ASA5510 without any extra services such as utm and using Comcast business internet.
Users stopped getting emails in middle of the night. That was our first indication. After checking things every computer had internet access except anything that was NAT'd. This included DNS server, exchange, web servers, etc. If I delete the NAT for a server it has internet. Our inside to outside is permitted any any. We do not filter it outgoing.
After trying a backup ASA with a previous config and it still not working I was pretty convinced it was Comcast. Since they wouldn't call us back I got a cheapy small business firewall, configured our Nats and viola. It all worked. Head scratcher!
So, I'm not sure how at 2 am in a company that only has 8-5 shift this happened at 2am and only to NAT'd computers. Tried two diffrent ASAs with two diffrent backup configs but works on a two hundred dollar firewall.
Comcast denies any changes.
: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
:
ASA Version 8.2(5)59
!
hostname My-Firewall
domain-name mydomain.com
enable password aaaaaaaaaa encrypted
passwd aaaaaaaaaaaaa encrypted
no names
name 192.168.163.0 city1 description Main subnet for Fort Wayne
name 192.168.164.0 city2 description Main subnet for city2
name 192.168.10.0 IP_thiss description Subnet for IP thiss in city3
name 192.168.160.0 city3 description Main city3 subnet
name 192.168.160.94 city3_Enterprise_Manager description Voicserver1 Server in city3
name 192.168.13.80 videothis_city3 description city3 video conference
name 192.168.160.81 this_Communicator description this Communicator
name 192.168.160.30 companyName-webconf description webconf server in city3
name 192.168.160.32 companyName-yabb description companyName-yabb
name 192.168.160.31 companyNameweb description companyName web server in city3access-list Inside_nat0_outbound permit ip 10.44.84.0 255.255.252.0 172.16.199.0 255.255.255.224
name 192.168.160.45 server_Server description FTP server on companyName-er01\
name 90.84.51.39 stuff_Outside_Server description Used for stuff Software Incoming
name 192.168.63.0 wf_Guest_Wifi description wf_Guest_Wifi
name 192.168.244.0 city3_Guest_Wifi description city3_Guest_Wifi
name 192.168.61.0 hgfd_Guest_Wifi description hgfd_Guest_Wifi
name 192.168.62.0 Rich_Guest_Wifi description Rich_Guest_Wifi
name 192.168.23.0 city3companyName-WIFI description Subnet buit city3 WiFi
name 90.195.161.168 Comcast_Outside_Internet
name 90.195.161.210 server1_Outside
name 192.168.160.12 server2_Inside description Shiny the DNS server
name 90.195.161.215 server_Outside
name 10.10.40.1 othercompanyRouter
name 90.195.161.218 othercompany_Outside
name 192.168.163.80 videothis_wf description Fort Wayne video conf
name 192.168.13.0 city3_videothis_Network description videothis Video subnet in city3
name 90.195.161.214 External-companyName-WEB description FOR EXTERNAL SERVICE APP
name 192.168.160.13 Internal-companyName-WEB description SERVER USED FOR EXTERNAL SERVICE APP
name 192.168.160.15 server1_Server description server1 server
name 90.195.161.216 wf_videothis_Outside
name 90.195.161.217 city3videothis_Outside
name 192.168.160.14 server_server3-Server description companyName-util
name 90.195.161.212 server2_Outside
name 172.16.162.0 VPNwfNetwork
name 172.16.161.0 VPNcity3Network
name 12.47.243.162 BigCompany_Main_Address description Firewall and VPN address on BigCompany circuit
name 4.53.56.162 A-4.53.56.162 description us-baas.acronis.com
name 192.168.165.80 Site4_videothis description Site4 conf room pc with videothis software
name 216.165.24.0 fun_outgoing_1
name 63.128.21.0 fun_outgoing_2
name 199.199.41.113 fun_outgoing_ 3
name 199.199.31.0 funcast_incoming_a nd_outgoing_1 description server1 Filter incoming
name 199.199.30.0 funcast_incoming_and_outgoing_2 description server1 filter incoming
name 205.244.110.0 funcast_incoming_and_outgoing_3 description server1 filter incoming
name 205.244.111.0 funcast_incoming_and_outgoing_4 description server1 filter incoming
name 244.141.187.121 country_Signal_Outside description Offsite Backups
name 192.168.165.0 Site4 description Main subnet for Site4
name 192.168.160.96 thisSystem_Inside.96
name 192.168.160.97 thisSystem_Inside.97
name 192.168.160.98 thisSystem_Inside.98
name 90.195.161.219 thisSystem_Outside.219
name 90.195.161.220 thisSystem_Outside.220
name 90.195.161.221 thisSystem_Outside.221
!
