AnyConnect VPN users cannot access remote subnets?

I googled this until blue in the face without result. I don't understand why Cisco this so difficult? When clients connect to the anyconnect vpn, they can access the local subnet, but cannot access the resources in remote offices. What should I do to allow my anyconnect vpn clients access to my remote sites?

Cisco 5510 8.4

Hello

What are remote sites using as Internet gateway? Their default route here leads to the ASA or have their own Internet gateway? If they use this ASA for their Internet connection while they should already have a default route that leads traffic to the VPN to the pool, even if they had no specific route for the VPN itself pool. If they use their own local Internet gateway and the default route is not directed to this ASA then you would naturally have a route on the remote site (and anything in between) indicating the remote site where to join the pool of 10.10.224.0/24 VPN network.

In addition to routing, you must have configured for each remote site and the VPN pool NAT0

Just a simple example of NAT0 configuration for 4 networks behind the ASA and simple VPN field might look like this

object-group network to REMOTE SITES

object-network 10.10.10.0 255.255.255.0

object-network 10.10.20.0 255.255.255.0

object-network 10.10.30.0 255.255.255.0

object-network 10.10.40.0 255.255.255.0

network of the VPN-POOL object

10.10.224.0 subnet 255.255.255.0

NAT static destination DISTANCE-SITES SITES source (indoor, outdoor) REMOTE static VPN-VPN-POOL

The above of course assumes that the remote site are located behind the interface 'inside' (although some networks, MPLS) and naturally also the remote site networks are made for the sake of examples.

Since you are using Full Tunnel VPN should be no problem to the user VPN transfer traffic to this ASA in question.

My first things to check would be configuring NAT0 on the ASA and routing between remote sites and this ASA (regarding to reach the VPN pool, not the ASA network IP address)

Are you sure that the configuration above is related to this? Its my understanding that AnyConnect uses only IKEv2 and the foregoing is strictly defined for IKEv1?

-Jouni

Tags: Cisco Security

Similar Questions

AnyConnectVPN users cannot access remote vpn site-to-site

Hello-

We have two 5510 s ASA one in 8.4 (4) and the other to 8.2 (5) in a site to site VPN configuration. All internal traffic is working smoothly.

A: site/subnet 192.160.0.0 - local (8.4 (4)) Site/subnet b: 192.260.0.0 - distance (8.2 (5)) VPN users: 192.160.40.0 - assigned by ASA

When you VPN into the network, all the hits of traffic A Site and everything on the subnet A is accessible.

However, the site B is totally inaccessible to users of VPN. All computers on subnet B, the firewall itself, etc. is not reachable by ping or otherwise.

There are also some NAT rules weird that I'm not happy with that were created after that I upgraded the Site to ASA to 8.4

A resident of the site: external 192.160.x.x: 55.55.555.201(main)/202(mail)

Site B (in addition to site to site) is external 192.260.x.x: 66.66.666.54 (all)

I've pretty much just the basic rules of the NAT for VPN, Email, Internet and site to site.

What I need to add for the VPN access to the network from site to site?

Here is my config NAT:

NAT (inside, outside) static source DOMAIN_LOCAL DOMAIN_LOCAL VPN_Network VPN_Network non-proxy-arp-search of route static destination

NAT (inside, outside) static source DOMAIN_LOCAL DOMAIN_LOCAL DOMAIN_REMOTE DOMAIN_REMOTE non-proxy-arp-search of route static destination

!

network of the DMZ_Network object

dynamic NAT interface (DMZ, outside)

network of the DOMAIN_LOCAL object

NAT dynamic interface (indoor, outdoor)

network of the EXCHANGE_Exchange object

NAT static Outside_Mail (any, any)

network of the DOMAINCTRL_DHCP object

NAT (inside, outside) interface static tcp ftp ftp service

Thank you very much in advance and I hope that I've been pretty thorough.

Let me know if you need anything that anyone else. Thank you!!

Theo,

You don't need the NAT rules outside (depending on your configuration).

Basically, you need to add the pool VPN L2L traffic and network remote to the ACL of split tunneling (if configured), also the "permit same-security-traffic intra-interface".

Please let me know.

Thank you.

Remote VPN users cannot access tunnel from site to site

Cisco ASA5505.

