management
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication rsa-sig
encryption 3des
hash md5
group 2
lifetime 86400
telnet 10.1.1.0 255.255.255.0 management
telnet 10.10.0.0 255.255.248.0 management
telnet management 255.255.255.0 management
telnet timeout 5
ssh 10.10.0.0 255.255.0.0 management
ssh management 255.255.255.0 management
ssh timeout 5
console timeout 0
management-access management
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 10.10.1.102 source inside prefer
tftp-server inside 10.10.3.9 /usr/Downloads
ssl trust-point ASDM_TrustPoint1 outside
ssl trust-point ASDM_TrustPoint1 outside vpnlb-ip
webvpn
enable outside
enable inside
csd image disk0:/securedesktop-asa-3.3.0.151-k9.pkg
svc image disk0:/anyconnect-win-2.1.0148-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-2.1.0148-k9.pkg 2
svc enable
port-forward Citrix 2598 10.1.1.5 2598 Citrix Remote - Reliability
port-forward Citrix https 10.1.1.5 https Citrix Remote - HTTPS
port-forward Citrix citrix-ica 10.1.1.5 citrix-ica Citrix Remote - ICA
port-forward Citrix

http://www 10.1.1.5

http://www Citrix

Remote - HTTP
tunnel-group-list enable
certificate-group-map DefaultCertificateMap 10 SSLClientProfile
group-policy SSLClientPolicy internal
group-policy SSLClientPolicy attributes
wins-server value 10.1.1.60 10.1.1.128
dns-server value 10.1.1.60 10.1.1.128
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
split-tunnel-network-list value CHANVPN09_splitTunnelAcl
default-domain value chandom.internal
address-pools value lhcchanpool
webvpn
url-list value SSLVPN
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy CHANREMOTEVPN internal
group-policy CHANREMOTEVPN attributes
wins-server value 10.10.1.1
dns-server value 10.10.1.1 10.10.1.2
vpn-tunnel-protocol IPSec svc
split-tunnel-policy tunnelspecified
split-tunnel-network-list value CHANREMOTEVPN_splitTunnelAcl
default-domain value chandom.internal
username testuser password H71CX14jHcYCmb5d encrypted privilege 0
username testuser attributes
vpn-group-policy CHANREMOTEVPN
username admin password 3CNayybjSxVPCxWO encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
authentication-server-group CHANDOM
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group CHANDOM
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
authentication-server-group CHANDOM
authentication-server-group (inside) CHANDOM
default-group-policy SSLClientPolicy
tunnel-group SSLClientProfile webvpn-attributes
hic-fail-group-policy SSLClientPolicy
nbns-server 10.1.1.60 timeout 2 retry 2
nbns-server 10.10.1.128 timeout 2 retry 2
group-alias SSLVPNClient enable
tunnel-group CHANREMOTEVPN type remote-access
tunnel-group CHANREMOTEVPN general-attributes
address-pool lhcchanpool
authentication-server-group CHANDOM
authentication-server-group (inside) CHANDOM
default-group-policy CHANREMOTEVPN
tunnel-group CHANREMOTEVPN ipsec-attributes
pre-shared-key *
tunnel-group CHAN-MCHC type ipsec-l2l
tunnel-group CHAN-MCHC ipsec-attributes
pre-shared-key *
!
class-map global-class
match access-list global_mpc
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect icmp error
class global-class
csc fail-open
policy-map group_policy
class inspection_default
inspect icmp
!
service-policy global_policy global
smtp-server 10.10.1.36 10.10.1.1
prompt hostname context
Cryptochecksum:453c10dcf594b10288e34b7c2d451bfd
: end
asdm image disk0:/asdm-615.bin
asdm location 10.10.1.35 255.255.255.255 inside
asdm location x.x.x.x 255.255.255.255 inside
asdm location 10.1.1.136 255.255.255.255 inside
asdm location 10.10.1.1 255.255.255.255 inside
asdm location 10.10.1.12 255.255.255.255 inside
asdm location 10.11.0.0 255.255.248.0 inside
no asdm history enable

 

[baddos]

ICMP is not permitted via your access list for the inside interface. Either add it to the "inside_access_in" list or to the "object-group service DM_INLINE_SERVICE_1".

 

[tdmelvin]

Thanks baddos. I added that, and still no luck. When that's in, I get the following error:

portmap translation creation failed for icmp src inside: 10.10.3.9 dst inside: 10.12.0.254 (type 8, code 0)

 

[tdmelvin]

I tried adding a static map "static (inside,outside) 10.10.x.x 10.10.x.x netmask 255.255.248.0" and then an ACL that says access-list 101 permit ip 10.12.0.0 255.255.248.0 10.10.0.0 255.255.248.0. But when I do that, it kills access to the Internet, etc...

 

[tdmelvin]

Hey, sorry for the replies...I did some googling, and found some things on this site as well. Would I need to add sub-interfaces [VLANS] to the existing Inside interface that includes all of the attached networks? Like VLAN 100 - 10.11.0.0/21, VLAN200 - 10.12.0.0/21, etc.?

 

[brianinms]

To me it sounds like the router that is .254 isn't properly configured. Traffic that enters an ASA interface can't exit back out of the same interface. Thus you cant set your PC to use the ASA as the Default gateway and expect to get out.

 

[tdmelvin]

brianinms,

Thanks for taking the time to reply. I asked that of the engineer who set it up, but it looks okay. I did some digging around, and it almost looks like I'll need to reconfigure the ASA to use VLAN'/Secondary Interfaces, and add the other subnets as VLAN's, then enable ACL's to allow traffic between those subnets. Seems extreme, but I may begin to explore that...

 

[brianinms]

Post the config from the router with the .254 address.