Cisco ASA Dial in VPN access Devices on Site-to-Site VPN

Question

Questions

1) What do I need to run to get this to allow the on-site to talk to the dial-in network clients E.G ping from 10.101.1.7 to 10.101.2.1?

2) What do I need to run to get the dial-in network clients to talk to the site-to-site network clients E.G ping from 10.101.2.1 to 10.1.42.216?

Updates I have now setup network-objects inoffice 10.101.1.0 255.255.255.0 outoffice 10.101.2.0 255.255.255.0

and when I run nat (inside,inside) source static inoffice interface destination static interface outoffice it all works other than the fact that lose access to ASDM (so talking to 10.101.0.1) and I have changed the ASA to now operate on 10.101.0.1 so its not in the inoffice or outoffice subnets.

Overview

I have managed to get my Cisco ASA 5505 setup and connecting to 2 different site-to-site VPN and that works when I'm local to the network.

So the ASA provides the network 10.101.0.0/16 (10.101.1.0/24 is on-site network, 10.101.2.0/24 is dial-in network) I then have 2 sites (inside AWS) 10.1.0.0/16 & 10.2.0.0/16

I have managed to get the system so I can dial in remotely so my remote gets an IP of 10.101.2.1 and my remote can ping my workstation 10.101.1.7

However, I'm unable to get my remote to be able to ping anything on the 10.1.0.0 or 10.2.0.0 networks I'm also unable to get my on-site network to talk to anything on the dial-in network while the dial in clients can ping the workstation in the on-site network.

My ASA Config:

: Saved
:
ASA Version 9.1(1)
!
hostname ciscoasa
enable password ****** encrypted
passwd ****** encrypted
names
ip local pool OutOfOfficePool 10.101.2.1-10.101.2.254 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.101.1.1 255.255.0.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address *.*.*.* 255.255.255.248
!
ftp mode passive
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network inside
 subnet 10.101.0.0 255.255.0.0
object network inside-subnet
 subnet 10.101.0.0 255.255.0.0
object network obj-SrcNet
 subnet 0.0.0.0 0.0.0.0
object network obj-amzn-lon
 subnet 10.1.0.0 255.255.0.0
 object network obj-amzn-ire
 subnet 10.2.0.0 255.255.0.0
object network NETWORK_OBJ_10.101.2.0_24
 subnet 10.101.2.0 255.255.255.0
access-list outside_acl extended permit ip host 35.177.42.137 host *.*.*.*
access-list outside_acl extended permit ip host 52.56.51.249 host *.*.*.*
access-list outside_acl extended permit ip host 52.17.198.135 host *.*.*.*
access-list outside_acl extended permit ip host 54.72.63.159 host *.*.*.*
access-list acl-amzn-lon extended permit ip any 10.1.0.0 255.255.0.0
access-list IRELAND-135 extended permit ip host 52.17.198.135 host *.*.*.*
access-list IRELAND-159 extended permit ip host 54.72.63.159 host *.*.*.*
access-list IRELAND-LOCAL extended permit ip any4 10.2.0.0 255.255.0.0
access-list outside_access_in extended permit ip host 35.177.42.137 host *.*.*.*
access-list outside_access_in extended permit ip host 52.56.51.249 host *.*.*.*
access-list acl-amzn extended permit ip any4 10.1.0.0 255.255.0.0
access-list amzn-filter extended permit ip 10.1.0.0 255.255.0.0 10.101.0.0 255.255.0.0
access-list ireland-filter extended permit ip 10.2.0.0 255.255.0.0 10.101.0.0 255.255.0.0
access-list outside_cryptomap_2 extended permit ip any4 10.2.0.0 255.255.0.0
access-list outside_cryptomap_2 extended permit ip any 10.1.0.0 255.255.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static obj-SrcNet obj-SrcNet destination static obj-amzn-ire obj-amzn-ire
nat (inside,outside) source static obj-SrcNet obj-SrcNet destination static obj-amzn-lon obj-amzn-lon
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.101.2.0_24 NETWORK_OBJ_10.101.2.0_24 no-proxy-arp route-lookup
!
object network obj_any
 nat (inside,outside) dynamic interface
object network inside-subnet
 nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
route outside 0.0.0.0 0.0.0.0 *.*.*.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
sysopt connection tcpmss 1379
sla monitor 1
 type echo protocol ipIcmpEcho 10.1.0.1 interface outside
 frequency 5
sla monitor schedule 1 life forever start-time now
sla monitor 2
 type echo protocol ipIcmpEcho 10.2.0.1 interface outside
 frequency 5
sla monitor schedule 2 life forever start-time now
sla monitor 5
 type echo protocol ipIcmpEcho 8.8.8.8 interface outside
 frequency 5
sla monitor schedule 5 life forever start-time now
crypto ipsec ikev1 transform-set transform-amzn-lon esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-amzn-ire esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set transfrom-amzn esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-amzn esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transfrom-amzn1 esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-amzn1 esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-ireland esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS mode transport
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256 protocol esp integrity sha-1 md5
crypto ipsec security-association replay window-size 128
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df outside
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
crypto dynamic-map DYN_OUTSIDE 10000 set ikev1 transform-set ESP-AES128-SHA1_TRANS
crypto map amazon_lon_map 1 match address acl-amzn-lon
crypto map amazon_lon_map 1 set pfs
crypto map amazon_lon_map 1 set peer 35.177.42.137 52.56.51.249
crypto map amazon_lon_map 1 set ikev1 transform-set transform-amzn-lon
crypto map amazon_lon_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map amazon_lon_map 1 set security-association lifetime seconds 3600
crypto map amazon_lon_map 2 match address outside_cryptomap_2
crypto map amazon_lon_map 2 set pfs
crypto map amazon_lon_map 2 set peer 52.17.198.135 54.72.63.159
crypto map amazon_lon_map 2 set ikev1 transform-set transform-ireland
crypto map amazon_lon_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map MAP_OUTSIDE 10000 ipsec-isakmp dynamic DYN_OUTSIDE
crypto map MAP_OUTSIDE interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
 crl configure
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=ciscoasa
 keypair OutOfOfficeKeyPair
 proxy-ldc-issuer
 crl configure
crypto ca trustpoint ASDM_TrustPoint1
 enrollment terminal
 subject-name CN=leeds.internal.beaconsoft.ltd,O=Beaconsoft Limited,C=UK
 keypair OutOfOfficeKeyPair
 crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
 certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    ****
  quit
crypto ca certificate chain ASDM_TrustPoint0
 certificate 7f301c5c
    ****
  quit
crypto isakmp identity address
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev1 enable outside
crypto ikev1 policy 201
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 28800
crypto ikev1 policy 1000
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 2000
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 3000
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0

