Newsgroup: it.comp.reti.cisco
Titolo: permissions

Un saluto a tutti, questa volta posto un quesito. sicuramente qualcuno
di voi può aiutarmi.
Ho un tunnel fra due sedi che chiamerò A e B. Su A ho un ASA con OS
7.2, su B ho un PIX 515 con 7.2. Su A è configurato un VPN
concentrator che accetta chiamate. Tra A e B il tunnel è perfettamente
funzionante, tra i vpn client e A anche, nessun problema. Mi è sorta
la necessità di uscire dal concetto di rete stellare e di far ruotare
i pacchetti dai vpn client fino a B.
Qui il problema: da un debug di A la seguente risposta:
ASA-3-106014 deny inbound icmp src outside: ........... dst
outside: ........... (type 8, code 0)
Ecco la cfg di A:
!
hostname
domain-name
enable password
names
dns-guard
!
interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 172.16.10.254 255.255.255.0
!
interface Ethernet0/1
 nameif outside
 security-level 0
 ip address 192.168.100.236 255.255.255.0
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.3.1 255.255.255.0
 management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
banner login  ASA5510 is Ready. Any access not authorized is
forbidden!
ftp mode passive
clock timezone GMT+1 1
clock summer-time summert recurring last Sun Mar 2:00 last Sun Oct
3:00
object-group service MSN_Messenger_tcp tcp
 description MSN Messenger tries to use these ports
 port-object eq www
 port-object eq 1863
 port-object eq 7001
object-group network MSN_Messenger_hosts
 description hosts that MSN Messenger lives on
 network-object 65.54.195.0 255.255.255.0
 network-object 65.54.225.0 255.255.255.0
 network-object 65.54.226.0 255.255.254.0
 network-object 65.54.228.0 255.255.254.0
 network-object host 65.54.240.61
 network-object host 65.54.240.62
 network-object 207.46.104.0 255.255.252.0
 network-object 207.46.108.0 255.255.255.0
 network-object 207.68.171.0 255.255.255.0
access-list nonat extended permit ip 172.16.10.0 255.255.255.0
172.16.11.0 255.255.255.0
access-list nonat extended permit ip 172.16.10.0 255.255.255.0
192.168.121.0 255.255.255.0
access-list nonat extended permit ip 172.16.10.0 255.255.255.0
172.16.1.0 255.255.255.0
access-list nonat extended permit ip 172.16.10.0 255.255.255.0
172.16.6.0 255.255.255.0
access-list nonat extended permit ip 192.168.121.0 255.255.255.0
172.16.1.0 255.255.255.0
access-list 101 extended permit ip 172.16.10.0 255.255.255.0
172.16.11.0 255.255.255.0
access-list acl_vpn extended permit ip any 192.168.121.0 255.255.255.0
access-list 102 standard permit 172.16.10.0 255.255.255.0
access-list 102 standard permit 172.16.1.0 255.255.255.0
access-list 102 standard permit 192.168.1.0 255.255.255.0
access-list FW_in extended permit tcp any host 192.168.100.200 eq
telnet log
access-list FW_in extended permit tcp any host 192.168.100.200 eq 449
log
access-list FW_in extended permit tcp any host 192.168.100.200 range
8470 8480 log
access-list 103 extended permit ip 172.16.10.0 255.255.255.0
172.16.1.0 255.255.255.0
access-list 103 extended permit ip 172.16.10.0 255.255.255.0
172.16.6.0 255.255.255.0
access-list 103 extended permit ip 192.168.121.0 255.255.255.0
172.16.1.0 255.255.255.0
access-list inside extended deny tcp any object-group
MSN_Messenger_hosts object-group MSN_Messenger_tcp
access-list inside extended permit ip any any
access-list outside extended permit tcp any host 192.168.100.200 eq
telnet log
access-list outside extended permit tcp any host 192.168.100.200 eq
449 log
access-list outside extended permit tcp any host 192.168.100.200 range
8470 8480 log
access-list outside extended permit ip 172.16.1.0 255.255.255.0
172.16.10.0 255.255.255.0
access-list outside extended permit ip 192.168.1.0 255.255.255.0
172.16.10.0 255.255.255.0
access-list outside extended permit ip 172.16.11.0 255.255.255.0
172.16.10.0 255.255.255.0
