Assign ACLs to VPN clients

We have a client that VPN in a Pix 515. I inserted the configuration of intra-interface same-security-traffic allowed on the pix so that members of staff who use the VPN would be able to access a specific resource from the public side. What I would do is to continue to use the same-security-traffic intra-interface command permit, but restrict access to other resources to the VPN client. Can I assign an access list to the VPN client allowing 10.10.10.10 everything and refuse all other connections? Where can I insert this in the VPN structure?

Thank you

Yes.

Kind regards

Arul

* Please note all useful messages *.

Tags: Cisco Security

Similar Questions

VPN client can get the gateway?

I have a question for a long time.

Cisco vpn client will find a gateway to the remote vpn server address.

There are many situations in which we need a gateway assigned to the vpn client. If the customer can freely access all private networks.

PIX of Cisco router has this feature?

Why the customer would need a bridge tunnel?

The customer already has a gateway of the ISP.

Once the tunnel is up, if not to do split tunneling, all customer traffic will be sent on to the CONCENTRATOR's IPSec tunnel. So, indeed, the HUB is the default gateway.

If you use the split tunneling, then your ACL will say what customer traffic must be encrypted on the tunnel on the hub. All other traffic is sent clear for the ISP. So, indeed, the HUB is the gateway for the LAN within the tunnel.

There is a featur default on the 3000 gateway Tunnel, but that's for a different purpose

http://www.ciscotaccc.com/security/showcase?case=K81543933

Remote access VPN clients

Hello

I've set up IPSec VPN remotely and it works fine. I need access to connected VPN clients, and it does not work. I have already added an entry to traffic allowing sheep ACL from inside my network to the VPN.

More information:

Inside of the net: 10.1.1.0/24

Pool VPN: 172.30.1.0/24

Is it possible to access from my internal network to the VPN users?

Thanks in advance.

Best regards.

Marcelo

VPN users have access to certain servers via the list of Tunnel from Split.

Marcelo,

Split tunnel ACLs must be an IP acl, it is not recommended and supported to set the TCP ports on the split tunnel ACL, the vpn client don't interpret this ACl as a lot are interested in IP, TCP ports, and that could cause you a problem. You can change your config to reflect this. Regarding ACL split tunnel, it must contain the server line. networks that this vpn, customers arrive, remind you this is two-way, as you know.

So if IT supports the IP range is on this vpnExample ACL vpn clients will be able to reach the IT support guys and vice versa.

I advise you to change your split tunnel ACLs to specific ports to only the desired servers and the presenters what these customers need to achieve.

Remove the ports out of this Split tunnel ACLs.

If you need to restrict services for vpn rather clients use VPN filters.

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml

assign fixed ip vpn?

Hello

I have a simple question here, I guess...

I use the vpn in the pix firewall and assign an ip address to the scope of the vpn to 192.168.2.1 to 192.168.2.254 client, but is it possible to assign with ip vpn client for example fixed 192.168.2.1 for pc A 192.168.2.2 to pc B, because the Firewall automatically assign it... the investigation period were always changing. is it possible do that with pix firewall?

Thanks for the help

Tonny

Hello Philippe,

In case you do a local authentication, it is not possible. The local user receives an ip address from the local pool configured on the PIX. This will be dynamic.

If you can use an ACS server can authenticate users using Radius or Ganymede, the RADIUS server can give a fixed IP address to the user's call. This can be configured on the ACS server.

It might cost you extra money. in order to reduce the cost, most of them simply use a dynamic IP pool on the PIX to use VPN.

I hope this helps... all the best...

REDA

Question: how to assign the VPN IP VPN client user using 5.4 ACS?

I'm new to ACS5.4. What I want to achieve is to leave the ACS5.4 to assign IP addresses to users who are connecting to our ASA using the Cisco VPN client. ASA runs as a Radius of ACS5.4 client, and we have tested successfully for Radius Authentication. But users always get "unknown error" in the client VPN, after to be authenticated successfully. I think I used probably incorrect RADIUS attributes to an authorization policy. Here's what I did:

1. in the elements of the policy-> authorization permissions->-> authorization of network access profiles, I created a new profile and this profile is called the Radius CVPN3000/ASA/PIX7.x-DHCP-Network-Scope attribute. An IP address is entered under this attribute as a static value.

2. then, in access policies-> services-> client VPN IPSec with RADIUS Access (it's politics that I created)-> permission, I created an authorization policy allowing RADIUS previously created profile in order to be used.

I missed something? Maybe I got the wrong RADIUS attribute? Thanks in advance for any help!

ACS 5 doesn't have the ability to provide the IP addresses between the pools of IP addresses defined in ACS.

You must assign static users on basis by user on ACS 5. You can also create a pool on the SAA and tap the name of the ACS 5 pool

http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.3/release/notes/acs_53_rn.html#wp216411

Jatin kone
-Does the rate of useful messages-

VPN client: static ip address assignment for xauth

is in any way to affect a specific (via CSACS) to a vpn client ip address each time when you use extended authentication?

Already answered in security - the AAA forum.

Routing problem between the VPN Client and the router's Ethernet device

Hello

I have a Cisco 1721 in a test environment.

A net 172.16.0.0/19 simulates the Internet and a net 192.168.1.0/24 simulates the net, the VPN tunnel must go to (intranet).

The net 172.16.0.0 depends on the router 0 FastEthernet, Intranet (VPN) hangs on Ethernet 0.

The configuration was inspired form the sample Configuration

"Configuring the Client VPN Cisco 3.x for Windows to IOS using Local extended authentication"

and the output of the ConfigMaker configuration.

Authentication and logon works. Client receives an IP address from the pool. But there's a routing problem

side of routers. Ping client-side - do not work (the VPN client statistics that count encrypt them packets, but not to decrypt).

Ping the router works too, but decrypt and encrypt customer statistics in VPN packets count progressive

(customer has a correct route and return ICMP packets to the router).

The question now is:

How to route packets between the Tunnel and an Ethernet device (Ethernet 0)?

conf of the router is attached - hope that's not too...

Thanks & cordially

Thomas Schmidt

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- snipp .-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

!

version 12.2

horodateurs service debug uptime

Log service timestamps uptime

encryption password service

!

!

host name * moderator edit *.

!

enable secret 5 * moderator edit *.

!

!

AAA new-model

AAA authentication login userauthen local

AAA authorization groupauthor LAN

!

! only for the test...

!

username cisco password 0 * moderator edit *.

!

IP subnet zero

!

audit of IP notify Journal

Max-events of po verification IP 100

!

crypto ISAKMP policy 3

3des encryption

preshared authentication

Group 2

!

ISAKMP crypto client configuration group 3000client

key cisco123

pool ippool

!

! We do not want to divide the tunnel

! ACL 108

!

Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

!

Crypto-map dynamic dynmap 10

Set transform-set RIGHT

!

map clientmap client to authenticate crypto list userauthen

card crypto clientmap isakmp authorization list groupauthor

client configuration address map clientmap crypto answer

10 ipsec-isakmp crypto map clientmap Dynamics dynmap

!

interface Ethernet0

no downtime

Description connected to VPN

IP 192.168.1.1 255.255.255.0

full-duplex

IP access-group 101 in

IP access-group 101 out

KeepAlive 10

No cdp enable

!

interface Ethernet1

no downtime

address 192.168.3.1 IP 255.255.255.0

IP access-group 101 in

IP access-group 101 out

full-duplex

KeepAlive 10

No cdp enable

!

interface FastEthernet0

no downtime

Description connected to the Internet

IP 172.16.12.20 255.255.224.0

automatic speed

KeepAlive 10

No cdp enable

!