interface Ethernet0/0
shutdown
nameif OLD-T1s
security-level 0
ip address 244.132.192.165 255.255.255.224
!
interface Ethernet0/1
description Lan that goes to HP switch but ultimatley to main router.
nameif Inside
security-level 100
ip address 10.44.104.16 255.255.255.0
!
interface Ethernet0/2
description Comcast Internet
nameif Outside
security-level 0
ip address 90.195.161.169 255.255.255.240
!
interface Ethernet0/3
description 10mb internet circuit through BigCompany.
nameif BigCompanyinternet
security-level 0
ip address 12.47.243.162 255.255.255.248
!
interface Management0/0
nameif manage
security-level 100
ip address 192.168.99.1 255.255.252.0
management-only
!
no ftp mode passive
dns domain-lookup OLD-T1s
dns domain-lookup Inside
dns domain-lookup Outside
dns server-group DefaultDNS
name-server 192.168.160.16
name-server 192.168.163.16
name-server 192.168.165.16
domain-name mydomain.com
dns server-group myoutsidedomain.com
name-server 192.168.160.12
domain-name myoutsidedomain.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network Guest_Wifi_Networks
description Traffic Identified for all wifi guest networks
network-object 192.168.61.0 255.255.255.0
network-object 192.168.62.0 255.255.255.0
network-object 192.168.63.0 255.255.255.0
network-object 192.168.244.0 255.255.255.0
object-group service stuff tcp-udp
description stuff Software incoming
port-object eq 34789
port-object range 49152 65535
port-object eq sip
port-object eq www
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object udp
protocol-object tcp
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service AllPortOpen
description AllPortOpen
service-object ip
object-group network wfallNetworks
network-object 192.168.163.0 255.255.255.0
object-group service videothis_h323
service-object tcp range 3230 3243
service-object tcp eq h323
service-object udp range 3230 3285
object-group network videothisBlocked
network-object host 103.28.37.174
network-object host 119.68.244.35
network-object host 121.14.133.164
network-object host 121.14.133.35
network-object host 122.248.32.134
network-object host 123.30.145.28
network-object host 162.243.223.37
network-object host 184.168.68.152
network-object host 185.14.232.171
network-object host 187.22.8.22
network-object host 187.84.144.21
network-object host 188.40.95.125
network-object host 191.241.39.5
network-object host 197.231.244.24
network-object host 199.168.112.38
network-object host 201.151.179.6
network-object host 202.93.176.243
network-object host 203.162.79.155
network-object host 206.225.80.25
network-object host 199.166.134.62
network-object host 208.43.10.227
network-object host 208.70.56.60
network-object host 209.197.191.75
network-object host 209.197.191.77
network-object host 209.41.161.161
network-object host 210.242.195.5
network-object host 210.245.90.163
network-object host 210.91.78.161
network-object host 216.165.99.1
network-object host 24.227.199.37
network-object host 38.109.36.53
network-object host 41.221.5.198
network-object host 90.30.119.83
network-object host 90.57.71.147
network-object host 54.160.152.3
network-object host 54.247.191.248
network-object host 58.83.237.14
network-object host 67.199.143.73
network-object host 69.65.17.180
network-object host 76.180.236.54
network-object host 78.129.231.92
network-object host 78.83.63.129
network-object host 85.125.67.66
network-object host 85.214.155.83
network-object host 85.214.246.93
network-object host 93.180.63.163
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp eq 8443
service-object tcp eq ftp
service-object tcp eq ftp-data
service-object tcp eq https
object-group network vpncity3Network
network-object 172.16.161.0 255.255.255.0
object-group network vpnwfNetwork
network-object 172.16.162.0 255.255.255.0
object-group network country_Signal_Incoming_Group
description name said these IP's are needed inbound for backups to US Signal
network-object 184.175.140.128 255.255.255.128
network-object 184.175.183.128 255.255.255.128
network-object host 244.141.171.160
network-object host 244.141.171.161
network-object host 244.141.171.162
network-object host 244.141.171.163
network-object host 244.141.171.170
network-object host 244.141.171.171
network-object host 244.141.171.172
network-object host 244.141.171.173
network-object host 244.141.171.175
network-object host 244.141.171.190
network-object host 244.141.171.60
network-object host 244.141.171.61
network-object host 244.141.171.62
network-object 244.141.187.112 255.255.255.240
object-group network funcast_incoming_all_ranges
description These are the ranges funcast uses for incoming. There are two additional outgoing only but we don't block outgoing. Those are 63.128.21.0/24 199.199.41.113/32 216.165.24.0/24
network-object 205.244.110.0 255.255.255.0
network-object 205.244.111.0 255.255.255.0
network-object 199.199.30.0 255.255.255.0
network-object 199.199.31.0 255.255.255.128
object-group network funcast_outgoing_all_ranges
network-object 205.244.110.0 255.255.255.0
network-object 205.244.111.0 255.255.255.0
network-object 199.199.30.0 255.255.255.0
network-object 199.199.31.0 255.255.255.128
network-object host 199.199.41.113
network-object 216.165.24.0 255.255.255.0
network-object 63.128.21.0 255.255.255.0