access-list outside extended permit ip 172.16.6.0 255.255.255.0
172.16.10.0 255.255.255.0
access-list outside extended permit ip 172.16.16.0 255.255.255.0
172.16.10.0 255.255.255.0
access-list outside extended permit ip 192.168.121.0 255.255.255.0
172.16.10.0 255.255.255.0
access-list outside extended permit ip 192.168.121.0 255.255.255.0
172.16.1.0 255.255.255.0
access-list outside extended permit ip 192.168.121.0 255.255.255.0
192.168.1.0 255.255.255.0
access-list outside extended permit ip 192.168.121.0 255.255.255.0
172.16.11.0 255.255.255.0
pager lines 24
logging enable
logging timestamp
logging monitor warnings
logging buffered warnings
logging trap warnings
logging host inside 172.16.10.2 6/1468
mtu inside 1500
mtu outside 1500
mtu management 1500
ip local pool vpn_pool 192.168.121.1-192.168.121.254 mask
255.255.255.0
asdm image disk0:/asdm506.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 192.168.100.200 172.16.10.240 netmask
255.255.255.255
access-group inside in interface inside
access-group outside in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.100.1 1
timeout xlate 3:00:00
timeout conn 3:00:00 half-closed 3:00:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 3:00:00 absolute
group-policy arivpn internal
group-policy arivpn attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value 102
 default-domain value 
telemacus.net
 webvpn
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authorization command LOCAL
http server enable
no snmp-server location
no snmp-server contact
no sysopt connection permit-ipsec
crypto ipsec transform-set xxx_set esp-aes-256 esp-sha-hmac
crypto ipsec transform-set EX-SET esp-3des esp-sha-hmac
crypto dynamic-map DYN-MAP 10 match address acl_vpn
crypto dynamic-map DYN-MAP 10 set transform-set EX-SET
crypto dynamic-map DYN-MAP 10 set security-association lifetime
seconds 288000
crypto dynamic-map DYN-MAP 10 set reverse-route
crypto map xxx_map 100 match address 101
crypto map xxx_map 100 set peer 85.18.54.57
crypto map xxx_map 100 set transform-set xxx_set
crypto map xxx_map 105 match address 103
crypto map xxx_map 105 set peer 151.11.48.2
crypto map xxx_map 105 set transform-set ari_set
crypto map xxx_map 65535 ipsec-isakmp dynamic DYN-MAP
crypto map xxx_map interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 43200
isakmp policy 100 authentication pre-share
isakmp policy 100 encryption aes-256
isakmp policy 100 hash sha
isakmp policy 100 group 2
isakmp policy 100 lifetime 86400
isakmp nat-traversal  20
tunnel-group XXXXXXXX type ipsec-l2l
tunnel-group XXXXXXXX ipsec-attributes
 pre-shared-key *
tunnel-group arivpn type ipsec-ra
tunnel-group arivpn general-attributes
 address-pool vpn_pool
 default-group-policy arivpn
tunnel-group arivpn ipsec-attributes
 pre-shared-key *
tunnel-group XXXXXXXXXX type ipsec-l2l
tunnel-group XXXXXXXXXX ipsec-attributes
 pre-shared-key *
tunnel-group-map default-group 85.18.54.57
telnet 172.16.10.0 255.255.255.0 inside
telnet timeout 5
ssh 172.16.10.0 255.255.255.0 inside
ssh 172.16.1.0 255.255.255.0 inside
ssh 85.18.54.57 255.255.255.255 outside
ssh 192.168.100.0 255.255.255.0 outside
ssh 151.11.48.0 255.255.255.192 outside
ssh timeout 60
console timeout 0
management-access inside
dhcpd address 172.16.10.131-172.16.10.220 inside
dhcpd dns 172.16.10.1 172.16.11.1
dhcpd wins 172.16.10.1 172.16.11.1
dhcpd lease 259200
dhcpd ping_timeout 50
dhcpd domain
dhcpd option 3 ip 172.16.10.254
dhcpd option 46 hex 08
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Non inoltro la cfg di B in quanto il debug mi ferma il pacchetto in A
con il deny esportato precedentemente.
Qualcuno mi può essere d'aiuto?
Grazie mille,
P

 wrote in message 
news:483a7a96-e8a1-41d1...@i72g2000hsd.googlegroups.com...


 wrote in message 
news:8cc84aa8-2bc3-4696...@v46g2000hsv.googlegroups.com...


