1920 router access remote vpn LDAP living
Hello
What is required for a router in 1920 use AnyConnect and/or also integrate with AD LDAP?
Currently, this router supports legacy clients and has these licenses:
Technology for the Module package license information: "c1900".
-----------------------------------------------------------------
Technology-technology-package technology
Course Type next reboot
------------------------------------------------------------------
IPBase ipbasek9 ipbasek9 Permanent
Security securityk9 Permanent securityk9
given none none none
The vpn to access remote client inherited integrate with AD LDAP?
Thank you.
As long as you are on IOS 15.3.3M3 or better, you have all the licenses you need for 3.1 AnyConnect run on your 1921.
The guide to directly connect your router to LDAP can be found here:
Personally, I would avoid directly interfacing with LDAP, because it can be a complex arrangement. While it can be done, it's easier to have your router to connect to the NPS Microsoft via RADIUS server for your authentication.
Tags: Cisco Security
Similar Questions
-
2 VPN SITE to SITE with ACCESS REMOTE VPN
Hello
I have a 870 router c and I would like to put 2 different VPN SITE to SITE and access remote VPN (VPN CLIENTS) so is it possible to put 3 VPN in the router even if yes can u give me the steps or the sample configuration
Concerning
Thus, on the routers will be:
Cisco 2611:
LAN: 10.10.10.0/24
access-list 100 permit ip 10.10.10.0 0.0.0.255 10.10.20.0 0.0.0.255
access-list 100 permit ip 14.1.1.0 0.0.0.255 10.10.20.0 0.0.0.255--> VPNPOOL
!
10 ipsec-isakmp crypto map clientmap
defined by peer 172.18.124.199
match address 100
!
IP local pool ippool 14.1.1.1 14.1.1.254
!
access-list 120 allow ip 10.10.10.0 0.0.0.255 14.1.1.0 0.0.0.255
access-list 120 allow ip 10.10.20.0 0.0.0.255 14.1.1.0 0.0.0.255 --> NETWORK REMOTE
!
crypto ISAKMP client configuration group ra-customer
pool ippool
ACL 120
!
Please note that the configuration is incomplete, I added that relevant changes, you should bring to the allow clients of RA through the LAN-to-LAN tunnel, of course, the LAN-to-LAN settings should match to the other side of the tunnel that is mirror of ACL, NAT and so on.
HTH,
Portu.
-
Hello
Im trying to figure out why vpn for remote access is at our company office fails. The scenario: we currently have a work situation. The way this works is that users connect to the public ip address of the DSL router and nat vpn traffic to an internal router. This router then forwards the traffic to the vpn server.
vpn client remote <=>{{internet}} <=>cpe <=>adsl router <=>vpn server
Now, Im implementation of a 2nd internet line with more or less the same configuration, but instead of an adsl cpe, we use a cisco router. When users need to connect even with the only difference being a different public ip address
client remote vpn <=>{{internet}} <=>cisco <=>router <=>router, vpn server
So, the only change in the prepective of cisco vpn clients is the host. However when testing, it didn't work. The vpn client times out. With something like 'the vpn peer did not' do not remember the exact error by heart. Now logic tells me that because he now works in the part between the internal router and the vpn gateway is ok. My guess is it's because of the cisco access list. I had my own list of access, but for some reason, I decided to use firewall SDM Wizard configuration and it generated this access list.
Expand the IP 100 access list
10 permit tcp any host 90.90.150.82 eq 4500
20 permit tcp any host 90.90.150.82 eq 500
30 permit tcp any host 90.90.150.82 eq 51
40 permit tcp any host 90.90.150.82 eq 50
50 permit tcp any host 90.90.150.82 eq 3101
60 permit tcp any host 90.90.150.82 eq 993
70 permit tcp any host 90.90.150.82 eq 587
80 permit tcp any host 90.90.150.82 eq smtp (722 matches)
90 deny ip 192.168.0.8 0.0.0.7 (20606 matches)
100 permit icmp any host 90.90.150.82 - response to echo (113 matches)
110 permit icmp any host 90.90.150.82 time exceeded (54 matches)
120 permit icmp any inaccessible 90.90.150.82 host (1051 matches)
130 deny ip 10.0.0.0 0.255.255.255 (726 matches)
140 deny ip 172.16.0.0 0.15.255.255 all
150 deny ip 192.168.0.0 0.0.255.255 everything
160 deny ip 127.0.0.0 0.255.255.255 everything
170 deny ip 255.255.255.255 host everything
180 deny host ip 0.0.0.0 everything
190 deny ip any any newspaper (5163 matches) Extended 100 IP access list
Given that the natting to the smtp protocol works, I think that the natting is ok. I ping the server vpn, so routing also seems to be ok. Vpn users receive a vpn ip address pool 192.168.x.x. is it possible that the 150 rule that prevents them to connect? I can't test, because it's a living environment and I'll have to plan a window. Im just trying to figure out what is wrong, so I can fix it for a window. Someone at - it ideas?