object-group service DM_INLINE_SERVICE_2
service-object tcp range 3998 3999
service-object tcp eq 5566
service-object tcp range 6800 6802
service-object udp eq 20001
service-object udp range 5004 5007
service-object udp range 50098 50508
service-object udp eq 5567
service-object udp range 6004 6261
service-object udp range 6604 7039
service-object udp eq tftp
service-object tcp eq 5570
object-group service DM_INLINE_SERVICE_0
service-object tcp range 3998 3999
service-object tcp eq 5566
service-object tcp eq 5570
service-object tcp range 6800 6802
service-object udp eq 20001
service-object udp range 5004 5007
service-object udp range 50098 50508
service-object udp eq 5567
service-object udp range 6004 6261
service-object udp range 6604 7039
service-object udp eq tftp
object-group service DM_INLINE_SERVICE_4
service-object tcp range 3998 3999
service-object tcp eq 5566
service-object tcp eq 5570
service-object tcp range 6800 6802
service-object udp eq 20001
service-object udp range 5004 5007
service-object udp range 50098 50508
service-object udp eq 5567
service-object udp range 6004 6261
service-object udp range 6604 7039
service-object udp eq tftp
object-group service DM_INLINE_SERVICE_3
service-object tcp-udp eq domain
service-object tcp eq www
service-object tcp eq https
access-list Inside_nat0_outbound extended permit ip 172.16.161.0 255.255.255.0 172.16.162.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 10.44.88.0 255.255.252.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.160.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.163.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.164.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.165.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 10.44.104.0 255.255.252.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.13.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.15.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 10.10.0.0 255.255.0.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.23.0 255.255.255.0 172.16.199.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip any 172.16.199.0 255.255.255.0
access-list Outside_access_in remark To Block Ping In and Out
access-list Outside_access_in extended deny icmp any any
access-list Outside_access_in extended permit udp any any eq isakmp
access-list outbound extended deny ip any host 216.178.39.74
access-list outbound extended deny ip any host 216.178.38.131
access-list outbound extended deny ip any host 216.178.38.129
access-list outbound extended deny ip any host 216.178.38.130
access-list outbound extended deny ip any host 216.178.39.15
access-list outbound extended deny ip any host 216.178.39.14
access-list outbound extended deny ip any host 216.178.39.13
access-list outbound extended deny ip any host 216.178.39.12
access-list outbound extended deny ip any host 216.178.39.11
access-list outbound extended deny tcp any host 216.178.39.16 eq www
access-list outbound extended deny ip any host 216.178.39.16
access-list outbound extended permit ip any any
access-list outbound extended permit ip any host 90.84.51.39
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.165.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 172.16.16.0 255.255.240.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.160.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.163.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.164.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.13.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 10.44.0.0 255.255.0.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.15.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0
access-list companyNamevpn_splitTunnelAcl remark Guest WiFi
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.244.0 255.255.255.0
access-list outside extended permit icmp any any
access-list Inside_ACL extended permit ip any any
access-list Inside_ACL extended permit icmp any any
access-list Inside_ACL extended permit tcp host 192.168.160.15 object-group funcast_outgoing_all_ranges eq smtp
access-list Inside_ACL extended permit ip any host 244.141.187.121
access-list 101 extended permit ip 192.168.13.0 255.255.255.0 any
access-list dsl extended permit ip any any
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_3 any host 90.195.161.212
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_4 any host 90.195.161.221
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_0 any host 90.195.161.220
access-list Outside_ACL extended permit tcp object-group funcast_incoming_all_ranges host 90.195.161.210 eq smtp
access-list Outside_ACL remark WebMail
access-list Outside_ACL extended permit tcp any host 90.195.161.210 eq https
access-list Outside_ACL extended permit icmp any any
access-list Outside_ACL extended permit ip any host 90.195.161.218
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_2 any host 90.195.161.219
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_1 any host 90.195.161.215
access-list Outside_ACL extended permit tcp any host 90.195.161.214 eq https
access-list Outside_ACL extended permit ip host 244.141.187.121 any
access-list Outside_ACL remark To Block Hackers that have been hitting our network. Edit the object videothisBlocked to add more.
