Advertisement

08.19.2008 at 08:27AM PDT, ID: 23659950
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!
8.8

Site to Site VPN (2 ASA 5505's) Config/Verification

Asked by bkana in Cisco PIX Firewall, Network Software Firewalls, Networking Hardware Firewalls

Tags: , , , ,

Hello experts,

Need to setup a site-to-site VPN with my hosting provider to join our current web server, as well as an SQL server to my domain, so that we may install Share Point on them and have AD authentication back to my domain here. Below is both running configs of the ASA's. Mine is first and I belive mine is the one that needs adjusting or just re-doing. Can someone provide some guidance please. I am unable to ping the internal IP's of the host and don't know if the tunel is actuall working.

MY running config:

ASA Version 7.2(2)
!
hostname ciscoasa
domain-name audiology.org
enable password encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
 ospf cost 10
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 216.64.x.x 255.255.255.240
 ospf cost 10
!
interface Vlan12
 no nameif
 no security-level
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
 domain-name audiology.org
same-security-traffic permit inter-interface
access-list outside_in extended permit tcp any host 216.64.x.x eq https
access-list outside_in extended permit tcp any host 216.64.x.x  eq www
access-list outside_access_in remark RDP for Bkana
access-list outside_access_in extended permit tcp any host 216.64.x.x eq 3389
access-list outside_access_in remark AAADC2
access-list outside_access_in extended permit tcp any host 216.64.x.x eq smtp
access-list outside_access_in extended permit tcp any host 216.64.x.x eq ftp
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.64.x.x eq www
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.64.x.x eq https
access-list outside_access_in extended permit tcp any host 216.64.x.x eq https
access-list outside_access_in remark RDP for CRM
access-list outside_access_in extended permit tcp any host 216.64.x.x eq 3389
access-list outside_access_in extended permit tcp any host 216.64.x.x eq www
access-list outside_access_in remark HTTP access for CRM
access-list outside_access_in extended permit tcp any host 216.64.x.x eq www
access-list outside_access_in extended permit tcp any host 216.64.x.x eq https
access-list outside_access_in extended permit tcp any host 216.64.x,x eq www
access-list outside_access_in extended permit tcp any host 216.64.x.x eq www
access-list outside_access_in extended permit tcp any host 216.64.x.x eq https
access-list outside_access_in extended permit tcp any host 216.64.x.x eq 46168
access-list outside_access_in remark RDP for WebPortal Svr
access-list outside_access_in extended permit tcp any host 216.64.x.x eq 3389
access-list inside_nat0_outbound extended permit ip any 192.168.0.160 255.255.255.240
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list outside_access extended permit tcp any host 216.64.x.x eq 3389
access-list AAA_split_tunnel_ACL extended permit ip 192.168.0.0 255.255.255.0 any
access-list outside_20_cryptomap extended permit ip 192.168.0.0 255.255.255.0 host 192.168.100.0
pager lines 24
logging enable
logging trap debugging
logging asdm informational
logging queue 150
mtu inside 1500
mtu outside 1500
ip local pool AAAIPPOOL 192.168.0.161-192.168.0.180 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 216.64.x.x-216.64.x.x netmask 255.255.255.240
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 216.64.x.x 192.168.0.4 netmask 255.255.255.255
static (inside,outside) 216.64.x.x 192.168.0.212 netmask 255.255.255.255
static (inside,outside) 216.64.x.x 192.168.0.12 netmask 255.255.255.255
static (inside,outside) 216.64.x.x 192.168.0.62 netmask 255.255.255.255
static (inside,outside) 216.64.x.x 192.168.0.66 netmask 255.255.255.255
static (inside,outside) 216.64.x.x 192.168.0.8 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 216.64.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server NTWRKSVRS protocol ldap
aaa-server NTWRKSVRS host 192.168.0.62
 timeout 5
 ldap-scope onelevel
group-policy Audiology_VPN internal
group-policy Audiology_VPN attributes
 banner value Welcome to the Audiology Network.
 dns-server value 192.168.0.8 192.168.0.62
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value AAA_split_tunnel_ACL
 default-domain value audiology
username sbishop password Eeg.fmr26DELXEKw encrypted privilege 5
username sbishop attributes
 vpn-group-policy Audiology_VPN
username lowens password ZikxJcEBZ0YqVONZ encrypted privilege 5
username lowens attributes
 vpn-group-policy Audiology_VPN
username cgallow password cxuXh2CnVa2e5tEm encrypted privilege 5
username cgallow attributes
 vpn-group-policy Audiology_VPN
username equinn password Lctoi4gVDnZoklWY encrypted privilege 5
username equinn attributes
 vpn-group-policy Audiology_VPN
username bwertheim password v/.qI7/EEH1aAXjD encrypted privilege 5
username bwertheim attributes
 vpn-group-policy Audiology_VPN
username lyonkers password 0GBHQTdxHCMx3HFC encrypted privilege 5
username lyonkers attributes
 vpn-group-policy Audiology_VPN
username vanessas password 7IE6D1eIfx0KcZHE encrypted privilege 5
username vanessas attributes
 vpn-group-policy Audiology_VPN
username kculver password L2v7uYSr3CyfUsWt encrypted privilege 5
username kculver attributes
 vpn-group-policy Audiology_VPN
username meggano password TB2g6ELNob5JQpTe encrypted privilege 5
username meggano attributes
 vpn-group-policy Audiology_VPN
username skelley password fLQvCBmxMLbGw02J encrypted privilege 5
username skelley attributes
 vpn-group-policy Audiology_VPN
username bkana password 7nGPp4eh4G.KZH7p encrypted privilege 15
username bkana attributes
 vpn-group-policy Audiology_VPN
username jwilson password yhQDuki0An31.NuN encrypted privilege 5
username jwilson attributes
 vpn-group-policy Audiology_VPN
username jdopsovic password 4emxlYAqLQHnecty encrypted privilege 5
username jdopsovic attributes
 vpn-group-policy Audiology_VPN
aaa authorization command LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 20 match address outside_20_cryptomap
crypto map outside_map 20 set pfs
crypto map outside_map 20 set peer 67.192.x.x
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
tunnel-group Audiology_VPN type ipsec-ra
tunnel-group Audiology_VPN general-attributes
 address-pool AAAIPPOOL
 default-group-policy Audiology_VPN
tunnel-group Audiology_VPN ipsec-attributes
 pre-shared-key *
tunnel-group 67.192.x.x type ipsec-l2l
tunnel-group 67.192.x.x ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.0.2-192.168.0.129 inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
client-update enable
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
Cryptochecksum:25ec900b5e48e4c9a18ed75e02003b30
: end


