Access linux VPN client XP host

Similar Questions

• Unable to connect to other remote access (ASA) VPN clients

  Hello

  I have a cisco ASA 5510 appliance configured with remote VPN access

  I can connect all hosts on the INSIDE and DMZ network, but not able to access other clients connected to the same VPN.

  For example, if I have 2 clients connected to the VPN, customer and CustomerB, with a pool of vpn IP addresses such as 10.40.170.160 and 10.40.170.161 respectively, these two clients are not able to communicate with each other.

  Any help is welcome.

  Thanks in advance.

  Hello

  I'm a little rusty on the old format NAT, but would be what I would personally try to configure NAT0 on the 'outer' interface.

  It seems to me that you currently have dynamic PAT configured for the VPN users you have this

  NAT (outside) 1 10.40.170.0 255.255.255.0

  If your traffic is probably corresponding to it.

  The only thing I can think of at the moment would be to configure

  Note of VPN-CLIENT-NAT0-access-list NAT0 for traffic between VPN Clients

  list of access VPN-CLIENT-NAT0 permit ip 10.40.170.0 255.255.255.0 10.40.170.0 255.255.255.0

  NAT (outside) 0-list of access VPN-CLIENT-NAT0

  I don't know if it works. I did not really have to configure it on any ASAs running older software. There was some similar questions here on the forums for the new format.

  -Jouni

• Can't access secondary VPN client subnet

  Please can someone help with the following: I have an ASA 5510 performer v8.4 9 (3) and setup a remote user VPN using the v5.0.07.0410 of customer Cisco VPN which is working apart from the fact that I can not access resources on secondary subnet.

  The configuration is the following:

  ASA inside the interface on 192.168.10.240

  VPN clients on 192.168.254.x

  I can access reources on the 192.168.10 subnet but not no matter what other subnets internally, I need to specifically allow access to the 192.168.20 subnet, but I cannot figure out how to do advise please, the config is lower to: -.

  Output from the command: 'show startup-config '.

