We have a Cisco ASA5510 and need to create another VPN group to allow a software vendor to access thier server located on our LAN behind the firewall.
We currently allow remote users access to the network using the Cisco VPN client. The users VPN group name is PIXVPN.
I need to create a new VPN group named WESTKM and assign a password to it.
Any assistance with the necessary commands and/or configuration advice would be appreciated.
Below is the current config of the 5510.
Thanks Frank
ASA Version 7.2(2)
!
hostname central
domain-name uks.com
enable password **************** encrypted
no names
name 10.10.x.x mail.uks.com
name 10.10.x.x HTFD_Network
name 10.10.x.x NH_Network
name 10.10.x.x email.uks.com
name 10.10.x.x docs.uks.com
name 10.10.x.x HTFD2_Network
name 10.10.x.x mail2.uks.com
dns-guard
!
interface Ethernet0/0
nameif WAN
security-level 0
ip address 74.x.x.x 255.255.255.248
!
interface Ethernet0/1
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
nameif LAN
security-level 100
ip address 10.10.x.x 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
no ip address
management-only
!
passwd **************** encrypted
boot system disk0:/asa722-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name uks.com
object-group service HTTPgroup tcp
description HTTPS and HTTP
port-object eq https
port-object eq www
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit udp any eq isakmp any eq isakmp
access-list outside_access_in extended permit tcp any host 74.x.x.x object-group HTTPgroup
access-list outside_access_in extended permit tcp any host 74.x.x.x object-group HTTPgroup
access-list outside_access_in extended permit tcp 64.x.0.0 255.255.240.0 host 74.x.x.x eq smtp
access-list outside_access_in extended permit tcp 64.x.0.0 255.255.240.0 host 74.x.x.x eq smtp
access-list 100 extended permit ip 10.10.x.x 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 extended permit ip 10.10.x.x 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 extended permit ip 10.10.x.x 255.255.255.0 192.168.1.0 255.255.255.0
access-list 100 extended permit ip 10.10.x.x 255.255.255.0 192.168.1.0 255.255.255.0
access-list smtp_out extended permit ip host 10.10.x.x host 74.x.x.x
access-list smtp_out extended permit ip host 10.10.x.x host 74.x.x.x
access-list smtp2_out extended permit ip host 10.10.x.x host 74.x.x.x
pager lines 24
logging asdm informational
mtu WAN 1500
mtu LAN 1500
mtu management 1500
ip local pool VPN192 192.168.1.1-192.168.1.254
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
nat-control
global (WAN) 1 interface
global (WAN) 2 74.x.x.x
global (WAN) 3 74.x.x.x
nat (LAN) 0 access-list 100
nat (LAN) 2 access-list smtp_out
nat (LAN) 3 access-list smtp2_out
nat (LAN) 3 10.10.x.x 255.255.255.255
nat (LAN) 2 10.10.x.x 255.255.255.255
nat (LAN) 2 10.10.x.x 255.255.255.255
nat (LAN) 1 10.0.0.0 255.0.0.0
static (LAN,WAN) tcp 74.x.x.x smtp 10.10.x.x smtp netmask 255.255.255.255
static (LAN,WAN) tcp 74.x.x.x smtp 10.10.x.x smtp netmask 255.255.255.255
static (LAN,WAN) 74.x.x.x 10.10.x.x netmask 255.255.255.255
static (LAN,WAN) 74.x.x.x 10.10.x.x netmask 255.255.255.255
access-group outside_access_in in interface WAN
route WAN 0.0.0.0 0.0.0.0 74.x.x.x 1
route LAN 10.10.x.x 255.255.255.0 10.10.x.x 1
route LAN 10.10.x.x 255.255.255.0 10.10.x.x 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server admin protocol radius
max-failed-attempts 4
aaa-server admin (LAN) host 10.10.x.x
timeout 7
key **********
authentication-port 1812
accounting-port 1813
group-policy PIXVPN internal
group-policy PIXVPN attributes
wins-server value 10.10.x.x 10.10.x.x
dns-server value 10.10.x.x 10.10.x.x
vpn-idle-timeout 30
split-tunnel-policy tunnelspecified
split-tunnel-network-list value 100
default-domain value uks.lan
http server enable
http 10.10.x.x 255.255.255.0 LAN
http 10.10.x.x 255.255.255.0 LAN
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map VPNIN 10 ipsec-isakmp dynamic dynmap
crypto map VPNIN interface WAN
crypto isakmp identity address
crypto isakmp enable WAN
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 30
tunnel-group DefaultRAGroup ipsec-attributes
isakmp ikev1-user-authentication (WAN) none
tunnel-group PIXVPN type ipsec-ra
tunnel-group PIXVPN general-attributes
address-pool VPN192
authentication-server-grou
p (WAN) admin
default-group-policy PIXVPN
tunnel-group PIXVPN ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh 10.10.x.x 255.255.255.0 LAN
ssh timeout 30
ssh version 2
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
!
service-policy global_policy global
prompt hostname context
central#
Start Free Trial