la prima quella legata ad A l'ho postata, l'altra è un delirio
postarla, ho una marea di ACL, posso provarci.
non so, ammetto he è un vero caos questa configurazione, se ti salta
all'occhio qualcosa però ti ringrazio un sacco a priori.
Paolo
PIX Version 7.2(3)
!
xxxxxxx
xxxxxxx
xxxxxxx
!
interface Ethernet0
 speed 100
 nameif outside
 security-level 0
 ip address xxxxxxx 255.255.255.192 standby xxxxxxx
!
interface Ethernet1
 speed 100
 nameif inside
 security-level 100
 ip address 172.16.1.28 255.255.255.0 standby 172.16.1.29
!
interface Ethernet2
 speed 100
 nameif dmz
 security-level 20
 ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
!
xxxxxxx
boot system flash:/image.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
 xxxxxxx
same-security-traffic permit intra-interface
object-group service MSN_Messenger_tcp tcp
 description MSN Messenger tries to use these ports
 port-object eq www
 port-object eq 1863
 port-object eq 7001
object-group network MSN_Messenger_hosts
 description hosts that MSN Messenger lives on
 network-object 65.54.195.0 255.255.255.0
 network-object 65.54.225.0 255.255.255.0
 network-object 65.54.226.0 255.255.254.0
 network-object 65.54.228.0 255.255.254.0
 network-object host 65.54.240.61
 network-object host 65.54.240.62
 network-object 207.46.104.0 255.255.252.0
 network-object 207.46.108.0 255.255.255.0
 network-object 207.68.171.0 255.255.255.0
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq https
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq https
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq
https
access-list outside_in extended permit tcp any host xxxxxxx eq smtp
access-list outside_in extended permit tcp any host srv0725-pub eq
https
access-list outside_in extended permit tcp any host srv0725-pub eq www
access-list outside_in extended permit tcp host 217.58.145.114 host
xxxxxxx eq ssh
access-list outside_in extended permit tcp host 217.58.145.114 host
xxxxxxx eq 3306
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp host 217.58.145.114 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 217.58.145.115 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 217.58.145.115 host
xxxxxxx eq ssh
access-list outside_in extended permit tcp host 217.58.145.115 host
xxxxxxx eq 3306
access-list outside_in extended permit tcp host 217.58.145.97 host
xxxxxxx
access-list outside_in remark xxxxxxxvs As400S653756b
access-list outside_in extended permit tcp host Sinord host xxxxxxx
access-list outside_in extended permit tcp any host xxxxxxx eq
https
access-list outside_in extended permit tcp any host xxxxxxx eq
https
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp host 149.139.10.23 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 149.139.10.23 host
xxxxxxx eq ftp-data
access-list outside_in extended permit tcp host 195.103.49.83 host
xxxxxxx eq 1414
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq smtp
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq smtp
access-list outside_in extended permit tcp any host xxxxxxx eq smtp
access-list outside_in extended permit tcp host 82.189.157.202 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 212.190.125.38 host
xxxxxxx eq 3306
access-list outside_in extended permit tcp host 213.193.188.105 host
xxxxxxx eq 3306
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any hostxxxxxxx eq www
access-list outside_in extended permit tcp host 217.133.16.214 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp host 82.63.214.147 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 82.63.214.147 host
xxxxxxx eq ftp-data
access-list outside_in extended permit tcp host 217.133.16.214 host
xxxxxxx eq ftp-data
access-list outside_in extended permit tcp any host xxxxxxx eq ftp
access-list outside_in extended permit tcp any host xxxxxxx eq
ftp-data
access-list outside_in extended permit tcp host 62.72.107.226 host
xxxxxxx eq 3306
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp 192.190.239.216
255.255.255.248 host xxxxxxx eq 3389
access-list outside_in extended permit tcp host 192.190.239.216 host
xxxxxxx eq 3389
access-list outside_in extended permit tcp 88.44.163.120
255.255.255.248
host xxxxxxx eq 3389
access-list outside_in extended permit tcp host 88.44.163.121 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 88.44.163.121 host
xxxxxxx eq ftp-data
access-list outside_in extended permit tcp host 88.44.163.121 host
xxxxxxx eq ftp
