ASA allows 1 only RAS VPN Client IPSEC
Hi all
I have a strange problem where an ASA 5510 configured for IPSEC - over - udp VPN RAS allows only one 1 customer vpn traffic through.
Other clients can connect successfully (obtain IP/DNS etc., auth using LDAP) but only the all connected client is first able to browse internal resources. Others show 0 decrypted packets when I check the statistics. I have confirmed that it is not a problem with the license that the ipsec default license allows customers up to 250 I believe. Does anyone had this problem in the past?
TKS,
Donavan
It is usually a problem with the translations, which intervened on the NAT/PAT device in front of these multiple machines:
http://www.ciscotaccc.com/Kaidara-Advisor/security/showcase?case=K71102938
Check the translations look correct initially on this device. There should be a translation for each VPN.
There were also a few bugs on multiple clients behind the same PAT, such as CSCse03299, but these had to do with IPSec over TCP connections.
-heather
Tags: Cisco Security
Similar Questions
-
Cisco VPN Client and Windows XP VPN Client IPSec to ASA
I configured ASA for IPSec VPN via Cisco VPN Client and XP VPN client communications. I can connect successfully with Cisco VPN Client, but I get an error when connecting with the XP client. Debugging said "misconfigured groups and transport/tunneling mode" I know, they use different methods of transport and tunneling, and I think that I have configured both. Take a look at the config.
PS a funny thing - when I connect with client VPN in Windows Server 2003, I have no error. The only difference is that client XP is behind an ADSL router and client server is directly connected to the Internet on one of its public IP of interfaces. NAT in the case of XP can cause problems?
Config is:
!
interface GigabitEthernet0/2.30
Description remote access
VLAN 30
nameif remote access
security-level 0
IP 85.*. *. 1 255.255.255.0
!
access-list 110 scope ip allow a whole
NAT list extended access permit tcp any host 10.254.17.10 eq ssh
NAT list extended access permit tcp any host 10.254.17.26 eq ssh
access-list extended ip allowed any one sheep
access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh
sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0
tunnel of splitting allowed access list standard 192.168.121.0 255.255.255.0
flow-export destination inside-Bct 192.168.1.27 9996
IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0
ARP timeout 14400
global (outside-Baku) 1 interface
global (outside-Ganja) interface 2
NAT (inside-Bct) 0 access-list sheep-vpn
NAT (inside-Bct) 1 access list nat
NAT (inside-Bct) 2-nat-ganja access list
Access-group rdp on interface outside-Ganja
!
Access remote 0.0.0.0 0.0.0.0 85.*. *. 1 2
Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1
Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1
Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1
Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1
Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1
Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1
Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1
dynamic-access-policy-registration DfltAccessPolicy
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
Crypto ipsec transform-set newset aes - esp esp-md5-hmac
Crypto ipsec transform-set esp-3des esp-md5-hmac vpnclienttrans
Crypto ipsec transform-set vpnclienttrans transport mode
Crypto ipsec transform-set esp-3des esp-md5-hmac raccess
life crypto ipsec security association seconds 214748364
Crypto ipsec kilobytes of life security-association 214748364
raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map
vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1
card crypto interface for remote access vpnclientmap
crypto isakmp identity address
ISAKMP crypto enable vpntest
ISAKMP crypto enable outside-Baku
ISAKMP crypto enable outside-Ganja
crypto ISAKMP enable remote access
ISAKMP crypto enable Interior-Bct
crypto ISAKMP policy 30
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
No encryption isakmp nat-traversal
No vpn-addr-assign aaa
Telnet timeout 5
SSH 192.168.1.0 255.255.255.192 outside Baku
SSH 10.254.17.26 255.255.255.255 outside Baku
SSH 10.254.17.18 255.255.255.255 outside Baku
SSH 10.254.17.10 255.255.255.255 outside Baku
SSH 10.254.17.26 255.255.255.255 outside-Ganja
SSH 10.254.17.18 255.255.255.255 outside-Ganja
SSH 10.254.17.10 255.255.255.255 outside-Ganja
SSH 192.168.1.0 255.255.255.192 Interior-Bct
internal vpn group policy
attributes of vpn group policy
value of DNS-server 192.168.1.3
Protocol-tunnel-VPN IPSec l2tp ipsec
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value split tunnel
BCT.AZ value by default-field
attributes global-tunnel-group DefaultRAGroup
raccess address pool
Group-RADIUS authentication server
Group Policy - by default-vpn
IPSec-attributes tunnel-group DefaultRAGroup
pre-shared-key *.
