ASA easy VPN connection problem

Similar Questions

• ASA 5505 ASDM VPN connection problem

  Hello

  We are running a version of firewall ASA 5505 8.4 (4) 1. The ASDM version is 6.4 (9).

  The problem is when the creation of remote access VPN connection, it works fine for about 2-3 days.

  After that, the VPN client cannot connect more and gives the error code 789.

  In this case, the VPN clients are clients of Windows 7 from different remote networks with the same problem scenario.

  Windows 8.1 clients cannot connect at all and show the same error code...

  All connections go through the keys defaultragroup and preshare match on both sides.

  When the user to connect attemps I receive the following text in the log of the ASDM:

  6 April 10, 2015 10:52:39 group = DefaultL2LGroup, IP = 5.240.31.116, P1 retransmit msg sent to the WSF MM
   
  5 April 10, 2015 10:52:39 group = DefaultL2LGroup, IP = 5.240.31.116, in double Phase 1 detected package.  Retransmit the last packet.
   
  5 April 10, 2015 10:53:03 IP = 5.240.31.116, encrypted packet received with any HIS correspondent, drop
   
  When I implemented the remote login through ASDM I followed the instructions according to the following link:
  http://www.databasemart.com/HOWTO/Cisco_VPN_Remote_Access_Setup_ASA5500...
   
  The steps were a little different, but almost the same, given that these instructions show an old version
   
  I'm interested in trying the steps according to this link but not sure this will help me solve the problem id:
  http://www.petenetlive.com/kb/article/0000571.htm
   
  Any help would be appreciated!
  Thank you

  Hello

  If you use local authentication (user name and password on the SAA), so why you would need this threshold?

  tunnel-group DefaultRAGroup ppp-attributes
  No chap authentication
  ms-chap-v2 authentication
  !

  Remove it and try.

• Easy VPN configuration problems

  Hello

  I have 6.2 (2) Version PIX PIX 515E. I am trying to setup the easy VPN server to this topic. This pix not recognized the next line of the comand.

  1.

  Crypto-map dynamic 70 outside_dyn_map Road opposite value

  2.

  Crypto isakmp nat-traversal 70

  or isakmp nat-traversal 70

  3 tunnel-group

  is there a command line I can use inplace of them. I have also attached my config so I would be very grateful if someone could check and advice me what to do to raise this connection.

  Thank you

  Take a look at this:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080241a0d.shtml

  Yes nat - t is available on 6.3.x and above and no it is not enabled by default on the PIX / ASA. It is IOS.

  Please note if useful, cordially

  Farrukh

• ASA 5505 VPN Ping problems

  Hi all

  First of all, I apologize if this is something that I can google. My knowledge of the administration of the network is all self-taught, so if there is a guide that I missed please point me in the right direction, it is often difficult to Google the terms for troubleshooting when your jargon is not the height.

  The main problem is that when ping devices internal when you are connected to the results are very inconsistent.

  Ping 192.168.15.102 with 32 bytes of data:

  Reply from 192.168.15.102: bytes = 32 time = 112ms TTL = 128

  Request timed out.

  Request timed out.

  Request timed out.

  We have implemented an IPSec VPN connection to a remote Cisco ASA 5505. There is no connection problems, connection seems constant, etc. good packages. At this stage, I can only assume I have configuration problems, but I was watching this while if long and pair with my inexperience configuration of these settings I have no idea where to start. My first impressions are that LAN devices I'm ping do not send their response back or the ASA does not know how to route packets back?

  Here is a dump of the configuration:

  Output of the command: "show config".

  : Saved

  : Written by enable_15 to the 12:40:06.114 CDT MON Sep 9 2013

  !

  ASA Version 8.2 (5)

  !

  hostname VPN_Test

  activate the encrypted password of D37rIydCZ/bnf1uj

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  192.168.15.0 - internal network name

  DDNS update method DDNS_Update

  DDNS both

  maximum interval 0 4 0 0

  !