  !
  ASA 3,0000 Version 9
  !
  blank host name
  domain name

  activate the encrypted password
  encrypted passwd
  names of
  DNS-guard
  !
  interface Ethernet0/0
  nameif outside
  security-level 0
  IP 255.255.255.224
  !
  interface Ethernet0/1
  nameif inside
  security-level 100
  IP 192.168.10.240 255.255.255.0
  !
  interface Ethernet0/2
  nameif DMZ
  security-level 50
  IP 10.10.10.253 255.255.255.0
  !
  interface Ethernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  management only
  !
  boot system Disk0: / asa843-9 - k8.bin
  boot system Disk0: / asa823 - k8.bin
  passive FTP mode
  clock timezone GMT/UTC 0
  summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00
  DNS domain-lookup outside
  DNS lookup field inside
  DNS server-group DefaultDNS
  Server name 194.168.4.123
  Server name 194.168.8.123
  domain nifcoeu.com
  network object obj - 192.168.0.0
  192.168.0.0 subnet 255.255.255.0
  network object obj - 192.168.5.0
  192.168.5.0 subnet 255.255.255.0
  network object obj - 192.168.10.0
  192.168.10.0 subnet 255.255.255.0
  network object obj - 192.168.100.0
  255.255.255.0 subnet 192.168.100.0
  network object obj - 192.168.254.0
  192.168.254.0 subnet 255.255.255.0
  network object obj - 192.168.20.1
  Host 192.168.20.1
  network obj_any object
  subnet 0.0.0.0 0.0.0.0
  network obj_any-01 object
  subnet 0.0.0.0 0.0.0.0
  network object obj - 0.0.0.0
  host 0.0.0.0
  object network obj_any-02
  subnet 0.0.0.0 0.0.0.0
  network object obj - 10.10.10.1
  host 10.10.10.1
  obj_any-03 network object
  subnet 0.0.0.0 0.0.0.0
  object network obj_any-04
  subnet 0.0.0.0 0.0.0.0
  object network obj_any-05
  subnet 0.0.0.0 0.0.0.0
  network of the NS1000_EXT object
  Home 80.4.146.133
  network of the NS1000_INT object
  Host 192.168.20.1
  network of the SIP_REGISTRAR object
  Home 83.245.6.81
  service of the SIP_INIT_TCP object
  SIP, service tcp destination eq
  service of the SIP_INIT_UDP object
  SIP, service udp destination eq
  network of the NS1000_DSP object
  192.168.20.2 home
  network of the SIP_VOICE_CHANNEL object
  Home 83.245.6.82
  service of the DSP_UDP object
  destination udp 6000 40000 service range
  service of the DSP_TCP object
  destination tcp 6000 40000 service range
  network 20_range_subnet object
  subnet 192.168.20.0 255.255.255.0
  subnet of voice Description
  network 25_range_Subnet object
  255.255.255.0 subnet 192.168.25.0
  PC devices customer Description VLAN 25
  the ISP_NAT object-group network
  object-group Protocol TCPUDP
  object-protocol udp
  object-tcp protocol
  object-group service SIP_INIT tcp - udp
  port-object eq sip
  object-group service DSP_TCP_UDP tcp - udp
  6000-40000 object-port Beach
  permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.254.0 255.255.255.0
  inside_nat0_outbound list extended access allowed object 20_range_subnet 192.168.254.0 ip 255.255.255.0
  standard VPN_splitTunnelAcl-Remote Access-list allowed 192.168.10.0 255.255.255.0
  standard VPN_splitTunnelAcl-Remote Access-list allowed 192.168.20.0 255.255.255.0
  access-list 100 extended allow object object-group TCPUDP object SIP_REGISTRAR NS1000_INT SIP_INIT object-group
  access-list 100 extended allow object object-group TCPUDP object SIP_VOICE_CHANNEL NS1000_DSP DSP_TCP_UDP object-group
  access-list extended 100 permit ip 62.255.171.0 255.255.255.224 all
  access-list 100 extended allow icmp from any echo-answer idle
  access-list extended 100 permit icmp any one has exceeded the idle time
  access-list extended 100 allow all unreachable icmp inactive
  access-list extended 100 permit tcp any host 10.10.10.1 eq ftp
  access-list extended 100 permit tcp any host 10.10.10.1 eq ftp - data
  pager lines 24
  Enable logging
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 DMZ
  management of MTU 1500
  192.168.254.1 mask - local 192.168.254.254 pool Pool VPN IP 255.255.255.0
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 647.bin
  enable ASDM history
  ARP timeout 14400
  NAT (inside, all) source static obj - 192.168.0.0 obj - 192.168.0.0 destination static obj - 192.168.5.0 obj - 192.168.5.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 192.168.100.0 obj - 192.168.100.0 non-proxy-arp-search to itinerary
  NAT (inside, all) source static obj - 192.168.10.0 obj - 192.168.10.0 destination static obj - 192.168.254.0 obj - 192.168.254.0 no-proxy-arp-search to itinerary
  NAT (exterior, Interior) static source SIP_REGISTRAR destination interface static NS1000_INT service SIP_INIT_TCP SIP_INIT_TCP SIP_REGISTRAR
  NAT (exterior, Interior) static source SIP_REGISTRAR destination interface static NS1000_INT service SIP_INIT_UDP SIP_INIT_UDP SIP_REGISTRAR
  !
  network obj_any object
  NAT dynamic interface (indoor, outdoor)
  network obj_any-01 object
  NAT (inside, outside) dynamic obj - 0.0.0.0
  object network obj_any-02
  NAT (inside DMZ) dynamic obj - 0.0.0.0
  network object obj - 10.10.10.1
  NAT (DMZ, outside) static 80.4.146.134
  obj_any-03 network object
  NAT (DMZ, outside) dynamic obj - 0.0.0.0
  object network obj_any-04
  NAT (management, outside) dynamic obj - 0.0.0.0
  object network obj_any-05
  NAT (management, DMZ) dynamic obj - 0.0.0.0
  Access-group 100 in external interface
  Route outside 0.0.0.0 0.0.0.0 80.4.146.129 1
  Route inside 192.168.20.0 255.255.255.0 192.168.10.254 1
  Route inside 192.168.25.0 255.255.255.0 192.168.10.254 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  the ssh LOCAL console AAA authentication
  Enable http server
  http 192.168.1.0 255.255.255.0 management
  http 192.168.10.0 255.255.255.0 inside
  http 192.168.25.0 255.255.255.0 inside
  http 62.255.171.0 255.255.255.224 outside
  http 192.168.254.0 255.255.255.0 outside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  Crypto ca trustpoint ASDM_TrustPoint0
  registration auto
  name of the object CN =

  Configure CRL
  Crypto ca trustpoint _SmartCallHome_ServerCA
  Configure CRL
  string encryption ca ASDM_TrustPoint0 certificates
  certificate 2f0e024d

  quit smoking
  Crypto ca certificate chain _SmartCallHome_ServerCA
  certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

  quit smoking
  crypto isakmp identity address
  Crypto ikev1 allow outside
  IKEv1 crypto policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  Telnet 192.168.1.0 255.255.255.0 management
  Telnet timeout 5
  SSH 62.255.171.0 255.255.255.224 outside
  SSH 192.168.254.0 255.255.255.0 outside
  SSH 192.168.10.0 255.255.255.0 inside
  SSH 192.168.25.0 255.255.255.0 inside
  SSH timeout 5
  SSH version 2
  Console timeout 0
  VPN-sessiondb max-other-vpn-limit 250
  VPN-sessiondb 2 max-anyconnect-premium-or-essentials-limit
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  prefer NTP server 192.168.10.6 source inside
  WebVPN
  internal group to distance-VPN strategy
  attributes of group to VPN remote policy
  value of server WINS 192.168.10.21 192.168.10.22
  value of server DNS 192.168.10.21 192.168.10.22
  Ikev1 VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value Remote-VPN_splitTunnelAcl
  value by default-field
  username empty empty encrypted password privilege 0
  user name empty attributes
  VPN-VPN-remote group policy
  username empty encrypted password privilege 0
  user name empty attributes
  VPN-VPN-remote group policy
  type tunnel-group to distance-VPN remote access
  global-tunnel-group attributes to remote VPN
  address pool VPN-pool
  strategy of group - by default - remote-VPN
  remote VPN-ipsec-attributes tunnel-group
  IKEv1 pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  inspect the tftp
  Review the ip options
  inspect the sip
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  contact-email-addr

  Profile of CiscoTAC-1
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory
  monthly periodicals to subscribe to alert-group configuration
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:b8263c5aa7a6a4d9cb08368c042ea236

  Hi Simon,.