Hello
For the Cisco VPN client, you would need a tunnel-group name configured on the ASA with a pre-shared key.
Please see configuration below:
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml
or
Please see the section of tunnel-group config of the SAA.
There is a tunnel-group called "rtptacvpn" and a pre-shared key associated with it. This group name is used by the VPN Client Group name.
So, you would need a specific tunnel-group name configured with a pre-shared key and use it on the Cisco VPN Client.
Secondly, because you are behind a router ADSL, I'm sure that's configured for NAT. can you please activate NAT - T on your ASA.
"crypto isakmp nat-traversal.
Thirdly, change the transformation of the value
raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map
Let me know the result.
Thank you
Gilbert
-
ASA 5505 VPN Client Ipsec config problems
I configured the asa the wizard to Setup vpn, but this still does not work properly. Vpn connect without problem, but I can't access all the resources on the 192.168.1.x subnet. Don't know what I'm missing here, here's a copy of my config.
ASA Version 8.0 (3)
!
host name
domain name
activate the password
names of
!
interface Vlan1
nameif inside
security-level 100
192.168.1.3 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
"Public ip" 255.255.255.0 IP address
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd
passive FTP mode
DNS lookup field inside
DNS domain-lookup outside
DNS server-group DefaultDNS
Server name 192.168.1.28
domain fmrs.org
GroupVpn_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
vpngroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
outside_access_in list extended access permit tcp any any eq pptp
outside_access_in list extended access will permit a full
inside_nat0_outbound list of allowed ip extended access all 192.168.99.0 255.255.255.0
inside_nat0_outbound list of allowed ip extended access entire 192.168.1.0 255.255.255.0
inside_access_in to access ip 192.168.1.0 scope list allow 255.255.255.0 any
access extensive list ip 192.168.99.0 inside_access_in allow 255.255.255.0 any
inside_access_in list of allowed ip extended access all 192.168.99.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
mask 192.168.99.2 - 192.168.99.100 255.255.255.0 IP local pool GroupPool
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM image disk0: / asdm - 602.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 192.168.1.0 255.255.255.0
public static tcp (indoor, outdoor) interface 192.168.1.62 pptp pptp netmask 255.255.255.255
inside_access_in access to the interface inside group
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 66.76.199.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout, uauth 0:05:00 absolute
dynamic-access-policy-registration DfltAccessPolicy
RADIUS protocol AAA-server fmrsdc
fmrsdc AAA-server 192.168.1.28
Timeout 5
fmrsasa key
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
crypto ISAKMP allow inside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
No vpn-addr-assign aaa
No dhcp vpn-addr-assign
Console timeout 0
dhcpd outside auto_config
!a basic threat threat detection
Statistics-list of access threat detection
GroupVpn internal group policy
GroupVpn group policy attributes
value of server WINS 192.168.1.28
value of server DNS 192.168.1.28
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list GroupVpn_splitTunnelAcl
FMRs.org value by default-field
ID password cisco
tunnel-group GroupVpn type remote access
attributes global-tunnel-group GroupVpn
address pool GroupPool
authentication-server-group fmrsdc
Group Policy - by default-GroupVpn
IPSec-attributes tunnel-group GroupVpn
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
inspect the pptp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:b5df903e690566360b38735b6d79e65e
: endPlease configure the following:
ISAKMP nat-traversal crypto
management-access inside
You should be able to ping of the SAA within the IP 192.168.1.3
-
Problems to connect via the Cisco VPN client IPSec of for RV180W small business router
Hello
I tried to configure my router Cisco of RV180W as a customer VPN IPSec, but have encountered a problem that I hope someone can help me with. "" I managed to do the work of configuration so that the Cisco's VPN IPSec client authenticates successfully with the XAUTH user, I put on the router, but during the negotiation, the client ends with the following, which appears several times on the router error message: ' Mar 20 Oct 19:41:53 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for
> [34360] has no config mode. I've read around the internet and a number of people seem to say that the Cisco VPN Client is not compatible with the router, but the same thing happens to my iPhone VPN client.