access-list Outside_ACL extended deny ip object-group videothisBlocked any
access-list Outside_ACL remark Malicious BigCompanyack on wf videothis. From Hungary.Added 4/13/2015 Rodney Tyler
access-list Outside_ACL extended deny ip host 91.83.236.154 any
access-list Outside_ACL remark Enable this rule to allow Fort Wayne videothis to accept calls
access-list Outside_ACL extended permit object-group videothis_h323 any host 90.195.161.216 inactive
access-list Outside_ACL remark Enable this rule to allow city3 videothis to accept calls
access-list Outside_ACL extended permit object-group videothis_h323 any host 90.195.161.217 inactive
access-list Outside_ACL extended permit ip host 90.84.51.39 any
access-list Outside_ACL extended permit object-group DM_INLINE_PROTOCOL_1 object-group country_Signal_Incoming_Group any range 7770 8000
access-list outside_1_cryptomap extended permit ip 10.44.104.0 255.255.255.0 192.168.163.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.44.104.0 255.255.255.0 192.168.163.0 255.255.255.0
access-list qos extended permit ip host 90.195.161.216 any
access-list qos extended permit ip host 90.195.161.217 any
access-list AndroidVPN_Split_ACL remark All Sites
access-list AndroidVPN_Split_ACL standard permit 192.168.0.0 255.255.0.0
access-list AndroidVPN_Split_ACL remark Making sure Firewall and any other 10.44.104 interface passes traffic
access-list AndroidVPN_Split_ACL standard permit 10.44.104.0 255.255.255.0
access-list Outside_1_cryptomap extended permit ip 172.16.161.0 255.255.255.0 172.16.162.0 255.255.255.0
access-list Outside_1_cryptomap extended permit ip 172.16.162.0 255.255.255.0 172.16.161.0 255.255.255.0
access-list Outside_2_cryptomap extended permit ip 172.16.161.0 255.255.255.0 172.16.162.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 12.47.243.160 255.255.255.248
access-list BigCompanyvpn_splitTunnelAcl standard permit 172.16.161.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.160.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.163.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.164.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.165.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 172.16.199.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.13.0 255.255.255.0
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0
access-list BigCompanyinternet_access_in extended permit icmp any any
access-list testing webtype permit url any log default
pager lines 20
logging enable
logging buffer-size 1000000
logging buffered notifications
logging history errors
logging asdm notifications
logging from-address [email protected]
logging ftp-server 244.132.192.171 21 companyName *****
mtu OLD-T1s 1500
mtu Inside 1500
mtu Outside 1500
mtu BigCompanyinternet 1500
mtu manage 1500
ip local pool VPNipPool 172.16.199.129-172.16.199.254 mask 255.255.255.128
ip local pool companyNamevpn 172.16.199.1-172.16.199.25 mask 255.255.255.224
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp deny any OLD-T1s
icmp deny any Outside
asdm image disk0:/asdm-621.bin
no asdm history enable
arp timeout 14400
global (Outside) 101 interface
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 101 0.0.0.0 0.0.0.0 dns
static (Inside,Outside) 90.195.161.217 192.168.13.80 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.218 10.10.40.1 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.214 192.168.160.13 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.210 192.168.160.15 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.215 192.168.160.14 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.216 192.168.163.80 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.220 192.168.160.96 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.219 192.168.160.98 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.221 192.168.160.97 netmask 255.255.255.255