  Please try this and let me know.

  NAT (inside, all) source 20_range_subnet destination 20_range_subnet static static obj - 192.168.254.0 obj - 192.168.254.0

  Let me know, if this can help.

  Thank you

  Rizwan James

• Unable to access the VPN Client LAN

  I configured a 877 for VPN Client Access. The Client authenticates and connects and receives an IP address off the coast of the pool of intellectual property. However, he is unable to access anything on the IP network.

  I have included my router config. The VPN Client is v5.0.05.0290.

  Any ideas on what I'm missing?

  Can try reverse our ACL VPN-Client, I think that it is written in the wrong way

  For example:

  VPN-Client extended IP access list

  Note * permit VPN Client pool *.

  IP enable any 192.168.201.0 0.0.0.255

  or more precise

  VPN-Client extended IP access list

  Note * permit VPN Client pool *.

  192.168.1.0 255.255.255.0 ip permit 192.168.201.0 0.0.0.255

• Internet access with VPN Client to ASA and full effect tunnel

  I'm trying to migrate our concentrator at our new 5520 s ASA. The concentrator has been used only for VPN Client connections, and I have not the easiest road. However, I, for some reason, can't access to internet through our business network when I've got profiles with lots of tunneling.

  I've included the configuration file, with many public IP information and omitted site-to-site tunnels. I left all the relevant stuff on tunnel-groups and group strategies concerning connectivity of VPN clients. The range of addresses that I use for VPN clients is 172.16.254.0/24. The group, with what I'm trying to access the internet "adsmgt" and the complete tunnel to our network part is fine.

  As always, any help is appreciated. Thank you!

  Hüseyin... good to see you come back.. bud, yes try these Hüseyin sugesstiong... If we looked to be ok, we'll try a different approach...

  IM thinking too, because complete tunnel is (no separation) Jim ASA has to go back for the outbound traffic from the internet, a permit same-security-traffic intra-interface, instruction should be able to do it... but Jim start by Hüseyin suggestions.

  Rgds

  Jorge

• VPN access with VPN client problem. Help, please

  I have a PIX 520 as VPN tunnels endpoint device. I was able to establish an IPsec connection. I checked that I have gave me an address in the IP pool that I set up but I can't to any resource on the internal network. I could only ping myself. When I run ' ipconfig/all' I see my address on the correct vpn with DNS interface, but my front door is set to my own address. I think that's the problem. Please help me solve this problem. Let me know if you need more information.

  Here are some suggestions you might try to get this working:

  1.) change your "taken" to access-list. The lines are no longer supported by Cisco even if they still work. This will help you in debugging your access list because there will be some hitcounts.

  There is a tool from cisco for conduits of concert on access lists:

  http://www.Cisco.com/cgi-bin/tablebuild.pl/PIX?sort=release

  Download the: occ - 121.zip

  PIX Firewall Outbound leads binary converter for Windows, version 1.2.1

  2.) change your pool of VPN.

  IP local pool techvpn 10.x.x.100 - 10.x.x.120

  With this, it's already you have a 10.x.x.x subnet in your internal network. The ip pool automatically assigns a 255.0.0.0 for the VPN Clients subnet mask. This may cause routing problems. You can use a subnet used anywhere 172.16.100.x.

  example:

  No vpngroup address techvpn pool lsdvpn

  no ip local pool techvpn

  IP local pool techvpn 172.16.100.1 - 172.16.100.254

  vpngroup address techvpn pool lsdvpn

  No inside_outbound_nat0_acl access list

  No outside_cryptomap_dyn_20 access list

  inside_outbound_nat0_acl ip access list allow any 172.16.100.0 255.255.255.0

  outside_cryptomap_dyn_20 ip access list allow any 172.16.100.0 255.255.255.0

  Claire ipsec his

  Claire isakmp his

  sincerely

  Patrick

• Allowing external IP access via VPN Client

  We are looking for our remote VPN users to access an external IP address.  Basically once users authenticate when they try to access 202.1.56.19, they should be out nat through the external interface of the firewall.  Below is out of the package violated on "vpn ecrypt" tracer and as an extract from the config.  On the client, I see that the road to 202.1.56.19 was added, but it does not work.

  Please advise more information be required ing.  Thank you.

  access list INSIDE-OUT scope ip 10.15.160.0 allow 255.255.255.0 any
  access OUTSIDE list / allowed extended Interior ip 10.15.160.0 255.255.255.0 any
  Access-group OUTSIDE / inside interface OUTSIDE-IDC

  NONATIDC list of allowed ip extended access all 10.15.160.0 255.255.255.0

  NAT (INSIDE) 0-list of access NONATIDC
  NAT (INSIDE) 1 10.15.160.0 255.255.255.0
  Global (OUTSIDE-IDC) 1 128.15.155.2

  internal CorpVPN group strategy
  attributes of Group Policy CorpVPN
  value of server DNS 10.15.155.17
  VPN-idle-timeout no
  VPN-session-timeout no
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list SplitTunnel
  something.com value by default-field

  attributes global-tunnel-group CorpVPN
  address pool CorpVPNpool
  Group Policy - by default-CorpVPN
  IPSec-attributes tunnel-group CorpVPN
  pre-shared key

