Advertisement

10.06.2007 at 09:25AM PDT, ID: 22876659
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

Cisco ASA 5505 VPN setup
Tags: asa, cisco, vpn, 5505
I have a Cisco ASA 5505. I have the initial setup working fine. I have not setup a VPN before and, using the ASDM VPN Wizard configured it the way that seemed correct to me. I am using the Cisco VPN Client version 5. I have obviously not configured the 5505 correctly because I can't get in. Can one of you geniuses please help?

My current config:

  Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name sbcglobal.net
enable password 0duV6wY858Xg13N4 encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 76.247.252.133 255.255.255.248
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system disk0:/asa722-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 68.94.156.1
 name-server 68.94.157.1
 domain-name sbcglobal.net
same-security-traffic permit intra-interface
access-list K2CONTROLS_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any 192.168.1.32 255.255.255.240
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNpool 192.168.1.34-192.168.1.40 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 76.247.252.134 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy K2CONTROLS internal
group-policy K2CONTROLS attributes
 dns-server value 68.94.156.1 68.94.157.1
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value K2CONTROLS_splitTunnelAcl
 default-domain value k2controls.com
username dwilson password T6U.2SHm.gQGq0.E encrypted privilege 0
username dwilson attributes
 vpn-group-policy K2CONTROLS
username kparrott password ECDkMSryjP4tnERe encrypted privilege 0
username kparrott attributes
 vpn-group-policy K2CONTROLS
http server enable
http 74.193.6.0 255.255.255.0 outside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
tunnel-group K2CONTROLS type ipsec-ra
tunnel-group K2CONTROLS general-attributes
 address-pool VPNpool
 default-group-policy K2CONTROLS
tunnel-group K2CONTROLS ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
client-update enable
prompt hostname context
Cryptochecksum:5fa878773be37fd96c8ee2460d74a06d
: end
Start your free trial to view this solution
Question Stats
Zone: Networking
Question Asked By: dw1958
Solution Provided By: lrmoore
Participating Experts: 2
Solution Grade: A
Views: 244
Translate:
Loading Advertisement...
10.06.2007 at 10:18AM PDT, ID: 20028010

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 02:15PM PDT, ID: 20028479

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 03:22PM PDT, ID: 20028629

Rank: Guru

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 03:24PM PDT, ID: 20028634

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 03:39PM PDT, ID: 20028659

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 03:45PM PDT, ID: 20028671

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:19PM PDT, ID: 20028720

Rank: Guru

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:21PM PDT, ID: 20028727

Rank: Guru

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:23PM PDT, ID: 20028732

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:25PM PDT, ID: 20028739

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:27PM PDT, ID: 20028741

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:28PM PDT, ID: 20028744

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:33PM PDT, ID: 20028753

Rank: Guru

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:49PM PDT, ID: 20028775

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 04:56PM PDT, ID: 20028784

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.06.2007 at 05:13PM PDT, ID: 20028809

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 04:48AM PDT, ID: 20029756

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 05:58AM PDT, ID: 20029883

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 07:46AM PDT, ID: 20030119

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 04:47PM PDT, ID: 20031376

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 04:53PM PDT, ID: 20031386

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 05:21PM PDT, ID: 20031431

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.07.2007 at 05:42PM PDT, ID: 20031505

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.08.2007 at 04:27AM PDT, ID: 20033199

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.08.2007 at 06:02AM PDT, ID: 20033693

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.08.2007 at 04:07PM PDT, ID: 20037587

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.09.2007 at 05:06AM PDT, ID: 20040083

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.09.2007 at 05:54AM PDT, ID: 20040430

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.09.2007 at 05:26PM PDT, ID: 20045590

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
10.09.2007 at 05:42PM PDT, ID: 20045646

Rank: Genius

All comments and solutions are available to Premium Service Members only.

Start your 7 day free trial and see for yourself why Experts Exchange is the easiest and most proven technology resource in the world. Get Started

Already a member? Login to view this solution.

 
 