! This access group is also only for test cases!

!

no access list 101

access list 101 ip allow a whole

!

local pool IP 192.168.10.1 ippool 192.168.10.10

IP classless

IP route 0.0.0.0 0.0.0.0 172.16.12.20

enable IP pim Bennett

!

Line con 0

exec-timeout 0 0

password 7 * edit from moderator *.

line to 0

line vty 0 4

!

end

^-^-^-^-^-^-^-^-^-^-^-^-^- snapp ^-^-^-^-^-^-^-^-^-^-^-^-^-^-

Thomas,

Can't wait to show something that might be there, but I don't see here. You do not have the card encryption applied to one of the interfaces, perhaps it was not copied. Assuming your description you do it, or should it be, applied to the fa0 and you are connected. Try how you ping? Since the router or a device located on E0? If you ping the router, you will need to do an extended ping of E0 to the ip address of the client has been assigned. If your just ping the router without the extension, you will get sales and decrypts that you declare on the client. Have you tried to ping from the client to interface E0? Your default route on the router is pointing to fa0? You have a next hop to affect? You have several NIC on the client pc? Turn off your other network cards to check that you don't have a problem with routing on the client if you have more than one.

Kurtis Durrett

THE SSL VPN CLIENT ERROR!

VPN concentrator running 4.7. I have to connect to the web vpn session. The SSL VPN Client installs. Message that says: "so that the SSL VPN connection is pending" and later another message appears that says "HTTP RESPONSE received from gateway SSL VPN is not valid" appears.

What is strange is that the VPN concentrator lists me as it is connected with an IP address assigned to the ACS, but I can't access anything whatsoever. BTW, no ACLs WEB or IP filters are configured for this group that would not allow me access to the network. In addition, with the same information identification and the same group, I have no problem to access the network when the client SSL VPN is not configured to be used. IE web vpn before 4.7.

Any ideas?

The "VPN SSL HTTP RESPONSE received from gateway is incorrect" message may appear if the configuration of the client of the concentrator contains over split tunneling 26 entries.

ASA Anyconnect VPN do not work or download the VPN client

I have a Cisco ASA 5505 that I try to configure anyconnect VPN and thought, I've changed my setup several times but trying to access my static public IP address of the external IP address to download the image, I am not able to. Also when I do a package tracer I see he has been ignored through the acl when the packets from side to the ASA via port 443, it drops because of the ACL. My DMZ so will he look like something trying to access the ASA via the VPN's going to port 443. Here is my config

XXXX # sh run
: Saved
:
ASA Version 8.4 (3)
!
hostname XXXX
search for domain name
activate pFTzVNrKdD9x5rhT encrypted password
zPBAmb8krxlXh.CH encrypted passwd
names of
!
interface Ethernet0/0
Outside-interface description
switchport access vlan 20
!
interface Ethernet0/1
Uplink DMZ description
switchport access vlan 30
!
interface Ethernet0/2
switchport access vlan 10
!
interface Ethernet0/3
switchport access vlan 10
!
interface Ethernet0/4
Ganymede + ID description
switchport access vlan 10
switchport monitor Ethernet0/0
!
interface Ethernet0/5
switchport access vlan 10
!
interface Ethernet0/6
switchport access vlan 10
!
interface Ethernet0/7
Description Wireless_AP_Loft
switchport access vlan 10
!
interface Vlan10
nameif inside
security-level 100
IP 192.168.10.1 255.255.255.0
!
interface Vlan20
nameif outside
security-level 0
IP address x.x.x.249 255.255.255.248
!
Vlan30 interface
no interface before Vlan10
nameif dmz
security-level 50
IP 172.16.30.1 255.255.255.0
!
boot system Disk0: / asa843 - k8.bin
passive FTP mode
DNS lookup field inside
DNS domain-lookup outside
DNS domain-lookup dmz
DNS server-group DefaultDNS
Name-Server 8.8.8.8
Server name 8.8.4.4
search for domain name
network obj_any1 object
subnet 0.0.0.0 0.0.0.0
network of the Webserver_DMZ object
Home 172.16.30.8
network of the Mailserver_DMZ object
Home 172.16.30.7
the object DMZ network
172.16.30.0 subnet 255.255.255.0
network of the FTPserver_DMZ object
Home 172.16.30.9
network of the Public-IP-subnet object
subnet x.x.x.248 255.255.255.248
network of the FTPserver object
Home 172.16.30.8
network of the object inside
192.168.10.0 subnet 255.255.255.0
network of the VPN_SSL object
10.101.4.0 subnet 255.255.255.0
outside_in list extended access permit tcp any newspaper object Mailserver_DMZ eq www
outside_in list extended access permit tcp any newspaper EQ 587 Mailserver_DMZ object
outside_in list extended access permit tcp any newspaper SMTP object Mailserver_DMZ eq
outside_in list extended access permit tcp any newspaper of the Mailserver_DMZ eq pop3 object
outside_in list extended access permit tcp any newspaper EQ 2525 Mailserver_DMZ object
outside_in list extended access permit tcp any newspaper of the Mailserver_DMZ eq imap4 object
outside_in list extended access permit tcp any newspaper EQ 465 Mailserver_DMZ object
outside_in list extended access permit tcp any newspaper EQ 993 Mailserver_DMZ object
outside_in list extended access permit tcp any newspaper EQ 995 object Mailserver_DMZ
outside_in list extended access permit tcp any newspaper EQ 5901 Mailserver_DMZ object
outside_in list extended access permit tcp any newspaper Mailserver_DMZ eq https object
Note access list ACL for VPN Tunnel from Split vpn_SplitTunnel
vpn_SplitTunnel list standard access allowed 192.168.10.0 255.255.255.0
pager lines 24
Enable logging
timestamp of the record
exploitation forest-size of the buffer to 8192
logging trap warnings
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
MTU 1500 dmz
local pool VPN_SSL 10.101.4.1 - 10.101.4.4 255.255.255.0 IP mask
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 647.bin
don't allow no asdm history
ARP timeout 14400
NAT (inside, outside) static source inside inside static destination VPN_SSL VPN_SSL
NAT (exterior, Interior) static source VPN_SSL VPN_SSL
!
network obj_any1 object
NAT static interface (indoor, outdoor)
network of the Webserver_DMZ object
NAT (dmz, outside) static x.x.x.250
network of the Mailserver_DMZ object
NAT (dmz, outside) static x.x.x.. 251
the object DMZ network
NAT (dmz, outside) static interface
Access-group outside_in in external interface
Route outside 0.0.0.0 0.0.0.0 x.x.x.254 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
AAA-server protocol Ganymede HNIC +.
AAA-server host 192.168.10.2 HNIC (inside)
Timeout 60
key *.
identity of the user by default-domain LOCAL
Console HTTP authentication AAA HNIC
AAA console HNIC ssh authentication
Console AAA authentication telnet HNIC
AAA authentication secure-http-client
http 192.168.10.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ca trustpoint localtrust
registration auto
Configure CRL
Crypto ca trustpoint VPN_Articulate2day
registration auto
name of the object CN = vpn.articulate2day.com
sslvpnkey key pair
Configure CRL
Telnet 192.168.10.0 255.255.255.0 inside
Telnet timeout 30
SSH 192.168.10.0 255.255.255.0 inside
SSH timeout 15
SSH version 2
Console timeout 0
No vpn-addr-assign aaa

