hostname ASAFW
domain-name firma.sk
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 150
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.30.28.3 255.255.252.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address [IP] [MASKA]
!
interface Vlan150
 nameif dmz
 security-level 50
 ip address 192.168.150.1  255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
 domain-name fwfirma.sk
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network Bkancel-obj
 subnet 172.30.60.0 255.255.252.0
 description description objekt kancelarska siet v budove B
object network dmz-obj
 subnet 192.168.150.0 255.255.255.0
 description objekt predstavujuci siet dmz
object network kancel-obj
 subnet 172.30.28.0 255.255.252.0
 description description objekt kancelarska siet v budove A
object network mojPC-obj
 host 172.30.28.50
 description description objekt moj pocitac
object network proxy-obj
 host 172.30.28.4
 description description proxy ma povoleny pristup na internet
object network server10-obj
 host 172.30.28.38
 description objekt testovaci server, ktory bude mat docasny pristup na internet
object network webserver-obj
 host 192.168.150.10
 description objekt webovy server
object network kancel-do-dmz-obj
 subnet 172.30.28.0 255.255.252.0
 description objekt sluzi na pristup do dmz
object network Bkancel-do-dmz-obj
 subnet 172.30.60.0 255.255.252.0
 description objekt sluzi na pristup do siete dmz
object network webserver-do-inside
 host 192.168.150.10
 description objekt ktory bude mat nastaveny preklad sam na seba pri prechode do internej iste
object network server20-obj
 host 172.30.28.15
 description server na spojenie s dmz web serverom
object network halvny-sw-obj
 host 172.30.28.1
 description hlavny prepinac v budove A
object-group network sietova-skupina-NET
 description description skupina do ktorej mozem pridavat objekty pre pristup na internet
 network-object object mojPC-obj
 network-object object server10-obj
object-group network sietova-skupina-ping
 network-object object Bkancel-obj
 network-object object kancel-obj
object-group network sietova-skupina-DMZ
 description skupina ktora bude mat povoleny plny pristup do dmz web servera
 network-object object mojPC-obj
 network-object object server10-obj 
object-group network sietova-skupina-do-dmz-web
 description skupina ktora bude mat povoleny obmedzeny pristup do dmz web servera
 network-object object Bkancel-do-dmz-obj
 network-object object kancel-do-dmz-obj
object-group service inside-dmz-sl tcp
 port-object eq www
 port-object eq https
object-group service outside-inside-sl tcp
 port-object eq www
 port-object eq https
access-list inside_access_in remark povolenie proxy prejst z inside portu na outside port a do internetu
access-list inside_access_in extended permit ip object proxy-obj any 
access-list inside_access_in remark povolenie obmedzeneho pristupu na web server pre kancelarske skupiny
access-list inside_access_in extended permit tcp object-group sietova-skupina-do-dmz-web 192.168.150.0 255.255.255.0 object-group inside-dmz-sl 
access-list inside_access_in remark sluzi na povolenie plneho pristupu pre urcite pocitace z inside do web servera dmz
access-list inside_access_in extended permit ip object-group sietova-skupina-DMZ object webserver-obj 
access-list inside_access_in remark povolenie sietovej skupiny vstup do internetu
access-list inside_access_in extended permit ip object-group sietova-skupina-NET any 
access-list outside_access_in remark povolenie odpovede na prikaz ping pre kancelarske siete
access-list outside_access_in extended permit tcp any object-group sietova-skupina-ping eq hostname 
access-list outside_access_in remark povolnie pristupu z internetu na webserver
access-list outside_access_in extended permit tcp any object webserver-obj object-group outside-inside-sl 
access-list dmz_access_in remark povolenie pristupu weboveho servera do inside siete na prepojenie sluzieb
access-list dmz_access_in extended permit tcp object webserver-do-inside object server20-obj eq 1200 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
ip local pool DHCP-POOL 192.168.200.10-192.168.200.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.200.0_25 NETWORK_OBJ_192.168.200.0_25 no-proxy-arp route-lookup
!
