I am sure that it is something silly. I am pretty sure that I have it setup the same way as my other vlans. It will not connect to the Internet. I have a NAT rule for it. I have no access rules, that I am aware of that are stopping it.
VLAN5 - Cannot connect to Internet or any websites. 10.37.0.0 /24
I just use this to mess around at home but if someone could help or tell me where I am going wrong that would be greatly appreciated.
ASA Version 9.2(2)4
!
hostname aquaman
domain-name batcave.local
enable password 8Ry2YjIyt7RRXU24 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 208.67.222.222 OpenDNS1
name 208.67.220.220 OpenDNS2
name 208.67.222.220 OpenDNS3
name 208.67.220.222 OpenDNS4
name 10.37.1.101 spiderman
name 10.37.1.99 green-arrow
name 10.37.3.0 vpn-network
name 10.37.1.25 ironman
name 10.37.1.20 the-flash
ip local pool Home_DHCP_VPN 10.37.3.130-10.37.3.160 mask 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport trunk allowed vlan 1,3-5
switchport trunk native vlan 1
switchport mode trunk
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif home
security-level 100
ip address 10.37.1.1 255.255.255.0
dhcprelay server 10.37.1.10
dhcprelay server 10.37.1.9
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
interface Vlan3
nameif guest
security-level 50
ip address 10.37.2.254 255.255.255.0
dhcprelay information trusted
!
interface Vlan4
nameif test
security-level 25
ip address 192.168.37.254 255.255.255.0
dhcprelay information trusted
!
interface Vlan5
nameif mgt
security-level 100
ip address 10.37.0.1 255.255.255.0
dhcprelay information trusted
!
!
time-range guest-permit
periodic weekdays 8:00 to 21:00
!
boot system disk0:/asa922-4-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
name-server OpenDNS1
name-server OpenDNS2
name-server OpenDNS3
name-server OpenDNS4
domain-name batcave.local
same-security-traffic permit inter-interface
object network OpenDNS2
host 208.67.220.220
object network OpenDNS4
host 208.67.220.222
object network OpenDNS3
host 208.67.222.220
object network OpenDNS1
host 208.67.222.222
object network vpn-network
subnet 10.37.3.0 255.255.255.0
object network green-arrow_rdp
host 10.37.1.99
object network spiderman_vnc
host 10.37.1.101
object network ironman_smtp
host 10.37.1.30
object network the-flash
host 10.37.1.20
object network work_ip
host 64.80.36.218
object network the-hulk_http
host 10.37.1.15
object network spiderman
host 10.37.1.101
object network the-hulk_ftp
host 10.37.1.15
object network the-hulk
host 10.37.1.15
object network cyclops
host 10.37.1.9
object network daredevil
host 10.37.1.10
object network google-dns-a
host 8.8.8.8
object network google-dns-b
host 8.8.4.4
object network ironman
host 10.37.1.30
object network wiki
host 10.37.1.25
object network the-flash_tftp
host 10.37.1.20
object network home_network
subnet 10.37.1.0 255.255.255.0
object network guest_network
subnet 10.37.2.0 255.255.255.0
object network test_network
subnet 192.168.37.0 255.255.255.0
object network mgt_network
subnet 10.37.0.0 255.255.255.0
object network mxsrv1.spamgateway.comodo.com
host 178.33.199.65
object network mxsrv2.spamgateway.comodo.com
host 178.33.199.66
object network mxsrv3.spamgateway.comodo.com
host 178.33.199.69
object network ironman_pop
host 10.37.1.30
object network the-hulk_ssh
host 10.37.1.15
object network wiki_http
host 10.37.1.25
object network BruceCamera
host 10.37.1.65
object network mgt
subnet 10.37.0.0 255.255.255.0
object network mangt_network
subnet 10.37.0.0 255.255.255.0
object-group network obj_any
object-group network OpenDNS_Servers
network-object object OpenDNS2
network-object object OpenDNS4
network-object object OpenDNS3
network-object object OpenDNS1
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service vnc tcp
port-object eq 5900
object-group service rdp tcp
port-object eq 3389
object-group network Comodo_Server
network-object object mxsrv1.spamgateway.comodo.com
network-object object mxsrv2.spamgateway.comodo.com
network-object object mxsrv3.spamgateway.comodo.com
object-group network domain-controllers
network-object object cyclops
network-object object daredevil
object-group network google-dns
network-object object google-dns-a
network-object object google-dns-b
object-group network DM_INLINE_NETWORK_1
network-object 10.37.0.0 255.255.255.0
network-object 10.37.1.0 255.255.255.0
network-object 192.168.37.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