  Standard access list SplitTunnel allow 192.168.168.0 255.255.255.0
  SplitTunnel list standard access allowed host 202.1.56.19

  Packet-trace input outside-iDC tcp 10.15.160.18 22 202.1.56.19 22

  Phase: 1
  Type: ACCESS-LIST
  Subtype:
  Result: ALLOW
  Config:
  Implicit rule
  Additional information:
  MAC access list

  Phase: 2
  Type: FLOW-SEARCH
  Subtype:
  Result: ALLOW
  Config:
  Additional information:
  Not found no corresponding stream, creating a new stream

  Phase: 3
  Type:-ROUTE SEARCH
  Subtype: entry
  Result: ALLOW
  Config:
  Additional information:
  in 0.0.0.0 0.0.0.0 OUTSIDE-IDC

  Phase: 4
  Type: ACCESS-LIST
  Subtype: Journal
  Result: ALLOW
  Config:
  Access-group OUTSIDE / inside interface OUTSIDE-IDC
  access OUTSIDE list / allowed extended Interior ip 10.15.160.0 255.255.255.0 any
  Additional information:

  Phase: 5
  Type: IP-OPTIONS
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 6
  Type: CP-PUNT
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 7
  Type: VPN
  Subtype: ipsec-tunnel-flow
  Result: ALLOW
  Config:
  Additional information:

  Phase: 8
  Type: VPN
  Subtype: encrypt
  Result: DECLINE
  Config:
  Additional information:

  Result:
  input interface: OUTSIDE-IDC
  entry status: to the top
  entry-line-status: to the top
  output interface: OUTSIDE-IDC
  the status of the output: to the top
  output-line-status: to the top
  Action: drop
  Drop-reason: flow (acl-drop) is denied by the configured rule

  Essentially, the traffic needs to make a u-turn at ASA outside interface if I understand your configuration.

  You need the following to make it work.

  -permit same-security-traffic intra-interface

  -Host202 of the 10.15.160.0 ip access list permit 255.255.255.0 host 202.1.56.19

  -nat (OUTSIDE-IDC) 1 access-list Host202

• How to allow access to a local area network behind the cisco vpn client

  Hi, my question is about how to allow access to a local area network behind the cisco vpn client

  With the help of:

  • Cisco 5500 Series Adaptive Security Appliance (ASA) that is running version 8.2 software
  • Cisco VPN Client version 5.0 software

  Cisco VPN client allows to inject a local routes in the routing table Cisco ASA?

  Thank you.

  Hi Vladimir,.

  Unfortunately this is not a supported feature if you connect through the VPN Client. With VPN Client, that the VPN Client can access the VPN Client LAN host/local machine, not host from the local network to business as customer VPN is not designed for access from the local company network, but to the local corporate network.

  If you want to access from your local business to your LAN network, you need to configure LAN-to-LAN tunnel.

• Access remote VPN question - hairpin

  Hello, I did a search before posting this question but I have not found anything specific to my situation.

  We have our ASA5520 configured in our main office to allow remote access Cisco VPN client users to access our network.  We have a (network 192.168.1.0/24) remote desktop we have a configured on the same ASA5520 VPN IPSec tunnel that allows the use of internal users (in the main office) to access resources on the network remote (192.168.1.0) and vice versa.  The problem is that when users connect to the remote VPN access, they are not able to access the resources of the remote office network.  We created the nat0 ACL and labour, and split tunnel routing is implemented for users VPN remote network access (if I make a copy of the route on my laptop after connecting to the VPN, I see the road to 192.168.0.0/24 in my routing table).  Routing everything is in place to do this, since the IPSec VPN tunnel is up and working.  My suspicion is that the question has something to do with the consolidation of these VPN clients.

  What else needs to be configured to work?  Thank you.

  Hi Scott,.

  I have a client with a PIX 515E which allows connections to remote VPN and VPN LAN2LAN multiple connections.

  We had this problem too... so what I made in my pix was:

  TEST (config) # same-security-traffic intra-interface permits (its off by default)

  If you use ASDM go to:

  Configuration > Interfaces >

  at the bottom of this page, there is an option that says: 'enable traffic between two or more host computers connected to the same interface '.

  Check and it should work... I hope

  I await your comments...

  Kind regards.

  Joao Tendeiro

• Default gateway of the VPN Client is empty

  Hello

  When I connect via ASA VPN remote access via VPN client, I have a new IP assigned but the default gateway is blank. Why is it so?

  Sorry - been busy with other things.

  OK - you see the ASA package being encrypted and de-encrypted?

  The ASA has roads relvan in it?

  The ASA has the correct IP subnets in the list of VPN split tunnel?

• IPSec site to site VPN cisco VPN client routing problem and

  Hello

  I'm really stuck with the configuration of ipsec site to site vpn (hub to spoke, multiple rays) with cisco vpn remote client access to this vpn.

  The problem is with remote access - cisco vpn client access - I can communicate with hub lan - but I need also communication of all lans speaks of the cisco vpn client.

  There are on the shelves, there is no material used cisco - routers DLINK.

  Someone told me that it is possible to use NAT to translate remote access IP-lan-HUB customers and thus allow communication - but I'm unable to set up and operate.

  Can someone help me please?