DHCP-client update dns
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd outside auto_config
!
dhcpd address 192.168.10.100 - 192.168.10.150 inside
dhcpd allow inside
!
dhcpd address dmz 172.16.30.20 - 172.16.30.23
dhcpd enable dmz
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
authenticate the NTP
NTP server 192.168.10.2
WebVPN
allow outside
AnyConnect image disk0:/anyconnect-linux-64-3.1.06079-k9.pkg 1
AnyConnect enable
tunnel-group-list activate
internal VPN_SSL group policy
VPN_SSL group policy attributes
value of server DNS 8.8.8.8
client ssl-VPN-tunnel-Protocol
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list vpn_SplitTunnel
the address value VPN_SSL pools
WebVPN
activate AnyConnect ssl dtls
AnyConnect Dungeon-Installer installed
AnyConnect ssl keepalive 15
AnyConnect ssl deflate compression
AnyConnect ask enable
ronmitch50 spn1SehCw8TvCzu7 encrypted password username
username ronmitch50 attributes
type of remote access service
type tunnel-group VPN_SSL_Clients remote access
attributes global-tunnel-group VPN_SSL_Clients
address VPN_SSL pool
Group Policy - by default-VPN_SSL
tunnel-group VPN_SSL_Clients webvpn-attributes
enable VPNSSL_GNS3 group-alias
type tunnel-group VPN_SSL remote access
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect esmtp
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e
: end

XXXX #.

You do not have this configuration:
```
 object network DMZ nat (dmz,outside) static interface
```
Try and take (or delete):
```
 object network DMZ nat (dmz,outside) dynamic interface
```

Terminating the VPN client on 871W

Hello

I tried to install EasyVPN on a cisco 871W by SDM. The goal is to finish the VPN client with authentication with an external RADIUS/advertising (on a local subnet). I implemented the IAS on a win2003 Server advertising and checked the accounts.

SDM was missing the 'crypto map' piece of config. After you add this in the CLI it still didn't work. Thus, EasyVPN is not as easy at is sounds...

Could someone with some knowledge of VPN and IPsec and so forth please look at this config? Maybe it gives me an idea of what I did wrong (which, without a doubt, must be the case).