dhcpd domain leeds.internal.beaconsoft.ltd
dhcpd auto_config outside
dhcpd option 3 ip 10.101.1.1 *.*.*.*
dhcpd option 6 ip 8.8.8.8 8.8.4.4
!
dhcpd address 10.101.1.5-10.101.2.4 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd domain leeds.internal.beaconsoft.ltd interface inside
dhcpd option 3 ip 10.101.1.1 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
 dns-server value 8.8.8.8 8.8.4.4
 vpn-tunnel-protocol l2tp-ipsec
 default-domain value leeds.internal.beaconsoft.ltd
group-policy OutOfOffice internal
group-policy OutOfOffice attributes
 dns-server value 8.8.8.8 8.8.4.4
 vpn-tunnel-protocol ikev1 l2tp-ipsec
 default-domain value leeds.internal.beaconsoft.ltd
group-policy ireland-filter internal
group-policy ireland-filter attributes
 vpn-filter value ireland-filter
 vpn-tunnel-protocol ikev1
group-policy filter1 internal
group-policy filter1 attributes
 vpn-filter value amzn-filter
group-policy filter internal
group-policy filter attributes
 vpn-filter value acl-amzn
username Martin password OJGPTRIZGYa1YSuquXoicg== nt-encrypted privilege 0
username Martin attributes
 vpn-group-policy OutOfOffice
 vpn-tunnel-protocol ikev1 l2tp-ipsec
tunnel-group DefaultRAGroup general-attributes
 address-pool OutOfOfficePool
 default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
 authentication pap
 authentication ms-chap-v2
tunnel-group 35.177.42.137 type ipsec-l2l
tunnel-group 35.177.42.137 general-attributes
 default-group-policy filter1
tunnel-group 35.177.42.137 ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10
tunnel-group 52.56.51.249 type ipsec-l2l
tunnel-group 52.56.51.249 general-attributes
 default-group-policy filter1
tunnel-group 52.56.51.249 ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10
tunnel-group IRELAND-135 type ipsec-l2l
tunnel-group IRELAND-135 general-attributes
 default-group-policy ireland-filter
tunnel-group IRELAND-135 ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10
tunnel-group IRELAND-159 type ipsec-l2l
tunnel-group IRELAND-159 general-attributes
 default-group-policy ireland-filter
tunnel-group IRELAND-159 ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 10 retry 10
tunnel-group OutOfOffice type remote-access
tunnel-group OutOfOffice general-attributes
 address-pool OutOfOfficePool
 default-group-policy OutOfOffice
tunnel-group OutOfOffice ipsec-attributes
 ikev1 pre-shared-key *****
 ikev1 trust-point ASDM_TrustPoint0
tunnel-group OutOfOffice ppp-attributes
 authentication ms-chap-v2
tunnel-group 52.17.198.135 type ipsec-l2l
tunnel-group 52.17.198.135 general-attributes
 default-group-policy ireland-filter
tunnel-group 52.17.198.135 ipsec-attributes
 ikev1 pre-shared-key *****
tunnel-group 54.72.63.159 type ipsec-l2l
tunnel-group 54.72.63.159 general-attributes
 default-group-policy ireland-filter
tunnel-group 54.72.63.159 ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:641f9d6eb344bf069af64678716624a5
: end