I have a tunnel of site-to-site set up from our office to our Amazon AWS VPC. I'm not a network engineer and have spent way too much time just to get to this point.

It works very well since within the office, but users remote VPN can not access the tunnel from site to site. All other remote access looks very good.

The current configuration is here: https://gist.github.com/pmac72/f483ea8c7c8c8c254626

Any help or advice would be greatly appreciated. It is probably super simple for someone who knows what they're doing to see the question.

Hi Paul.

Looking at your configuration:

Remote access:

internal RA_GROUP group policy
RA_GROUP group policy attributes
value of server DNS 8.8.8.8 8.8.4.4
Protocol-tunnel-VPN IPSec
value of Split-tunnel-network-list Split_Tunnel_List

permit same-security-traffic intra-interface

type tunnel-group RA_GROUP remote access
attributes global-tunnel-group RA_GROUP
address RA_VPN_POOL pool
Group Policy - by default-RA_GROUP
IPSec-attributes tunnel-group RA_GROUP
pre-shared key *.

local pool RA_VPN_POOL 10.0.0.10 - 255.255.255.0 IP 10.0.0.50 mask

Site to site:
```
  
```
card crypto outside_map 1 match address acl-amzn

card crypto outside_map 1 set pfs

peer set card crypto outside_map 1 AWS_TUNNEL_1_IP AWS_TUNNEL_2_IP

card crypto outside_map 1 set of transformation transformation-amzn

I recommend you to use a local IP address pool with a different IP address that deals with the inside interface uses, now you are missing NAT are removed from the IP local pool to the destination of the site to site:

NAT_EXEMPT list of ip 10.0.0.0 access allow 255.255.255.0 172.17.0.0 255.255.0.0

NAT (outside) 0-list of access NAT_EXEMPT

Now, there's a dynamically a NAT exempt allowing traffic to go out and are not translated.

I would like to know how it works!

Please don't forget to rate and score as correct the helpful post!

Kind regards

David Castro,

VPN users cannot access Tunnel

Hi all

I have a problem, I have 2 sites both with ASA 5520, they are both connected via a site to site VPN.

It works very well all users in site A can access resources in site B and vice versa.

The problem comes when a user connects to a remote user VPN site has they cannot access or anything in site B same ping if the FW them delivers an ip address in the range for the site.

Im sure there is something simple that I missed.

Thank you

If the VPN Client pool is in the same subnet as the site of A LAN, then you are probably missing just the following:

(1) check if you have divided political tunnel, and site-B LAN is included in the ACL split tunnel.

(2) configure 'same-security-traffic permit intra-interface' on the site A ASA.

If the above has been configured, please share configuration the two ASA to further check where it is.

VPN clients cannot access remote sites - PIX, routing problem?

I have a problem with routing to remote from our company websites when users connect via their VPN client remotely (i.e. for home workers)

Our headquarters contains a PIX 515E firewall. A number of remote sites to connect (via ADSL) to head office using IPSEC tunnels, ending the PIX.

Behind the PIX is a router 7206 with connections to the seat of LANs and connections to a number of ISDN connected remote sites. The default route on 7206 points to the PIX from traffic firewall which sits to ADSL connected remote sites through the PIX. Internal traffic for LAN and ISDN connected sites is done via the 7206.

Very good and works very well.

When a user connects remotely using their VPN client (connection is interrupted on the PIX) so that they get an IP address from the pool configured on the PIX and they can access resources located on local networks to the office with no problems.

However, the problem arises when a remote user wants access to a server located in one of the remote sites ADSL connected - it is impossible to access all these sites.

On the remote site routers, I configured the access lists to allow access from the pool of IP addresses used by the PIX. But it made no difference. I think that the problem may be the routes configured on the PIX itself, but I don't know what is necessary to solve this problem.

Does anyone have suggestions on what needs to be done to allow access to remote sites for users connected remotely via VPN?

(Note: I suggested a workaround, users can use a server on LAN headquarters as a "jump point" to connect to remote servers from there)

with pix v6, no traffic is allowed to redirect to the same interface.

for example, a remote user initiates an rdp session for one of the barns adsl. PIX decrypts the packet coming from the external interface and looks at the destination. because the destination is one of adsl sites, pix will have to return traffic to the external interface. Unfortunately, pix v6.x has a limitation that would force the pix to drop the packet.

with the v7, this restriction has been removed with the "same-security-traffic control intra-interface permits".

http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

Win 7 VPN client cannot access remote resources beyond the VPN server

I have a Win 7 laptop with work and customer Win 7 VPN set up, and through it that I can access everything allowed resources on the remote network.