access-list outside_in extended permit tcp host 88.44.163.121 host
xxxxxxx eq ftp-data
access-list outside_in extended permit tcp host 88.44.163.121 host
xxxxxxx eq ssh
access-list outside_in extended permit tcp host xxxxxxx host
xxxxxxx eq 3389
access-list outside_in extended permit tcp any host xxxxxxx
access-list outside_in extended permit tcp host 217.201.132.102 host
151.11.48.7 eq ssh
access-list outside_in extended permit tcp host 88.44.163.121 host
151.11.48.22
access-list outside_in extended permit tcp host 88.44.163.121 host
xxxxxxx eq 3306
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp host fw-bsassi host
xxxxxxx
access-list outside_in extended permit tcp any host xxxxxxx eq www
access-list outside_in extended permit tcp any host xxxxxxx eq
https
access-list outside_in extended permit ip net-modena 255.255.255.0
net-lan 255.255.255.0
access-list outside_in extended permit ip net-modena 255.255.255.0
net-dmz 255.255.255.0
access-list outside_in extended permit ip net-modena 255.255.255.0
vpnsuperuser 255.255.255.0
access-list outside_in extended permit ip net-modenavpncli-172.16.16.0
255.255.255.0 net-lan 255.255.255.0
access-list outside_in extended permit ip net-bsassi 255.255.255.0
net-dmz 255.255.255.0
access-list outside_in extended permit ip net-bsassi 255.255.255.0
net-lan 255.255.255.0
access-list outside_in extended permit ip net-bsassi 255.255.255.0
vpnsuperuser 255.255.255.0
access-list outside_in extended permit ip net-
sassivpncli-192.168.121.0
255.255.255.0 net-lan 255.255.255.0
access-list outside_in extended permit ip net-
sassivpncli-192.168.121.0
255.255.255.0 net-dmz 255.255.255.0
access-list outside_in extended permit ip vpnsuperuser 255.255.255.0
net-lan 255.255.255.0
access-list outside_in extended permit ip vpnsuperuser 255.255.255.0
net-dmz 255.255.255.0
access-list outside_in extended permit ip vpnsuperuser 255.255.255.0
net-modena 255.255.255.0
access-list outside_in extended permit ip vpnsuperuser 255.255.255.0
net-bsassi 255.255.255.0
access-list outside_in extended permit tcp host 78.4.107.22 host
151.11.48.7 eq ssh
access-list outside_in extended permit tcp host 80.21.151.162 host
srv0725-pub eq 3389
access-list outside_in extended permit tcp any host 151.11.48.43 eq
www
access-list outside_in remark Bagnoli vs S653756b
access-list outside_in extended permit tcp host Bagnoli host
151.11.48.22
access-list outside_in remark Ecs Vs S653759B
access-list outside_in extended permit tcp host Ecs host xxxxxxx
access-list outside_in extended permit ip net-roma 255.255.255.0 net-
lan
255.255.255.0
access-list outside_in extended permit ip net-roma 255.255.255.0 net-
dmz
255.255.255.0
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
https
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
domain
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
smtp
access-list inside extended permit udp net-lan 255.255.255.0 any eq
domain
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.29 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
8003
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
8002
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.26 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
1433
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.4 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.16 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.17 eq 8080
access-list inside extended permit tcp host webserver-int any eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.17 eq 3306
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.17 eq ftp
access-list inside extended permit tcp host S653756B any eq ftp
access-list inside extended permit tcp host S653756B any eq telnet
access-list inside extended permit tcp host S653756B any eq ftp-data
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.17 eq ssh
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.50 eq ssh
access-list inside extended permit ip host xxxxxxx any
access-list inside remark xxxxxxx
access-list inside extended permit tcp net-lan 255.255.255.0 host
89.96.189.128
access-list inside extended permit udp net-lan 255.255.255.0 host
89.96.189.128
access-list inside extended permit ip net-lan 255.255.255.0 host
89.96.189.128
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.17 eq https
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
9876
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
5003
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