Is it possible that this can be implemented? Below, I have attached the full configuration files and the log files. Thank you much in advance.
Router log file (I changed the IP
addresses > respectively as well as references to MAC addresses) Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: floating ports NAT - T with counterpart
> [44074]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] WARNING: notification to ignore INITIAL-CONTACT> [44074] because it is admitted only after the phase 1.
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT - D payload does not match for> [4500]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT - D payload does not match for> [44074]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: received unknown Vendor ID
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: received Vendor ID: CISCO-UNITY
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: NAT detected: is located behind a device. NAT and alsoPeer is behind a NAT device
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: request sending Xauth for> [44074]
Mar 20 Oct 20:03:10 2015 (GMT + 0000): [r1] [IKE] INFO: ISAKMP Security Association established for> [4500] - > [44074] with spi = >.
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: receives the type of the attribute 'ISAKMP_CFG_REPLY' of> [44074]
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: login successful for the user "myusername".
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: myusername XAuthUser connected from the IP>
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: sending of information Exchange: Notify payload [10381]
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: receives the type of the attribute 'ISAKMP_CFG_REQUEST' of> [44074]
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: ignored attribute 5
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: attribute ignored 28683
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no mode config
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] WARNING: attribute ignored 28684
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no config mode
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: local configuration for> [44074] has no mode config
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] ERROR: remove the invalid payload with doi:0.
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: purged-Association of ISAKMP security with proto_id = ISAKMP and spi =>.
Mar 20 Oct 20:03:15 2015 (GMT + 0000): [r1] [IKE] INFO: myusername XAuthUser Logged Out of the IP>
Mar 20 Oct 20:03:16 2015 (GMT + 0000): [r1] [IKE] INFO: ISAKMP Security Association deleted for> [4500] - > [44074] with spi = > The router configuration
IKE policy
VPN strategy
Client configuration
Hôte : < router="" ip=""> >
Authentication group name: remote.com
Password authentication of the Group: mysecretpassword
Transport: Enable Transparent Tunneling; IPSec over UDP (NAT/PAT)
Username: myusername
Password: mypassword
Please contact Cisco.
Correct, the RV180 is not compatible with the Cisco VPN Client. The Iphone uses the Cisco VPN Client.
You can use the PPTP on the RV180 server to connect a PPTP Client.
In addition, it RV180 will allow an IPsec connection to third-party customers 3. Greenbow and Shrew Soft are 2 commonly used clients.
-
All necessary licenses on ASA 5510 for old Cisco VPN Client
We're trying to migrate our firewall Watchguard to a Cisco ASA 5510, who bought some time ago. For some reason, all of our users have already installed the old Cisco VPN client. I think it will work. Are there licensing issues on the 5510 I had to be concerned with? No matter what special config that needs to be done on the 5510?
Fix. You don't require licensing of AnyConnect of any type of configuration and the use of IKEv1 IPsec remote access VPN (which use the old Cisco VPN client).
You will be limited to 250 active IPsec peers (remote access more no matter what VPN site-to-site) by the platform (hardware) device capabilities that are enforced by the software.
-
Have problems with the IPSec VPN Client and several target networks
I use an ASA 5520 8.2 (4) running.