No, you don't need AH if your VPN policy does not include AH.
-
Access remote VPN question - hairpin
Hello, I did a search before posting this question but I have not found anything specific to my situation.
We have our ASA5520 configured in our main office to allow remote access Cisco VPN client users to access our network. We have a (network 192.168.1.0/24) remote desktop we have a configured on the same ASA5520 VPN IPSec tunnel that allows the use of internal users (in the main office) to access resources on the network remote (192.168.1.0) and vice versa. The problem is that when users connect to the remote VPN access, they are not able to access the resources of the remote office network. We created the nat0 ACL and labour, and split tunnel routing is implemented for users VPN remote network access (if I make a copy of the route on my laptop after connecting to the VPN, I see the road to 192.168.0.0/24 in my routing table). Routing everything is in place to do this, since the IPSec VPN tunnel is up and working. My suspicion is that the question has something to do with the consolidation of these VPN clients.
What else needs to be configured to work? Thank you.
Hi Scott,.
I have a client with a PIX 515E which allows connections to remote VPN and VPN LAN2LAN multiple connections.
We had this problem too... so what I made in my pix was:
TEST (config) # same-security-traffic intra-interface permits (its off by default)
If you use ASDM go to:
Configuration > Interfaces >
at the bottom of this page, there is an option that says: 'enable traffic between two or more host computers connected to the same interface '.
Check and it should work... I hope
I await your comments...
Kind regards.
Joao Tendeiro
-
a public access remote vpn from an inside interface asa 5505
I'm trying to see if it is possible to accomplish what I am trying. I have an ASA 5505 with the following configuration.
1. There is an external connection, connected to the ISP. Let's say that it is 10.1.1.1/24 for ease. There is a remote VPN configuration as the access of people through this interface.
2. There's the inside network, which is the normal LAN. It's cable system in the office. to say that it is 172.20.0.1/24.
3. There is a wireless network on a VLAN separate called WLAN. It has an IP of 192.168.1.1/24. There is an ACL allowing traffic to that VLAN to the public internet.
Essentially, I would like users to be able to use the same VPN settings they use when connecting from outside of the Office when you are connected to WIFI.
Also, I would like that they can access public IP addresses that I have NAT would be to internal servers. In this way, they can use IP addresses when they use on the public internet.
Is this possible?
Hello
Well that's not going to be possible, the only thing you can really do is to activate the crypto map on the WLAN facing interface, by design, you cannot not access VPN, ping or manage the device on an interface which is not directly connected to you.
I hope this helps.
Mike
-
Cannot access remote VPN site-to-site VPN
Internal network: 192.168.0.0/16
The remote VPN Clients: 192.168.0.100 - 192.168.0.254
Remote (L2L) network: 10.10.10.0/26
Remote VPN Clients are able to access the internal network without problem, but are unable to access the remote 10.10.10.0. Is it possible to debug this? "packet - trace" show no problem...
Hi Ben,
Please create a no. - nat on the external interface, because your customers to vpn-remote and remote-L2L tunnels are located on outside interface (i.e. from the outside). You should treat your outside network identical to your inside network, as you would create a no. - nat for your inside networks.
The ACL you create for the no - nat outside must be in both directions as below.
permit access ip 192.168.0.0 scope list outside_nat0 255.255.255.0 10.10.10.0 255.255.255.192
outside_nat0 to access extended list ip 10.10.10.0 allow 255.255.255.192 192.168.0.0 255.255.255.0
NAT (outside) 0-list of access outside_nat0
permit same-security-traffic intra-interface
Pls let me know, if this is useful.