static (Inside,Outside) 90.195.161.212 192.168.160.12 netmask 255.255.255.255
access-group Outside_access_in in interface OLD-T1s
access-group Inside_ACL in interface Inside
access-group Outside_ACL in interface Outside
access-group BigCompanyinternet_access_in in interface BigCompanyinternet
route Outside 0.0.0.0 0.0.0.0 90.195.161.222 1
route Inside 10.10.0.0 255.255.0.0 192.168.160.1 1
route Inside 172.16.16.0 255.255.240.0 192.168.160.1 1
route Inside 172.16.161.0 255.255.255.0 192.168.160.1 1
route Inside 172.16.161.0 255.255.255.0 172.16.161.1 1
route Inside 192.168.160.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.163.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.164.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.165.0 255.255.255.0 192.168.160.1 1
route Inside 172.16.199.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.10.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.13.0 255.255.255.0 192.168.13.1 1
route Inside 192.168.15.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.23.0 255.255.255.0 192.168.23.1 1
route Inside 192.168.61.0 255.255.255.0 192.168.61.1 1
route Inside 192.168.62.0 255.255.255.0 192.168.62.1 1
route Inside 192.168.244.0 255.255.255.0 192.168.244.1 1
route Inside 192.168.70.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.71.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.72.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.73.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.74.0 255.255.255.0 192.168.160.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server TACACS+ protocol tacacs+
max-failed-BigCompanyempts 2
aaa-server RADIUS protocol radius
max-failed-BigCompanyempts 2
aaa-server RADIUS (Inside) host 192.168.160.16
timeout 5
key *****
aaa-server auth protocol radius
max-failed-BigCompanyempts 2
aaa-server auth (Inside) host 192.168.160.16
key *****
aaa authentication ssh console LOCAL
http server enable
http server idle-timeout 60
http 192.0.0.0 255.0.0.0 Inside
http 192.168.0.0 255.255.0.0 manage
http 192.168.0.0 255.255.0.0 Inside
snmp-server host Inside 192.168.160.14 community ***** version 2c
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
snmp-server enable traps remote-access session-threshold-exceeded
sysopt noproxyarp OLD-T1s
sysopt noproxyarp Inside
sysopt noproxyarp Outside
sysopt noproxyarp BigCompanyinternet
sysopt noproxyarp manage
auth-prompt prompt Login
auth-prompt accept Your login is accepted
auth-prompt reject Your login information was rejected by the Radius Server
REMOVED CRYPTO
client-update enable
vpn-addr-assign local reuse-delay 10
telnet 192.168.0.0 255.255.0.0 Inside
telnet 0.0.0.0 0.0.0.0 Inside
telnet timeout 60
ssh 10.44.104.0 255.255.255.0 Inside
ssh 192.168.0.0 255.255.0.0 Inside
ssh 0.0.0.0 0.0.0.0 Inside
ssh 0.0.0.0 0.0.0.0 Outside
ssh timeout 60
console timeout 60
management-access Inside
dhcpd address 192.168.99.2-192.168.99.254 manage
dhcpd enable manage
!
priority-queue Inside
priority-queue Outside
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp authenticate
ntp server 192.168.160.16 source Inside prefer
ssl encryption rc4-sha1 aes256-sha1 aes128-sha1 3des-sha1 des-sha1 rc4-md5
ssl trust-point ASDM_TrustPoint0 Outside
ssl trust-point ASDM_TrustPoint0 OLD-T1s vpnlb-ip
ssl trust-point ASDM_TrustPoint0 OLD-T1s
REMOVED VPN POLICIES AND QOS
!
!
policy-map type inspect dns preset_server2_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_server2_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
policy-map qos
description voip and videothis
class qos
priority
policy-map type inspect esmtp tls-allow
parameters
no mask-banner
allow-tls
!
service-policy global_policy global
service-policy qos interface Inside
service-policy qos interface Outside
: end
