VPN not able to connect to DMZ network

I have a site to site VPN from Denver to Tokyo.  We can see that the VPN tunnel is running but unable to access the DMZ.  The firewall doesn't even seem to route to the DMZ but we are able to access the internal IP address interface in Tokyo.  Posted below are the configurations with several security items replaced with X.  Any idea's?  


Configuration for Denver

ASA Version 8.0(2)
!
hostname X
domain-name X
names
name X PGP_NAT_X description PGP NAT
name X X2_interface description X2 interface
name X X_Interface description Cogetn Interface
name X PGP_X2 description NAT for PGP through X2
name 10.0.40.0 Pueblo_Network description Pueblo Network
name 10.0.35.0 Web_Vpn_Pool description Web Vpn Pool Network
name X MXlogic1 description Spam filter smtp
name X MXlogic2 description Spam Filter smtp
name X MXlogic3 description Spam Filter smtp
name X MXlogic4 description Spam Filter smtp
name X MXlogic5 description Spam Filter smtp
name X MXlogic6 description Spam Filter smtp
name X MXlogic7 description Spam Filter smtp
name X MXlogic8 description Spam Filter smtp
name 10.0.20.20 PGP_Server_Boston description Inside address for PGP
!
interface GigabitEthernet0/0
 description Outside X2
 nameif Outside-X2
 security-level 0
 ip address X X2_interface 255.255.255.128
!
interface GigabitEthernet0/1
 description Inside Network
 nameif Inside_Network
 security-level 100
 ip address 10.0.30.210 255.255.255.0
!
interface GigabitEthernet0/2
 description Outside X
 nameif Outside-X
 security-level 0
 ip address X_Interface 255.255.255.252
!
interface GigabitEthernet0/3
 description DMZ
 nameif DMZ
 security-level 50
 ip address 10.0.20.1 255.255.255.0
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 management-only
!
passwd Ho55q4D0bMKw6pX3 encrypted
banner login Unauthorized users please disconnect
Object groups removed for security
ACL lists removed for security