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  interface Vlan1

  Description VLAN internal guests

  nameif inside

  security-level 100

  DDNS update hostname 0.0.0.0

  DDNS update DDNS_Update

  DHCP client updated dns server time

  192.168.15.1 IP address 255.255.255.0

  !

  interface Vlan2

  Description of VLAN external to the internet

  nameif outside

  security-level 0

  address IP xx.xx.xx.xx 255.255.255.248

  !

  passive FTP mode

  clock timezone CST - 6

  clock to summer time recurring CDT

  DNS server-group DefaultDNS

  Server name 216.221.96.37

  Name-Server 8.8.8.8

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  DM_INLINE_TCP_1 tcp service object-group

  port-object eq www

  EQ object of the https port

  outside_access_in list extended access permit icmp any one

  outside_access_in list extended access deny interface icmp outside interface inside

  access extensive list ip 192.168.15.192 outside_access_in allow 255.255.255.192 all

  Remote_splitTunnelAcl list standard allowed internal-network access 255.255.255.0

  inside_nat0_outbound list extended access allowed internal-network ip, 255.255.255.0 192.168.15.192 255.255.255.192

  Note to inside_access_in to access list blocking Internet traffic

  access extensive list ip 192.168.15.192 inside_access_in allow 255.255.255.192 all

  Note to inside_access_in to access list blocking Internet traffic

  inside_access_in extended access list allow interface ip inside the interface inside

  inside_access_in list of allowed ip extended access all 192.168.15.192 255.255.255.192

  Note to inside_access_in to access list blocking Internet traffic

  access extensive list ip 192.168.15.192 inside_nat0_outbound_1 allow 255.255.255.192 all

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  mask 192.168.15.200 - 192.168.15.250 255.255.255.0 IP local pool VPN_IP_Pool

  inside_access_ipv6_in list of access allowed IPv6 interface ip inside the interface inside

  ICMP unreachable rate-limit 1 burst-size 1

  ICMP allow any inside

  ICMP allow any response of echo outdoors

  ICMP allow all outside

  don't allow no asdm history

  ARP timeout 14400

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

  NAT (inside) 1 192.168.15.192 255.255.255.192

  NAT (inside) 1 0.0.0.0 0.0.0.0

  inside_access_in access to the interface inside group

  inside_access_ipv6_in access to the interface inside group

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  255.255.255.0 inside internal network http

  http yy.yy.yy.yy 255.255.255.255 outside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Sysopt connection timewait

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  management-access inside

  dhcpd outside auto_config

  !

  dhcpd address 192.168.15.200 - 192.168.15.250 inside

  dhcpd allow inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200

  NTP server 192.168.15.101 source inside

  prefer NTP server 192.168.15.100 source inside

  WebVPN

  internal remote group strategy

  Group remote attributes policy

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list Remote_splitTunnelAcl

  username StockUser encrypted password privilege 0 t6a0Nv8HUfWtUdKz

  username StockUser attributes

  Strategy-Group-VPN remote

  tunnel-group type remote access remotely

  tunnel-group remote General attributes

  address pool VPN_IP_Pool

  Group Policy - by default-remote control

  tunnel-group remote ipsec-attributes

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  inspect the icmp

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  Cryptochecksum:f4271785b86e45dd3a17bab8f60cd2f3

  Hi Graham,

  My first question is do you have a site to site VPN and VPN remote access client.

  After checking your configuration, I see you don't have any Site to SIte VPN configuration, so I'm assuming you ara facing issue with the VPN client.

  And if I understand you are able to connect VPN client, but you not able to access internal resources properly.

  I recommend tey and make the following changes.

  First remove the following configuration:

  NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

  NAT (inside) 1 192.168.15.192 255.255.255.192

  You don't need the 1st one and I do not understand the reason for the second

  Second, one is your pool IP subnet (192.168.15.200 - 192.168.15.250) and I don't know why you added this NAT.

  If possible change your subnet pool all together because we do not recommend to use th ip POOL that is similar to your local network.

  Try the changes described above and let me know in case if you have any problem.

  Thank you

  Jeet Kumar

• SDM & easy VPN server problem

  I'm having a problem setting up an easy VPN server using Cisco Security

  Device Manager Version 2. 0a on a router in 1711 with IOS 12.3 (7) XR3.

  I have reset the router to the factory defects since the opening screen of SDM.

  Connect to 10.10.10.1

  User: cisco

  Password: Cisco

  Start SDM for the initial router configuration dialog box.

