: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 14DBPbhNGLa//Mhx encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 116.228.205.166 255.255.255.252
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
 management-only
!
ftp mode passive
object network obj-192.168.30.0
 subnet 192.168.30.0 255.255.255.0
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj_any
 subnet 0.0.0.0 0.0.0.0
access-list nonat extended permit ip 192.168.30.0 255.255.255.0 172.16.0.0 255.255.0.0
access-list all extended permit icmp any any
access-list all extended permit ip any any
access-list all extended permit tcp any any
access-list tunnel_list extended permit ip 172.16.0.0 255.255.0.0 192.168.30.0 255.255.255.0
access-list tunnel_list extended permit ip 192.168.30.0 255.255.255.0 172.16.0.0 255.255.0.0
pager lines 24
mtu outside 1500
mtu inside 1500
ip local pool ***pool 172.16.1.1-172.16.1.254
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,any) source static obj-192.168.30.0 obj-192.168.30.0 destination static obj-172.16.0.0 obj-172.16.0.0 no-proxy-arp
!
object network obj_any
 nat (inside,outside) dynamic interface
access-group all in interface outside
route outside 0.0.0.0 0.0.0.0 116.228.205.165 1
route inside 192.168.10.0 255.255.255.0 192.168.1.2 1
route inside 192.168.20.0 255.255.255.0 192.168.1.2 1
route inside 192.168.30.0 255.255.255.0 192.168.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev1 transform-set ***set esp-3des esp-md5-hmac
crypto dynamic-map dmap 20 set ikev1 transform-set ***set
crypto dynamic-map dmap 20 set reverse-route
crypto map map 20 ipsec-isakmp dynamic dmap
crypto map map interface outside
crypto ikev1 enable outside
crypto ikev1 policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy duogou internal
group-policy duogou attributes
 dns-server value 202.96.209.133 202.96.209.5
 ***-idle-timeout 1800
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value tunnel_list
 default-domain value duogou.com
username iits password dAvNY25Ev3juWEq8 encrypted privilege 15
username duogou password N92/4DkP6FS9qGTR encrypted
tunnel-group duogou type remote-access
tunnel-group duogou general-attributes
 address-pool ***pool
 default-group-policy duogou
 authorization-required
tunnel-group duogou ipsec-attributes
 ikev1 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:10b8b83a55f6d2d78d9087e27c3fdd65
: end