8080
access-list inside extended permit tcp net-lan 255.255.255.0 host
212.17.209.225 eq 2042
access-list inside extended permit tcp net-lan 255.255.255.0 host
195.103.49.83 eq 1414
access-list inside extended permit tcp net-lan 255.255.255.0 host
199.41.254.164 eq ftp
access-list inside extended permit udp host srv04 any eq domain
access-list inside extended permit tcp host 172.16.5.100 any eq ftp
access-list inside extended permit tcp host 172.16.1.13 host
192.168.1.17 eq 6101
access-list inside extended permit tcp host 172.16.1.13 host
192.168.1.17 eq 8192
access-list inside extended permit tcp host srv04 host 192.168.1.17 eq
6101
access-list inside extended permit tcp host srv04 host 192.168.1.17 eq
8192
access-list inside extended permit udp host 172.16.1.13 any eq domain
access-list inside extended permit tcp net-lan 255.255.255.0 host
198.141.28.66 eq ftp
access-list inside extended deny tcp net-lan 255.255.255.0 host
206.173.193.13
access-list inside extended deny tcp net-lan 255.255.255.0 host
216.239.153.142
access-list inside extended deny tcp net-lan 255.255.255.0 host
216.239.153.143
access-list inside extended deny tcp net-lan 255.255.255.0 host
206.173.193.10
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
www
access-list inside extended permit tcp host 172.16.1.169 any eq ftp
access-list inside extended permit tcp host 172.16.1.169 any eq ftp-
data
access-list inside extended permit tcp net-lan 255.255.255.0 host
web-meeting eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
web-meeting eq ftp-data
access-list inside extended permit tcp net-lan 255.255.255.0 host
199.41.238.143 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
194.185.44.188 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.35 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
151.99.208.211 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
213.156.60.61 eq telnet
access-list inside extended permit tcp net-lan 255.255.255.0 host
62.241.2.33 eq 33000
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
7618
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
8443
access-list inside extended permit tcp host srv09 any eq ftp
access-list inside extended permit tcp host srv09 any eq ftp-data
access-list inside extended permit tcp net-lan 255.255.255.0 host
172.16.6.1 eq 9595
access-list inside extended permit tcp net-lan 255.255.255.0 host
195.103.49.83 eq cifs
access-list inside extended permit tcp net-lan 255.255.255.0 host
192.168.1.40 eq ftp
access-list inside extended permit tcp net-lan 255.255.255.0 host
posta-dmz eq 18080
access-list inside extended permit tcp net-lan 255.255.255.0 host
posta-dmz eq 28080
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
1503
access-list inside extended permit tcp host 172.16.1.87 any eq ftp
access-list inside extended permit tcp host 172.16.1.87 any eq ftp-
data
access-list inside extended permit ip host srv06 any
access-list inside extended permit ip host srv0725 any
access-list inside extended permit tcp net-lan 255.255.255.0 any eq
citrix-ica
access-list inside extended permit tcp net-lan 255.255.255.0 host
194.185.163.78 eq 10580
access-list inside extended deny tcp net-lan 255.255.255.0 host
207.210.93.242
access-list inside extended deny tcp host 172.16.1.164 any
access-list inside extended permit tcp net-lan 255.255.255.0 host
posta-dmz eq ssh
access-list inside extended permit ip host spider any
access-list inside extended permit ip net-lan 255.255.255.0 net-bsassi
255.255.255.0
access-list inside extended permit ip net-lan 255.255.255.0 net-modena
255.255.255.0
access-list inside extended permit tcp net-lan 255.255.255.0 host
81.29.203.20 eq pop3
access-list inside extended permit tcp net-lan 255.255.255.0 host
81.29.203.20 eq smtp
access-list inside extended permit ip net-lan 255.255.255.0 net-roma
255.255.255.0
access-list inside extended deny tcp any object-group
MSN_Messenger_hosts object-group MSN_Messenger_tcp
access-list vpn-bsassi extended permit ip net-lan 255.255.255.0
net-bsassi 255.255.255.0
access-list vpn-bsassi extended permit ip net-dmz 255.255.255.0
net-bsassi 255.255.255.0
access-list vpn-bsassi extended permit ip vpnsuperuser 255.255.255.0
net-bsassi 255.255.255.0
access-list vpn-bsassi extended permit ip net-lan 255.255.255.0
net-sassivpncli-192.168.121.0 255.255.255.0
access-list dmz_to_outside extended permit tcp host posta-dmz any eq
8080