object network Bkancel-obj
 nat (inside,outside) dynamic interface
object network dmz-obj
 nat (inside,outside) static interface service tcp www www 
object network kancel-obj
 nat (inside,outside) dynamic interface
object network proxy-obj
 nat (inside,outside) dynamic interface
object network webserver-obj
 nat (dmz,outside) static interface
object network kancel-do-dmz-obj
 nat (inside,dmz) static kancel-do-dmz-obj
object network Bkancel-do-dmz-obj
 nat (inside,dmz) static Bkancel-do-dmz-obj
object network webserver-do-inside
 nat (dmz,inside) static webserver-do-inside
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group dmz_access_in in interface dmz
route outside 0.0.0.0 0.0.0.0 195.12.128.145 1
route inside 172.30.60.0 255.255.252.0 172.30.28.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server AAA-SERVER-Skup protocol radius
aaa-server AAA-SERVER-Skup (inside) host 172.30.28.12
 key [heslo]
 radius-common-pw [heslo]
user-identity default-domain LOCAL
aaa authentication enable console LOCAL 
aaa authentication http console AAA-SERVER-Skup LOCAL
aaa authentication ssh console AAA-SERVER-Skup LOCAL
aaa authentication telnet console AAA-SERVER-Skup LOCAL
http server enable
http 172.30.28.0 255.255.255.0 inside
snmp-server host inside 172.30.28.14 community SNMPkomunita version 2c
snmp-server location ASA-lokacia
no snmp-server contact
snmp-server community SNMPkomunita
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
snmp-server enable traps memory-threshold
snmp-server enable traps interface-threshold
snmp-server enable traps remote-access session-threshold-exceeded
snmp-server enable traps connection-limit-reached
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=ciscoasa
 keypair MOJ-RSA-KEY
 crl configure
crypto ca certificate chain ASDM_TrustPoint0
 certificate 4e5e8351
    308201e3 3082014c a0030201 0202044e 5e835130 0d06092a 864886f7 0d010105 
    05003036 3111300f 06035504 03130863 6973636f 61736131 21301f06 092a8648 
    86f70d01 09021612 63697363 6f617361 2e646f6d 656e612e 736b301e 170d3133 
    30353033 30383230 31315a17 0d323330 35303130 38323031 315a3036 3111300f 
    06035504 03130863 6973636f 61736131 21301f06 092a8648 86f70d01 09021612 
    63697363 6f617361 2e646f6d 656e612e 736b3081 9f300d06 092a8648 86f70d01 
    01010500 03818d00 30818902 818100b5 4c89ed3e 764e33ec 5e6e5621 d4d10c53 
    799b20d3 fd2dec51 aba530ad e2cc19e6 4a1aac0e ef65806e e28f227f e14a9cbe 
    4c53038e 826b7b0b 78880788 1825ffaf 4858a64d 44880259 f7ee122e 6a61bbd3 
    6241451f fee17e96 0fb0523e 6c780a53 0cb9ef46 f4dad0ab 0c3f69f4 f571c791 
    6b89604a 65996173 147dd0ce 038e3702 03010001 300d0609 2a864886 f70d0101 
    05050003 81810064 cdf06946 2409a447 03eda0de df473dff 92beeba0 87b5b7a6 
    32b3b941 d953fa0a 4642cf56 898e9d67 b7720c90 fcfabae6 5c183cc6 31d9268a 
    9c7ff66b 27f2b816 65947e72 cbac9c27 c537b04f 847d5eea db7f574c 5f02cf15 
    122fbb2a 6c3d0c43 037be952 9043d1c3 a90f91b1 d8c86a89 eccaef69 fbf9ae4a 
    43ccd985 dde901
  quit
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
telnet 172.30.28.0 255.255.255.0 inside
telnet timeout 5
ssh 172.30.28.0 255.255.255.0 inside
ssh timeout 5
console timeout 0

dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 anyconnect image disk0:/anyconnect-win-3.0.7059-k9.pkg 1
 anyconnect profiles profil-VPN_client_profile disk0:/profil-VPN_client_profile.xml
 anyconnect enable
 tunnel-group-list enable
group-policy GroupPolicy_profil-VPN internal
group-policy GroupPolicy_profil-VPN attributes
 wins-server none
 dns-server value 172.30.28.3
 vpn-tunnel-protocol ikev2 ssl-client 
 default-domain value domena.sk
 webvpn
  anyconnect profiles value profil-VPN_client_profile type user
username asaadmin password ..bb7d0917YRTEI encrypted privilege 15
tunnel-group profil-VPN type remote-access
tunnel-group profil-VPN general-attributes
 address-pool DHCP-POOL
 authentication-server-group AAA-SERVER-Skup LOCAL
 default-group-policy GroupPolicy_profil-VPN
tunnel-group profil-VPN webvpn-attributes
 group-alias profil-VPN enable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:a7b4204e7ac9654a1bb7d0917b8dfa90
: end