I built a new computer, set up the Win 7 client with the exact same parameters everywhere, connected to the VPN with success, but can not access any of the resources on the remote network that I can on my laptop.

Win 7 64 bit SP 1

I did research online and suggestions have already had reason of my new set up. In addition, I have a second computer that I've set up the VPN client, and I'm having the same problem. VPN connects successfully, but is unable to access the resources.

Tested with firewall off the coast.

Troubleshooting Diagnostic reports: your computer seems to be configured correctly, distance resources detected, but not answered do not.

I created another VPN client on the new computer to another remote network and everything works perfectly.

Remember the old VPN connection to the remote network that does not work on the new computer works perfectly on Win 7 64 bit laptop computer.

So, what do I find also different between identical configurations "should be" where we work and two new machines is not?

It must be something stupid.

Hello

This question is more suited for a TechNet audience. I suggest you send the query to the Microsoft TechNet forum. See the link below to do so:
https://social.technet.Microsoft.com/forums/Windows/en-us/home?Forum=w7itpronetworking

Please let us know if you have more queries on Windows.

VPN users cannot access all resources
```
User is able to connect, get's assigned an IP, we can see them connected

    via ASDM, they can't access anything in our network.

    
```
Hello

Check the following:

When you try to send the traffic check the output of "sh cry ips her" to make sure packages encrypted/decrypted by slices.

If it isn't...

May be that NAT - T is not configured.

Check the configuration of:

ISAKMP crypto nat - t

SH run all sysopt--> should show sysopt connection permit VPN

Test:

Add the command

management-access inside

And try to PING IP address of the VPN client ASA inside.

We will consider here...

Federico.

problem with users to access remote vpn site to site vpn network

I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

execution of the configuration of my asa 5510 is

Result of the command: "show run"