  Thank you

  Peter

  RAYS - not cisco devices / another provider

  Cisco 1841 HSEC HUB:

  crypto ISAKMP policy 1

  BA 3des

  preshared authentication

  Group 2

  ISAKMP crypto key x xx address no.-xauth

  !

  the group x crypto isakmp client configuration

  x key

  pool vpnclientpool

  ACL 190

  include-local-lan

  !

  86400 seconds, duration of life crypto ipsec security association

  Crypto ipsec transform-set esp-3des esp-sha-hmac 1cisco

  !

  Crypto-map dynamic dynmap 10

  Set transform-set 1cisco

  !

  card crypto ETH0 client authentication list userauthen

  card crypto isakmp authorization list groupauthor ETH0

  client configuration address card crypto ETH0 answer

  ETH0 1 ipsec-isakmp crypto map

  set peer x

  Set transform-set 1cisco

  PFS group2 Set

  match address 180

  card ETH0 10-isakmp ipsec crypto dynamic dynmap

  !

  !

  interface FastEthernet0/1

  Description $ES_WAN$

  card crypto ETH0

  !

  IP local pool vpnclientpool 192.168.200.100 192.168.200.150

  !

  !

  overload of IP nat inside source list LOCAL interface FastEthernet0/1

  !

  IP access-list extended LOCAL

  deny ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  deny ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  IP 192.168.7.0 allow 0.0.0.255 any

  !

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  !

  How the DLINK has been configured for traffic between the site to site VPN subnets? You are able to add multiple remote subnets on DLINK? If you can, then you must add the pool of Client VPN subnet.

  Alternatively, if you cannot add multiple subnet on DLINK router, you can change the pool of Client VPN 192.168.6.0/24, and on the crypto ACL between the site to site VPN, you must edit the 180 existing ACL

  DE:

  access-list 180 allow ip 192.168.7.0 0.0.0.255 192.168.1.0 0.0.0.255

  access-list 180 allow ip 192.168.200.0 0.0.0.255 192.168.1.0 0.0.0.255

  TO:

  access-list 180 allow ip 192.168.6.0 0.0.1.255 192.168.1.0 0.0.0.255

  Also change the ACL 190 split tunnel:

  DE:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.200.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.200.0 0.0.0.255

  TO:

  access-list 190 allow ip 192.168.7.0 0.0.0.255 192.168.6.0 0.0.0.255

  access-list 190 allow ip 192.168.1.0 0.0.0.255 192.168.6.0 0.0.0.255

  Finally, replace the remote subnet 192.168.7.0/255.255.255.0 192.168.6.0/255.255.254.0 DLINK.

  Hope that helps.

• Binds two ISP ASA to remote VPN Client to connect to instead of creating two profiles on the remote client

  Hello

  just a quick,

  TOPOLOGY

  ASA isps1 - 197.1.1.1 - outside

  ASA ISP2 - 196.1.1.1 - backup

  LAN IP - 192.168.202.100 - inside

  I have configured Tunnel on the interfaces (external and backup), but is to link both legs public to serve a thare as redundancy for vpn users and users of the vpn tunnel leave pointing inside IP whenever they want to establish vpn sssion, we want it to be one, so if an interface fails vpn users will not know , but he will try the second for the connection. instead of creating the profile for the two outside of the leg on the vpn client.

  is this possible?

  Hi Rammany.

  In your case, you have only an ASA that connects with 2 ISP in another segment IP... 196.x.x.x (Link1) & 197.x.x.x (Link2). What your condition is you want to have the VPN client who must be consulted with backup. If 196.x.x.x link fails, it should automatically take 197.x.x.x link. That too we should not have the config set in the VPN client backup server. You don have the possibility of having standby active also in asa single.

  I think n so it will work with your current design.

  This option is if your VPN client supports host name resolution (DNS). You can have the VPN created for both the public IP address share the same host name keeping the bond as the primary address 1 and 2 a secondary address. It will work alone.

  Hope someother experts in our forum can help you with that.

• Vpn client access to the DMZ host

  I'm having a problem where my customers who establish a VPN with Pix 515 cannot access hosts on the DMZ. VPN clients can access hosts inside network without any problems. I discovered that when I make a route to trace from a client computer that has established a VPN connection to a host on the DMZ, he tries to go through the default gateway of computers instead of the client from cisco. Any ideas?

  More information:

  When a client connects with the PIX over the VPN, it is given the internal DNS servers and the DNS Server internal, we have a host entry that says "www.whatever.com" 2.2.2.2 (this is the DMZ host). Customers within the network can access this host with problems, it's just the customers who establish a VPN connection. But the VPN Clients can access "www.whatever.com" using the public ip address. The problem is that if remove us the entry from the host on the DNS server so that the name of "www.whatever.com" decides the public ip address customers inside will not be able to access the DMZ host. The names and IP numbers are not real just using those as an example.

  Any help would be apperciated. Thank you

  You'll currently have something like this in your config file:

  sheep allowed ip access-list

  NAT (inside) 0 access-list sheep

  This tells the PIX not to NAT any traffic from inside interface, which is to go to a VPN client. You need the same thing but for the DMZ interface, then add the following:

  sheep allowed ip access-list

  NAT 0 access-list sheep (dmz)

  Who should you get.

• Router RV042 VPN Client access from Linux?

  Hello world!

  I have a question for the creators and users of RV042.

