I'm trying to set up a guest network.
The native VLAN for our switches (all Cisco Catalyst switches) was never changed away from 1 (untagged). I've created VLAN 20 to use for the guest network.
I'm using a physical DMZ interface on a Cisco ASA to act as the gateway/DHCP server for the guest net. I've trunked all ports going to the wireless controller, access points, and the ASA interface, and set them to allow VLAN 20. However, nothing was talking to each other.
I decided to troubleshoot by connecting a laptop to a port on the same switch that the gateway interface was connected to. Both ports are trunked, and set to allow VLANs 1 and 20. The ports show as trunking. I manually set the IP address of the machine in the same subnet as the gateway interface but cannot get a ping.
However, if I change the trunk ports for the GW and PC to use VLAN 20 as the native VLAN, they do indeed talk. I'd like to be able to pass both VLANs on all trunk ports, except for the one going to the gateway (which I'll probably change to just an access port for VLAN 20), so both networks can pass through the remaining trunks.
Any idea what I'm missing? Been a long while since I set up VLANs and I'm sure that I'm overlooking something, on my part.
Ron M. - As of right now, I'm just troubleshooting using one switch, a Catalyst 3560. Port 9 is connected to the DMZ interface of an ASA 5512-x, with an IP 192.168.125.1. The port is a trunk with native VLAN 20, only VLAN 20 allowed. The PC that I'm troubleshooting from is connected to port 38, set up as a trunk to allow both VLANs 1 and 20.
Ron T. - Output from that command:
sh spanning-tree vlan 20
VLAN0020
Spanning tree enabled protocol ieee
Root ID Priority 32788
Address 0035.1aad.eb00
This bridge is the root
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 32788 (priority 32768 sys-id-ext 20)
Address 0035.1aad.eb00
Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Aging Time 300 sec
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/1 Desg FWD 4 128.1 P2p
Gi1/0/2 Desg FWD 19 128.2 P2p
Gi1/0/3 Desg FWD 4 128.3 P2p
Gi1/0/4 Desg FWD 4 128.4 P2p
Gi1/0/5 Desg FWD 4 128.5 P2p
Gi1/0/6 Desg FWD 4 128.6 P2p
Gi1/0/8 Desg FWD 4 128.8 P2p
Gi1/0/9 Desg FWD 4 128.9 P2p
Interface Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
Gi1/0/12 Desg FWD 4 128.12 P2p
Gi1/0/30 Desg FWD 4 128.30 P2p
Gi1/0/38 Desg FWD 4 128.38 P2p
Gi1/0/42 Desg FWD 4 128.42 P2p
Gi1/0/44 Desg FWD 4 128.44 P2p
Gi1/0/46 Desg FWD 4 128.46 P2p
Gi1/0/47 Desg FWD 19 128.47 P2p
Gi1/0/48 Desg FWD 4 128.48 P2p
Switch Config:
Building configuration...
Current configuration : 6527 bytes
!
! Last configuration change at 13:46:51 UTC Fri Apr 27 2018
!
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service compress-config
!
hostname MEDFORDCORESWITCH
!
boot-start-marker
boot-end-marker
!
!
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
no logging console
no aaa new-model
switch 1 provision ws-c3650-48ps
!
ip domain-name xxx.com
ip device tracking
!
!
!
!
!
!
!
!
diagnostic bootup level minimal
spanning-tree mode pvst
spanning-tree extend system-id
!
redundancy
mode sso
!
!
ip ssh version 2
!
class-map match-any non-client-nrt-class
match non-client-nrt
!
policy-map port_child_policy
class non-client-nrt-class
bandwidth remaining ratio 10
!
!
!
!
!