  Don't use CNS

  On basic configuration screen:

  Hostname set to router

  Domain: test.com

  Synchronize time with local PC

  Change the user name

  New user name: root

  password: xyzzy123

  password: xyzzy1234

  The LAN Interface Setup screen

  IP address set to 10.1.1.1

  Subnet: 255.255.255.0

  Active DHCP server

  Start IP: 10.1.1.50

  End IP: 10.1.1.70

  DNS Configuration screen

  Primary: 45.45.45.45

  Secondary: 45.45.45.46

  Use for DHCP Clients

  WAN Configuration screen

  Ethernet selected without Encapsulation PPOE

  No dynamic (DHCP Client) host name

  Advanced options screen

  Selected for VLAN1 port address translation

  After reading the summary, I chose the FINISH. Asked if dialog box I have

  you want to set up a basic firewall, I selected YES. I left all the

  secure by default items selected. I clicked FINISH. SDM detected that the

  DHCP client on the untrusted external interface and asked if I wanted to

  allow DHCP traffic through the firewall. I selected YES. The configuration

  has been delivered.

  Save the running-config startup-config and reloaded the router.

  Released and renewed my ip address and then reconnected in 1711 from new

  user name and password. SDM restarted.

  Has begun the task of configuration and choose to set up an easy VPN server.

  The opening screen had a command prompt to enable AAA. I launched the selected task

  After that the AAA commands have been delivered to the router.

  I chose the interface FastEthernet0 menu drop-down

  IKE proposals - selected default all the

  Transform set - selected default all the

  Group authorization / policy research - Selected Local only

  Add the user name: User1

  Password: local1

  Encrypt with MD5

  Privilege: 2

  Group permission/User Group Policies

  Add political group: tunnel

  Preshared key: sharedkey

  Selected new address Pool: 10.1.1.80 to 10.1.1.90

  Test after you have configured the selected button.

  Exit this screen, there was a warning SDM on the NAT with ACL rules

  have to be converted into NAT rules with course maps. I clicked YES to let

  SDM convert rules.

  Tests successful Easy VPN Server and client screen displays a warning

  on the "crypto ipsec df - bit clear' needing to be defined." He was not a

  way to put it in SDM and the search function had no success.

  I copied the running-config to the startup-config and tested the router from a

  connect remotely using a different ISP.

  The results:

  The SDM monitor shows the client connection, but the client cannot ping

  any host on the LAN of the router. No one on the LAN can easy ping of VPN client

  Assigned IP of VPN, but they can ping the client using the asigned IP ISP

  address.

  It seems that SDM not correctly configures the 1711 to route of the

  VPN interface to the local network.

  I enclose my 1711 Running Configuration generated by SDM.

  Hello

  I think that the reason why the ping is not successful is that your LAN IP address (connected to the VLAN interface) and the pool of IP addresses assigned to the client are in the same network.

  You can try assigning a pool of IP addresses for VPn clients that is in another subnet (say 10.1.2.80 to 10.1.2.90) and then try to ping?

  You can change the pool by means of configure-> additional tasks-> local swimming pools.

  You can then disconnect the client on the Monitoring page and connect again.

  Kind regards

  Ravikumar

• VPN connection problem: keep connection

  I'm having a problem with the maintenance of VPN connection. I connect okay but the line VPN disconnects after about 2 minutes each time.  I use XP Professional V2002, Service Pack 3.  I have disabled the WIndows firewall, as I have F-Secure software suite with its active firewall.  I connect laptop wireless via a Belkin router.  I had no problem for months up until August when suddenly this problem appeared.  I have disabled firewall F-secure, but that did not help. I also disabled the firewall on the router, but again without success.  Can you please help?

  Hi Rashmis,

  Thanks for visiting the site of the community of Microsoft Windows XP. The question you have posted is related to VPN issues and would be better suited to the Technet community. Please visit the link below to find a community that will provide the support you want. http://social.technet.Microsoft.com/forums/en/categories/

  Shawn - Support Engineer - MCP, MCDST
  Microsoft Answers Support Engineer
  Visit our Microsoft answers feedback Forum and let us know what you think

• Easy VPN server problem

  I have a Cisco 881 router and try to connect to a customer (customer VPN Cisco 5.xxx) to this router.