  Is there a way to communicate with a Linux box for access on a RV042 VPN client? I'm trying to do that and play with the settings, but I am not able to connect. I tried profiles in OpenVPN, OpenSwan, kVPNc and others. For the most part, my problem is that all of these software require too many parameters and other certificates that only types that you can create on a RV042 (.pem files).

  Please let me know if any of you were able to connect to a Linux box for on a RV042 VPN.

  Also, I would ask the CISCO/Linksys people why they provide only a Windows client for this option? "Small companies" are devices not windows based commercial devices!

  Thank you!

  Zoli

  Good day Zoli,

  Unfortunately, there is not any Quickvpn client available for Linux and Macintosh which work together with the Small Business/Small Business routers Pro.

  If I share your dismay that we do not formally use Quickvpn with all Linux distributions or any Mac OS, we have seen limited success with solutions that allow the use of third party VPN Clients when used in conjunction with our routers.

  I'm curious to know whether or not you have explored Shrew Soft VPN Client (a simple Google search will yield results). I'm currently taking a look and to experiment a little bit on my end to see if there is anything we can get to work. If you can, please let me know what you use distribution, what version and a list of all customers third-party vpn that you used.

  Personally, I'd love to see the development of a guide that we as support engineers to help all of our Linux-savvy customer.

  Thanks for your patience!

• Windows - Internet access, no split Tunnel L2TP VPN Clients does not

  Greetings!

  I have four ASA 5505 that I configured with 4 site to site VPN tunnels (works perfectly) to connect to our company facilities 4. The ASA is also configured with remote access L2TP/IPsec so that a specific group of users of portable computers can connect to and access to all facilities. It also works very well except for one important exception - my split tunnel setting doesn't seem to work, because I can't connect to the Internet outside the VPN resources.

  I accept the inherent risk of allowing tunnels to split from a security point of view since I take the necessary steps to secure the systems used for remote access. I would appreciate any feedback on how to get the job of split tunnel.

  Here is the configuration:

  : Saved
  :
  ASA Version 1.0000 11
  !
  SGC hostname
  domain somewhere.com
  names of
  COMMENTS COMMENTS LAN 192.168.2.0 name description
  name 75.185.129.13 description of SGC - external INTERNAL ASA
  name 172.22.0.0 description of SITE1-LAN Ohio management network
  description of SITE2-LAN name 172.23.0.0 Lake Club Network
  name 172.24.0.0 description of training3-LAN network Southwood
  description of training3 - ASA 123.234.8.124 ASA Southwoods name
  INTERNAL name 192.168.10.0 network Local INTERNAL description
  description of name 192.168.11.0 INTERNAL - VPN VPN INTERNAL Clients
  description of Apollo name 192.168.10.4 INTERNAL domain controller
  description of DHD name 192.168.10.2 Access Point #1
  description of GDO name 192.168.10.3 Access Point #2
  description of Odyssey name 192.168.10.5 INTERNAL Test Server
  CMS internal description INTERNAL ASA name 192.168.10.1
  name 123.234.8.60 description of SITE1 - ASA ASA management Ohio
  description of SITE2 - ASA 123.234.8.189 Lake Club ASA name
  description of training3-VOICE name Southwood Voice Network 10.1.0.0
  name 172.25.0.0 description of training3-WIFI wireless Southwood
  !
  interface Vlan1
  nameif outside
  security-level 0
  IP address dhcp setroute
  !
  interface Vlan2
  nameif INSIDE
  security-level 100
  255.255.255.0 SGC-internal IP address
  !
  interface Vlan3
  nameif COMMENTS
  security-level 50
  IP 192.168.2.1 255.255.255.0
  !
  interface Ethernet0/0
  Time Warner Cable description
  !
  interface Ethernet0/1
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  interface Ethernet0/2
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  interface Ethernet0/3
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  interface Ethernet0/4
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  interface Ethernet0/5
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  interface Ethernet0/6
  Description for Wireless AP Trunk Port
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  interface Ethernet0/7
  Description for Wireless AP Trunk Port
  switchport access vlan 2
  switchport trunk allowed vlan 2-3
  switchport vlan trunk native 2
  switchport mode trunk
  !
  boot system Disk0: / asa821-11 - k8.bin
  Disk0: / config.txt boot configuration
  passive FTP mode
  clock timezone IS - 5
  clock to summer time EDT recurring
  DNS domain-lookup outside
  INTERNAL DNS domain-lookup
  DNS domain-lookup GUEST
  DNS server-group DefaultDNS
  Name-Server 4.2.2.2
  domain somewhere.com
  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface
  DM_INLINE_TCP_1 tcp service object-group
  EQ port 3389 object
  port-object eq www
  EQ object of the https port
  EQ smtp port object
  the DM_INLINE_NETWORK_1 object-group network
  network-object SITE1-LAN 255.255.0.0
  network-object SITE2-LAN 255.255.0.0
  network-object training3-LAN 255.255.0.0
  object-group training3-GLOBAL network
  Southwood description Global Network
  network-object training3-LAN 255.255.0.0
  network-object training3-VOICE 255.255.0.0
  network-object training3-WIFI 255.255.0.0
  DM_INLINE_TCP_2 tcp service object-group
  EQ port 5900 object
  EQ object Port 5901
  object-group network INTERNAL GLOBAL
  Description Global INTERNAL Network
  network-object INTERNAL 255.255.255.0
  network-object INTERNALLY-VPN 255.255.255.0
  access-list outside_access note Pings allow
  outside_access list extended access permit icmp any CMS-external host
  access-list outside_access note that VNC for Camille
  outside_access list extended access permit tcp any host CMS-external object-group DM_INLINE_TCP_2
  access-list outside_access note INTERNAL Services
  outside_access list extended access permit tcp any host CMS-external object-group DM_INLINE_TCP_1
  DefaultRAGroup_splitTunnelAcl list standard access allowed INTERNAL 255.255.255.0
  access-list sheep extended ip INTERNAL 255.255.255.0 allow INTERNAL VPN 255.255.255.0
  access-list extended sheep allowed ip IN-HOUSE-GLOBAL SITE1-LAN 255.255.0.0 object-group
  access-list extended sheep allowed ip IN-HOUSE-GLOBAL SITE2-LAN 255.255.0.0 object-group
  access-list extended sheep allowed ip object-IN-HOUSE-GLOBAL object group training3-GLOBAL
  access-list INTERNAL-to-SITE1 extended permit ip IN-HOUSE-GLOBAL SITE1-LAN 255.255.0.0 object-group
  access-list INTERNAL-to-training3 extended permitted ip object-IN-HOUSE-GLOBAL object group training3-GLOBAL
  access-list INTERNAL-to-SITE2 extended permit ip IN-HOUSE-GLOBAL SITE2-LAN 255.255.0.0 object-group
  no pager
  Enable logging
  exploitation forest asdm warnings
  Debugging trace record
  Outside 1500 MTU
  MTU 1500 INTERNAL
  MTU 1500 COMMENTS
  192.168.11.1 mask - local 192.168.11.25 pool IN-HOUSE VPN IP 255.255.255.0
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 623.bin
  enable ASDM history
  ARP timeout 14400
  Global 1 interface (outside)
  (INTERNAL) NAT 0 access-list sheep
  NAT (INTERNAL) 1 0.0.0.0 0.0.0.0
  NAT (GUEST) 1 0.0.0.0 0.0.0.0
  5900 5900 Camille netmask 255.255.255.255 interface static tcp (GUEST, outdoor)
  3389 3389 Apollo netmask 255.255.255.255 interface static tcp (INDOOR, outdoor)
  public static tcp (INDOOR, outdoor) interface www Apollo www netmask 255.255.255.255
  public static tcp (INDOOR, outdoor) interface https Apollo https netmask 255.255.255.255
  public static tcp (INDOOR, outdoor) interface smtp smtp Apollo netmask 255.255.255.255
  5901 puppy 5901 netmask 255.255.255.255 interface static tcp (GUEST, outdoor)
  Access-group outside_access in interface outside
  Timeout xlate 0:05:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  RADIUS protocol AAA-server Apollo
  Apollo (INTERNAL) AAA-server Apollo
  Timeout 5
  key *.
  AAA authentication enable LOCAL console
  the ssh LOCAL console AAA authentication
  AAA authentication LOCAL telnet console
  AAA authentication http LOCAL console
  Enable http server
  http 0.0.0.0 0.0.0.0 INTERNAL
  http 0.0.0.0 0.0.0.0 COMMENTS
  No snmp server location
  No snmp Server contact
  Community SNMP-server
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA
  Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  life crypto ipsec security association seconds 28800
  Crypto ipsec kilobytes of life - safety 4608000 association
  SYSTEM_DEFAULT_CRYPTO_MAP game 65535 dynamic-map crypto transform-set ESP-3DES-SHA TRANS_ESP_3DES_SHA
  correspondence address 1 card crypto outside_map INTERNAL SITE1
  card crypto outside_map 1 set of peer SITE1 - ASA
  card crypto outside_map 1 set of transformation-ESP-3DES-SHA
  address for correspondence card crypto outside_map 2 INTERNAL training3
  outside_map 2 peer training3 - ASA crypto card game
  card crypto outside_map 2 game of transformation-ESP-3DES-SHA
  address for correspondence outside_map 3 card crypto INTERNAL SITE2
  game card crypto outside_map 3 peers SITE2 - ASA
  card crypto outside_map 3 game of transformation-ESP-3DES-SHA
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  delimiter group @.
  Telnet training3 - ASA 255.255.255.255 outside
  Telnet SITE2 - ASA 255.255.255.255 outside
  Telnet SITE1 - ASA 255.255.255.255 outside
  Telnet 0.0.0.0 0.0.0.0 INTERNAL
  Telnet 0.0.0.0 0.0.0.0 COMMENTS
  Telnet timeout 60
  SSH enable ibou
  SSH training3 - ASA 255.255.255.255 outside
  SSH SITE2 - ASA 255.255.255.255 outside
  SSH SITE1 - ASA 255.255.255.255 outside
  SSH 0.0.0.0 0.0.0.0 INTERNAL
  SSH 0.0.0.0 0.0.0.0 COMMENTS
  SSH timeout 60
  Console timeout 0
  access to the INTERNAL administration
  Hello to tunnel L2TP 100
  interface ID client DHCP-client to the outside
  dhcpd dns 4.2.2.1 4.2.2.2
  dhcpd ping_timeout 750
  dhcpd outside auto_config
  !
  address INTERNAL 192.168.10.100 dhcpd - 192.168.10.200
  dhcpd Apollo Odyssey interface INTERNAL dns
  dhcpd somewhere.com domain INTERNAL interface
  interface of dhcpd option 150 ip 10.1.1.40 INTERNAL
  enable dhcpd INTERNAL
  !
  dhcpd address 192.168.2.100 - 192.168.2.200 COMMENTS
  dhcpd dns 4.2.2.1 4.2.2.2 interface COMMENTS
  enable dhcpd COMMENTS
  !