network-object 10.37.0.0 255.255.255.0
network-object 10.37.1.0 255.255.255.0
access-list home_access_in extended permit object-group TCPUDP object-group DM_INLINE_NETWORK_2 object-group OpenDNS_Servers eq domain log disable
access-list home_access_in extended permit object-group TCPUDP object-group domain-controllers object-group google-dns eq domain log disable
access-list home_access_in extended permit object-group TCPUDP object spiderman any4 eq domain log disable
access-list home_access_in extended deny object-group TCPUDP 10.37.1.0 255.255.255.0 any4 eq domain log disable
access-list home_access_in extended permit ip 10.37.0.0 255.255.255.0 any log disable
access-list home_access_in extended permit ip any4 any4 log disable
access-list Home standard permit 10.37.0.0 255.255.255.0
access-list Home standard permit 10.37.1.0 255.255.255.0
access-list Home standard permit 10.37.2.0 255.255.255.0
access-list Home standard permit 192.168.37.0 255.255.255.0
access-list home_nat0_outbound extended permit ip object vpn-network any4
access-list guest_access_in extended permit object-group TCPUDP 10.37.2.0 255.255.255.0 object-group OpenDNS_Servers eq domain log disable
access-list guest_access_in extended deny object-group TCPUDP 10.37.2.0 255.255.255.0 any4 eq domain log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 eq ftp log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 eq telnet log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 eq ssh log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 object-group rdp log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 object-group vnc log disable
access-list guest_access_in extended permit ip any4 any4 log disable
access-list test_access_in extended permit object-group TCPUDP 192.168.37.0 255.255.255.0 object-group google-dns eq domain log disable
access-list test_access_in extended deny object-group TCPUDP 192.168.37.0 255.255.255.0 any4 eq domain log disable
access-list test_access_in extended permit ip any4 any4 log disable
access-list outside_access_in extended permit tcp any4 object spiderman_vnc eq 5900 log disable
access-list outside_access_in extended permit tcp any4 object green-arrow_rdp eq 3389 log disable
access-list outside_access_in extended permit tcp any4 object the-hulk_http eq www log disable
access-list outside_access_in extended permit tcp any4 object the-hulk_ftp eq ftp log disable
access-list outside_access_in extended permit udp any4 object the-flash_tftp eq tftp log disable inactive
access-list outside_access_in extended permit tcp object-group Comodo_Server object ironman_smtp eq smtp log disable inactive
access-list outside_access_in extended permit tcp any object the-hulk_ssh eq ssh log disable
access-list outside_access_in extended permit tcp any4 object wiki_http eq 8080 log disable inactive
access-list outside_access_in extended permit tcp any4 object ironman_pop eq pop3 log disable inactive
access-list outside_access_in extended permit icmp any4 object-group DM_INLINE_NETWORK_1 log disable
pager lines 24
logging enable
logging timestamp
logging monitor informational
logging trap warnings
logging asdm informational
logging device-id hostname
logging host home the-flash
logging ftp-server 10.37.1.15 Cisco aquaman WhyAquaman
mtu home 1500
mtu outside 1500
mtu guest 1500
mtu test 1500
mtu mgt 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit 10.37.1.0 255.255.255.0 home
icmp permit host 64.80.36.218 echo outside
icmp deny any echo outside
icmp deny any guest
icmp permit 10.37.0.0 255.255.255.0 mgt
asdm image disk0:/asdm-731.bin
asdm location green-arrow 255.255.255.255 home
asdm location ironman 255.255.255.255 home
asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (home,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to Home
nat (home,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description Home to VPN
nat (guest,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to Guest
nat (guest,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description Guest to VPN
nat (test,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to Test
nat (test,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description Test to VPN
nat (mgt,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to MGT
nat (mgt,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description MGT to VPN
nat (mgt,any) source static mgt_network mgt_network no-proxy-arp route-lookup
!