Thank you
Rizwan James
-
Cisco IOS - access remote VPN - route unwanted problem
Hello
I recently ran into a problematic scenario: I am trying to connect to a remote LAN (using a Cisco VPN client on my windows xp machine) my office LAN and access a server there. The problem is that I need a remote local network access at the same time.
Remote LAN: 172.16.0.0/16
LAN office: 172.16.45.0/24
Topology:
(ME: 172.16.10.138/25) - (several subnets form 172.16.0.0/16) - (Internet cloud) - (VPN-Gateway) - (172.16.45.0/24) - (TARGET: 172.16.45.100)
To provide access, I configured a VPN to access simple distance on a 1700 series router. It's the relevant part:
(...)
crypto ISAKMP client config group group-remote access
my-key group
VPN-address-pool
ACL 100
IP local pool pool of addresses-vpn - 172.16.55.1 172.16.55.30
access-list 100 permit ip 172.16.45.100 host 172.16.55.0 0.0.0.31
(...)
The configuration works fine, I can access the 172.16.45.100 server every time I need to. However, the problem is that when the VPN connection is connected, Windows wants to somehow rout the packets intended for 172.16.0.0/16 through the VPN tunnel. This is apparently due to a static route that added by the Cisco VPN Client and all other specific VPN routes.
I suspect that the culprit is the IP LOCAL POOL, since when the VPN is connected, debugging of Client VPN log shows something like "adapter connected, address 172.16.55.1/16. Focus on the part "/ 16". I checked the VPN status page and the only road indicated there was "172.16.45.100 255.255.255.255" under remote routes. Local routes was empty.
Is this a known problem I missed the obvious solution for? Is there no workaround apart from the pool local vpn penetrating high-end 10.x.x.x or 192.168.x.x? Thank you in advance for advice or tips!
Hello
The best way is to avoid any overlap between the local network and VPN pool.
Try 172.17.0.0/16, is also private IP address space:
http://en.Wikipedia.org/wiki/Private_network
Please rate if this helped.
Kind regards
Daniel
-
Hi all
IM, configuration of a vpn for remote access with ldap, for what I see in some examples, I need to create a user/pass.
In my case, I already configured the aaa for the ldap Protocol Server. I also have the Group tunnl with the authentication server.
I need to create a user/pass?
Thank you.
Hello
I see what you mean!
It is not necessary for the integration of LDAP.
You don't have authentication LDAP not the LOCAL database, so no need for this.
Do not forget to rate all my answers
Julio Carvajal
Main and specialist of the Core network security
CCIE #42930, 2-CCNP JNCIS-SEC
For immediate assistance commit to http://i-networks.us -
problem with users to access remote vpn site to site vpn network
I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?
execution of the configuration of my asa 5510 is
Result of the command: "show run"
: Saved
:
ASA Version 8.4(2)
!
hostname asa5510
domain-name dri.local
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.178 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.0.10 255.255.255.0
!
interface Ethernet0/2
description Mreza za virtualne masine- mail server, wsus....
nameif DMZ
security-level 50
ip address 172.16.20.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name dri.local
object network VPN-POOL
subnet 192.168.50.0 255.255.255.0
description VPN Client pool
object network LAN-NETWORK
subnet 192.168.0.0 255.255.255.0
description LAN Network
object network NETWORK_OBJ_192.168.0.0_24
subnet 192.168.0.0 255.255.255.0
object network 192.168.0.10
host 192.168.0.10
object service ssl
service tcp destination eq 465
object service tls
service tcp destination eq 995
object network mail_server
host 172.16.20.201
object service StartTLS
service tcp destination eq 587
object service admin_port
service tcp destination eq 444
object service ODMR
service tcp destination eq 366
object service SSL-IMAP
service tcp destination eq 993
object network remote
host 172.16.20.200
object network test
host 192.168.0.22
object network mail
host 172.16.20.200
object network DMZ
host 172.16.20.200
object network Inside_DMZ
host 192.168.0.20
object service rdp
service tcp destination eq 3389
object network DRI_PS99
host 192.168.0.54
object service microsoft_dc
service tcp destination eq 445
object service https448
service tcp destination eq 448
object network mail_server_internal
host 172.16.20.201
object service Acronis_remote
service tcp destination eq 9876
object service Acronis_25001
service tcp destination eq 25001
object service HTTP3000
service tcp destination eq 3000
object network VPNPOOL
subnet 192.168.50.0 255.255.255.0
object-group network PAT-SOURCE-NETWORKS
description Source networks for PAT
network-object 192.168.0.0 255.255.255.0
object-group service DM_INLINE_SERVICE_1
service-object object admin_port
service-object object ssl
service-object object tls
service-object object https448
object-group service DM_INLINE_SERVICE_2
service-object object admin_port
service-object object https448
service-object object ssl
service-object object tls
service-object tcp destination eq pop3
service-object tcp destination eq smtp
object-group service DM_INLINE_SERVICE_3
service-object object admin_port
service-object object https448
service-object object ssl
service-object tcp destination eq smtp
service-object object tls
service-object object Acronis_remote
service-object tcp destination eq www
service-object object Acronis_25001
service-object object microsoft_dc
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object tcp
object-group service DM_INLINE_SERVICE_4
service-object object Acronis_25001
service-object object Acronis_remote
service-object object microsoft_dc
service-object tcp destination eq www
service-object tcp
service-object ip
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
access-list DMZ extended deny tcp any any eq smtp
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
mtu management 1500
ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
!