  a basic threat threat detection
  statistical threat detection port
  Statistical threat detection Protocol
  Statistics-list of access threat detection
  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
  NTP server 192.43.244.18 prefer external source
  WebVPN
  allow outside
  CSD image disk0:/securedesktop-asa-3.4.2048.pkg
  SVC disk0:/sslclient-win-1.1.4.179.pkg 1 image
  SVC disk0:/anyconnect-win-2.4.1012-k9.pkg 2 image
  enable SVC
  Group Policy DefaultRAGroup INTERNAL
  attributes of Group Policy DefaultRAGroup
  Server DNS 192.168.10.4 value
  Protocol-tunnel-VPN l2tp ipsec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl
  value by default-domain somewhere.com
  Group Policy DefaultWEBVPNGroup INTERNAL
  attributes of Group Policy DefaultWEBVPNGroup
  VPN-tunnel-Protocol webvpn
  Group Policy DefaultL2LGroup INTERNAL
  attributes of Group Policy DefaultL2LGroup
  Protocol-tunnel-VPN IPSec l2tp ipsec
  Group Policy DefaultACVPNGroup INTERNAL
  attributes of Group Policy DefaultACVPNGroup
  VPN-tunnel-Protocol svc
  attributes of Group Policy DfltGrpPolicy
  value of 192.168.10.4 DNS Server 4.2.2.2
  VPN - 25 simultaneous connections
  VPN-idle-timeout no
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl
  value by default-domain somewhere.com
  the value INTERNAL VPN address pools
  chip-removal-disconnect disable card
  WebVPN
  SVC keepalive no
  client of dpd-interval SVC no
  dpd-interval SVC bridge no
  value of customization DfltCustomization
  attributes global-tunnel-group DefaultRAGroup
  VPN INTERNAL address pool
  Group Policy - by default-DefaultRAGroup
  IPSec-attributes tunnel-group DefaultRAGroup
  pre-shared-key *.
  Disable ISAKMP keepalive
  tunnel-group DefaultRAGroup ppp-attributes
  No chap authentication
  no authentication ms-chap-v1
  ms-chap-v2 authentication
  attributes global-tunnel-group DefaultWEBVPNGroup
  VPN INTERNAL address pool
  Group Policy - by default-DefaultWEBVPNGroup
  tunnel-group 123.234.8.60 type ipsec-l2l
  IPSec-attributes tunnel-group 123.234.8.60
  pre-shared-key *.
  tunnel-group 123.234.8.124 type ipsec-l2l
  IPSec-attributes tunnel-group 123.234.8.124
  pre-shared-key *.
  tunnel-group 123.234.8.189 type ipsec-l2l
  IPSec-attributes tunnel-group 123.234.8.189
  pre-shared-key *.
  type tunnel-group DefaultACVPNGroup remote access
  attributes global-tunnel-group DefaultACVPNGroup
  VPN INTERNAL address pool
  Group Policy - by default-DefaultACVPNGroup
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  inspect the http
  inspect the they
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:423c807c0d63cb3e9aeceda977053f84
  : end
  ASDM image disk0: / asdm - 623.bin
  ASDM location Camille 255.255.255.255 INTERNAL
  ASDM location INTERNAL CGT-external 255.255.255.255
  ASDM location INTERNAL SITE1-LAN 255.255.0.0
  ASDM location INTERNAL SITE2-LAN 255.255.0.0
  ASDM location INTERNAL training3-LAN 255.255.0.0
  ASDM location INTERNAL training3 - ASA 255.255.255.255
  ASDM location INTERNAL GDO 255.255.255.255
  ASDM location INTERNAL SITE1 - ASA 255.255.255.255
  ASDM location INTERNAL SITE2 - ASA 255.255.255.255
  ASDM location INTERNAL training3-VOICE 255.255.0.0
  ASDM location puppy 255.255.255.255 INTERNAL
  enable ASDM history

  I should also mention that my test clients are a combination of Windows XP, Windows 7, and Windows Mobile. Other that in specifying the preshared key and forcing L2TP/IPsec on the client side, the VPN settings on clients are the default settings with the help of MS-CHAP/MS-CHAPv2.

  You must configure * intercept-dhcp enable * in your group strategy:

  attributes of Group Policy DefaultRAGroup

  attributes of Group Policy DefaultRAGroup

  Server DNS 192.168.10.4 value
  Protocol-tunnel-VPN l2tp ipsec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl
  value by default-domain somewhere.com

  Intercept-dhcp enable

  -Latptop VPN clients (which I assume are on windows computers) is also the * use on remote network default gateway * box unchecked.  It is located on the Advanced tab of VPN client TCP/IP properties.   Select Client VPN > properties > Networking > TCP/IP Internet Protocol > properties > advanced and uncheck the box.

  Alex