object network green-arrow_rdp
nat (home,outside) static interface service tcp 3389 3389
object network spiderman_vnc
nat (home,outside) static interface service tcp 5900 5900
object network ironman_smtp
nat (home,outside) static interface service tcp smtp smtp
object network the-hulk_http
nat (any,outside) static interface service tcp www www
object network the-hulk_ftp
nat (any,outside) static interface service tcp ftp ftp
object network the-flash_tftp
nat (any,outside) static interface service udp tftp tftp
object network home_network
nat (home,outside) dynamic interface
object network guest_network
nat (guest,outside) dynamic interface
object network test_network
nat (test,outside) dynamic interface
object network the-hulk_ssh
nat (any,outside) static interface service tcp ssh 3722
object network wiki_http
nat (any,outside) static interface service tcp www 8080
object network mangt_network
nat (mgt,outside) dynamic interface
access-group home_access_in in interface home
access-group outside_access_in in interface outside
access-group guest_access_in in interface guest
access-group test_access_in in interface test
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server BATCAVE protocol ldap
aaa-server BATCAVE (home) host 10.37.1.10
ldap-base-dn OU=Users,OU=Home,DC=batcave,DC=local
ldap-naming-attribute sAMAccountName
ldap-login-password ci$coLD@P@ccount!
ldap-login-dn CN=Cisco LDAP Account,OU=Service Accounts,DC=batcave,DC=local
server-type microsoft
aaa-server BATCAVE (home) host 10.37.1.9
ldap-base-dn OU=Users,OU=Home,DC=batcave,DC=local
ldap-naming-attribute sAMAccountName
ldap-login-password ci$coLD@P@ccount!
ldap-login-dn CN=Cisco LDAP Account,OU=Service Accounts,DC=batcave,DC=local
server-type microsoft
no user-identity enable
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
http server enable 3737
http 10.37.1.0 255.255.255.0 home
http 64.80.36.218 255.255.255.255 outside
http 192.168.37.0 255.255.255.0 test
http 10.37.0.0 255.255.255.0 mgt
http redirect home 80
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
crypto ca server
shutdown
issuer-name CN=vpn.endofinternet.net
telnet timeout 5
ssh stricthostkeycheck
ssh spiderman 255.255.255.255 home
ssh green-arrow 255.255.255.255 home
ssh 10.37.1.100 255.255.255.255 home
ssh the-flash 255.255.255.255 home
ssh 64.80.36.218 255.255.255.255 outside
ssh 192.168.37.0 255.255.255.0 test
ssh 10.37.0.0 255.255.255.0 mgt
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 10
vpn-addr-assign local reuse-delay 5
dhcpd auto_config outside
!
dhcprelay server 10.37.1.9 home
dhcprelay server 10.37.1.10 home
dhcprelay enable guest
dhcprelay enable test
dhcprelay enable mgt
dhcprelay setroute guest
dhcprelay setroute test
dhcprelay setroute mgt
dhcprelay timeout 60
dhcprelay information trust-all
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.37.1.9 source home
ntp server 10.37.1.10 source home prefer
tftp-server home the-flash ASA-aquaman-config
webvpn
enable home
enable outside
enable test
enable mgt
anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 2
anyconnect enable
tunnel-group-list enable
group-policy DfltGrpPolicy attributes
dns-server value 10.37.1.10 10.37.1.9
vpn-simultaneous-logins 1
vpn-idle-timeout none
vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Home
default-domain value batcave.local
msie-proxy method no-proxy
msie-proxy lockdown disable
address-pools value Home_DHCP_VPN
group-policy GroupPolicy_HomeVPN internal
group-policy GroupPolicy_HomeVPN attributes
wins-server none
dns-server value 10.37.1.10 10.37.1.9
vpn-tunnel-protocol ssl-client
default-domain value batcave.local
split-tunnel-all-dns enable
username jared password YlQ4V6UbWiR/Dfov encrypted privilege 15
username heather password k.n80rwHaJIBfsIb encrypted
username heather attributes
service-type remote-access
username root password Tz23FNHAkYSJufHD encrypted privilege 15
tunnel-group HomeVPN type remote-access
tunnel-group HomeVPN general-attributes
address-pool Home_DHCP_VPN
authentication-server-group BATCAVE LOCAL
default-group-policy GroupPolicy_HomeVPN
tunnel-group HomeVPN webvpn-attributes
group-alias HomeVPN enable
!
class-map guest-class
match any
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map guest-policy
class guest-class
police input 8000000 4000
police output 8000 1500
!
service-policy guest-policy interface guest
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:0a10e716f6b87c443b80655f7ff88aa3