: Saved
:
ASA Version 8.4(2)
!
hostname asa5510
domain-name dri.local
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.178 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.0.10 255.255.255.0
!
interface Ethernet0/2
description Mreza za virtualne masine- mail server, wsus....
nameif DMZ
security-level 50
ip address 172.16.20.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name dri.local
object network VPN-POOL
subnet 192.168.50.0 255.255.255.0
description VPN Client pool
object network LAN-NETWORK
subnet 192.168.0.0 255.255.255.0
description LAN Network
object network NETWORK_OBJ_192.168.0.0_24
subnet 192.168.0.0 255.255.255.0
object network 192.168.0.10
host 192.168.0.10
object service ssl
service tcp destination eq 465
object service tls
service tcp destination eq 995
object network mail_server
host 172.16.20.201
object service StartTLS
service tcp destination eq 587
object service admin_port
service tcp destination eq 444
object service ODMR
service tcp destination eq 366
object service SSL-IMAP
service tcp destination eq 993
object network remote
host 172.16.20.200
object network test
host 192.168.0.22
object network mail
host 172.16.20.200
object network DMZ
host 172.16.20.200
object network Inside_DMZ
host 192.168.0.20
object service rdp
service tcp destination eq 3389
object network DRI_PS99
host 192.168.0.54
object service microsoft_dc
service tcp destination eq 445
object service https448
service tcp destination eq 448
object network mail_server_internal
host 172.16.20.201
object service Acronis_remote
service tcp destination eq 9876
object service Acronis_25001
service tcp destination eq 25001
object service HTTP3000
service tcp destination eq 3000
object network VPNPOOL
subnet 192.168.50.0 255.255.255.0
object-group network PAT-SOURCE-NETWORKS
description Source networks for PAT
network-object 192.168.0.0 255.255.255.0
object-group service DM_INLINE_SERVICE_1
service-object object admin_port
service-object object ssl
service-object object tls
service-object object https448
object-group service DM_INLINE_SERVICE_2
service-object object admin_port
service-object object https448
service-object object ssl
service-object object tls
service-object tcp destination eq pop3
service-object tcp destination eq smtp
object-group service DM_INLINE_SERVICE_3
service-object object admin_port
service-object object https448
service-object object ssl
service-object tcp destination eq smtp
service-object object tls
service-object object Acronis_remote
service-object tcp destination eq www
service-object object Acronis_25001
service-object object microsoft_dc
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object tcp
object-group service DM_INLINE_SERVICE_4
service-object object Acronis_25001
service-object object Acronis_remote
service-object object microsoft_dc
service-object tcp destination eq www
service-object tcp
service-object ip
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
access-list DMZ extended deny tcp any any eq smtp
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
mtu management 1500
ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
!
object network mail_server
nat (DMZ,outside) static x.x.x.179
object network mail
nat (DMZ,outside) static x.x.x.180
access-group outside_access_in in interface outside
access-group DMZ in interface DMZ
route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
action terminate
dynamic-access-policy-record dripolisa
aaa-server DRI protocol ldap
aaa-server DRI (inside) host 192.168.0.20
ldap-base-dn DC=dri,DC=local
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
server-type microsoft
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
aaa authorization command LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
virtual telnet 192.168.1.12
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 195.222.96.223
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.0.14-192.168.0.45 inside
!
dhcpd address 172.16.20.2-172.16.20.150 DMZ
dhcpd dns x.x.x.177 interface DMZ
dhcpd auto_config outside interface DMZ
dhcpd option 6 ip x.x.x.177 interface DMZ
dhcpd enable DMZ
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy GroupPolicy_x.x.x.223 internal
group-policy GroupPolicy_x.x.x.223 attributes
vpn-tunnel-protocol ikev1 ikev2
group-policy drivpn internal
group-policy drivpn attributes
dns-server value 192.168.0.20 192.168.0.254
vpn-simultaneous-logins 10
vpn-idle-timeout 30
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-network-list value Split_Tunnel_List
default-domain value dri.local
username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
tunnel-group drivpn type remote-access
tunnel-group drivpn general-attributes
address-pool vpnadrese
authentication-server-group DRI
default-group-policy drivpn
tunnel-group drivpn ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group x.x.x.223 type ipsec-l2l
tunnel-group x.x.x.223 general-attributes
default-group-policy GroupPolicy_x.x.x.223
tunnel-group x.x.x.223 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect tftp
inspect ip-options
inspect netbios
inspect icmp
inspect http
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
: end

running config asa 5505

Result of the command: "show run"

: Saved
:
ASA Version 8.2(1)
!
hostname ciscoasa
enable password csq7sfr0bQJqMGET encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.5.0 PALATA
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.17 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 10.13.74.33 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object-group service DM_INLINE_SERVICE_1
service-object ip
service-object tcp
service-object icmp echo
service-object icmp echo-reply
service-object tcp eq domain
service-object tcp eq ldap
service-object tcp eq smtp
object-group service DM_INLINE_SERVICE_2
service-object ip
service-object tcp eq domain
service-object tcp eq www
service-object tcp eq https
service-object tcp eq smtp
object-group service Sharepoint8080 tcp
port-object eq 8080
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging mail errors
logging from-address
logging recipient-address level debugging
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL
http server enable
http 10.13.74.0 255.255.255.0 outside
http 192.168.0.0 255.255.255.0 inside
http 10.15.100.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
virtual telnet 192.168.0.53
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_2_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 10.15.100.15
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
tunnel-group 10.15.100.15 type ipsec-l2l
tunnel-group 10.15.100.15 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
smtp-server 173.194.79.109
prompt hostname context
Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
: end

Thank you

Hello

I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

So you don't really have any of those.

Please mark the question answers and/or assess response

Ask more if necessary

-Jouni

Why my VPN clients cannot access network drives and resources?

I have a cisco asa 5505 configured to be a VPN gateway. I can dial using the anyconnect VPN client. The remote user is assigned an IP address to my specifications. However... The remote user cannot access network such as disks in network resources or the fax server. I've done everything I can to set the right settings NAT and ACLs, but in vain. I write my config... If someone can track down the problem. It would be appreciated!