Thank you

Erik

==

AAA new-model
!
AAA rad_eap radius server group
auth-port 1645 10.128.7.5 Server acct-port 1646
!
AAA rad_mac radius server group
!
AAA rad_acct radius server group
!
AAA rad_admin radius server group
!
AAA server Ganymede group + tac_admin
!
AAA rad_pmip radius server group
!
RADIUS server AAA dummy group
!
AAA authentication login default local
AAA authentication login eap_methods group rad_eap
AAA authentication login mac_methods local
AAA authentication login sdm_vpn_xauth_ml_1 local
AAA authorization exec default local
AAA authorization ipmobile default group rad_pmip
AAA authorization sdm_vpn_group_ml_1 LAN
AAA accounting network acct_methods
action-type market / stop
Group rad_acct
!
!
!
AAA - the id of the joint session
clock timezone MET 1
clock to DST DST PUTS recurring last Sun Mar 02:00 last Sun Oct 02:00
!
Crypto pki trustpoint TP-self-signed-1278336536
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 1278336536
revocation checking no
rsakeypair TP-self-signed-1278336536
!
!
TP-self-signed-1278336536 crypto pki certificate chain
certificate self-signed 01
3082024A 308201B 3 A0030201 02020101 300 D 0609 2A 864886 F70D0101 04050030
2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
69666963 31323738 33333635 6174652D 3336301E 170 3039 31303237 32313237
32395A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 32373833 65642D
33363533 3630819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
81008B 56 5902F5DF FCE1A56E 3A63350E 45956514 1767EF73 FEC6CD16 7E982A82
B0AF8546 ABB3D35A B7C3A7E3 3ACCB34A 8B655C97 F103DBD5 9AAEFEFC 37A 02103
4EFC398B 0C8B6BE5 AD3E568E 6CB69F87 CBCA0785 EAED0A28 726F2F0A B0B0453E
32E6B3B7 861F87FA 222197DD 3410D8A9 35939E9B CBF95F20 B8DA6ADE BF460F5C
BF8F0203 010001A 3 72307030 130101 1 FF040530 030101FF 301D 0603 0F060355
551 1104 16301482 12444341 4E495430 302E6361 6E2D6974 2E657530 1F060355
1 230418 30168014 84C9223E 661B2EB4 5BAB0B0E 1BE3A27A 64B3AEB0 301D 0603
551D0E04 16041484 C9111E66 1B2EB45B AB0B0E1B E3A27A64 B3AEB030 0D06092A
010104 05000381 8693B 599 70EC1F1A D2995276 F3E4AF9D 81002F4A 0D 864886F7
17E3583A 46C749F9 38743E6F F5E60478 5B9B5091 E944C689 7BA6DCA2 94D2FBD3
AFDE4500 A0A3644E 603A852D 55ED7A87 93501D5C 1662DAED 3FFFEC5A F1C38ED4
E0787561 BA5C14A3 6D065FCF 7DBDEBB6 9186C2D9 AA253FBF A9E38BC3 342C3AC9
2BEF6821 E4C50277 493AD5B6 2AFE
quit smoking
dot11 syslog
!
IP source-route
!
!
DHCP excluded-address IP 10.128.1.250 10.128.1.254
DHCP excluded-address IP 10.128.150.250 10.128.150.254
DHCP excluded-address IP 10.128.7.0 10.128.7.100
DHCP excluded-address IP 10.128.7.250 10.128.7.254
!
pool IP dhcp VLAN30-COMMENTS
import all
Network 10.128.1.0 255.255.255.0
router by default - 10.128.1.254
10.128.7.5 DNS server
-10.128.7.5 NetBIOS name server
aaa.com domain name
4 rental
!
IP dhcp VLAN20-STAFF pool
import all
Network 10.128.150.0 255.255.255.0
router by default - 10.128.150.254
10.128.7.5 DNS server
-10.128.7.5 NetBIOS name server
aaa.com domain name
4 rental
!
IP dhcp SERVERS VLAN10 pool
import all
Network 10.128.7.0 255.255.255.0
router by default - 10.128.7.254
10.128.7.5 DNS server
-10.128.7.5 NetBIOS name server
aaa.com domain name
4 rental
!
!
IP cef
no ip domain search
IP domain name aaa.com
inspect the tcp IP MYFW name
inspect the IP udp MYFW name
No ipv6 cef
!
Authenticated MultiLink bundle-name Panel
!
VPDN enable
!
!
!
username privilege 15 secret 5 xxxx xxxx
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
ISAKMP crypto client configuration group vpn
key xxxx
pool SDM_POOL_1
netmask 255.255.255.0
!
!
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
market arriere-route
!
!
card crypto SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1 crypto
client configuration address map SDM_CMAP_1 crypto answer
map SDM_CMAP_1 65535-isakmp dynamic SDM_DYNMAP_1 ipsec crypto
!
Crypto ctcp port 10000
Archives
The config log
hidekeys
!
!
!
Bridge IRB
!
!
interface Loopback0
10.128.201.1 the IP 255.255.255.255
map SDM_CMAP_1 crypto
!
interface FastEthernet0
switchport access vlan 10
!
interface FastEthernet1
switchport access vlan 20
!
interface FastEthernet2
switchport access vlan 10
!
interface FastEthernet3
switchport access vlan 30
!
interface FastEthernet4
no ip address
Speed 100
full-duplex
PPPoE enable global group
PPPoE-client dial-pool-number 1
No cdp enable
!
interface Dot11Radio0
no ip address
Shutdown
No dot11 extensions aironet
!
interface Vlan1
address IP AAA. BBB. CCC.177 255.255.255.240
no ip redirection
no ip proxy-arp
NAT outside IP
no ip virtual-reassembly
No autostate
Hold-queue 100 on
!
interface Vlan10
SERVER description
no ip address
IP nat inside
no ip virtual-reassembly
No autostate
Bridge-group 10
Bridge-group of 10 disabled spanning
!
interface Vlan20
Description of the STAFF
no ip address
IP nat inside
no ip virtual-reassembly
No autostate
Bridge-group 20
Bridge-group 20 covering people with reduced mobility
!
Vlan30 interface
Description COMMENTS
no ip address
IP nat inside
no ip virtual-reassembly
No autostate
Bridge-group 30
Bridge-group 30 covering people with reduced mobility
!
interface Dialer1
MTU 1492
IP unnumbered Vlan1
no ip redirection
no ip proxy-arp
NAT outside IP
inspect the MYFW over IP
IP virtual-reassembly
encapsulation ppp
Dialer pool 1
Dialer-Group 1
PPP authentication pap callin
PPP pap sent-name of user password 7 xxxx xxxxx
!
interface BVI10
Description the server network bridge
IP 10.128.7.254 255.255.255.0
IP nat inside
IP virtual-reassembly
!
interface BVI20
Description personal network bridge
IP 10.128.150.254 255.255.255.0
IP nat inside
IP virtual-reassembly
!
interface BVI30
Bridge network invited description
IP 10.128.1.254 255.255.255.0
IP access-group Guest-ACL in
IP nat inside
IP virtual-reassembly
!
pool of local SDM_POOL_1 192.168.2.1 IP 192.168.2.100
IP forward-Protocol ND
IP route 0.0.0.0 0.0.0.0 Dialer1
IP http server
access-class 2 IP http
local IP http authentication
IP http secure server
IP http secure ciphersuite 3des-ede-cbc-sha
IP http secure-client-auth
IP http timeout policy slowed down 60 life 86400 request 10000
!
!
overload of IP nat inside source list 101 interface Vlan1
IP nat inside source static tcp 10.128.7.1 25 AAA. BBB. Expandable 25 CCC.178
IP nat inside source static tcp 10.128.7.1 80 AAA. BBB. CCC.178 extensible 80
IP nat inside source static tcp 10.128.7.1 443 AAA. BBB. CCC.178 extensible 443
IP nat inside source static tcp 10.128.7.1 8333 AAA. BBB. CCC.178 extensible 8333
IP nat inside source static tcp 10.128.7.2 25 AAA. BBB. Expandable 25 CCC.179
IP nat inside source static tcp 10.128.7.2 80 AAA. BBB. CCC.179 extensible 80
IP nat inside source static tcp 10.128.7.2 443 AAA. BBB. CCC.179 extensible 443
IP nat inside source static tcp 10.128.7.2 8333 AAA. BBB. CCC.179 extensible 8333
IP nat inside source static tcp 10.128.7.3 25 AAA. BBB. Expandable 25 CCC.180
IP nat inside source static tcp 10.128.7.3 80 AAA. BBB. CCC.180 extensible 80
IP nat inside source static tcp 10.128.7.3 443 AAA. BBB. CCC.180 extensible 443
IP nat inside source static tcp 10.128.7.3 8333 AAA. BBB. CCC.180 extensible 8333
IP nat inside source static tcp 10.128.7.4 25 AAA. BBB. Expandable 25 CCC.181
IP nat inside source static tcp 10.128.7.4 80 AAA. BBB. CCC.181 extensible 80
IP nat inside source static tcp 10.128.7.4 443 AAA. BBB. CCC.181 extensible 443
IP nat inside source static tcp 10.128.7.4 8333 AAA. BBB. CCC.181 extensible 8333
IP nat inside source static tcp 10.128.7.5 25 AAA. BBB. Expandable 25 CCC.182
IP nat inside source static tcp 10.128.7.5 80 AAA. BBB. CCC.182 extensible 80
IP nat inside source static tcp 10.128.7.5 443 AAA. BBB. CCC.182 extensible 443
IP nat inside source static tcp 10.128.7.5 8333 AAA. BBB. CCC.182 extensible 8333
IP nat inside source static tcp 10.128.7.6 25 AAA. BBB. Expandable 25 CCC.183
IP nat inside source static tcp 10.128.7.6 80 AAA. BBB. CCC.183 extensible 80
IP nat inside source static tcp 10.128.7.6 443 AAA. BBB. CCC.183 extensible 443
IP nat inside source static tcp 10.128.7.6 8333 AAA. BBB. CCC.183 extensible 8333
IP nat inside source static tcp 10.128.7.7 25 AAA. BBB. Expandable 25 CCC.184
IP nat inside source static tcp 10.128.7.7 80 AAA. BBB. CCC.184 extensible 80
IP nat inside source static tcp 10.128.7.7 443 AAA. BBB. CCC.184 extensible 443
IP nat inside source static tcp 10.128.7.7 8333 AAA. BBB. CCC.184 extensible 8333
IP nat inside source static tcp 10.128.7.8 25 AAA. BBB. Expandable 25 CCC.185
IP nat inside source static tcp 10.128.7.8 80 AAA. BBB. CCC.185 extensible 80
IP nat inside source static tcp 10.128.7.8 443 AAA. BBB. CCC.185 extensible 443
IP nat inside source static tcp 10.128.7.8 8333 AAA. BBB. CCC.185 extensible 8333
IP nat inside source static tcp 10.128.7.9 25 AAA. BBB. Expandable 25 CCC.186
IP nat inside source static tcp 10.128.7.9 80 AAA. BBB. CCC.186 extensible 80
IP nat inside source static tcp 10.128.7.9 443 AAA. BBB. CCC.186 extensible 443
IP nat inside source static tcp 10.128.7.9 8333 AAA. BBB. CCC.186 extensible 8333
IP nat inside source static tcp 10.128.7.10 25 AAA. BBB. Expandable 25 CCC.187
IP nat inside source static tcp 10.128.7.10 80 AAA. BBB. CCC.187 extensible 80
IP nat inside source static tcp 10.128.7.10 443 AAA. BBB. CCC.187 extensible 443
IP nat inside source static tcp 10.128.7.10 8333 AAA. BBB. CCC.187 extensible 8333
IP nat inside source static tcp 10.128.7.11 25 AAA. BBB. Expandable 25 CCC.188
IP nat inside source static tcp 10.128.7.11 80 AAA. BBB. CCC.188 extensible 80
IP nat inside source static tcp 10.128.7.11 443 AAA. BBB. CCC.188 extensible 443
IP nat inside source static tcp 10.128.7.11 8333 AAA. BBB. CCC.188 extensible 8333
IP nat inside source static tcp 10.128.7.12 25 AAA. BBB. Expandable 25 CCC.189
IP nat inside source static tcp 10.128.7.12 80 AAA. BBB. CCC.189 extensible 80
IP nat inside source static tcp 10.128.7.12 443 AAA. BBB. CCC.189 extensible 443
IP nat inside source static tcp 10.128.7.12 8333 AAA. BBB. CCC.189 extensible 8333
!
Guest-ACL extended IP access list
deny ip any 10.128.7.0 0.0.0.255
deny ip any 10.128.150.0 0.0.0.255
allow an ip
IP Internet traffic inbound-ACL extended access list
allow udp any eq bootps any eq bootpc
permit any any icmp echo
permit any any icmp echo response
permit icmp any any traceroute
allow a gre
allow an esp
!
access-list 1 permit 10.128.7.0 0.0.0.255
access-list 1 permit 10.128.150.0 0.0.0.255
access-list 1 permit 10.128.1.0 0.0.0.255
access-list 2 allow 10.0.0.0 0.255.255.255
access-list 2 refuse any
access-list 101 permit ip 10.128.7.0 0.0.0.255 any
access-list 101 permit ip 10.128.150.0 0.0.0.255 any
access-list 101 permit ip 10.128.1.0 0.0.0.255 any
Dialer-list 1 ip Protocol 1
!
!
!
!
format of server RADIUS attribute 32 include-in-access-req hour
RADIUS-server host 10.128.7.5 auth-port 1645 acct-port 1646 borders 7 xxxxx
RADIUS vsa server send accounting
!
control plan
!
IP route 10 bridge
IP road bridge 20
IP road bridge 30
Banner motd ^.
Unauthorized access prohibited. *
All access attempts are logged! ***************