object network mail_server
nat (DMZ,outside) static x.x.x.179
object network mail
nat (DMZ,outside) static x.x.x.180
access-group outside_access_in in interface outside
access-group DMZ in interface DMZ
route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
action terminate
dynamic-access-policy-record dripolisa
aaa-server DRI protocol ldap
aaa-server DRI (inside) host 192.168.0.20
ldap-base-dn DC=dri,DC=local
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
server-type microsoft
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
aaa authorization command LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
virtual telnet 192.168.1.12
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 195.222.96.223
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.0.14-192.168.0.45 inside
!
dhcpd address 172.16.20.2-172.16.20.150 DMZ
dhcpd dns x.x.x.177 interface DMZ
dhcpd auto_config outside interface DMZ
dhcpd option 6 ip x.x.x.177 interface DMZ
dhcpd enable DMZ
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy GroupPolicy_x.x.x.223 internal
group-policy GroupPolicy_x.x.x.223 attributes
vpn-tunnel-protocol ikev1 ikev2
group-policy drivpn internal
group-policy drivpn attributes
dns-server value 192.168.0.20 192.168.0.254
vpn-simultaneous-logins 10
vpn-idle-timeout 30
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-network-list value Split_Tunnel_List
default-domain value dri.local
username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
tunnel-group drivpn type remote-access
tunnel-group drivpn general-attributes
address-pool vpnadrese
authentication-server-group DRI
default-group-policy drivpn
tunnel-group drivpn ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group x.x.x.223 type ipsec-l2l
tunnel-group x.x.x.223 general-attributes
default-group-policy GroupPolicy_x.x.x.223
tunnel-group x.x.x.223 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect tftp
inspect ip-options
inspect netbios
inspect icmp
inspect http
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
: endrunning config asa 5505
Result of the command: "show run"
: Saved
:
ASA Version 8.2(1)
!
hostname ciscoasa
enable password csq7sfr0bQJqMGET encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.5.0 PALATA
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.17 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 10.13.74.33 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object-group service DM_INLINE_SERVICE_1
service-object ip
service-object tcp
service-object icmp echo
service-object icmp echo-reply
service-object tcp eq domain
service-object tcp eq ldap
service-object tcp eq smtp
object-group service DM_INLINE_SERVICE_2
service-object ip
service-object tcp eq domain
service-object tcp eq www
service-object tcp eq https
service-object tcp eq smtp
object-group service Sharepoint8080 tcp
port-object eq 8080
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging mail errors
logging from-address
logging recipient-address level debugging
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL
http server enable
http 10.13.74.0 255.255.255.0 outside
http 192.168.0.0 255.255.255.0 inside
http 10.15.100.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
virtual telnet 192.168.0.53
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_2_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 10.15.100.15
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
tunnel-group 10.15.100.15 type ipsec-l2l
tunnel-group 10.15.100.15 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
smtp-server 173.194.79.109
prompt hostname context
Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
: endThank you
Hello
I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel
EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"
So you don't really have any of those.
Please mark the question answers and/or assess response
Ask more if necessary
-Jouni
-
Access remote VPN, no split tunneling, internet access. Translation NAT problem
Hi all, I'm new to the forum. I have a Cisco ASA 5505 with confusing (to me) question NAT.