Answer 1

Many things to look at here...

1. Your crypto map amazon_lon_map does nothing, because it is not bound to an interface. Instead, all your outside-in crypto is handled by crypto map MAP_OUTSIDE (as it has a corresponding crypto map MAP_OUTSIDE interface outside)

2. You have no access-group statements, so your access-list outside_acl and access-list outside_access_in probably aren't doing what you think they should. In any case, you may not need them.

3. Your three manual nat statements appear to be identity NATs, but you allow the ASA to proxy-ARP. Since obj-SrcNet is currently 0.0.0.0, that means your network probably thinks every address it ever tries to access is answered by the ASA. You probably don't want this.

4. As @RonTrunk alludes in his comment, you will need hairpin NAT to allow your remote-access VPN clients to access your Amazon tunnels. Hairpinning is hard, though.

5. Your ip local pool OutOfOfficePool is a network range inside your inside interface's subnet. This might cause you additional problems (especially using a transport-based transform-set, rather than a tunnelled one).

6. You have objects with duplicate definitions and access-lists with disparate naming conventions, which are adding to the confusion.

7. You mix manual nat and object nat statements, which I would avoid. Personally, I stick to manual nat.

If it were me, depending on how much of this already works for you and how much doesn't, I would probably gut this config and start from basic principals but, if this is a production device, only do this if you have a solid backup and recovery process and are confident you understand what I'm suggesting...

That said, here goes...

---

If I understand correctly, your LAN users are on 10.101.0.0/16. You have an Amazon London LAN on 10.1.0.0/16 and an Amazon Ireland LAN on 10.2.0.0/16:

object OBJ_LAN01
  subnet 10.101.0.0 255.255.0.0
object OBJ_AZNLON01
  subnet 10.1.0.0 255.255.0.0
object OBJ_AZNIRE01
  subnet 10.2.0.0 255.255.0.0

You have a pool of VPN users -- let's put them somewhere else:

ip local pool IPP_RA_VPN 10.255.1.1-10.255.1.254 mask 255.255.255.0

object OBJ_RA_VPN
  subnet 10.255.1.0 255.255.255.0

You want your LAN and VPN users to be able to access the same stuff (as if the VPN guys were on your LAN), so we'll group them together:

object-group OGP_PERMITTED_LOCAL
  network-object OBJ_LAN01
  network-object OBJ_RA_VPN

Similarly, we'll group all the remote networks that the local guys should be able to access:

object-group OGP_PERMITTED_REMOTE
  network-object OBJ_AZNLON01
  network-object OBJ_AZNIRE01

At this point, I don't know one thing:

1. EITHER: You want anyone in your LAN to be able to access the Amazon sites, and you want anything at the Amazon sites to access devices on your LAN, in which case we identity-NAT:

   nat (outside,outside) source static OGP_PERMITTED_LOCAL OGP_PERMITTED_LOCAL destination static OGP_PERMITTED_REMOTE OGP_PERMITTED_REMOTE no-proxy-arp route-lookup
   nat (inside,outside) source static OGP_PERMITTED_LOCAL OGP_PERMITTED_LOCAL destination static OGP_PERMITTED_REMOTE OGP_PERMITTED_REMOTE no-proxy-arp route-lookup
   