pager lines 24
logging enable
logging buffer-size 100000
logging monitor debugging
logging buffered debugging
logging asdm warnings
logging mail critical
logging from-address mbaroody@Xgroup.com
logging recipient-address mbaroody@Xgroup.com level critical
logging class auth asdm warnings
mtu Outside-X2 1500
mtu Inside_Network 1500
mtu Outside-X 1500
mtu DMZ 1500
mtu management 1500
ip local pool WebVPNPool 10.0.35.50-10.0.35.151 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any Inside_Network
asdm image disk0:/asdm-602.bin
asdm history enable
arp timeout 14400
nat-control
global (Outside-X2) 2 interface
global (Inside_Network) 1 interface
global (Outside-X) 2 interface
nat (Inside_Network) 0 access-list nonat
nat (Inside_Network) 2 10.0.30.0 255.255.255.0
nat (Inside_Network) 2 Pueblo_Network 255.255.255.0
nat (Inside_Network) 2 0.0.0.0 0.0.0.0
nat (DMZ) 2 0.0.0.0 0.0.0.0
static (Inside_Network,Outside-X2) tcp interface 3389 10.0.30.17 3389 netmask 255.255.255.255
static (Inside_Network,Outside-X2) tcp interface www 10.0.30.4 www netmask 255.255.255.255
static (Inside_Network,Outside-X2) tcp interface https 10.0.30.4 https netmask 255.255.255.255
static (DMZ,Outside-X2) tcp interface smtp 10.0.20.22 smtp netmask 255.255.255.255
static (Inside_Network,DMZ) 10.0.30.0 10.0.30.0 netmask 255.255.255.0
static (Inside_Network,DMZ) 10.0.20.0 10.0.10.0 netmask 255.255.255.0
static (DMZ,Outside-X2) PGP_X2 PGP_Server_Boston netmask 255.255.255.255
access-group Outside-X2_access_in in interface Outside-X2
access-group inside-acl in interface Inside_Network
access-group Outside-X_access_in in interface Outside-X
access-group DMZ_access_in in interface DMZ
route Outside-X 0.0.0.0 0.0.0.0 38.112.15.201 1 track 1
route Outside-X2 0.0.0.0 0.0.0.0 206.168.188.1 2
route Inside_Network 10.0.10.0 255.255.255.0 10.0.30.200 1
route Inside_Network Pueblo_Network 255.255.255.0 10.0.30.206 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server X_AD protocol nt
aaa-server X_AD host 10.0.30.25
 nt-auth-domain-controller phoenix
aaa-server X_AD host 10.0.30.27
 nt-auth-domain-controller orlando
url-server (Inside_Network) vendor websense host 10.0.30.36 timeout 30 protocol TCP version 1 connections 5
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
filter url http 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 allow proxy-block cgi-truncate
http server enable
http 192.168.156.0 255.255.255.0 Outside-X2
http 192.168.156.0 255.255.255.0 Outside-X
http 10.0.30.95 255.255.255.255 Inside_Network
http 10.0.30.90 255.255.255.255 Inside_Network
http 10.0.30.117 255.255.255.255 management
http 10.0.30.0 255.255.255.0 Inside_Network
http 192.168.1.0 255.255.255.0 management
http redirect Outside-X 80
http redirect Inside_Network 80
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt connection tcpmss 1200
sysopt noproxyarp Inside_Network
sla monitor 1
 type echo protocol ipIcmpEcho 4.2.2.2 interface Outside-X
sla monitor schedule 1 life forever start-time now
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec df-bit clear-df Outside-X
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside-X_map 10 match address vpn
crypto map Outside-X_map 10 set peer 66.55.114.210
crypto map Outside-X_map 10 set transform-set ESP-AES-256-SHA
crypto map Outside-X_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside-X_map interface Outside-X
crypto map Outside-X2_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside-X2_map interface Outside-X2
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 fqdn X-gw
 subject-name CN=vpn.Xgroup.com,OU=IT,O=The X Group
 keypair SSL_VPN
 no client-types
 crl configure
crypto ca trustpoint ASDM_TrustPoint2
 enrollment terminal
 fqdn Xaccess.com
  subject-name CN=Xaccess.com,O="X Group, LLC",C=US,St=CO,L=Denver,EA=
 ip-address X2_interface
 no client-types
 crl configure
crypto ca certificate chain ASDM_TrustPoint0
  quit
crypto isakmp enable Outside-X2
crypto isakmp enable Outside-X
crypto isakmp policy 5
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal 120
!
track 1 rtr 1 reachability
telnet timeout 60
ssh scopy enable
ssh 10.0.30.95 255.255.255.255 Inside_Network
ssh X 255.255.255.255 Outside-X
ssh 0.0.0.0 0.0.0.0 Outside-X
ssh timeout 60
console timeout 0
management-access Inside_Network
vpn load-balancing
 interface lbpublic DMZ
 interface lbprivate DMZ
threat-detection basic-threat
threat-detection scanning-threat
threat-detection statistics
!
!
url-block url-mempool 1500
url-block url-size 4
ntp authenticate
ntp server 10.0.20.22 source DMZ prefer
tftp-server Inside_Network 10.0.30.95 c:\temp
ssl trust-point ASDM_TrustPoint0 Outside-X
webvpn
 enable Outside-X2
 enable Outside-X
 svc image disk0:/anyconnect-win-2.0.0343-k9.pkg 1
 svc enable
 tunnel-group-list enable
group-policy DfltGrpPolicy attributes
 dns-server value 10.0.30.25 10.0.30.27
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split-tunnel
 default-domain value X
 address-pools value WebVPNPool
 webvpn
  url-list value Clientless_SSL
  svc ask none default svc
group-policy GroupPolicy1 internal
group-policy Clientless_SSL internal
group-policy Clientless_SSL attributes
 banner value You are connecting to a private network. If you are not authorized user please disconnect now. By connecting you are consenting to a monitored session.
 default-domain value X
 webvpn
  url-list value Clientless_SSL
  svc ask none default webvpn
  customization value DfltCustomization
  http-comp gzip
  url-entry enable
group-policy Client_SSL_VPN internal
group-policy Client_SSL_VPN attributes
 banner value You are connecting to a private network. If you are not authorized user please disconnect now. By connecting you are consenting to a monitored session.
 default-domain value X
username bpugh password BwL9wWdv49VDWihE encrypted privilege 15
username admin password DAcE8Gs06hndWjUR encrypted privilege 15
username admin attributes
 webvpn
  html-content-filter none
tunnel-group DefaultRAGroup general-attributes
 address-pool WebVPNPool
 authentication-server-group X_AD
tunnel-group DefaultWEBVPNGroup general-attributes
 authentication-server-group X_AD
tunnel-group Clientless_SSL type remote-access
tunnel-group Clientless_SSL general-attributes
 authentication-server-group X_AD
tunnel-group Clientless_SSL webvpn-attributes
 nbns-server 10.0.30.25 master timeout 2 retry 2
 nbns-server 10.0.30.27 timeout 2 retry 2
 group-alias Clientless_SSL enable
tunnel-group Client_VPN type remote-access
tunnel-group Client_VPN general-attributes
 address-pool WebVPNPool
 authentication-server-group X_AD
tunnel-group Client_VPN webvpn-attributes
 group-alias Client_VPN enable
tunnel-group Client_VPN ipsec-attributes
 pre-shared-key *
tunnel-group (Outside IP Tokyo) type ipsec-l2l
tunnel-group (Outside IP Tokyo) ipsec-attributes
 pre-shared-key *
tunnel-group-map default-group DefaultL2LGroup
smtp-server 10.0.20.22
prompt hostname context
Cryptochecksum:97ac324645e814e9b8f76f0fe9240967
: end
asdm image disk0:/asdm-602.bin
asdm history enable