^
!
Line con 0
password 7 xxxx
no activation of the modem
line to 0
line vty 0 4
access-class 2
privilege level 15
transport input telnet ssh
!
max-task-time 5000 Planner
AAA.BBB.CCC.ddd NTP server
end

Erik,

The address pool you are talking about is to assign to the customer or the public router interface? If you want to set up your vpn client software point a full domain name instead of an IP address that you can do it too long you can ensure the use of the name is resolved by a DNS SERVER.

The range of addresses that you can be asigned to your Dialer interface will depend on your ISP.

-Butterfly

VPN client connected but no ping nor access to privat network

Hello

I have a 1802w installed, a VPN client that can connect to the router and L2L connection, which works very well.

On the router, I see that the client is connected, but no traffic passes. In sh crypto ipsec, I see that traffic is decrypted, but no packtets are encypted.

Can someone point me in the right direction? I have the confs and debugs attached. Thanks for the help in advance.

Erich

Erich,

Looking at your configuration, two things:

1 - is the current running configuration. I see your Tunnel L2L is configured with an address of correspondence of 101, but I don't see a 101 ACL set on the router.

2. your Split Tunnel must be reconfigured. Which means, the source and destination must be exchanged.

SplitList extended IP access list

permit ip 192.168.2.0 0.0.0.255 192.168.111.0 0.0.0.255

Split Tunneling

http://www.Cisco.com/en/us/Tech/tk59/technologies_configuration_example09186a00800a393b.shtml#Con4

Also, the IP address pool you assign to clients, ensure that they are not part of a LAN on your side. If so, you can then run in routing problems.

Kind regards

Arul

* Please note all useful messages *.

Why my VPN clients cannot access network drives and resources?

I have a cisco asa 5505 configured to be a VPN gateway. I can dial using the anyconnect VPN client. The remote user is assigned an IP address to my specifications. However... The remote user cannot access network such as disks in network resources or the fax server. I've done everything I can to set the right settings NAT and ACLs, but in vain. I write my config... If someone can track down the problem. It would be appreciated!

: Saved

:

ASA Version 8.2 (5)

!

ciscoasa hostname

Cisco domain name

activate the password xxxxxxxxxxxxx

passwd xxxxxxxxxxxxxxxxx

names of

name 68.191.xxx.xxx outdoors

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.201.200 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP address outside 255.255.255.0

!

passive FTP mode

DNS domain-lookup outside

DNS lookup field inside

DNS server-group DefaultDNS

192.168.201.1 server name

Cisco domain name

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

object-group Protocol TCPUDP

object-protocol udp

object-tcp protocol

object-group network obj - 192.168.201.0

FREE access-list extended ip 192.168.201.0 NAT allow 255.255.255.0 192.168.201.0 255.255.255.0

NAT-FREE 192.168.202.0 permits all ip extended access list 255.255.255.0

FREE access-list extended ip 192.168.202.0 NAT allow 255.255.255.0 any

Extended access list-NAT-FREE enabled a whole icmp

allow any scope to an entire ip access list

allow any scope to the object-group TCPUDP an entire access list

allow any scope to an entire icmp access list

inside_access_in of access allowed any ip an extended list

inside_access_in list extended access allow TCPUDP of object-group a

inside_access_in list extended access permit icmp any one

outside_access_in of access allowed any ip an extended list

outside_access_in list extended access allow TCPUDP of object-group a

outside_access_in list extended access permit icmp any one

Standard access list DefaultRAGroup_splitTunnelAcl allow 192.168.201.0 255.255.255.0

access extensive list ip 192.168.202.0 inside_nat0_outbound allow 255.255.255.0 192.168.201.0 255.255.255.0

inside_nat0_outbound list extended access permit icmp any one

inside_nat0_outbound_1 of access allowed any ip an extended list

pager lines 24

Enable logging

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

mask 192.168.202.1 - 192.168.202.50 255.255.255.0 IP local pool KunduVPN

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

NAT-control

Global 1 interface (outside)

NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

NAT (inside) 1 192.168.201.0 255.255.255.0

Access-group outside_access_in in interface outside

inside_access_in access to the interface inside group

Route inside 0.0.0.0 0.0.0.0 192.168.201.1 1

Route inside 0.0.0.0 255.255.255.255 outdoor 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

http 192.168.201.0 255.255.255.0 inside

http 0.0.0.0 0.0.0.0 outdoors

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

Crypto ca trustpoint ASDM_TrustPoint0

registration auto

name of the object CN = ciscoasa

Keypairs xxx

Proxy-loc-transmitter

Configure CRL

XXXXXXXXXXXXXXXXXXXXXXXX

quit smoking

crypto ISAKMP allow outside

crypto ISAKMP allow inside

crypto ISAKMP policy 10

authentication crack

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 20

authentication rsa - sig

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 40

authentication crack

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 50

authentication rsa - sig

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 60

preshared authentication

aes-192 encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 70

authentication crack

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 80

authentication rsa - sig

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 90

preshared authentication

aes encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 100

authentication crack

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 110

authentication rsa - sig

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 120

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 130

authentication crack

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 140

authentication rsa - sig

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 150

preshared authentication

the Encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

SSL-trust outside ASDM_TrustPoint0 point

WebVPN

allow outside

allow inside

SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image

enable SVC

tunnel-group-list activate

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of 192.168.201.1 DNS server

VPN-tunnel-Protocol svc webvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl

Cisco by default field value

attributes of Group Policy DfltGrpPolicy

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

WebVPN

SVC request enable

internal KunduVPN group strategy

attributes of Group Policy KunduVPN

WINS server no

value of 192.168.201.1 DNS server

VPN-tunnel-Protocol svc webvpn

Cisco by default field value

username xxxx

username xxxxx

VPN-group-policy DfltGrpPolicy

attributes global-tunnel-group DefaultRAGroup

address VPNIP pool

Group Policy - by default-DefaultRAGroup

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared key *.

tunnel-group DefaultRAGroup ppp-attributes

ms-chap-v2 authentication

type tunnel-group KunduVPN remote access

attributes global-tunnel-group KunduVPN

address (inside) VPNIP pool

address pool KunduVPN

authentication-server-group (inside) LOCAL

Group Policy - by default-KunduVPN

tunnel-group KunduVPN webvpn-attributes

enable KunduVPN group-alias

allow group-url https://68.191.xxx.xxx/KunduVPN

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

no remote anonymous reporting call

Cryptochecksum:c0e4540d4a07f2c544f0eddb653627cc

: end

don't allow no asdm history

Hello

What is the IP address of the hosts/servers LAN Gateway?