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet1/0/1
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/2
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/3
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/4
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/5
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/6
switchport trunk native vlan 20
switchport trunk allowed vlan 20
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/7
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/8
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/9
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/10
duplex full
!
interface GigabitEthernet1/0/11
duplex full
!
interface GigabitEthernet1/0/12
switchport mode trunk
power inline never
duplex full
!
interface GigabitEthernet1/0/13
duplex full
!
interface GigabitEthernet1/0/14
duplex full
!
interface GigabitEthernet1/0/15
duplex full
!
interface GigabitEthernet1/0/16
duplex full
!
interface GigabitEthernet1/0/17
duplex full
!
interface GigabitEthernet1/0/18
duplex full
!
interface GigabitEthernet1/0/19
duplex full
!
interface GigabitEthernet1/0/20
duplex full
!
interface GigabitEthernet1/0/21
duplex full
!
interface GigabitEthernet1/0/22
duplex full
!
interface GigabitEthernet1/0/23
duplex full
!
interface GigabitEthernet1/0/24
duplex full
!
interface GigabitEthernet1/0/25
duplex full
!
interface GigabitEthernet1/0/26
duplex full
!
interface GigabitEthernet1/0/27
duplex full
!
interface GigabitEthernet1/0/28
duplex full
!
interface GigabitEthernet1/0/29
duplex full
!
interface GigabitEthernet1/0/30
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/31
duplex full
!
interface GigabitEthernet1/0/32
duplex full
!
interface GigabitEthernet1/0/33
duplex full
!
interface GigabitEthernet1/0/34
duplex full
!
interface GigabitEthernet1/0/35
duplex full
!
interface GigabitEthernet1/0/36
duplex full
!
interface GigabitEthernet1/0/37
duplex full
!
interface GigabitEthernet1/0/38
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/39
duplex full
!
interface GigabitEthernet1/0/40
duplex full
!
interface GigabitEthernet1/0/41
duplex full
!
interface GigabitEthernet1/0/42
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/43
duplex full
!
interface GigabitEthernet1/0/44
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/45
duplex full
!
interface GigabitEthernet1/0/46
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/47
switchport mode trunk
duplex full
!
interface GigabitEthernet1/0/48
switchport mode trunk
duplex full
!
interface GigabitEthernet1/1/1
!
interface GigabitEthernet1/1/2
!
interface GigabitEthernet1/1/3
!
interface GigabitEthernet1/1/4
!
interface Vlan1
ip address 10.10.108.8 255.255.252.0
!
interface Vlan20
ip address 192.168.125.10 255.255.255.0
!
ip http server
ip http authentication local
ip http secure-server
!
!
!
!
!
line con 0
password 7 046B0A151C361C5C0D4903341A0A0114237B2A3B72
login
stopbits 1
line aux 0
stopbits 1
line vty 0 4
password 7 1059280D061F3F2E02
login local
transport input ssh
line vty 5 15
password 7 1059280D061F3F2E02
login local
transport input ssh
!
wsma agent exec
profile httplistener
profile httpslistener
wsma agent config
profile httplistener
profile httpslistener
wsma agent filesys
profile httplistener
profile httpslistener
wsma agent notify
profile httplistener
profile httpslistener
!
wsma profile listener httplistener
transport http
!
wsma profile listener httpslistener
transport https
ap group default-group
end
ASA Config (trimmed up):
medfordasa5512# sh run
: Saved
:
: Serial Number: xxxxxxxxxx
: Hardware: ASA5512, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
:
ASA Version 9.8(2)20
!
hostname
enable password
names
no mac-address auto
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address x.x.x.x 255.255.224.0 standby x.x.x.x
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 10.10.108.1 255.255.252.0 standby 10.10.108.2
!
interface GigabitEthernet0/2
nameif dmz
security-level 50
ip address 192.168.125.1 255.255.255.0 standby 192.168.125.253
!
interface GigabitEthernet0/3
nameif point-to-point
security-level 100
ip address 172.16.10.2 255.255.255.0 standby 172.16.10.3
!
interface GigabitEthernet0/4
description LAN Failover Interface
!
interface GigabitEthernet0/5
description STATE Failover Interface
!
interface Management0/0
management-only
nameif management
security-level 100
no ip address
!