  Here is a diagram of my network:

  LAN (192.168.252.0/24)--- router Cisco 881 - router N ° 2 - Internet - router N ° 3 - Client (192.168.1.10))

  Router Cisco 881:

  -@IP lan: 192.168.252.1

  -@IP wan: 192.168.0.2

  -Gateway: 192.168.0.1

  -DNS: 192.168.0.1

  Router N ° 2:

  -@IP lan: 192.168.0.1

  -@IP wan: xx.xx.xx.xx

  -Port forwarding: 500UDP to 192.168.0.2

  -Port forwarding: 4500UDP to 192.168.0.2

  I have create this VPN profile:

  -IP address of the virtual Tunnel Interface: FastEthernet4

  -Configuration mode: REACT

  -Address pool (the VPN client): 192.168.254.10-> 192.168.254.149

  -Split tunneling: 192.168.252.0/24

  -Authentication: local

  -No firewall (for testing only)

  When I connect my VPN client for the first time, everything is OK: VPN connection is Ok, and I can ping any computer on the local network (192.168.252.0/24)

  If I disconnect/reconnect, the connection works, but I can't access all the resources on the local network.

  Once again, the computers on the lan ping, I have:

  -reboot the Cisco router

  -enable/disable RIP (in the dynamic routing of the CCP section): strange isn't it?

  But who works for the connection of a customer: if I disconnect/reconnect the client once again, I cannot ping all resources on the local network.

  I'm getting crazy!

  I used a sniffer tool on a machine on my LAN, and I see ICMP trap (ICMP request).

  If ping may come from VPN of LAN, but not for VPN LAN.

  Any help would be appreciated.

  Thank you

  Nicolas

  Yes, you forgot to apply the plan crypto on the external interface.

  interface FastEthernet4

  card crypto VPN_Policy

  Hope that solves the problem.

• VPN connection problems...

  I don't know what is happening or what Miss me...

  I set up a vpn connection to my remote offices with a 5505.  My main office, I have a 5510.

  My remote offices, I can PING my main Office Server.  However, when I go to set up a VPN through windows network sharing Center I can't get the connection to connect...

  Am I doing something wrong or what step am I missing?

  Thank you!!

  Can you try to add this:

  permit same-security-traffic inter-interface
  permit same-security-traffic intra-interface

  I'd put it on two unless you have a reason not to.  If there is no love after that we will break down the pppoe and vpn configuration.

  Matt

• ASA 5510 IPSEC VPN connection problem

  Hello

  We have an ASA 5510 (ASA version 8.0) of remote access VPN configured and works most of the time, but there is a problem when you have more than one client that connects to the same office remotely.  When the first VPN client is connected to the remote desktop, everything works fine, but when the second client connects to the VPN, it connects fine but do not get any traffice return to customer.  I can see under monitor-> statistical VPN-> Sessions-> remote access-> Rx Bytes is 0. Both connections are from the same public IP address of the remote desktop.  I changed some settings on NAT - T and a few other things, but without success.

  Could someone help me please how to fix this?

  Thank you very much.

  Make sure that customers use because that probably her you're not. (default value is NAT - T).

  Federico.

• Ikev1 ASA 5505 VPN connection error

  Hello

  I had previously defined our VPN using IPsec on our ASA 5505 via the ASDM.   It was workign fine until an outtage power loses my settings on the device.  (possibly a recording of order is not pressed)

  Now when I try and put in place, once again I am recieveing an error to port binding.  I have configured as normal using the wizard and activate split defintion and exempt the network inside.

  The isssue when you apply the settings that I get is:

  "[ERROR] crypto ikev 1 activate outdoors.

  IkevReceiverInit, cannot bind the port. "

  When I try to connect to the VPN I then get an error "the server cannot be reached" or something similar to that...

  Could someone please shed some light on what can cause this problem?

  Best regards, the Paris

  William.

  Hello

  Thanks for the information!

  We will need to know why this host using UDP 4500 and if this host really needs to use this port.

  What type of application is running on this host?

  What is a host internal or external?