2. OR: You want anyone in your LAN to be able to access the Amazon sites, and you don't want anything at the Amazon sites to access devices on your LAN, in which case we hide-NAT behind your outside interface address:

   nat (outside,outside) source dynamic OGP_PERMITTED_LOCAL interface destination static OGP_PERMITTED_REMOTE OGP_PERMITTED_REMOTE no-proxy-arp route-lookup
   nat (inside,outside) source dynamic OGP_PERMITTED_LOCAL interface destination static OGP_PERMITTED_REMOTE OGP_PERMITTED_REMOTE no-proxy-arp route-lookup
   

Note that, in both cases above, we perform nat on both (inside,outside) and (outside,outside); the latter is the hairpinning -- your VPN clients will technically be outside and going back to outside. This is why you will also need to permit same-security back through the interface:

same-security-traffic permit intra-interface

We'll now define the interesting traffic for the VPNs to Amazon. This has to be replicated in Amazon's VPN configuration, but I'm not an AWS guy, so I don't immediately know how that will look. Again, this depends on what we chose above:

1. If we identity-NAT:

   access-list ACL_VPN_AZNLON extended permit ip object-group OGP_PERMITTED_LOCAL object OBJ_AZNLON01
   access-list ACL_VPN_AZNIRE extended permit ip object-group OGP_PERMITTED_LOCAL object OBJ_AZNIRE01
   

2. If we hide-NAT:

   access-list ACL_VPN_AZNLON extended permit ip interface outside object-group OBJ_AZNLON01
   access-list ACL_VPN_AZNIRE extended permit ip interface outside object-group OBJ_AZNIRE01
   

Note that, when it comes to defining the VPNs within Amazon's infrastructure, I can't really help you. I can say though that the identity-NAT solution requires you to set up a tunnel with two subnets in the Phase #2 encryption domain (which might mean two separate Phase #2 security association configs, depending on how Amazon does it), while the hide-NAT one requires only one Phase #2 security associations.

Use show access-list ACL_VPN_AZNLON to see what Amazon London will see -- note how it shows two lines for the identity-NAT? Those are your two security associations. There will be one extra line for every LAN subnet you add (if you ever need to), unless you want to try and dynamic NAT all your users into one dedicated address in your LAN subnet before you transfer out to Amazon.

We'll add one more NAT statement, as a fallback option, so your LAN users to get out to the internet using your ISP-allocated outside address:

object OBJ_ANY_IPV4
  subnet 0.0.0.0 0.0.0.0

nat (inside,outside) after-auto source dynamic OBJ_LAN01 interface destination OBJ_ANY_IPV4 OBJ_ANY_IPV4

Now we can build up the crypto policies for Phase #1 and Phase #2. I'm going to assume that you've transcribed these correctly in your (albeit unused) crypto map statements, so I'm going to adapt what you had above into the below Phase #2 settings. Note that I'm only currently familiar with IKEv1, so I've left out IKEv2 at this stage (it doesn;t look to be enabled on your config, anyway):

crypto ipsec ikev1 transform-set IKEV1_AES128_SHA1 esp-aes esp-sha-hmac

crypto map CRY_OUTSIDE 10 match address ACL_VPN_AZNLON
crypto map CRY_OUTSIDE 10 set peer 35.177.42.137 52.56.51.249
crypto map CRY_OUTSIDE 10 set ikev1 transform-set IKEV1_AES128_SHA1
crypto map CRY_OUTSIDE 10 set pfs group2
crypto map CRY_OUTSIDE 10 set security-association lifetime seconds 3600

crypto map CRY_OUTSIDE 20 match address ACL_VPN_AZNIRE
crypto map CRY_OUTSIDE 20 set peer 52.17.198.135 54.72.63.159
crypto map CRY_OUTSIDE 20 set ikev1 transform-set IKEV1_AES128_SHA1
crypto map CRY_OUTSIDE 20 set pfs group2
crypto map CRY_OUTSIDE 20 set security-association lifetime seconds 3600

Again, I'm not sure which Phase #1 settings you are using (perhaps you have a choice in Amazon's ecosystem), so I'll use the highest-priority one from your existing config, below (you can configure more than one here; the policy number denotes the priority -- smallest number is chosen first, where possible):

crypto ikev1 policy 100
  authentication pre-share
  encryption aes
  hash sha
  group 2
  lifetime 28800