If this is not the ASA 'inside' interface IP address then I assume that the problem with VPN is simply routing.

For example, if your hosts/servers LAN wireless LAN gateway router then the following would happen to your Clients VPN connections.
- Forms of customers login VPN users through configuring wireless routers static PAT (Port Forward) to interface "inside" ASA
- Client VPN sends traffic through the VPN to ASA and again the host of the server or LAN.
- Host/server LAN sees the connection from a network other than the LAN (192.168.202.0/24) and therefore to forward traffic to the default gateway that would likely be the wireless router.
- Wireless router has no route to the network 192.168.202.0/24 (VPN Pool) and therefore uses its default route to the external network to forward traffic.
- Client VPN host never received the traffic back as transmitted sound on the external network and abandoned by the ISP
So if the above assumption is correct, then you would at least need a configuration of the road on the wireless router that tells the device to transfer traffic to the network 192.168.202.0/24 to the 192.168.201.200 gateway IP address (which is the SAA)

I would like to know if the installation is as described above.

-Jouni

[SOLVED] Native Iphone4s Cisco VPN client cannot establish the tunnel (victory clients do)

Hello

IPhone 4 s last IOS5 V 5.1.1 installed

I'm not able to make the native IPSEC VPN connection upset my company Cisco 877

Instead, all my computer laptop and netbook with Cisco VPN Client work installed fine when they connect remotely to society 877

Turn debugging 877, it seems Iphone successfully passes the 1 connection ike (actually Iphone wonder phase2 user/pass), but it hung to phase2 give me the error 'Negotiation with the VPN server has no' back

An idea or a known issue on this?

This is how I configured my VPN 877 part:

R1 (config) # aaa new-model

R1 (config) # aaa authentication default local connection

R1 (config) # aaa authentication login vpn_xauth_ml_1 local

R1 (config) # aaa authentication login local sslvpn

R1 (config) # aaa authorization network vpn_group_ml_1 local

R1 (config) # aaa - the id of the joint session

Crypto isakmp policy of R1 (config) # 1

R1(config-ISAKMP) # BA 3des

# Preshared authentication R1(config-ISAKMP)

Group R1(config-ISAKMP) # 2

R1(config-ISAKMP) #.

R1(config-ISAKMP) #crypto isakmp policy 2

R1(config-ISAKMP) # BA 3des

Md5 hash of R1(config-ISAKMP) #.

# Preshared authentication R1(config-ISAKMP)

Group R1(config-ISAKMP) # 2

Output R1(config-ISAKMP) #.

R1 (config) # CUSTOMER - VPN crypto isakmp client configuration group

R1(config-ISAKMP-Group) # key xxxxxxxx

R1(config-ISAKMP-Group) # 192.168.0.1 dns

R1(config-ISAKMP-Group) # VPN - pool

ACL R1(config-ISAKMP-Group) # 120

R1(config-ISAKMP-Group) max-users # 5

Output R1(config-ISAKMP-Group) #.

R1 (config) # ip local pool VPN-pool 192.168.0.20 192.168.0.25

R1 (config) # crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac

R1 (config) # crypto ipsec VPN-profile-1 profile

R1(IPSec-Profile) # set the transform-set encrypt method 1

Tunnel type interface virtual-Template2 R1 (config) #.

R1(Config-if) # ip unnumbered FastEthernet0/0

R1(Config-if) # tunnel mode ipsec ipv4

Ipsec protection tunnel R1(Config-if) # VPN - profile - 1 profile

Profile of R1 (config) # isakmp crypto vpn-ike-profile-1

R1(conf-ISA-Prof) # match group identity CUSTOMER VPN

R1(conf-ISA-Prof) # vpn_xauth_ml_1 list client authentication

R1(conf-ISA-Prof) # isakmp authorization list vpn_group_ml_1

R1(conf-ISA-Prof) # client configuration address respond

R1(conf-ISA-Prof) virtual-model # 2

Then run AccessList 120 for desired traffic ("access-list 120 now allows ip any any")

I have configured my VPN Cisco "CUSTOMER-VPN" clients and relative password

Whenever they connect, they are prompted for the password and username phase2 then they join the VPN with an IP address from local subnet released.

With the same parameters required and confirmed in section ipsec VPN Iphone it does not work.

It's 877 isakmp debug output after that Iphone wonder name of user and password (then I suppose that phase 1 completed):

* 14:29:30.731 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport CONF_XAUTH

* 14:29:30.735 May 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID =-1427983983

* 14:29:30.735 May 19: ISAKMP: Config payload RESPONSE

* 14:29:30.735 May 19: ISAKMP/xauth: response XAUTH_USER_NAME_V2 attribute

* 14:29:30.735 May 19: ISAKMP/xauth: response XAUTH_USER_PASSWORD_V2 attribute

* 14:29:30.735 May 19: ISAKMP: (2081): node-1427983983 error suppression FALSE reason "made with Exchange of request/response xauth.

* 14:29:30.735 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_REPLY

* 14:29:30.735 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_REQ_SENT = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT

* 14:29:30.743 May 19: ISAKMP: node set 1322685842 to CONF_XAUTH

* 19 May 14:29:30.747: ISAKMP: (2081): launch peer 151.38.197.143 config. ID = 1322685842

* 19 May 14:29:30.747: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) CONF_XAUTH

* 14:29:30.747 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.

* 14:29:30.747 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN

* 14:29:30.747 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_AAA_CONT_LOGIN_AWAIT = IKE_XAUTH_SET_SENT

* 14:29:31.299 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport CONF_XAUTH

* 14:29:31.299 May 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID = 1322685842

* 14:29:31.299 May 19: ISAKMP: Config payload ACK

* 19 May 14:29:31.303: ISAKMP: (2081): XAUTH ACK processed

* 14:29:31.303 May 19: ISAKMP: (2081): error suppression node 1322685842 FALSE basis "Mode of Transaction.

* 14:29:31.303 May 19: ISAKMP: (2081): talking to a customer of the unit

* 14:29:31.303 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_ACK

* 14:29:31.303 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_SET_SENT = IKE_P1_COMPLETE

* 14:29:31.303 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

* 14:29:31.303 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

* 19 May 14:29:31.303: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

* 14:29:31.315 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

* 14:29:31.315 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

* 14:29:31.623 may 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport QM_IDLE

* 14:29:31.623 may 19: ISAKMP: node set-851463821 to QM_IDLE

* 14:29:31.623 may 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID =-851463821

* 14:29:31.623 may 19: ISAKMP: Config payload REQUEST

* 14:29:31.623 may 19: ISAKMP: (2081): verification of claim:

* 14:29:31.623 may 19: ISAKMP: IP4_ADDRESS

* 14:29:31.623 may 19: ISAKMP: IP4_NETMASK

* 14:29:31.623 may 19: ISAKMP: IP4_DNS

* 14:29:31.623 may 19: ISAKMP: IP4_NBNS

* 14:29:31.623 may 19: ISAKMP: ADDRESS_EXPIRY

* 14:29:31.623 may 19: ISAKMP: APPLICATION_VERSION

* 14:29:31.623 may 19: ISAKMP: MODECFG_BANNER

* 14:29:31.623 may 19: ISAKMP: domaine_par_defaut

* 14:29:31.623 may 19: ISAKMP: SPLIT_DNS

* 14:29:31.623 may 19: ISAKMP: SPLIT_INCLUDE

* 14:29:31.623 may 19: ISAKMP: INCLUDE_LOCAL_LAN

* 14:29:31.623 may 19: ISAKMP: PFS

* 14:29:31.623 may 19: ISAKMP: MODECFG_SAVEPWD

* 14:29:31.623 may 19: ISAKMP: FW_RECORD

* 14:29:31.623 may 19: ISAKMP: serveur_sauvegarde

* 14:29:31.623 may 19: ISAKMP: MODECFG_BROWSER_PROXY

* 14:29:31.627 May 19: ISAKMP/author: author asks for CUSTOMER-VPNsuccessfully group AAA

* 14:29:31.627 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST

* 14:29:31.627 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_CONFIG_AUTHOR_AAA_AWAIT

* 14:29:31.627 May 19: ISAKMP: (2081): attributes sent in the message:

* 19 May 14:29:31.627: address: 0.2.0.0

* 19 May 14:29:31.627: ISAKMP: (2081):address of 192.168.0.21 assignment

* 14:29:31.627 May 19: ISAKMP: sending private address: 192.168.0.21

* 14:29:31.627 May 19: ISAKMP: send the subnet mask: 255.255.255.0

* 14:29:31.631 May 19: ISAKMP: sending IP4_DNS server address: 192.168.0.1

* 14:29:31.631 May 19: ISAKMP: sending ADDRESS_EXPIRY seconds left to use the address: 3576

* 14:29:31.631 May 19: ISAKMP: string APPLICATION_VERSION sending: Cisco IOS software, software C870 (C870-ADVIPSERVICESK9-M), Version 12.4 (15) T7, VERSION of the SOFTWARE (fc3)

Technical support: http://www.cisco.com/techsupport

Copyright (c) 1986-2008 by Cisco Systems, Inc.

Updated Friday 14 August 08 07:43 by prod_rel_team

* 14:29:31.631 May 19: ISAKMP: split shipment include the name Protocol 120 network 0.0.0.0 mask 0.0.0.0 0 src port 0, port 0 DST

* 14:29:31.631 May 19: ISAKMP: sending save the password answer value 0

* 19 May 14:29:31.631: ISAKMP: (2081): respond to peer 151.38.197.143 config. ID =-851463821

* 19 May 14:29:31.631: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) CONF_ADDR

* 14:29:31.631 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.

* 14:29:31.631 May 19: ISAKMP: (2081): node-851463821 error suppression FALSE reason "error no.".

* 14:29:31.631 May 19: ISAKMP: (2081): talking to a customer of the unit

* 14:29:31.631 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_AAA, IKE_AAA_GROUP_ATTR

* 14:29:31.631 May 19: ISAKMP: (2081): former State = new State IKE_CONFIG_AUTHOR_AAA_AWAIT = IKE_P1_COMPLETE

* 14:29:31.635 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

* 14:29:31.635 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

Here the Iphone remains unused for a few seconds...

* 14:29:48.391 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport QM_IDLE

* 14:29:48.391 May 19: ISAKMP: node set 1834509506 to QM_IDLE

* 19 May 14:29:48.391: ISAKMP: (2081): HASH payload processing. Message ID = 1834509506

* 19 May 14:29:48.391: ISAKMP: (2081): treatment of payload to DELETE. Message ID = 1834509506

* 14:29:48.391 May 19: ISAKMP: (2081): peer does not paranoid KeepAlive.

* 14:29:48.395 May 19: ISAKMP: (2081): peer does not paranoid KeepAlive.

* 14:29:48.395 May 19: ISAKMP: (2081): removal of HIS right State 'No reason' (R) QM_IDLE (post 151.38.197.143)

* 14:29:48.395 May 19: ISAKMP: (2081): error suppression node 1834509506 FALSE reason 'informational (en) State 1.

* 19 May 14:29:48.395: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

* 19 May 14:29:48.395: IPSEC (key_engine_delete_sas): rec would notify of ISAKMP

* 19 May 14:29:48.395: IPSEC (key_engine_delete_sas): remove all SAs shared with peer 151.38.197.143

* 14:29:48.395 May 19: ISAKMP: node set-1711408233 to QM_IDLE

* 19 May 14:29:48.395: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) QM_IDLE

* 14:29:48.395 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.

* 14:29:48.399 May 19: ISAKMP: (2081): purge the node-1711408233

* 14:29:48.399 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

* 14:29:48.399 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

* 14:29:48.399 May 19: ISAKMP: (2081): removal of HIS right State 'No reason' (R) QM_IDLE (post 151.38.197.143)

* 14:29:48.399 May 19: ISAKMP: (0): cannot decrement IKE Call Admission Control incoming_active stat because he's already 0.

* 14:29:48.399 May 19: ISAKMP (0:2081): return address 192.168.0.21 to pool

* 14:29:48.399 May 19: ISAKMP: Unlocking counterpart struct 0 x 84084990 for isadb_mark_sa_deleted(), count 0

* 14:29:48.399 May 19: ISAKMP: return address 192.168.0.21 to pool

* 14:29:48.399 May 19: ISAKMP: delete peer node by peer_reap for 151.38.197.143: 84084990

* 14:29:48.399 May 19: ISAKMP: return address 192.168.0.21 to pool

* 14:29:48.403 May 19: ISAKMP: (2081): node-1427983983 error suppression FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): error suppression node 1322685842 FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): node-851463821 error suppression FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): error suppression node 1834509506 FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

* 14:29:48.403 May 19: ISAKMP: (2081): former State = new State IKE_DEST_SA = IKE_DEST_SA

* 19 May 14:29:48.403: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

It seems 877 comes even to assign a local ip address of LAN for Iphone (192.168.0.21) but then something goes wrong...

Any idea or suggestion on this?

Thank you very much

Hi Federico,.

Please let us know.

Please mark this message as answered while others will be able to learn the lessons.

Thank you.

Portu.

Impossible to access them Internert through the split tunneling VPN client.

I divided tunnel configured on a PIX 515. The remote VPN client connects to the PIX very well and can ping hosts on the internal network, but cannot access the Internet. Am I missing something? My config as shown below.

In addition, I don't see the routes on the VPN client via statistics (screenshot below)

All opinions are appreciated.

Rob

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------

8.0 (3) version PIX

!

hostname PIX-to-250

enable the encrypted password xxxxx

names of

!

interface Ethernet0

nameif outside

security-level 0

IP address x.x.x.250 255.255.255.240

!

interface Ethernet1

nameif inside

security-level 100

IP 192.168.9.1 255.255.255.0

!