Loading Advertisement...
Microsoft
  • Internet Protocols
  • Applications
  • Development
  • OS
  • Hardware
  • Windows Security
Apple
  • Operating Systems
  • Hardware
  • Programming
  • Networking
  • Software
Internet
  • Search Engines
  • File Sharing
  • WebTrends / Stats
  • Spy / Ad Blockers
  • Web Browsers
  • New Net Users
  • Web Development
  • Chat / IM
  • Anti Spam
  • Web Servers
  • Anti-Virus
  • Email Clients
Gamers
  • Tips
  • Online / MMORPG
  • Puzzle
  • Emulators
  • Action / Adventure
  • Role Playing
  • Consoles
  • Game Programming
  • Strategy
  • Sports
  • Misc
  • Computer Games
Digital Living
  • Hardware
  • New Net Users
  • New Users
  • Software
  • Digital Music
  • Gaming World
  • Home Security
  • Apple
  • Networking Hardware
Virus & Spyware
  • Vulnerabilities
  • IDS
  • Encryption
  • Anti-Virus
  • Operating Systems Security
  • Software Firewalls
  • WebApplications
  • Cell Phones
  • Operating Systems
  • Internet
  • Hardware Firewalls
Hardware
  • Handhelds / PDAs
  • Displays / Monitors
  • Components
  • Networking Hardware
  • Peripherals
  • Laptops/Notebooks
  • Storage
  • Servers
  • Desktops
  • New Users
  • Misc
  • Apple
Software
  • System Utilities
  • Industry Specific
  • Network Management
  • Photos / Graphics
  • Page Layout
  • VMWare
  • Misc
  • Web Development
  • OS
  • CYGWIN
  • Voice Recognition
  • Message Queue
  • Quality Assurance
  • Security
  • Firewalls
  • MultiMedia Applications
  • Development
  • Database
  • Office / Productivity
  • Business Management
  • OS/2 Apps
  • Server Software
  • Internet / Email
ITPro
  • OS
  • Storage
  • Encryption
  • Operating Systems Security
  • Apple Hardware
  • Laptops & Notebooks
  • Servers
  • Networking Hardware
  • Peripherals
  • Devices
  • Displays / Monitors
  • WebTrends / Stats
  • Search Engines
  • Firewalls
  • WebApplications
  • IDS
  • Vulnerabilities
  • Email Clients
  • File Sharing
  • Spy / Ad Blockers
  • Web Browsers
  • Web Servers
  • Networking
  • Anti-Virus
  • Chat / IM
  • Anti Spam
Developer
  • Web Servers
  • Web Browsers
  • Game Programming
  • Dev Tools
  • Industry Specific
  • Office / Productivity
  • Database
  • CYGWIN
  • Web Development
  • Search Engines
  • File Sharing
  • WebTrends / Stats
  • Programming
  • Content Management
  • Application Servers
  • Protocols
Storage
  • Removable Backup Media
  • Storage Technology
  • Servers
  • Grid
  • Remote Access
  • Backup / Restore
  • Misc
  • Hard Drives
OS
  • Miscellaneous
  • Security
  • Development
  • Linux
  • VMWare
  • MainFrame OS
  • Unix
  • Apple
  • OS / 2
  • AS / 400
  • BeOS
  • Microsoft
  • VMS / OpenVMS
Database
  • Oracle
  • Miscellaneous
  • MySQL
  • Software
  • Sybase
  • Contact Management
  • PostgreSQL
  • Data Manipulation
  • Clarion
  • InterSystems Cache
  • Siebel
  • MUMPS
  • OLAP
  • SQLBase
  • SAS
  • GIS & GPS
  • 4GL
  • Berkeley DB
  • DB2
  • Informix
  • Interbase / Firebird
  • FoxPro
  • Reporting
  • LDAP
  • Filemaker Pro
  • MS SQL Server
  • dBase
  • MS Access
Security
  • Misc
  • Web Browsers
  • Software Firewalls
  • Operating Systems Security
  • File Sharing
  • Spy / Ad Blockers
  • Vulnerabilities
  • WebApplications
  • IDS
  • Anti-Virus
  • Encryption
  • Anti Spam
  • Email Clients
  • VPN
  • Chat / IM
Programming
  • Editors IDEs
  • Installation
  • Handhelds / PDAs
  • Multimedia Programming
  • System / Kernel
  • Algorithms
  • Game
  • Signal Processing
  • Project Management
  • Open Source
  • Database
  • Misc
  • Languages
  • Processor Platforms
  • Theory
Web Development
  • Scripting
  • Blogs
  • Web Servers
  • Software
  • Search Engines
  • Web Graphics
  • Images
  • Internet Marketing
  • Images and Photos
  • Components
  • Document Imaging
  • Web Languages/Standards
  • Illustration
  • WebApplications
  • Fonts
  • WebTrends / Stats
  • Authoring
  • Digital Camera Software
  • Miscellaneous
Networking
  • Protocols
  • Apple Networking
  • Network Management
  • Message Queue
  • Application Servers
  • Content Management
  • File Servers
  • Email Servers
  • Misc
  • Java Editors & IDEs
  • Wireless
  • Networking Hardware
  • Backup / Restore
  • System Utilities
  • ISPs & Hosting
  • Web Servers
  • Storage Technology
  • Removable Backup Media
  • Servers
  • Broadband
  • Grid
  • OS / 2
  • Novell Netware
  • Unix Networking
  • Windows Networking
  • Security
  • Telecommunications
  • Operating Systems
  • Linux Networking
Other
  • Community Advisor
  • Lounge
  • Community Support
  • New Net Users
  • Philosophy / Religion
  • Math / Science
  • Miscellaneous
  • URLs
  • Expert Lounge
  • Politics
  • Puzzles / Riddles
Community Support
  • Suggestions
  • New to EE
  • New Topics
  • Community Advisor
  • CleanUp
  • Announcements
  • General
  • Feedback
  • Input
  • EE Bugs
 
10.06.2007 at 10:18AM PDT, ID: 20028010

Rank: Genius

>ip local pool VPNpool 192.168.1.34-192.168.1.40 mask 255.255.255.0
Your IP pool should be from a different IP subnet, and not smack in the middle of your LAN subnet.