My goal is to get a VPN client to access more than one network within the network, for example, I need VPN client IPSec and power establish tcp connections on servers to 192.168.210.x and 10.21.9.x and 10.21.3.x
I think I'm close to having this resolved, but seems to have a routing problem. Which I think is relevant include:
Net1: 192.168.210.0/32
NET2: 10.21.0.0/16
NET2 has several subnets defined VIRTUAL local network:
DeviceManagement (vlan91): 10.21.9.0/32
Servers (vlan31): 10.21.3.0/32
# See the road
Code: C - connected, S - static, RIP, M - mobile - IGRP, R - I, B - BGP
D - EIGRP, OSPF, IA - external EIGRP, O - EX - OSPF inter zone
N1 - type external OSPF NSSA 1, N2 - type external OSPF NSSA 2
E1 - OSPF external type 1, E2 - external OSPF of type 2, E - EGP
i - IS - L1 - IS - IS level 1, L2 - IS - IS IS level 2, AI - IS inter zone
* - candidate by default, U - static route by user, o - ODR
P periodical downloaded static route
Gateway of last resort is x.x.x.x network 0.0.0.0
C 192.168.210.0 255.255.255.0 is directly connected to the inside
C 216.185.85.92 255.255.255.252 is directly connected to the outside of the
C 10.21.9.0 255.255.255.0 is directly connected, DeviceManagement
C 10.21.3.0 255.255.255.0 is directly connected, servers
S * 0.0.0.0 0.0.0.0 [1/0] via x.x.x.x, outdoor
I can communicate freely between all networks from the inside.
interface GigabitEthernet0/0
Description * INTERNAL NETWORK *.
Speed 1000
full duplex
nameif inside
security-level 100
IP 192.168.210.1 255.255.255.0
OSPF hello-interval 2
OSPF dead-interval 7
!
interface Redundant1.31
VLAN 31
nameif servers
security-level 100
IP 10.21.3.1 255.255.255.0
!
interface Redundant1.91
VLAN 91
nameif DeviceManagement
security-level 100
IP 10.21.9.1 255.255.255.0
permit same-security-traffic inter-interface
NO_NAT list of allowed ip extended access all 172.31.255.0 255.255.255.0
IP local pool vpnpool 172.31.255.1 - 172.31.255.254 mask 255.255.255.0
Overall 101 (external) interface
NAT (inside) 0-list of access NO_NAT
NAT (inside) 101 192.168.210.0 255.255.255.0
NAT (servers) 101 10.21.3.0 255.255.255.0
NAT (DeviceManagement) 101 10.21.9.0 255.255.255.0
static (inside, DeviceManagement) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
static (inside, servers) 192.168.210.0 192.168.210.0 netmask 255.255.255.0
static (servers, upside down) 10.21.3.0 10.21.3.0 netmask 255.255.255.0
static (DeviceManagement, upside down) 10.21.9.0 10.21.9.0 netmask 255.255.255.0
access list IN LAN extended permitted tcp 192.168.210.0 255.255.255.0 any
access list IN LAN extended permit udp 192.168.210.0 255.255.255.0 any
LAN-IN scope ip 192.168.210.0 access list allow 255.255.255.0 any
LAN-IN extended access list allow icmp 192.168.210.0 255.255.255.0 any
access list IN LAN extended permitted tcp 10.21.0.0 255.255.0.0 any
access list IN LAN extended permitted udp 10.21.0.0 255.255.0.0 any
LAN-IN scope 10.21.0.0 ip access list allow 255.255.0.0 any
LAN-IN extended access list allow icmp 10.21.0.0 255.255.0.0 any
standard access list permits 192.168.210.0 SPLIT-TUNNEL 255.255.255.0
standard access list permits 10.21.0.0 SPLIT-TUNNEL 255.255.0.0
group-access LAN-IN in the interface inside
internal VPNUSERS group policy
attributes of the VPNUSERS group policy
value of server DNS 216.185.64.6
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value of SPLIT TUNNEL
field default value internal - Network.com
type VPNUSERS tunnel-group remote access
tunnel-group VPNUSERS General attributes
address vpnpool pool
strategy-group-by default VPNUSERS
tunnel-group VPNUSERS ipsec-attributes
pre-shared key *.
When a user establishes a VPN connection, their local routing tables have routes through the tunnel to the 10.21.0.0/16 and the 192.168.210.0/32.
