: Saved
:
ASA Version 8.4(2)
!
hostname CCNA-ASA
domain-name ccnasecurity.com
enable password 4IncP7vTjpaba2aF encrypted
passwd 4IncP7vTjpaba2aF encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 1
!
interface Ethernet0/2
 switchport access vlan 3
!
interface Ethernet0/3
 switchport access vlan 1
!
interface Ethernet0/4
 switchport access vlan 1
!
interface Ethernet0/5
 switchport access vlan 1
!
interface Ethernet0/6
 switchport access vlan 1
!
interface Ethernet0/7
 switchport access vlan 1
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 209.165.200.226 255.255.255.248
!
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 70
 ip address 192.168.2.1 255.255.255.0
!
object network INSIDE-NET
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface
object network LOCAL-NET
 subnet 192.168.2.0 255.255.255.0
object network OUTSIDE-DMZ
object network REMOTE-NET
 subnet 172.16.3.0 255.255.255.0
object network dmz-server
 host 192.168.2.3
 nat (dmz,outside) static 209.165.200.227
!
route outside 0.0.0.0 0.0.0.0 209.165.200.225 1
!
access-list OUTSIDE-DMZ extended permit ip any host 192.168.2.3
access-list VPN-ACL extended permit ip object LOCAL-NET object REMOTE-NET
!
!
access-group OUTSIDE-DMZ in interface outside
aaa authentication ssh console LOCAL
!
username admin password qDkcg3XLw7CT08wq encrypted
!
class-map inspection_default
 match default-inspection-traffic
!
policy-map global_policy
 class inspection_default
  inspect ftp 
  inspect h323 
  inspect icmp 
  inspect tftp 
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
!
service-policy global_policy global
!
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh 172.16.3.3 255.255.255.255 outside
ssh timeout 10
!
dhcpd dns 209.165.201.2
dhcpd option 3 ip 192.168.1.1
dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.36 inside
dhcpd enable inside
!
!
!
crypto ipsec ikev1 transform-set ESP-TUNNEL esp-3des esp-sha-hmac
!
crypto map S2S-MAP 10 match address VPN-ACL
crypto map S2S-MAP 10 set peer 10.2.2.1 
crypto map S2S-MAP 10 set ikev1 transform-set ESP-TUNNEL 
crypto map S2S-MAP interface outside
crypto ikev1 enable outside
crypto ikev1 policy 10
 encr 3des
 authentication pre-share
 group 2
!
tunnel-group 10.2.2.1 type ipsec-l2l
tunnel-group 10.2.2.1 ipsec-attributes
 ikev1 pre-shared-key SECRET-KEY
!