Configuration for Tokyo

ASA Version 7.2(3)
!
hostname X
domain-name X
names
!
interface Vlan1
 nameif Inside-X
 security-level 100
 ip address 192.168.156.100 255.255.255.0
!
interface Vlan11
 nameif Outside-North
 security-level 0
 ip address (Outside IP) 255.255.255.240
!
interface Vlan21
 nameif DMZ
 security-level 50
 ip address 192.168.159.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 11
!
interface Ethernet0/1
 switchport access vlan 21
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
banner login Unauthorized users please disconnect.
ftp mode passive
dns domain-lookup Inside-X
dns domain-lookup Outside-North
dns domain-lookup DMZ
dns server-group DefaultDNS
 domain-name X.bm
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service PGPserverOUTSIDE tcp
 description Allow mail traffice from outside to PGP in DMZ
 port-object eq www
 port-object eq https
 port-object eq ldap
 port-object eq ldaps
object-group icmp-type ICMP_Allowed
 description Allow ping and traceroute replies back in
 icmp-object echo-reply
 icmp-object information-reply
 icmp-object source-quench
 icmp-object time-exceeded
 icmp-object timestamp-reply
 icmp-object traceroute
 icmp-object unreachable
 icmp-object echo
ACL lists - removed for security

pager lines 24
logging enable
logging asdm informational
logging mail errors
mtu Inside-X 1500
mtu Outside-North 1500
mtu DMZ 1500
no failover
monitor-interface Inside-X
monitor-interface Outside-North
monitor-interface DMZ
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (Inside-X) 3 interface
global (Outside-North) 1 interface
global (DMZ) 1 interface
nat (Inside-X) 0 access-list Inside-X_nat0_outbound
nat (Inside-X) 1 0.0.0.0 0.0.0.0
nat (Outside-North) 0 access-list nonat-out
nat (DMZ) 1 0.0.0.0 0.0.0.0
static (Inside-X,DMZ) 192.168.156.22 192.168.156.22 netmask 255.255.255.255
static (DMZ,Outside-North) (Outside IP network) netmask 255.255.255.255
access-group Outside-North_access_in in interface Outside-North
access-group DMZ_access_in in interface DMZ
route Outside-North 0.0.0.0 0.0.0.0 192.168.156.100 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http (Outside IP network)0 255.255.255.0 Outside-North
http 192.168.159.0 255.255.255.0 DMZ
http 10.0.30.0 255.255.255.0 Inside-X
http 10.0.30.0 255.255.255.0 Outside-North
http 192.168.156.0 255.255.255.0 Inside-X
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto map Outside-North_map0 1 match address Outside-North_1_cryptomap_1
crypto map Outside-North_map0 1 set peer (Outside IP Denver)
crypto map Outside-North_map0 1 set transform-set ESP-AES-256-SHA
crypto map Outside-North_map0 2 match address Outside-North_2_cryptomap_1
crypto map Outside-North_map0 2 set peer (Outside IP Kyoto)
crypto map Outside-North_map0 2 set transform-set ESP-AES-256-SHA
crypto map Outside-North_map0 3 match address Outside-North_cryptomap_3
crypto map Outside-North_map0 3 set peer (Outside IP Denver)
crypto map Outside-North_map0 3 set transform-set ESP-AES-256-SHA
crypto map Outside-North_map0 interface Outside-North
crypto isakmp enable Outside-North
crypto isakmp policy 9
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 Inside-X
ssh X 255.255.255.255 Outside-North
ssh timeout 5
console timeout 0
management-access Inside-X
dhcpd auto_config Outside-North
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
ssl encryption des-sha1 rc4-md5
username admin password GnweTVP6OUUbtQV. encrypted privilege 15
tunnel-group (outside IP kyoto) type ipsec-l2l
tunnel-group (outside IP kyoto) ipsec-attributes
 pre-shared-key *
tunnel-group (Outside IP Denver) type ipsec-l2l
tunnel-group (Outside IP Denver) ipsec-attributes
 pre-shared-key *
prompt hostname context
Cryptochecksum:cb8a06fc3fa8c37137a9f737a4f84e3e
: end
asdm image disk0:/asdm-523.bin
no asdm history enable
Start Free Trial