  You may also block the host on the SAA on the incoming interface to avoid the use of the UDP 4500 port using a group of access (outside or inside). Don't forget that you will need a ip to allow a at the end of the ACL to avoid any problems. Another option would be to use IKEv1/IPsec over TCP

  IKEv1/IPsec over TCP allows a Cisco VPN client operate in an environment in which IKEv1 or standard ESP may not work or may work only with the change of the existing firewall rules. IPsec over TCP encapsulates IPsec protocols both IKEv1 in a TCP packet as and allows a tunnel secure two firewalls and NAT and PAT devices. This feature is disabled by default.

  The default port is 10000.

  HostName (config) # ikev1 crypto ipsec-over-tcp

  You also need to activate on the VPN client under the profile.

  Change > Transport > IPSec over TCP.

  I hope this helps.

  Luis.

• easy vpn connection drops

  I replaced our PIX with a new asa 5505 firewall. I use this like easyvpn firewall client to connect to the PIX seat unit. VPN tunnel established without problem but after 1 to 3 minutes of the Tomb tunnel. During the replacement of the asa with the old pix, all is well. The ASA is not able to connect to the pix or won't my config? output to see the attached config.

  Thomas

  use:

  peer conditio debug crypto [ip address of the vpn peer]

  debugging cry isa 127

  Debug crypto ipsec 127

  Set out at the time of the issue!

  Cheers.

• VPN connection problem

  Hello

  We have a server to remote client, on which we need to connect via VPN. My VPN is able to connect. But any application that needs to connect via VPN does not work. I also can't ping on remote servers. While for others its works very well. I can't understand the problem, I tried to reinstall the VPN client.

  I am using windows XP pro and the client VPN CISCO 4.0.3.

  Hello

  Your Windows XP question is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please post your question in the forum TechNet for assistance:

  TechNet Windows XP Service Pack 3 (SP3)

  Hope the helps of information.

• Client VPN connectivity problems

  I use the cisco VPN client to connect to our network, located behind a 515E. The client is authenticated and gets an ip address but cannot ping or connect with one of the hosts. The connection is to a network of customers that is also behind a 515E. I have successfully connected using the same policy to other places and have had no problem. What confuses me, is that we have used to have a Netscreen firewall before and he had a netscreen vpn client which connected since their network with a problem. Is that something they need for their firewall so that we can get through the traffic?

  Try to turn on NAT - T on your pix, by setting up:

  ISAKMP nat-traversal 20

  and configure the client vpn accordingly:

  http://www.Cisco.com/warp/public/471/cvpn_3k_nat.html#conf_client

  I think these discussions are useful:

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=virtual%20Private%20Networks&topic=General&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd7dda4

  http://Forum.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=virtual%20Private%20Networks&topic=General&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd7fe80

• IPSec VPN connectivity problem

  OK, I have the following Setup. An asa 5540 is the vpn server and some cisco vpn site-to-site 2811 routers allows you to connect to it. All cisco routers have the same ip address in their internal interface, so I'm nat'ing to another ip to connect to the vpn. It goes the same for servers behind. So we have

  IP nat inside source static 10.0.10.10 10.1.89.10

  IP nat inside source static 10.0.10.30 10.1.89.30

  OU.10 is the et.30 router server. Vpn comes up, and I cannot pint from my internal network server say Server 10.0.20.10 leash. Server 10.0.20.10 I can ping both the ip nat' ed. However, I can't ping routers 10.0.20.10. Also, I try ping 10.1.89.10 on the router and it pings fine. The other 10.1.89.30 ping does not when 10.0.10.30 does. Help, please. I need the router to communicate with 10.0.20.10 break.

  Thanks in advance.

  Since you're natting, and you use the same LAN ip subnet in routers (very bad desgin) try using an extended ping of the address on the lan interface nat pool.

• ASA easy vpn server and ios client both need public ip

  Hello

  If someone can define that cisco asa 5525-x and cisco 2800 router ios can be customer both parties have public ip or only side server.

  Please clear my doubt

  Hello

  Then you can do with ezvpn himself. Take the below mentioned thing for example and configure accordingly for your scenario.

  http://www.Cisco.com/c/en/us/products/collateral/iOS-NX-OS-software/iOS-...

  Concerning

  Knockaert