XXXXX encrypted passwd

passive FTP mode

DNS domain-lookup outside

DNS server-group Ext_DNS

Server name 194.72.6.57

Server name 194.73.82.242

the LOCAL_LAN object-group network

object-network 192.168.9.0 255.255.255.0

object-network 192.168.88.0 255.255.255.0

Internet_Services tcp service object-group

port-object eq www

area of port-object eq

EQ object of the https port

port-object eq ftp

EQ object of port 8080

port-object eq telnet

the WAN_Network object-group network

object-network 192.168.200.0 255.255.255.0

ACLOUT list extended access allowed object-group LOCAL_LAN udp any eq log field

ACLOUT list extended access allow icmp object-group LOCAL_LAN no matter what paper

ACLOUT list extended access permitted tcp object-group LOCAL_LAN connect to any object-group Internet_Services

access-list extended ACLIN all permit icmp any what newspaper echo-reply

access-list extended ACLIN all permit icmp any how inaccessible journal

access-list extended ACLIN allowed icmp no matter what newspaper has exceeded the time

Comment by split_tunnel_list-LAN Local access list

split_tunnel_list list standard access allowed 192.168.9.0 255.255.255.0

access-list extended SHEEP allowed object-group ip LOCAL_LAN 192.168.100.0 255.255.255.0

pager lines 24

Enable logging

Outside 1500 MTU

Within 1500 MTU

IP local pool testvpn 192.168.100.1 - 192.168.100.99

no failover

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0 access-list SHEEP

NAT (inside) 1 0.0.0.0 0.0.0.0

Access-group ACLIN in interface outside

ACLOUT access to the interface inside group

Route outside 0.0.0.0 0.0.0.0 195.171.252.45 1

Route inside 192.168.88.0 255.255.255.0 192.168.88.254 1

Route inside 192.168.199.0 255.255.255.0 192.168.199.254 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

dynamic-access-policy-registration DfltAccessPolicy

Enable http server

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-sha-hmac Set_1

Crypto-map dynamic outside_dyn_map 10 game of transformation-Set_1

life together - the association of security crypto dynamic-map outside_dyn_map 10 seconds 280000

Crypto-map dynamic outside_dyn_map 10 the value reverse-road

outside_map 10 card crypto ipsec-isakmp dynamic outside_dyn_map

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 1

preshared authentication

3des encryption

sha hash

Group 2

life 43200

crypto ISAKMP policy 65535

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

a basic threat threat detection

Statistics-list of access threat detection

internal testvpn group policy

attributes of the strategy of group testvpn

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelspecified

name of user testuser encrypted password xxxxxx

type tunnel-group testvpn remote access

tunnel-group testvpn General-attributes

address testvpn pool

Group Policy - by default-testvpn

testvpn group of tunnel ipsec-attributes

pre-shared-key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the netbios

inspect the rsh

inspect the rtsp

inspect the skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect the tftp

inspect the sip

inspect xdmcp

inspect the icmp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:5dcb5dcdff277e1765a9a0c366b88b9e

: end

# 250 A - PIX

You have not assigned the ACL split tunnel to your strategy.

PLS, configure the following:

attributes of the strategy of group testvpn

value of Split-tunnel-network-list split_tunnel_list

Cisco VPN Client cannot ping from LAN internal IP

Hello

I apologize in advance for my lack of knowledge about it, but I got a version of the software running ASA 5510 7.2 (2) and has been invited to set up a site with a client, I managed to get this configured and everything works fine. In addition, I created a group of tunnel ipsec-ra for users to connect to a particular server 192.168.10.100/24 remote, even if the connection is made successfully, I can not ping any IP on the LAN 192.168.10.0/24 located behind the ASA and when I ping inside the interface on the ASA it returns the public IP address of the external interface.

If someone out there could give me a little push in the right direction, it would be much appreciated! This is the current configuration of the device.

Thanks in advance.

: Saved

:

ASA Version 7.2 (2)

!

hostname ciscoasa5510

domain.local domain name

activate the password. 123456789 / encrypted

names of

!

interface Ethernet0/0

nameif outside

security-level 0

PPPoE client vpdn group ISP

12.34.56.789 255.255.255.255 IP address pppoe setroute

!

interface Ethernet0/1

nameif inside

security-level 100

IP 192.168.10.1 255.255.255.0

!

interface Ethernet0/2

Shutdown

No nameif

no level of security

no ip address

!

interface Ethernet0/3

Shutdown

No nameif

no level of security

no ip address

!

interface Management0/0

nameif management

security-level 100

IP 192.168.1.1 255.255.255.0

management only

!

passwd encrypted 123456789

passive FTP mode

clock timezone GMT/UTC 0

summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00

DNS server-group DefaultDNS

domain.local domain name

permit outside_20_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 host 10.16.2.124

permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 host 10.16.2.124

access-list Split_Tunnel_List note the network of the company behind the ASA

Split_Tunnel_List list standard access allowed 192.168.10.0 255.255.255.0

pager lines 24

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

management of MTU 1500

IP local pool domain_vpn_pool 192.168.11.1 - 192.168.11.254 mask 255.255.255.0

ICMP unreachable rate-limit 1 burst-size 1

ASDM image disk0: / asdm - 522.bin

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

Route outside 0.0.0.0 0.0.0.0 12.34.56.789 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout, uauth 0:05:00 absolute

internal domain_vpn group policy

attributes of the strategy of group domain_vpn

value of 212.23.3.100 DNS server 212.23.6.100

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list Split_Tunnel_List

username domain_ra_vpn password 123456789 encrypted

username domain_ra_vpn attributes

VPN-group-policy domain_vpn

encrypted utilisateur.123456789 password username

encrypted utilisateur.123456789 password username

privilege of username user password encrypted passe.123456789 15

encrypted utilisateur.123456789 password username

the ssh LOCAL console AAA authentication

AAA authentication enable LOCAL console

Enable http server

http 192.168.1.0 255.255.255.0 management

http 192.168.10.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto-map dynamic outside_dyn_map 20 set pfs

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

card crypto outside_map 20 match address outside_20_cryptomap

peer set card crypto outside_map 20 987.65.43.21

outside_map crypto 20 card value transform-set ESP-3DES-SHA

3600 seconds, duration of life card crypto outside_map 20 set - the security association

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

aes-256 encryption

sha hash

Group 5

life 86400

crypto ISAKMP policy 30

preshared authentication

3des encryption

sha hash

Group 2

life 86400

tunnel-group 987.65.43.21 type ipsec-l2l

IPSec-attributes tunnel-group 987.65.43.21

pre-shared-key *.

tunnel-group domain_vpn type ipsec-ra

tunnel-group domain_vpn General-attributes

address domain_vpn_pool pool

Group Policy - by default-domain_vpn

domain_vpn group of tunnel ipsec-attributes

pre-shared-key *.

Telnet 192.168.10.0 255.255.255.0 inside

Telnet timeout 5

Console timeout 0

VPDN group ISP request dialout pppoe

VPDN group ISP localname [email protected] / * /

VPDN group ISP ppp authentication chap

VPDN username [email protected] / * / password *.

dhcpd dns 212.23.3.100 212.23.6.100

dhcpd lease 691200

dhcpd ping_timeout 500

domain.local domain dhcpd

!

dhcpd address 192.168.10.10 - 192.168.10.200 inside

dhcpd allow inside

!

management of 192.168.1.2 - dhcpd address 192.168.1.254

enable dhcpd management

!

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:1234567890987654321

: end

Hello

Seems to me that you are atleast lack the NAT0 configuration for your VPN Client connection.

This configuration is intended to allow the VPN Client to communicate with the local network with their original IP addresses. Although the main reason that this is necessary is to avoid this traffic to the normal rule of dynamic PAT passing this traffic and that traffic is falling for the corresponding time.

You can add an ACL rule to the existing ACL NAT0, you have above and the NAT configuration should go next

Add this

permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0

Hope this helps

Let me know how it goes

-Jouni

Assign ACLs to VPN clients

Similar Questions

Maybe you are looking for