Make sure also that your remote VPN user home lan is not also 192.168.1.x
Accepted Solution
 
10.06.2007 at 02:15PM PDT, ID: 20028479
Ok I changed to local VPN pool.
Here's the messoge I get in the syslog:      
713903       Group = DefaultRAGroup, IP = 74.193.6.108, Error: Unable to remove PeerTblEntry
Also the current config:
Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name sbcglobal.net
enable password 0duV6wY858Xg13N4 encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 76.247.252.133 255.255.255.248
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system disk0:/asa722-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 68.94.156.1
 name-server 68.94.157.1
 domain-name sbcglobal.net
same-security-traffic permit intra-interface
access-list K2CONTROLS_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any 192.168.1.32 255.255.255.240
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNpool 192.168.2.1-192.168.2.10 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 76.247.252.134 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy K2CONTROLS internal
group-policy K2CONTROLS attributes
 dns-server value 68.94.156.1 68.94.157.1
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value K2CONTROLS_splitTunnelAcl
 default-domain value k2controls.com
username dwilson password T6U.2SHm.gQGq0.E encrypted privilege 0
username dwilson attributes
 vpn-group-policy K2CONTROLS
username kparrott password ECDkMSryjP4tnERe encrypted privilege 0
username kparrott attributes
 vpn-group-policy K2CONTROLS
http server enable
http 74.193.6.0 255.255.255.0 outside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
tunnel-group TunnelGroup1 type ipsec-ra
tunnel-group TunnelGroup1 general-attributes
 default-group-policy K2CONTROLS
tunnel-group TunnelGroup1 ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
client-update enable
prompt hostname context
Cryptochecksum:c0d701a452953c0848386819328fb283
: end
 
10.06.2007 at 03:22PM PDT, ID: 20028629

Rank: Guru

  Hi dw1958
       "Error: Unable to remove PeerTblEntry"
        Make sure you have license for 3DES, type sh ver in CLI, you should an output like following

Licensed features for this platform:
Maximum Physical Interfaces : 3        
Maximum VLANs               : 10        
Inside Hosts                : Unlimited
Failover                    : Disabled
VPN-DES                     : Enabled  
VPN-3DES-AES                : Enabled      <-------
Cut-through Proxy           : Enabled  
Guards                      : Enabled  
URL Filtering               : Enabled  
Security Contexts           : 0        
GTP/GPRS                    : Disabled  
VPN Peers                   : Unlimited

            Also add
           crypto isakmp nat-traversal  20
          Make sure your ISP supports Bridging (a few doesnt in some countries)
          Make sure you choose group auth in vpn client and typed TunnelGroup1 in VPN client.

Regards
Assisted Solution
 
10.06.2007 at 03:24PM PDT, ID: 20028634

Rank: Genius

You need to change the nat 0 acl to match the new pool:
no access-list inside_nat0_outbound extended permit ip any 192.168.1.32 255.255.255.240
access-list inside_nat0_outbound permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
 
Re-apply the acl to nat 0
    nat (inside) 0 access-list inside_nat0_outbound

I would also suggest changing the Split-tunnel acl:
no access-list K2CONTROLS_splitTunnelAcl standard permit any
access-list K2CONTROLS_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0

Once you change that acl, you have to re-do the policy

group-policy K2CONTROLS attributes
  split-tunnel-network-list value K2CONTROLS_splitTunnelAcl

Assisted Solution
 
10.06.2007 at 03:39PM PDT, ID: 20028659
I did as MrHusy suggested and I got much farther. At least now I get a response from the asa 5505. It disconnects right away...
The syslog errors follow:( it is reverse order)

6      Oct 06 2007      22:34:14      302015      74.193.6.108      76.247.252.133       Built inbound UDP connection 20192 for outside:74.193.6.108/50905 (74.193.6.108/50905) to NP Identity Ifc:76.247.252.133/500 (76.247.252.133/500)

6      Oct 06 2007      22:34:14      302015      74.193.6.108      76.247.252.133       Built inbound UDP connection 20193 for outside:74.193.6.108/50906 (74.193.6.108/50906) to NP Identity Ifc:76.247.252.133/4500 (76.247.252.133/4500)