They are only able to communicate with the network 192.168.210.0/32, however.
I tried to add the following, but it does not help:
router ospf 1000
router ID - 192.168.210.1
Network 10.21.0.0 255.255.0.0 area 1
network 192.168.210.0 255.255.255.252 area 0
area 1
Can anyone help me please with this problem? There could be a bunch of superfluous things here, and if you could show me, too, I'd be very happy. If you need more information on the config, I'll be happy to provide.
Hello Kenneth,
Based on the appliance's routing table, I can see the following
C 10.21.9.0 255.255.255.0 is directly connected, DeviceManagement
C 10.21.3.0 255.255.255.0 is directly connected, servers
C 192.168.210.0 255.255.255.0 is directly connected to the inside
And you try to connect to the 3 of them.
Politics of Split tunnel is very good, the VPN configuration is fine
The problem is here
NO_NAT list of allowed ip extended access all 172.31.255.0 255.255.255.0
NAT (inside) 0-list of access NO_NAT
Dude, you point to just inside interface and 2 other subnets are on the device management interface and the interface of servers... That is the question
Now how to solve
NO_NAT ip 192.168.210.0 access list allow 255.255.255.0 172.31.255.0 255.255.255.0
no access list NO_NAT extended permits all ip 172.31.255.0 255.255.255.0
NO_NAT_SERVERS ip 10.21.3.0 access list allow 255.255.255.0 172.31.255.0 255.255.255.0
NAT (SERVERS) 0 ACCESS-LIST NO_NAT_SERVERS
Permit access-list no.-NAT_DEVICEMANAGMENT ip 10.21.9.0 255.255.255.0 172.31.255.0 255.255.255.0
NAT (deviceManagment) 0-no.-NAT_DEVICEMANAGMENT access list
Any other questions... Sure... Be sure to note all my answers.
Julio
-
Internet access with VPN Client to ASA and full effect tunnel
I'm trying to migrate our concentrator at our new 5520 s ASA. The concentrator has been used only for VPN Client connections, and I have not the easiest road. However, I, for some reason, can't access to internet through our business network when I've got profiles with lots of tunneling.
I've included the configuration file, with many public IP information and omitted site-to-site tunnels. I left all the relevant stuff on tunnel-groups and group strategies concerning connectivity of VPN clients. The range of addresses that I use for VPN clients is 172.16.254.0/24. The group, with what I'm trying to access the internet "adsmgt" and the complete tunnel to our network part is fine.
As always, any help is appreciated. Thank you!
Hüseyin... good to see you come back.. bud, yes try these Hüseyin sugesstiong... If we looked to be ok, we'll try a different approach...
IM thinking too, because complete tunnel is (no separation) Jim ASA has to go back for the outbound traffic from the internet, a permit same-security-traffic intra-interface, instruction should be able to do it... but Jim start by Hüseyin suggestions.
Rgds
Jorge
-
Cisco VPN client 3.5.1 and Cisco ASA 5.2 (2)
Hello
I have a strange problem about Cisco VPN client (IPSec) with Cisco ASA. The Cisco ASA runs software version 5.2 (2). The Cisco VPN client version is 3.5.1.
The problem is the customer able Cisco VPN to authenticate successfully with Cisco ASA, but could not PING to any LAN behind the Cisco ASA. In any case, the problem disappeared when we used the Cisco VPN version 4.6 or 4.8 of the customer. All parameters are exactly the same. What has happened? What is the cause of this problem? How can I solve this problem?
Please advice.
Thank you
Nitass
I understand your problem, I never used 3.5.1 so I thought that maybe nat - t is not enabled by default as 4.x.
-
The dynamic firewall application on the VPN Clients with ASA
Hello
I'll put up a Cisco ASA to complete the remote VPN client connections, but I want to assure you that the dynamic firewall is enabled on the client.
I know it's possible with the VPN concentrator, but cannot see any documentation detailing that can be performed on an ASA.
Anyone encountered this?