: Saved

:

ASA Version 8.2 (5)

!

ciscoasa hostname

Cisco domain name

activate the password xxxxxxxxxxxxx

passwd xxxxxxxxxxxxxxxxx

names of

name 68.191.xxx.xxx outdoors

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.201.200 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address outside 255.255.255.0

!

passive FTP mode

DNS domain-lookup outside

DNS lookup field inside

DNS server-group DefaultDNS

192.168.201.1 server name

Cisco domain name

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

object-group Protocol TCPUDP

object-protocol udp

object-tcp protocol

object-group network obj - 192.168.201.0

FREE access-list extended ip 192.168.201.0 NAT allow 255.255.255.0 192.168.201.0 255.255.255.0

NAT-FREE 192.168.202.0 permits all ip extended access list 255.255.255.0

FREE access-list extended ip 192.168.202.0 NAT allow 255.255.255.0 any

Extended access list-NAT-FREE enabled a whole icmp

allow any scope to an entire ip access list

allow any scope to the object-group TCPUDP an entire access list

allow any scope to an entire icmp access list

inside_access_in of access allowed any ip an extended list

inside_access_in list extended access allow TCPUDP of object-group a

inside_access_in list extended access permit icmp any one

outside_access_in of access allowed any ip an extended list

outside_access_in list extended access allow TCPUDP of object-group a

outside_access_in list extended access permit icmp any one

Standard access list DefaultRAGroup_splitTunnelAcl allow 192.168.201.0 255.255.255.0

access extensive list ip 192.168.202.0 inside_nat0_outbound allow 255.255.255.0 192.168.201.0 255.255.255.0

inside_nat0_outbound list extended access permit icmp any one

inside_nat0_outbound_1 of access allowed any ip an extended list

pager lines 24

Enable logging

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

mask 192.168.202.1 - 192.168.202.50 255.255.255.0 IP local pool KunduVPN

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

NAT-control

Global 1 interface (outside)

NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

NAT (inside) 1 192.168.201.0 255.255.255.0

Access-group outside_access_in in interface outside

inside_access_in access to the interface inside group

Route inside 0.0.0.0 0.0.0.0 192.168.201.1 1

Route inside 0.0.0.0 255.255.255.255 outdoor 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.201.0 255.255.255.0 inside

http 0.0.0.0 0.0.0.0 outdoors

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

Crypto ca trustpoint ASDM_TrustPoint0

registration auto

name of the object CN = ciscoasa

Keypairs xxx

Proxy-loc-transmitter

Configure CRL

XXXXXXXXXXXXXXXXXXXXXXXX

quit smoking

crypto ISAKMP allow outside

crypto ISAKMP allow inside

crypto ISAKMP policy 10

authentication crack

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 20

authentication rsa - sig

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 40

authentication crack

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 50

authentication rsa - sig

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 60

preshared authentication

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 70

authentication crack

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 80

authentication rsa - sig

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 90

preshared authentication

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 100

authentication crack

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 110

authentication rsa - sig

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 120

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 130

authentication crack

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 140

authentication rsa - sig

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 150

preshared authentication

the Encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

SSL-trust outside ASDM_TrustPoint0 point

WebVPN

allow outside

allow inside

SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image

enable SVC

tunnel-group-list activate

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of 192.168.201.1 DNS server

VPN-tunnel-Protocol svc webvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl

Cisco by default field value

attributes of Group Policy DfltGrpPolicy

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

WebVPN

SVC request enable

internal KunduVPN group strategy

attributes of Group Policy KunduVPN

WINS server no

value of 192.168.201.1 DNS server

VPN-tunnel-Protocol svc webvpn

Cisco by default field value

username xxxx

username xxxxx

VPN-group-policy DfltGrpPolicy

attributes global-tunnel-group DefaultRAGroup

address VPNIP pool

Group Policy - by default-DefaultRAGroup

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared key *.

tunnel-group DefaultRAGroup ppp-attributes

ms-chap-v2 authentication

type tunnel-group KunduVPN remote access

attributes global-tunnel-group KunduVPN

address (inside) VPNIP pool

address pool KunduVPN

authentication-server-group (inside) LOCAL

Group Policy - by default-KunduVPN

tunnel-group KunduVPN webvpn-attributes

enable KunduVPN group-alias

allow group-url https://68.191.xxx.xxx/KunduVPN

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:c0e4540d4a07f2c544f0eddb653627cc

: end

don't allow no asdm history

Hello

What is the IP address of the hosts/servers LAN Gateway?