boot system disk0:/asa982-20-smp-k8.bin
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network tierpoint-lan
subnet 10.20.10.0 255.255.255.0
object network tp-anyconnect
subnet 10.50.50.0 255.255.255.0
object network everett
subnet 10.1.0.0 255.255.252.0
object-group service Security-Ports tcp
port-object eq 10554
port-object eq 8000
port-object eq 8080
port-object eq https
access-list outside_access_in extended permit icmp any any
access-list outside_access_in extended permit tcp any object security object-group Security-Ports
access-list outside_cryptomap extended permit ip 10.10.108.0 255.255.252.0 object winchester-lan
access-list outside_cryptomap_1 extended permit ip 10.10.108.0 255.255.252.0 object providence-lan
access-list outside_cryptomap_2 extended permit ip 10.10.108.0 255.255.252.0 object allston-lan
access-list outside_cryptomap_5 extended permit ip 10.10.108.0 255.255.252.0 object bronx-lan
access-list outside_cryptomap_4 extended permit ip 10.10.108.0 255.255.252.0 object bu-lan
access-list outside_cryptomap_3 extended permit ip 10.10.108.0 255.255.252.0 object beverly-lan
access-list outside_cryptomap_8 extended permit ip 10.10.108.0 255.255.252.0 object ct-370james-lan
access-list outside_cryptomap_6 extended permit ip 10.10.108.0 255.255.252.0 object harvarddef-lan
access-list outside_cryptomap_9 extended permit ip 10.10.108.0 255.255.252.0 object ct-garage-lan
access-list outside_cryptomap_10 extended permit ip 10.10.108.0 255.255.252.0 object smast-lan
access-list outside_cryptomap_11 extended permit ip 10.10.108.0 255.255.252.0 object eprov-brownu-lan
access-list outside_cryptomap_12 extended permit ip 10.10.108.0 255.255.252.0 object everett
access-list outside_cryptomap_15 extended permit ip 10.10.108.0 255.255.252.0 object harvardsackler-lan
access-list outside_cryptomap_13 extended permit ip 10.10.108.0 255.255.252.0 object massport-termb-lan
access-list outside_cryptomap_14 extended permit ip 10.10.108.0 255.255.252.0 object brandeis-lan
access-list outside_cryptomap_20 extended permit ip 10.10.108.0 255.255.252.0 object mit-lan
access-list outside_cryptomap_19 extended permit ip 10.10.108.0 255.255.252.0 object medway-lan
access-list outside_cryptomap_17 extended permit ip 10.10.108.0 255.255.252.0 object sterling-lan
access-list outside_cryptomap_18 extended permit ip 10.10.108.0 255.255.252.0 object needham-lan
access-list outside_cryptomap_16 extended permit ip 10.10.108.0 255.255.252.0 object ngrid-southie-lan
access-list outside_cryptomap_21 extended permit ip 10.10.108.0 255.255.252.0 object massportcu-lan
access-list outside_mpc extended permit ip any any
pager lines 24
logging asdm informational
flow-export destination outside x.x.x.x 2055
flow-export template timeout-rate 1
flow-export delay flow-create 15
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu point-to-point 1500
mtu management 1500
failover
failover lan unit secondary
failover lan interface FailoverLink GigabitEthernet0/4
failover key *****
failover link StatefulFailoverLink GigabitEthernet0/5
failover interface ip FailoverLink 172.16.88.1 255.255.255.0 standby 172.16.88.2
failover interface ip StatefulFailoverLink 172.16.89.1 255.255.255.0 standby 172.16.89.2
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-791-151.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 8192
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static winchester-lan winchester-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static providence-lan providence-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static allston-lan allston-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static beverly-lan beverly-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static bu-lan bu-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static bronx-lan bronx-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static harvarddef-lan harvarddef-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static ct-370james-lan ct-370james-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static ct-garage-lan ct-garage-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static smast-lan smast-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static eprov-brownu-lan eprov-brownu-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static everett everett no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static massport-termb-lan massport-termb-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static brandeis-lan brandeis-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static harvardsackler-lan harvardsackler-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static ngrid-southie-lan ngrid-southie-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static sterling-lan sterling-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static needham-lan needham-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static medway-lan medway-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static mit-lan mit-lan no-proxy-arp route-lookup
nat (inside,outside) source static NETWORK_OBJ_10.10.108.0_22 NETWORK_OBJ_10.10.108.0_22 destination static massportcu-lan massportcu-lan no-proxy-arp route-lookup
!