access-list dmz_to_outside extended permit tcp host posta-dmz any eq
https
access-list vpngroup2_splitTunnelAcl standard permit net-lan
255.255.255.0
access-list outside_cryptomap_dyn_30 extended permit ip any
vpnsuperuser
255.255.255.0
access-list vpnsuperuser extended permit ip any vpnsuperuser
255.255.255.0
access-list nonat-inside extended permit ip net-lan 255.255.255.0
vpnsuperuser 255.255.255.0
access-list nonat-inside extended permit ip net-lan 255.255.255.0
net-modena 255.255.255.0
access-list nonat-inside extended permit ip net-lan 255.255.255.0
net-bsassi 255.255.255.0
access-list nonat-inside extended permit ip net-lan 255.255.255.0
net-roma 255.255.255.0
access-list nonat-inside extended permit ip net-lan 255.255.255.0
net-sassivpncli-192.168.121.0 255.255.255.0
access-list nonat-dmz extended permit ip net-dmz 255.255.255.0
vpnsuperuser 255.255.255.0
access-list nonat-dmz extended permit ip net-dmz 255.255.255.0
net-bsassi 255.255.255.0
access-list nonat-dmz extended permit ip net-dmz 255.255.255.0
net-modena 255.255.255.0
access-list vpn-modena extended permit ip net-dmz 255.255.255.0
net-modena 255.255.255.0
access-list vpn-modena extended permit ip net-lan 255.255.255.0
net-modena 255.255.255.0
access-list vpn-modena extended permit ip vpnsuperuser 255.255.255.0
net-modena 255.255.255.0
access-list dmz extended permit tcp host posta-dmz host 192.168.1.11
eq
smtp
access-list dmz extended permit tcp host 192.168.1.24 host
192.168.1.22
eq smtp
access-list dmz extended permit tcp host posta-dmz host 192.168.1.14
eq
domain
access-list dmz extended permit udp host posta-dmz host 192.168.1.14
eq
domain
access-list dmz extended permit udp net-dmz 255.255.255.0 any eq
domain
access-list dmz extended permit tcp net-dmz 255.255.255.0 any eq
domain
access-list dmz extended permit tcp net-dmz 255.255.255.0 any eq www
access-list dmz extended permit tcp net-dmz 255.255.255.0 any eq https
access-list dmz extended permit tcp net-dmz 255.255.255.0 any eq smtp
access-list dmz extended permit tcp host 192.168.1.4 host 192.168.1.18
eq smtp
access-list dmz extended permit tcp host 172.16.1.170 host
192.168.1.16
eq 8080
access-list dmz extended permit tcp host 192.168.1.17 any eq ftp
access-list dmz extended permit tcp host 192.168.1.50 any eq ftp
access-list dmz extended permit tcp host 192.168.1.50 any eq ftp-data
access-list dmz extended permit tcp host 192.168.1.51 any eq ftp-data
access-list dmz extended permit tcp host 192.168.1.51 any eq ftp
access-list dmz extended permit tcp host 192.168.1.17 host
192.168.1.13
eq 6101
access-list dmz extended permit tcp host 192.168.1.17 host
192.168.1.13
eq 8192
access-list dmz extended permit tcp host 192.168.1.17 any eq 3306
access-list dmz extended permit tcp host 192.168.1.17 any eq 3307
access-list dmz extended permit icmp net-dmz 255.255.255.0
vpnsuperuser
255.255.255.0 echo-reply
access-list vpn-roma extended permit ip net-lan 255.255.255.0 net-roma
255.255.255.0
pager lines 24
logging enable
logging timestamp
logging console informational
logging monitor debugging
logging buffered informational
logging trap informational
logging asdm informational
logging mail debugging
logging recipient-address xxxxxxx level warnings
logging device-id ipaddress inside
logging ftp-server 192.168.1.40 /pix administrator ****
logging class ip trap debugging
logging class session asdm debugging
logging message 101001 level critical
logging message 100000 level alerts
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool vpn-superuser 172.16.6.1-172.16.6.255 mask 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface dmz
xxxxxxx
xxxxxxx
ip audit attack action alarm drop
failover
failover polltime unit 5 holdtime 15
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-523.bin
asdm history enable
arp timeout 14400
nat-control
global (outside) 1 xxxxxxx
global (outside) 2 xxxxxxx
global (dmz) 1 192.168.1.200
nat (inside) 0 access-list nonat-inside
nat (inside) 1 172.16.0.0 255.255.0.0
nat (dmz) 0 access-list nonat-dmz
nat (dmz) 2 net-dmz 255.255.255.0
static (inside,dmz) 192.168.1.22 172.16.1.22 netmask 255.255.255.255
static (inside,dmz) 192.168.1.11 srv09 netmask 255.255.255.255
static (inside,dmz) 192.168.1.14 172.16.1.14 netmask 255.255.255.255
static (inside,dmz) 192.168.1.18 srv0725 netmask 255.255.255.255
static (dmz,outside) xxxxxxx posta-dmz netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.24 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.29 netmask 255.255.255.255