If this is not the ASA 'inside' interface IP address then I assume that the problem with VPN is simply routing.

For example, if your hosts/servers LAN wireless LAN gateway router then the following would happen to your Clients VPN connections.
- Forms of customers login VPN users through configuring wireless routers static PAT (Port Forward) to interface "inside" ASA
- Client VPN sends traffic through the VPN to ASA and again the host of the server or LAN.
- Host/server LAN sees the connection from a network other than the LAN (192.168.202.0/24) and therefore to forward traffic to the default gateway that would likely be the wireless router.
- Wireless router has no route to the network 192.168.202.0/24 (VPN Pool) and therefore uses its default route to the external network to forward traffic.
- Client VPN host never received the traffic back as transmitted sound on the external network and abandoned by the ISP
So if the above assumption is correct, then you would at least need a configuration of the road on the wireless router that tells the device to transfer traffic to the network 192.168.202.0/24 to the 192.168.201.200 gateway IP address (which is the SAA)

I would like to know if the installation is as described above.

-Jouni

ASA VPN connection cannot see all subnets

I'm new to the ASA and I have a problem with our remote users. When people access vpn, they don't see a couple subnets on the network. I looked at the ASA and he can see and communicate with subnets, but when you vpn in them is not reachable. All these connections are connections from admin to admin privlages. Anyone know why the ASA can see subnets, but the admin vpn users cannot?

You compare your ACL split tunnel and your table routing, but only for networks that are relevant to you and you must have access to and are not outside the old configuration. You should also ensure that these networks can route traffic from the pool of vpn.

VPN clients cannot access to the vlan

Hello

I just changed my flat lan to a virtual LAN environment multi, but now I need help to get to my VPN back working again as the VPN user can access servers that are not on the vlan 'door '. I've read enough to know that it is probably associated with NAT, but I'm not sure where to put this information.

Does go in the NAT, associated with the E0 interface (outgoing internet gateway), to the vlan10 (vlan router is actually on) or can I create a new one and apply it to the crypto ipsec and isakmp side of things that use VPN users?

My network is configured as such...

VPN client - Router1811 - split trunk - C3550 - 12G - shared - resources multiple C3550s - servers/Wstns

The router subnet 192.168.10.0 as all switches, VLAN is set up through the 12 G and all other switches as vtp "vtp clients", including the router. The user can get to the 10 subnet and any server on it, but not to the"farm" on the subnet 192.168.11.0.

I noticed Federico has been working on something very similar to this... but any help would be appreciated.

Thank you, Don

Hi Don,

Please mark this discussion as resolved if there is no other problem with this VPN.

See you soon,.

Nash.

Error message: Windows cannot access the specified device path and the second user cannot access the internet

Original title: I have two users on Vista. We get to the top with windows can not access the specified device path.etc. The other has no problem

The second user cannot access the internet. Can't access window appears. The other user is not problems.

Hi Rickravel,

1. what type of account you use?

2. This only happens when you access Internet?

3. when the problem started?

4. you remember to make changes to the computer before this problem?

Step 1:

You can start in safe mode with network and see if the problem occurs in the account.

You can see the following link to start in safe mode with network.

Start your computer in safe mode

Note: Restart the computer to boot into normal mode.

Step 2:

If you use Internet explorer, then you can try to disable add ons and check if it helps:

Run Internet explorer with no Add - ons. Steps to open Internet with no mode of modules:

a. click on start

(b) in the search box, type in Internet explore

c. Select Internet (no add-on mode)

If you were able to access the Web site without any problems, then the module may cause the error.

You can read the following article and try the steps to activate the modules individually determine which Add - ons may be the cause of the problem.

How the modules of the browser affect my computer?

Hope this information is useful.

Can not connect - when entering a password message "the service user profile service has no logon. Failed to load profile \User' cannot access start menu to apply the options.

Can not connect - when entering a password message "the service user profile service has no logon. Failed to load profile \User' cannot access start menu to apply the options.