Unique external IP (outside interface) with several translations of NAT static object to allow the redirection of port of various internal devices. The configuration worked smoothly during the past years.
Recently, I configured a without the split tunneling VPN remote access and access to the internet and noticed yesterday that my port forwarding has stopped working.
I reviewed the new rules for the VPN NAT and found the culprit.
I've been reviewing the rules again and again, and all I can think about and interpret it, I don't know how this rule affects the port forwarding on the device or how to fix.
Here's the NAT rules, I have in place: ('inactive' rule is the culprit. Once I have turn on this rule, the port forwarding hits a wall)
NAT (inside, outside) static source any any static destination VPN_Subnet VPN_Subnet non-proxy-arp-search to itinerary
NAT (outside, outside) static source VPN_Subnet VPN_Subnet VPN_Subnet VPN_Subnet non-proxy-arp-search of route static destination
NAT (outside, outside) source VPN_Subnet dynamic interface inactive
!
network obj_any object
NAT dynamic interface (indoor, outdoor)
network of the XXX_HTTP object
NAT (inside, outside) interface static tcp www www service
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1Any help would be appreciated.
Try changing the nat rule to VPN_Subnet interface of nat (outside, outside) the after-service automatic dynamic source
With respect,
Safwan
-
AnyConnectVPN users cannot access remote vpn site-to-site
Hello-
We have two 5510 s ASA one in 8.4 (4) and the other to 8.2 (5) in a site to site VPN configuration. All internal traffic is working smoothly.
A: site/subnet 192.160.0.0 - local (8.4 (4)) Site/subnet b: 192.260.0.0 - distance (8.2 (5)) VPN users: 192.160.40.0 - assigned by ASA
When you VPN into the network, all the hits of traffic A Site and everything on the subnet A is accessible.
However, the site B is totally inaccessible to users of VPN. All computers on subnet B, the firewall itself, etc. is not reachable by ping or otherwise.
There are also some NAT rules weird that I'm not happy with that were created after that I upgraded the Site to ASA to 8.4
A resident of the site: external 192.160.x.x: 55.55.555.201(main)/202(mail)
Site B (in addition to site to site) is external 192.260.x.x: 66.66.666.54 (all)
I've pretty much just the basic rules of the NAT for VPN, Email, Internet and site to site.
What I need to add for the VPN access to the network from site to site?
Here is my config NAT:
NAT (inside, outside) static source DOMAIN_LOCAL DOMAIN_LOCAL VPN_Network VPN_Network non-proxy-arp-search of route static destination
NAT (inside, outside) static source DOMAIN_LOCAL DOMAIN_LOCAL DOMAIN_REMOTE DOMAIN_REMOTE non-proxy-arp-search of route static destination
!
network of the DMZ_Network object
dynamic NAT interface (DMZ, outside)
network of the DOMAIN_LOCAL object
NAT dynamic interface (indoor, outdoor)
network of the EXCHANGE_Exchange object
NAT static Outside_Mail (any, any)
network of the DOMAINCTRL_DHCP object
NAT (inside, outside) interface static tcp ftp ftp service
Thank you very much in advance and I hope that I've been pretty thorough.
Let me know if you need anything that anyone else. Thank you!!
Theo,
You don't need the NAT rules outside (depending on your configuration).
Basically, you need to add the pool VPN L2L traffic and network remote to the ACL of split tunneling (if configured), also the "permit same-security-traffic intra-interface".
Please let me know.
Thank you.
-
Access remote vpn for the cisco1841
Hi all
Can I have an example configuration of a vpn for remote access to work for cisco router 1800 series?
My cisco 1800 series router already a site to site vpn, so can I still set up a vpn for remote access using the existing IKE policy?
Is it true that cisco router do support 1 IKE policy? Pls advise. Thks in advance.
what you have is correct
the line of authentication that you mentioned on is to suggest that we use the local user database authentication
If you have an external aaa server as Ganymede + or radius, you can specify that, instead of local, local, is a key word to suggest local authentication
your local database would be so user name passwords what ever you store on the router as
username cisco password cisco
hope this helps
If this answers your question please note this as responded to the benefit of users in the community
-
Divide access remote vpn tunnel ASA 5520
Hello
I'm setting up a vpn for remote access with split tunnel, but I use an acl extended to match a host and http to destination port, but does not work.