We'll set pre-shared keys for each peer, now (substitute the ***s for your relevant keys):

tunnel-group 35.177.42.137 type ipsec-l2l
tunnel-group 35.177.42.137 ipsec-attributes
  ikev1 pre-shared-key ******

tunnel-group 52.56.51.249 type ipsec-l2l
tunnel-group 52.56.51.249 ipsec-attributes
  ikev1 pre-shared-key ******

tunnel-group 52.17.198.135 type ipsec-l2l
tunnel-group 52.17.198.135 ipsec-attributes
  ikev1 pre-shared-key ******

tunnel-group 54.72.63.159 type ipsec-l2l
tunnel-group 54.72.63.159 ipsec-attributes
  ikev1 pre-shared-key ******

Now we'll tie the settings together, to at least get the site-to-sites in play:

crypto map CRY_OUTSIDE interface outside
crypto ikev1 enable outside

If we've got this right, so far, you LAN users should now be able to access the Amazon sites and, depending on your choice of #1/#2 above, so too should your Amazon objects be able to access your LAN devices.

Now let's try and get your remote-access users in place. For this, we'll need a dynamic map and a policy. I'm presuming that you are using the old-style Cisco VPN client here, but I can see you have L2TP/IPsec enabled as well in your old config. I'm going to gloss over L2TP/IPsec here, but it should be possible to get it working with some tweaks, if that is incorrect.

First, we need to define the interesting traffic for the VPN users

access-list ACL_VPN_RA extended permit ip any object OBB_RA_VPN

Then we need a dynamic map, which applies the Phase 2 settings to your VPN users:

crypto dynamic-map CDY_OUTSIDE 10 match address ACL_VPN_RA
crypto dynamic-map CDY_OUTSIDE 10 set ikev1 transform-set IKEV1_AES128_SHA1
crypto dynamic-map CDY_OUTSIDE 10 set security-association lifetime seconds 7200
crypto dynamic-map CDY_OUTSIDE 10 set reverse-route

We'll need to define some user-specific settings, which are handled in a group-policy. You'll probably want to use DNS servers that are internal to your LAN, so your users can resolve your private server names (substitute 10.101.100.100 and 10.101.200.200 for applicable addresses), and we'll use split-tunelling so that only requests for your network go through the tunnel and normal internet requests continue to use the VPN users' own ISP.

access-list ACL_RA_VPN_SPLIT_TUNNEL extended permit ip object OBJ_LAN01 object OBJ_RA_VPN
access-list ACL_RA_VPN_SPLIT_TUNNEL extended permit ip object-group OGP_PERMITTED_REMOTE object OBJ_RA_VPN

group-policy GPO_RA_VPN
  vpn-tunnel-protocol ikev1
  dns-server value 10.101.100.100 10.101.200.200
  split-tunnel-policy tunnelspecified
  split-tunnel-network-list value ACL_RA_VPN_SPLIT_TUNNEL
  default-domain value leeds.internal.beaconsoft.ltd

I don't know about your Trust Group stuff -- I've only done these with pre-shared keys, not certificates. I'll user PSKs below, but you can substitute in any cert work if you need to (again, substitute *** for your PSK):

tunnel-group TUN_RA_VPN type remote-access
tunnel-group TUN_RA_VPN general-attributes
  address-pool IPP_RA_VPN
  default-group-policy GPO_RA_VPN
tunnel-group TUN_RA_VPN ipsec-attributes
  ikev1 pre-shared-key *****

We should be able to tie the dynamic policy to the outside interface, by appending it to the static crypto map:

crypto map CRY_OUTSIDE 65535 ipsec-isakmp dynamic CDY_OUTSIDE

Lastly, we'll avoid the need for explicitly writing access control statements for VPN traffic, by using a sysopt option that automatically allows VPN connections to bypass access-group restrictions. This is a common (but well-hidden) option that I think is enabled by default, but we'll add it specifically here:

sysopt connection permit-vpn

---

I'm sure there are many nuances to your network that I have missed from your config, so I'll have to trust you to fold the above concepts correctly into your own setup.

However, at this point (presuming you can get the Amazon side configured correctly), you should have two site-to-site tunnels from your device to Amazon and a remote-access VPN (using the old Cisco VPN Client) which can access both your LAN and the Amazon environments.

We've not covered access from the internet to your LAN, so we still have no access-group. All access from outside to inside is restricted by security-level. Access from Amazon to your LAN is dependent on the option you chose regarding identity-NAT or hide-NAT. If hide-NAT is chosen, the Amazon objects should not be able to access your LAN, as they can only see your outside address. Changing this later might be a bit of a challenge, though, so choose wisely.

Cleanup of your old, unused configuration items is an exercise for you!

In any case, good luck!