VPN encrypt drop

Everything looks good but packet tracer gives vpn encrypt drop.

Will always happen the first time run the PT again.

Look at the encryption domain on the VPN. Is the network you are trying to reach in there ?

Some people have mentioned its because the ACLs aren't a mirror image / don't match.

Allowing access to an fqdn on cisco ASA

You need to set up the DNS first
don't forget domain-name DomainYouWantToLook.Up

Create the object network myobj
fqdn domain.com

Check its resolving correctly with show dns

Create the ACL as normal use the fqdn keyword to insert your fqdn object

Run a packet tracer as a test.

Full details here

https://supportforums.cisco.com/document/66011/using-hostnames-dns-access-lists-configuration-steps-caveats-and-troubleshooting

setting up a span port

Connect with the console cable
Setup source and destination ports
https://supportforums.cisco.com/document/13891/how-configure-port-monitoring-span-catalyst-2940-2950-2955-2970-3550-or-3750-series
Run wire shark as admin

This example shows how to set up a SPAN session (session 1) for monitoring source port traffic to a destination port. First, any existing SPAN configuration for session 1 is cleared and then bidirectional traffic is mirrored from source port 1 to destination port 10:  

Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface fastEthernet0/1
Switch(config)# monitor session 1 destination interface fastEthernet0/10 encapsulation dot1q
Switch(config)# end

This example shows how to configure the destination port for ingress traffic on VLAN 5 by using a security device that supports 802.1q encapsulation:  

Switch(config)# monitor session 1 destination interface Fa 0/5 encapsulation dot1q ingress vlan 5

This example shows how to clear any existing RSPAN configuration for session 1, configure RSPAN session 1 to monitor multiple source interfaces, and configure the destination RSPAN VLAN and the reflector-port:  

Switch(config)# no monitor session 1
Switch(config)# monitor session 1 source interface fastEthernet0/10 tx
Switch(config)# monitor session 1 source interface fastEthernet0/2 rx
Switch(config)# monitor session 1 source interface fastEthernet0/3 rx
Switch(config)# monitor session 1 source interface port-channel 102 rx
Switch(config)# monitor session 1 destination remote vlan 901 reflector-port fastEthernet0/1
Switch(config)# end 

This example shows how to configure VLAN 901 as the source remote VLAN and port 5 as the destination interface:   

Switch(config)# monitor session 1 source remote vlan 901
Switch(config)# monitor session 1 destination interface fastEthernet0/5
Switch(config)# end  

BGP looking glass

http://www.routeviews.org/

IP geolocation

https://dnsquery.org/

Cisco ASA named to number port mapping

 aol                              5120

  bgp                              179

  chargen                          19

  cifs                             3020

  citrix-ica                       1494

  cmd                              514

  ctiqbe                           2748

  daytime                           13

  discard                            9

  domain                            53

  echo                               7

  exec                              512

  finger                            79

  ftp                               21

  ftp-data                           20

  gopher                             70

  h323                              1720

  hostname                          101

  http                              80

  https                             443

  ident                             113

  imap4                             143

  irc                               194

  kerberos                          88

  klogin                            543

  kshell                            544

  ldap                              389

  ldaps                             636

  login                             513

  lotusnotes                        1352

  lpd                                515

  netbios-ssn                        139

  nfs                             2049

  nntp                            119

  pcanywhere-data                 5631

  pim-auto-rp                     496

  pop2                            109

  pop3                            110

  pptp                            1723

  rsh                             514

  rtsp                            554

  sip                             5060

  smtp                            25

  sqlnet                          1522

  ssh                             22

  sunrpc                          111

  tacacs                          49

  talk                            517

  telnet                          23

  uucp                            540

  whois                           43

  www                             80

Cisco ASA syslog messages

http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs.html

Some useful ones

302013 - built inbound TCP connection

302014 - teardown TCP connection

725012 - Device chooses cipher cipher for the SSL session

725008 - ssl client propose cipher

725007 - teardown new ssl connection / terminated

725001 - starting ssl handshake

725002 - ssl handsake completed

725003 - ssl request to resume previous session

You may want  "no logging hide username"

For FTD flex config you need to drop the g for some reason "no loggin hide username"

113005 - The AAA authentication on a connection has failed. The username is hidden when invalid or unknown, but appears when valid or the no logging hide username command has been configured

See also

https://www.cisco.com/c/en/us/support/docs/security/secure-client/221880-implement-hardening-measures-for-secure.html