ASA Version 7.2(3) ! hostname ciscoasa domain-name default.domain.invalid enable password names ! interface Vlan1 nameif inside security-level 100 ip address 192.168.5.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address dhcp setroute ! interface Vlan20 nameif comm security-level 100 ip address 192.168.6.1 255.255.255.0 ! interface Vlan30 nameif commpublic security-level 100 ip address 192.168.7.1 255.255.255.0 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 switchport trunk allowed vlan 1,20,30 switchport mode trunk ! interface Ethernet0/2 switchport access vlan 20 ! interface Ethernet0/3 switchport access vlan 30 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! passwd ftp mode passive clock timezone EST -5 clock summer-time EDT recurring dns server-group DefaultDNS domain-name default.domain.invalid same-security-traffic permit inter-interface same-security-traffic permit intra-interface access-list outside_1_cryptomap extended permit ip 192.168.5.0 255.255.255.0 172.18.1.0 255.255.255.0 access-list outside_1_cryptomap extended permit ip 192.168.6.0 255.255.255.0 172.18.1.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.5.0 255.255.255.0 172.18.1.0 255.255.255.0 access-list inside_nat0_outbound extended permit ip 192.168.5.0 255.255.255.0 172.18.0.0 255.255.0.0 access-list comm_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 172.18.1.0 255.255.255.0 access-list comm_nat0_outbound extended permit ip 192.168.6.0 255.255.255.0 172.18.0.0 255.255.0.0 pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu comm 1500 mtu commpublic 1500 ip local pool test 192.168.5.10-192.168.5.11 mask 255.255.255.0 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-523.bin no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 nat (comm) 0 access-list comm_nat0_outbound nat (comm) 1 0.0.0.0 0.0.0.0 nat (commpublic) 1 0.0.0.0 0.0.0.0 route outside 0.0.0.0 0.0.0.0 xx.xx.xx.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute http server enable no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto dynamic-map outside_dyn_map 20 set pfs crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA crypto map outside_map 1 match address outside_1_cryptomap crypto map outside_map 1 set pfs crypto map outside_map 1 set peer xx.xx.xx.99 crypto map outside_map 1 set transform-set ESP-3DES-MD5 ESP-DES-SHA ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map crypto map outside_map interface outside crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 crypto isakmp nat-traversal 20 telnet 0.0.0.0 0.0.0.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 management-access inside dhcp-client client-id interface outside dhcpd auto_config outside ! dhcpd address 192.168.5.10-192.168.5.50 inside dhcpd dns 172.18.1.12 4.2.2.2 interface inside dhcpd wins 172.18.1.17 interface inside dhcpd lease 86400 interface inside dhcpd domain 1234.int interface inside dhcpd enable inside ! dhcpd address 192.168.6.10-192.168.6.50 comm dhcpd dns 172.18.1.12 4.2.2.2 interface comm dhcpd wins 172.18.1.17 interface comm dhcpd lease 86400 interface comm dhcpd domain 1234.int interface comm dhcpd enable comm ! dhcpd address 192.168.7.10-192.168.7.50 commpublic dhcpd dns 4.2.2.2 4.1.1.1 interface commpublic dhcpd wins 172.18.1.17 interface commpublic dhcpd lease 86400 interface commpublic dhcpd domain 1234.int interface commpublic dhcpd enable commpublic ! ! ! group-policy DfltGrpPolicy attributes banner none wins-server none dns-server none dhcp-network-scope none vpn-access-hours none vpn-simultaneous-logins 3 vpn-idle-timeout 30 vpn-session-timeout none vpn-filter none vpn-tunnel-protocol IPSec l2tp-ipsec webvpn password-storage disable ip-comp disable re-xauth disable group-lock none pfs disable ipsec-udp disable ipsec-udp-port 10000 split-tunnel-policy tunnelall split-tunnel-network-list none default-domain none split-dns none intercept-dhcp 255.255.255.255 disable secure-unit-authentication disable user-authentication disable user-authentication-idle-timeout 30 ip-phone-bypass disable leap-bypass disable nem disable backup-servers keep-client-config msie-proxy server none msie-proxy method no-modify msie-proxy except-list none msie-proxy local-bypass disable nac disable nac-sq-period 300 nac-reval-period 36000 nac-default-acl none address-pools none smartcard-removal-disconnect enable client-firewall none client-access-rule none webvpn functions url-entry html-content-filter none homepage none keep-alive-ignore 4 http-comp gzip filter none url-list none customization value DfltCustomization port-forward none port-forward-name value Application Access sso-server none deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information svc none svc keep-installer installed svc keepalive none svc rekey time none svc rekey method none svc dpd-interval client none svc dpd-interval gateway none svc compression deflate group-policy remote internal group-policy remote attributes dns-server value 4.2.2.2 vpn-tunnel-protocol IPSec username 1234 password encrypted privilege 0 username edts attributes vpn-group-policy remote tunnel-group xx.xx.xxx.99 type ipsec-l2l tunnel-group xx.xx.xxx.99 ipsec-attributes pre-shared-key * tunnel-group remote type ipsec-ra tunnel-group remote general-attributes address-pool 1234 default-group-policy remote tunnel-group remote ipsec-attributes pre-shared-key prompt hostname context Cryptochecksum:e8d5ba78219a72588eb62513d44c7737 : end ciscoasa#