6      Oct 06 2007      22:34:14      713172                   Group = TunnelGroup1, IP = 74.193.6.108, Automatic NAT Detection Status:     Remote end   IS   behind a NAT device     This   end is NOT behind a NAT device

6      Oct 06 2007      22:34:19      113012                   AAA user authentication Successful : local database : user = dwilson

6      Oct 06 2007      22:34:19      113003                   AAA group policy for user dwilson is being set to K2CONTROLS

6      Oct 06 2007      22:34:19      113011                   AAA retrieved user specific group policy (K2CONTROLS) for user = dwilson

6      Oct 06 2007      22:34:19      113009                   AAA retrieved default group policy (K2CONTROLS) for user = dwilson

6      Oct 06 2007      22:34:19      113008                   AAA transaction status ACCEPT : user = dwilson

5      Oct 06 2007      22:34:19      713130                   Group = TunnelGroup1, Username = dwilson, IP = 74.193.6.108, Received unsupported transaction mode attribute: 5

6      Oct 06 2007      22:34:19      713184                   Group = TunnelGroup1, Username = dwilson, IP = 74.193.6.108, Client Type: WinNT  Client Application Version: 5.0.00.0340

3      Oct 06 2007      22:34:19      713132                   Group = TunnelGroup1, Username = dwilson, IP = 74.193.6.108, Cannot obtain an IP address for remote peer

3      Oct 06 2007      22:34:19      713902                   Group = TunnelGroup1, Username = dwilson, IP = 74.193.6.108, Removing peer from peer table failed, no match!

4      Oct 06 2007      22:34:19      713903                   Group = TunnelGroup1, Username = dwilson, IP = 74.193.6.108, Error: Unable to remove PeerTblEntry

Lrmoore: do I still need to make the canges you suggested? Do I just type in what you wrote in the CLI?

Thanks
 
10.06.2007 at 03:45PM PDT, ID: 20028671

Rank: Genius

Yes, you need to make those changes, and one more:
Add this back in:
tunnel-group K2CONTROLS general-attributes
 address-pool VPNpool

Assisted Solution
 
10.06.2007 at 04:19PM PDT, ID: 20028720

Rank: Guru

  Yep, Les finished it :), should work now.
 
10.06.2007 at 04:21PM PDT, ID: 20028727

Rank: Guru

  Wait a minute
    "Client Type: WinNT  Client Application Version"
      Are you using Microsoft VPN client?
 
10.06.2007 at 04:23PM PDT, ID: 20028732
After adding the 2 access-list lines I get this error when sending:
ERROR: Access-list K2CONTROLS_splitTunnelAcl is attached to class-map, route-map,
username, group-policy, distribute-list, multicast or wccp subsystem.
Please remove the relevant configuration before removing the access-list.

Here's the current config:

Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name sbcglobal.net
enable password 0duV6wY858Xg13N4 encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 76.247.252.133 255.255.255.248
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
boot system disk0:/asa722-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 68.94.156.1
 name-server 68.94.157.1
 domain-name sbcglobal.net
same-security-traffic permit intra-interface
access-list K2CONTROLS_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any any
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list K2Controls_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNpool 192.168.2.1-192.168.2.10 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 76.247.252.134 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy K2CONTROLS internal
group-policy K2CONTROLS attributes
 dns-server value 68.94.156.1 68.94.157.1
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value K2CONTROLS_splitTunnelAcl
 default-domain value k2controls.com
username dwilson password T6U.2SHm.gQGq0.E encrypted privilege 0
username dwilson attributes
 vpn-group-policy K2CONTROLS
username kparrott password ECDkMSryjP4tnERe encrypted privilege 0
username kparrott attributes
 vpn-group-policy K2CONTROLS
http server enable
http 74.193.6.0 255.255.255.0 outside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
tunnel-group TunnelGroup1 type ipsec-ra
tunnel-group TunnelGroup1 general-attributes
 default-group-policy K2CONTROLS
tunnel-group TunnelGroup1 ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
client-update enable
prompt hostname context
Cryptochecksum:4fd771c19a6da130226a7c395e8dbdb8
: end
 
10.06.2007 at 04:25PM PDT, ID: 20028739
Reply to MrHusy:

I am using the Cisco VPN Client 5.
 
10.06.2007 at 04:27PM PDT, ID: 20028741

Rank: Genius

Getting closer....

group-policy K2CONTROLS attributes
 no split-tunnel-network-list value K2CONTROLS_splitTunnelAcl
 split-tunnel-network-list value K2Controls_splitTunnelAcl

You can clean up/remove the K2CONTROLS_splitTunnelAcl later...
 
You  need this:
 tunnel-group TunnelGroup1 general-attributes
   address-pool VPNpool
Assisted Solution