HOST Config:

ASA Version 7.2(3)
!
hostname fw-567123-180591
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.100.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 67.192.x.x 255.255.255.128
!
interface Ethernet0/0
switchport access vlan 2
speed 100
duplex full
!
interface Ethernet0/1
speed 100
duplex full
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
ftp mode passive
clock timezone cst -6
clock summer-time cdt recurring
dns server-group DefaultDNS
domain-name dfw1.rackspace.com
object-group network rackspace-ips

access-list 101 extended permit ip object-group rackspace-ips any
access-list 101 extended permit icmp any any
access-list 101 extended permit ip object-group rackspace-rba any
access-list 101 extended permit ip object-group rackspace-monitoring any
access-list 101 extended permit tcp any any eq 3389
access-list 100 extended permit ip any any
access-list nonat extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.255.0
access-list 200 extended permit ip 192.168.100.0 255.255.255.0 192.168.0.0 255.255.255.0
pager lines 24
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
nat-control
nat (inside) 0 access-list nonat
static (inside,outside) 98.129.x.x 192.168.100.98 netmask 255.255.255.255
static (inside,outside) 98.129.x.x 192.168.100.210 netmask 255.255.255.255
access-group 100 in interface inside
access-group 101 in interface outside
route outside 0.0.0.0 0.0.0.0 67.192.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 64.39.x.x 255.255.254.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set rackset esp-3des esp-sha-hmac
crypto map rackmap 200 match address 200
crypto map rackmap 200 set peer 216.64.x.x
crypto map rackmap 200 set transform-set rackset
crypto map rackmap interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 10.0.0.0 255.240.0.0 outside
ssh 64.39.x.x 255.255.254.0 outside
ssh 69.20.x.x 255.255.254.0 outside
ssh 72.3.x.x  255.255.254.0 outside
ssh 212.100.x.x 255.255.255.224 outside
ssh 83.138.x.x 255.255.255.255 outside
ssh 92.52.x.x 255.255.255.255 outside
ssh 72.3.x.x 255.255.255.248 outside
ssh timeout 15
ssh version 2
console timeout 0

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
ntp server 72.3.x.x source outside
tunnel-group 216.64.x.x type ipsec-l2l
tunnel-group 216.64.x.x ipsec-attributes
pre-shared-key *
prompt hostname context
: end

Start Free Trial
[+][-]08.19.2008 at 08:38AM PDT, ID: 22260802

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]08.19.2008 at 08:53AM PDT, ID: 22260975

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]08.19.2008 at 09:11AM PDT, ID: 22261189

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]08.19.2008 at 10:40AM PDT, ID: 22262002

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]08.19.2008 at 10:56AM PDT, ID: 22262159

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]08.19.2008 at 11:26AM PDT, ID: 22262425

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]08.19.2008 at 11:51AM PDT, ID: 22262629

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]08.22.2008 at 07:00AM PDT, ID: 22290021

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Cisco PIX Firewall, Network Software Firewalls, Networking Hardware Firewalls
Tags: cisco/, ASDM/pix, cisco, ASA 5505, site-to-site vpn
Sign Up Now!
Solution Provided By: mabutterfield
Participating Experts: 1
Solution Grade: A
 
 
[+][-]08.22.2008 at 07:10AM PDT, ID: 22290143

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628