Hello

1st thing to try is the system in safe mode restore to before the problem

http://www.windowsvistauserguide.com/system_restore.htm

Windows Vista

Using the F8 method:
1. Restart your computer.
2. When the computer starts, you will see your computer hardware are listed. When you see this information begins to tap theF8 key repeatedly until you are presented with theBoot Options Advanced Windows Vista.
3. Select the Safe Mode option with the arrow keys.
4. Then press enter on your keyboard to start mode without failure of Vista.
5. To start Windows, you'll be a typical logon screen. Connect to your computer and Vista goes into safe mode.
6. Do whatever tasks you need and when you are done, reboot to return to normal mode.
If that does not solve it read more

read the tutorial below

http://www.Vistax64.com/tutorials/130095-user-profile-service-failed-logon-user-profile-cannot-loaded.html

When you log on a Windows Vista-based or a Windows 7 computer by using a temporary profile, you receive the following error message:

The user profile Service has not logon. User profile cannot be loaded.

http://support.Microsoft.com/kb/947215#letmefixit

Your user profile was not loaded correctly! You have been logged on with a temporary profile.

http://support.Microsoft.com/kb/947242

If you tried to log on to Windows and received an error message telling you that your user profile is damaged, you can try to fix it. You will need to create a new profile and then copy the files from the existing to the new profile. You must have at least three user accounts on the computer to perform these operations, including the new account that you created.

http://Windows.Microsoft.com/en-us/Windows-Vista/fix-a-corrupted-user-profile

The VPN Clients cannot access any internal address

Without a doubt need help from an expert on this one...

Attempting to define a client access on an ASA 5520 VPN that was used only as a

Firewall so far. The ASA has been recently updated to Version 7.2 (4).

Problem: Once connected, VPN client cannot access anything whatsoever. Client VPN cannot

ping any address on internal networks, or even the inside interface of the ASA.

(I hope) Relevant details:

(1) the tunnel seems to be upward. Customers are the authenticated by the SAA and

are able to connect.

(2) by many other related posts, I ran a ' sh crypto ipsec her "to see the output: it

appears that the packets are décapsulés and decrypted, but NOT encapsulated or

encrypted (see the output of "sh crypto ipsec his ' home).

(3) by the other related posts, we've added commands associated with inversion of NAT (crypto

ISAKMP nat-traversal 20

crypto ISAKMP ipsec-over-port tcp 10000). These were in fact absent from our

Configuration.

(4) we tried encapsulation TCP and UDP encapsulation with experimental client

profiles: same result in both cases.

(5) if I (attempt) ping to an internal IP address of the connected customer, the

real-time log entries ASA show the installation and dismantling of the ICMP requests to the

the inner target customer.

(6) the capture of packets to the internal address (one that we try to do a ping of the)

VPN client) shows that the ICMP request has been received and answered. (See attachment

shooting).

(7) our goal is to create about 10 VPN client of different profiles, each with

different combinations of access to the internal VLAN or DMZ VLAN. We do not have

preferences for the type of encryption or method, as long as it is safe and it works: that

said, do not hesitate to recommend a different approach altogether.

We have tried everything we can think of, so any help or advice would be greatly

Sanitized the ASA configuration is also attached.

appreciated!

Thank you!

It should be the last step :)

on 6509

IP route 172.16.100.0 255.255.255.0 172.16.20.2

and ASA

no road inside 172.16.40.0 255.255.255.0 172.16.20.2

New user cannot access any area of activity
Hi, I use Discoverer Desktop 9.0.4.43.17 and administrator of 9.0.4.43.18 and I have a new user cannot access any sector of activity, I tried to create a new business district to test and access the Security window on the Client of Directors for this user and my user (works very well!), for my user that this new BA shows normally on the desktop but for new user the selection of business on Assistant workbook area shows nothing. It's something to measure new users to access the space business?

Published by: user2997975 on 06/04/2009 07:19
Hello
As suggested by Rod it sounds as if you may have several EUL in the same prod73. Try to connect again, but this time go to tools | Options and click the EUL. It is the last tab on the right side and you may need to click the button to the right (next to connection) several times before seeing the EUL tab.

Under the EUL tab, make sure that the EUL you want to connect is selected. If it is bad you will need to change it, click on the OK button and then reconnect to the database using file | Connect to the database.

This time you must point to the right EUL.

Best wishes
Michael

AnyConnect VPN users cannot access remote subnets?

Similar Questions

Maybe you are looking for