static (inside,outside) xxxxxxx 172.16.1.15 netmask 255.255.255.255
static (inside,outside) srv0725-pub srv0725 netmask 255.255.255.255
static (inside,outside) xxxxxxx S653756B netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.26 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.17 netmask 255.255.255.255
static (dmz,outside) xxxxxxx web-meeting netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.23 netmask 255.255.255.255
static (inside,outside) xxxxxxx 172.16.1.51 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.30 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.34 netmask 255.255.255.255
static (inside,dmz) xxxxxxx srv04 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.36 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.35 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.37 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.4 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.38 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.39 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.40 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.41 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 172.16.1.112 netmask 255.255.255.255
static (inside,outside) xxxxxxx 172.16.1.14 netmask 255.255.255.255
static (inside,outside) xxxxxxx 172.16.1.7 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.32 netmask 255.255.255.255
static (dmz,outside) xxxxxxx 192.168.1.51 netmask 255.255.255.255
static (dmz,outside) xxxxxxx WebARGroup netmask 255.255.255.255
access-group outside_in in interface outside
access-group inside in interface inside
access-group dmz in interface dmz
route outside 0.0.0.0 0.0.0.0 151.11.48.1 1
route inside 137.135.128.0 255.255.255.0 172.16.1.70 1
route inside 172.16.5.0 255.255.255.0 172.16.1.1 1
route inside 172.16.7.0 255.255.255.0 172.16.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat
0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-
disconnect
0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http vpnsuperuser 255.255.255.0 inside
http srv09 255.255.255.255 inside
http matteoM 255.255.255.255 inside
http net-lan 255.255.255.0 inside
http vpnsuperuser 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
no sysopt connection permit-vpn
crypto ipsec transform-set strong-des esp-3des esp-md5-hmac
crypto ipsec transform-set strong-intranet esp-aes-256 esp-sha-hmac
crypto ipsec transform-set strong-des-sha esp-3des esp-sha-hmac
crypto dynamic-map dynmap 10 set transform-set strong-des
crypto dynamic-map dynmap 30 match address vpnsuperuser
crypto dynamic-map dynmap 30 set transform-set strong-des
crypto map mymap 10 ipsec-isakmp dynamic dynmap
crypto map mymap 15 match address vpn-bsassi
crypto map mymap 15 set peer fw-bsassi
crypto map mymap 15 set transform-set strong-intranet
crypto map mymap 20 match address vpn-modena
crypto map mymap 20 set peer fw-modena
crypto map mymap 20 set transform-set strong-intranet
crypto map mymap 25 match address vpn-roma
crypto map mymap 25 set peer fw-roma
crypto map mymap 25 set transform-set strong-des
crypto map mymap interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto isakmp policy 15
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 20
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
crypto isakmp ipsec-over-tcp port 10000
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
telnet vpnsuperuser 255.255.255.0 outside
telnet net-lan 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
ssh version 1
console timeout 0
management-access inside
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect http
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
ssl encryption des-sha1 rc4-md5
group-policy vpngroup internal
group-policy vpngroup attributes
 wins-server value 172.16.1.12
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *
tunnel-group vpngroup type ipsec-ra
tunnel-group vpngroup general-attributes
 address-pool vpn-superuser
 default-group-policy vpngroup
tunnel-group vpngroup ipsec-attributes
 pre-shared-key *
tunnel-group xxxxxxxtype ipsec-l2l
tunnel-group xxxxxxxipsec-attributes
 pre-shared-key *
tunnel-group xxxxxxxtype ipsec-l2l
tunnel-group xxxxxxxipsec-attributes
 pre-shared-key *
tunnel-group xxxxxxx type ipsec-l2l
tunnel-group xxxxxxxipsec-attributes
 pre-shared-key *
smtp-server 172.16.1.18
prompt hostname context
Cryptochecksum:6d5e8ebb70ed9441cb13afefe4a59e73
: end