Scenario of
Distance access(10.0.0.122/24)--internet---Cisco ASA(inside:192.168.10.1/24)---ip = 192.168.10.6 - C6509 - 10.0.0.254/24---hote = 10.0.0.31/24
The plot is when I activate the IP service connection or flow ICMP worked. Does anyone have an idea what is the problem? Thank you
Concerning
Split tunneling does not take into account the port information you specify in the ACL, he doesn't care the ip address/network you defined.
If you want to restrict access to ports and IP, you must define your split tunneling with only ip addresses and using a vpn-filter acl in group policy to restrict following the specific ports that you want:
split_acl ip access list allow
access-list allowed filter_acl ip eq
attributes of group-pol
Split-tunnel-pol tunnelspecified
value of Split-tunnel-net split_acl
VPN-filter value filter_acl
-heather
-
configuration problem pix515 to access remote vpn using the vpn client
Hello
My chart is simple:
a client pc with customer vpn cisco 3.X
try to connect to a remote site via a pix 515E.
What happened:
the pc can connect, the pix give it an ip address, but no traffic not encrypted so no access to the remote network.
My config is:
---------------------------------------
START THE CONFIG
--------------------------------------
access-list 102 permit ip 192.168.80.0 255.255.255.0 10.10.10.0 255.255.255.0
IP local pool clientpool 10.10.10.5 - 10.10.10.50
NAT (inside) - 0 102 access list
Permitted connection ipsec sysopt
Crypto ipsec transform-set robust esp - esp-md5-hmac
Crypto-map dynmap 10 transform-set robust Dynamics
map mymap 10-isakmp ipsec crypto dynamic dynmap
mymap outside crypto map interface
ISAKMP allows outside
ISAKMP identity address
part of pre authentication ISAKMP policy 10
encryption of ISAKMP policy 10
ISAKMP policy 10 md5 hash
10 2 ISAKMP policy group
ISAKMP life duration strategy 10 86400
vpngroup address clientpool pool vpn30002
vpngroup password 123daniel456789 vpn30002
vpngroup split tunnel 102 vpn30002
-------------------------------------
END CONFIG
-------------------------------------
Please help me!
Concerning
Can you upgrade to a new vpn client or try to disable the firewall in XP sp 2? I think the problem is that this old clients are not supported on xp sp2 or will have problems with the firewall in SP2. Try to run a higher customer or 4.0 x.
-
Split DNS on ASA 5510 access remote vpn works not
I connect successfully to the tunnel and can ping hosts remotely by IP but am unable to browse the internet from the VPN client. Also, the resolution of host name on the remote end does not work... can only connect through the IP address. Ideas? Thanks again!
Your group policy will SUFFER a good split tunneling and divide the dns settings. But I think that you are awarded the DfltGrpPolicy rather than your group policy will SUFFER because group policy is not set in your group of tunnel, nor be transmitted from authentication.
Make a vpn-sessiondb distance 'show' to confirm what group policy is assigned to fix it, assign your group policy will BE to your group of tunnel as follows:
global-tunnel-group attributes
Will BE by default-group-policy
-heather
Maybe you are looking for
-
Being given that I can't access anything ELSE all tips go into Keychain Access etc won't work. I tried to cancel it, but she and the other boxes of menu just POPs back up. It didn't happen when I upgraded my Mac mini to 2012. Please help me solve thi
-
How to get Freemake plug-in on Firefox
Hello I used to have this on my system, until a recent problem required a new XP installation. Now it won't work, despite the versions of Firefox and Freemake being the same. Https://support.mozilla.org/en-US/questions/975842 thread seems to solve th
-
When scanning, the ADP does not work on my HP Deskjet 3510 e-all-in-one printer
Ok. This is my second time to enter in this. I have an ADF and have tried SEVERAL times to scan but my scanner WILL NOT use the ADF. I chkd information available on this forum but nothing I've tried has worked. It is "operator error" or "hardware
-
Win7 works ok, so what drivers Lenovo/apps do I really need?
I installed win 7 ultimate on my laptop T61 and it runs great. I have not yet installed the drivers Lenovo or apps that apply to my machine. What drivers Lenovo/apps I really need because my Win 7 seems to work very well and everything seems to work
-
Upgraded to 7.1 on smart phones blackBerry bold 9900 and app world will not work
App world says there is a problem with the appworld and app world must be closed. How do I get this resolved. Worked fine before upgrade