object network security
nat (any,any) static 50.225.18.224
!
nat (any,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
route point-to-point 10.20.10.0 255.255.255.0 172.16.10.1 5
route outside 10.20.10.0 255.255.255.0 x.x.x.x 20
route point-to-point 10.50.50.0 255.255.255.0 172.16.10.1 10
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
http x.x.x.x 255.255.255.255 outside
snmp-server host outside x.x.x.x community ***** version 2c
snmp-server location Medford - 3rd Floor Data Closet
snmp-server contact
snmp-server community *****
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 18dad19e267de8bb4a2158cdcc6b3b4a
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 outside
ssh 10.10.108.0 255.255.252.0 inside
ssh 0.0.0.0 0.0.0.0 point-to-point
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 10.10.111.1-10.10.111.250 inside
dhcpd dns 10.10.108.5 10.20.10.30 interface inside
dhcpd domain bondbros.com interface inside
dhcpd option 4 ip 10.10.108.5 interface inside
dhcpd option 156 ascii ftpServers=10.20.10.46,configServers=10.20.10.46 interface inside
dhcpd enable inside
!
dhcpd address 192.168.125.50-192.168.125.240 dmz
dhcpd dns 8.8.8.8 8.8.4.4 interface dmz
dhcpd enable dmz
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy GroupPolicy_allston internal
group-policy GroupPolicy_allston attributes
vpn-tunnel-protocol ikev1 l2tp-ipsec
group-policy GroupPolicy_needham internal
group-policy GroupPolicy_needham attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_beverly internal
group-policy GroupPolicy_beverly attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_medway internal
group-policy GroupPolicy_medway attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_bronx internal
group-policy GroupPolicy_bronx attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_sterling internal
group-policy GroupPolicy_sterling attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_harvarddef internal
group-policy GroupPolicy_harvarddef attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_providence internal
group-policy GroupPolicy_providence attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_bu internal
group-policy GroupPolicy_bu attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_ctgarage internal
group-policy GroupPolicy_ctgarage attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_brownu internal
group-policy GroupPolicy_brownu attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_massportcu internal
group-policy GroupPolicy_massportcu attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_smast internal
group-policy GroupPolicy_smast attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_everett internal
group-policy GroupPolicy_everett attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_ngrid internal
group-policy GroupPolicy_ngrid attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_mit internal
group-policy GroupPolicy_mit attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_370james internal
group-policy GroupPolicy_370james attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_brandeis internal
group-policy GroupPolicy_brandeis attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_winchester internal
group-policy GroupPolicy_winchester attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
group-policy GroupPolicy_massporttermb internal
group-policy GroupPolicy_massporttermb attributes
vpn-tunnel-protocol ikev2 l2tp-ipsec
group-policy GroupPolicy_harvardsackler internal
group-policy GroupPolicy_harvardsackler attributes
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
dynamic-access-policy-record DfltAccessPolicy
!
class-map global-class
match any
class-map inspection_default
match default-inspection-traffic
class-map outside-class
match access-list outside_mpc
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class global-class
flow-export event-type all destination 207.x.x.x
policy-map outside-policy
class outside-class
sfr fail-open
!
service-policy global_policy global
service-policy outside-policy interface outside
prompt hostname context
call-home reporting anonymous
Cryptochecksum:09f6e7626cfc0128d85c80b24dcbf159
: end