Thank you
James
I believe you can use Group Policy settings to configure the firewall client.
You can find more information about this feature in the migration to http://www.cisco.com/en/US/docs/security/asa/asa72/vpn3000_upgrade/upgrade/guide/migrate.htmlguide.
Hope this helps.
Andrea.
Step 1 under Configuration > VPN > General > Group Policy Panel, select group policy in the table and
Click on change. ASDM displays the Edit Group Policy dialog box.
Step 2: click on the customer Firewall tab Figure 5-6 shows the firewall client options configured for this example:
• Inherit-disabled (disabled)
• The required Firewall Firewall setting
• Type firewall Cisco Integrated Client Firewall
Firewall policy-policy (CPP) pushed •
-
Access PIX using SSH when connected remotely with VPN client
Hello
I think that this should be a fairly simple for someone to sort for me - I'm new to PIX configuration If Yes please excuse my stupidity!
I changed the config on our PIX to allow only access via SSH (rather than via telnet as it was previously configured)
Now, everything works fine when I'm in the office - I can connect to the PIX using SSH without any problem.
However, if I work from home and connect to the office using my VPN client (IPSEC tunnel ends on the PIX firewall itself) I find that I can not connect to the PIX.
I have configured the PIX to access ssh on the office LAN subnet and the client pool of IP addresses used for VPN connections by using the following commands:
SSH 172.64.10.0 255.255.255.0 inside
SSH 192.28.161.0 255.255.255.0 inside
where the 1st line is reference to the office's LAN, which works very well, and the 2nd line denotes the IP address pool configured on the PIX for VPN access.
Can someone tell me how to fix this? I have the feeling that its something pressing!
Thank you
Neil
Try the command "management-access to the Interior.
-
Problem setting up vpn l2tp/ipsec
I tried to configure an ASA5505 with a l2tp/ipsec vpn which I can connect to with Windows Vista vpn client. I had connection problems. When I try to connect, watch windows vpn client tell an error message "error 789: the L2TP connection attempt failed because the security layer detected a processing error during initial negotiations with the remote computer." The newspaper on the SAA is errors saying "Phase 1 failure: incompatibility of the types of attributes of class Group Description: RRs would be: unknown Cfg was: Group 2.
It seems that the ASA does not like windows vpn client IKE proposal but I do not know if I interpret correctly this error message.
I was wondering if anyone has seen this problem or have had success with this type of installation. I have the setup of device OK so that I can connect with the Cisco VPN client, but get l2tp/ipsec Setup to work with the windows vpn client turns out to be problematic.
Can you post the Config of your ASA. Did you check the following link:
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807213a7.shtml
-
Cannot connect AnyConnect Secure Mobility Client IPSec 3.0
Hello
Our company has a configuration of IPSec VPN on a Cisco ASA 5505. We previously using the Cisco VPN Client - Version 5.0.07.0410. Everything worked well with this customer to date. The problem is it is not supported in our Virtual Machine, and environment with our new version of our networks paravirtualized drivers we get the problems of inadequacy HMAC and not connect to.
I created a file .pcf with the following information for the 5.0.07.0410 customer:
Input connection: VC VPN
Description: no
Host: xxx.xxx.xxx.xxx (IP address of the Interface of the ASA VPN)
Authentication group:
- Name: The name of the Group
- Password: password for pre-shared Key
Transport:
- Activate Transport tunnel
- IPSec over UDP (NAT/PAT)
I import the .pcf file in the client, the client connects, you are prompted for AD username - everything has worked well.
We have currently met that he had to use the Cisco AnyConnect Secure Mobility Client (3.0.0629) - I tried to use the profile for that AnyConnect client editor and I can't not all profile options. I leave all the defaults preferences (Part1), preferences (Part2), backup servers, matching certificate, Certificate Enrollment and the mobility policy.
I in the list of servers, click Add. I enter in the hostname, host (the host name IP address) address and group. There are no backup servers, I change the main IPSec protocol, save the profile and place it in C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile (Win7). Open the AnyConnect Secure Mobility Client and the profile is loaded. Trying to link returns "VPN Agent is unable to establish a connection." ASA, I don't even see a connection attempts to the outgoing IP address. On the client, I can ping the ASA and connect with ordinary VPN Client.
I can't find a place to enter a pre-shared in the profile editor.
The AnyConnect client seems also not to read the .pcf files. Am I missing something here?
My package DART from the failing client is attached. Any help would be greatly appreciated!
Kind regards
Rich Alto
Rich,
AC uses IKEv2 (for IPsec) which is not yet supported on SAA. Support is planned for 8.4 ASA which is still at least a few weeks.
HTH
Herbert
-
Cisco vpn client 5.0.07 no internet access
I am trying to configure access remote vpn for the ASA 5505 in my office.
The config is configured on my ASA, and I have cisco vpn client 5.0.07 installed on my laptop (64 bit) to Windows 7. I can start the vpn, put in my references and it seems that everything goes through, but once I'm connected, I lose access to the internet, and I cannot ping anything (4.2.2.2, 192.168.1.1 (gateway), etc...)
I keep seeing something uncheck the "use default gateway on remote network", but this option is available in the TCP/IP properties. Any suggestions?
Eric,
This should be the last change. Looks like you don't have inside the network split tunnel.
Here is the entry you need to do
TunnelSplit1 list standard access allowed 192.168.1.0 255.255.255.0
disconnect and reconnect. It should work like a charm.
Thank you
Bad Boy
-
Cisco VPN disconnection problem vpn client
Hello
We have a 8.2 (3) Cisco ASA and several vpn client ipsec that connect to it (5.0.07.0290 - k9 and 5.0.07.0410 - k9).
ExExactly after that 4 hours of these clients vpn connections are deleted even if the client is still sending traffic. I can't find any parameter configuration in order to avoid this connection drop. Someone has an idea how solve it?
I have
I have
AF
Hello
Please paste the output of "sh cry run." We can check the values of life.
also, you can activate him debugs following like half an hour before that the Client waits for the time to unplug.
Deb cry isa 127
Deb cry ips 127.
We can check the reason for the debugging by using the ip address of the client.
I hope this helps.
Kind regards
Anisha
P.S.:Please assign this thread answered if you feel that your query is resolved. Note the useful messages.
-
The ID attribute of the station call needs for Anyconnect VPN client MAC address
Hi all
We test tring Anyconnect VPN users to connect using the certificate. ASA East of validation / authentication user based on cert and approval it requires Radius server (ISE). Currently ASA sends the Ip address of the VPN client in «calling station ID» We want ASA to send the Anyconnect VPN client MAC address to the radius server in RADIUS attribute «calling station ID» Is it possible to do this. Get around them?
Parag salvation,
The calling Station ID always contains the IP if Anyconnect VPN.
L3 is originally unlike wireless which has L2 Assoc.
Currently no work around.
Respect of
Ed
Maybe you are looking for
-
Each launch I get a download message block as when the first one I tried to download this file
I tried to download this file some time ago and obtained the deadlock as on the picture message (quick translation is "blocked, probably contains a virus or other spy software"). After that each launch of Firefox, I get the same message. Cookes clean
-
Software pre-installed on Satellite L10-194
I bought my new laptop with XP Home Edition and all the preinstalled software Toshiba like Norton antivirus and MS OneNote. I upgraded my laptop with XP pro, of formatting my hard drive and do a fresh install. How can I get my Norton and MS Office On
-
Hey guys,. I checked my status on the xbox live for black ops 2 and all said I'm good. So I know that I'm not banned... but I can't play online for only Black Ops 2. I connect to xbox live from the dashboard and then what game to start and go to the
-
Hello I want that non admin users fully administer IIS that is to say, they should be able to create sites and virtual directories, etc...
-
Basic concepts of Replay/AA
Hi all As the title says, I have a difficult time in my head around a few basics of packaging. I looked for a guide of the user to Replay 4.7, but they apparently were fired. I have read a few KB and release notes, but they are not helping. (1) where