Cannot access remote resources - Cisco VPN Client

I'm having a problem with my Cisco VPN Client. I am new to VPN configuration, so this is probably something easy I'm missing. I have a my internet gateway for my LAN 2611XM router and my VPN server. I do all my tests of a society with a high card laptop mobile broadband. VPN connects, but anytime I ping anything in the network Cabinet, he returned with the public IP address of the external interface. I have NAT overload configured so any network can access the internet, inside which it looks like may be causing my problem. I don't know how to fix it. My config running is attatched. No one knows what might happen.

Oh, almost forgot to add. When I remove the nat overload on my interface fa0/1, the vpn will connect to any resource on the inside.

Your nat configuration seems to be the origin of the problem. If you are using an ACL to match the source for NAT, then it will be necessary to add the line 1A refuse for the local ip pool for your vpn clients to one only. try that to see how it goes.

Sent by Cisco Support technique iPhone App

Tags: Cisco Security

Similar Questions

Cannot access network resources - Cisco VPN client

Please see attached the network topology.

I can connect using the Cisco VPN client and access to all resources of the 192.168.3.0 network

I can't ping / access to all hosts on the network 192.168.5.0.

Any ideas?

Thanks for the help in advance

AD

Quite correct.

Please add has the access list:

CPA list standard access allowed 192.168.5.0 255.255.255.0

Win 7 VPN client cannot access remote resources beyond the VPN server

I have a Win 7 laptop with work and customer Win 7 VPN set up, and through it that I can access everything allowed resources on the remote network.

I built a new computer, set up the Win 7 client with the exact same parameters everywhere, connected to the VPN with success, but can not access any of the resources on the remote network that I can on my laptop.

Win 7 64 bit SP 1

I did research online and suggestions have already had reason of my new set up. In addition, I have a second computer that I've set up the VPN client, and I'm having the same problem. VPN connects successfully, but is unable to access the resources.

Tested with firewall off the coast.

Troubleshooting Diagnostic reports: your computer seems to be configured correctly, distance resources detected, but not answered do not.

I created another VPN client on the new computer to another remote network and everything works perfectly.

Remember the old VPN connection to the remote network that does not work on the new computer works perfectly on Win 7 64 bit laptop computer.

So, what do I find also different between identical configurations "should be" where we work and two new machines is not?

It must be something stupid.

Hello

This question is more suited for a TechNet audience. I suggest you send the query to the Microsoft TechNet forum. See the link below to do so:
https://social.technet.Microsoft.com/forums/Windows/en-us/home?Forum=w7itpronetworking

Please let us know if you have more queries on Windows.

Cannot access remote network via VPN

Hello

I'm trying to set up a router vpn access to my office network. The router is connected to the Internet through using pppoe vdsl.
There is also a public oriented Web server in the office which must be accessible.

I can access the Web server from the Internet and the vpn connects successfully. I can also ping the LAN Gateway, however, I can't access all the local machines.

I'm quite puzzled as to why it does not work. Please could someone help.

The results of tests and the router configuration are listed below. Please let me know if you need additional information.

Thank you and best regards,
Simon

1. routing on the router table
Router #sh ip route
Gateway of last resort is ggg.hhh.125.34 to network 0.0.0.0
xxx.yyy.zzz.0/29 is divided into subnets, subnets 1
C XXX.yyy.zzz.192 is directly connected, Vlan10
GGG.hhh.125.0/32 is divided into subnets, subnets 1
C GGG.HHH.125.34 is directly connected, Dialer0
172.16.0.0/32 is divided into subnets, subnets 1
S 172.16.100.50 [1/0] via mmm.nnn.ppp.sss
S * 0.0.0.0/0 [1/0] via ggg.hhh.125.34

2. ping PC remotely (172.16.100.50) local GW (172.16.100.1) successful
> ping 172.16.100.1
Ping 172.16.100.1 with 32 bytes of data:
Response to 172.16.100.1: bytes = 32 time = 24ms TTL = 255
Response to 172.16.100.1: bytes = 32 time = 10ms TTL = 255
Response to 172.16.100.1: bytes = 32 time = 10ms TTL = 255
Response to 172.16.100.1: bytes = 32 time = 11ms TTL = 255

3. ping PC remotely (172.16.100.50) to the local server (172.16.100.10) failure
> ping 172.16.100.10
Ping 172.16.100.10 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

4. ping the router to the successful local server
router #ping 172.16.100.10
Type to abort escape sequence.
Send 5, echoes ICMP 100 bytes to 172.16.100.10, wait time is 2 seconds:
!!!!!
Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/4 ms

5 see the version
Cisco IOS software, software of C181X (C181X-ADVIPSERVICESK9-M), Version 12.4 (15) T1, VERSION of the SOFTWARE (fc2)
ROM: System Bootstrap, Version 12.3 YH6 (8r), RELEASE SOFTWARE (fc1)
the availability of router is 1 hour, 9 minutes
System image file is "flash: c181x-advipservicesk9 - mz.124 - 15.T1.bin".
Cisco 1812-J (MPC8500) processor (revision 0 x 300) with 118784K / 12288K bytes of memory.
10 FastEthernet interfaces
1 ISDN basic rate interface
Configuration register is 0 x 2102

6. router Config
AAA authentication login default local
connection of local AAA VPN authentication.
AAA authorization exec default local
local authorization AAA VPN network
!
!
AAA - the id of the joint session
!
!
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
Configuration group customer isakmp crypto ASI_Group
key mykey
DNS aaa.bbb.cccc.ddd
domain mydomain.com
pool VPN_Pool
ACL VPN_ACL
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac TS1
!
crypto dynamic-map 10 DYNMAP
game of transformation-TS1
market arriere-route
!
!
list of authentication of VPN client VPN crypto card
card crypto VPN VPN isakmp authorization list
crypto map VPN client configuration address respond
card crypto 10 VPN ipsec-isakmp dynamic DYNMAP
!
!
!
IP cef
!
!
!
Authenticated MultiLink bundle-name Panel
!
!
username admin privilege 15 password mypassword
Archives
The config log
hidekeys
!
!
!
!
!
interface FastEthernet0
WAN description
no ip address
no ip redirection
no ip unreachable
no ip proxy-arp
no ip mroute-cache
automatic duplex
automatic speed
PPPoE enable global group
PPPoE-client dial-pool-number 1
!
interface FastEthernet2
Description Public_LAN_Interface
switchport access vlan 10
full duplex
Speed 100
!
FastEthernet6 interface
Description Private_LAN_Interface
switchport access vlan 100
full duplex
Speed 100
!
interface Vlan1
no ip address
!
interface Vlan10
Public description
IP address xxx.yyy.zzz.193 255.255.255.248
no ip redirection
no ip unreachable
no ip proxy-arp
no ip mroute-cache
!
interface Vlan100
172.16.100.1 IP address 255.255.255.0
no ip redirection
no ip unreachable
no ip proxy-arp
no ip mroute-cache
!
interface Dialer0
IP unnumbered Vlan10
no ip unreachable
IP mtu 1452
IP virtual-reassembly
encapsulation ppp
no ip mroute-cache
Dialer pool 1
Dialer-Group 1
Authentication callin PPP chap Protocol
PPP chap hostname myhostname
PPP chap password mychappassword
PPP ipcp dns request accept
failure to track PPP ipcp
PPP ipcp address accept
VPN crypto card
!
IP pool local VPN_Pool 172.16.100.50 172.16.100.60
!
!
no ip address of the http server
no ip http secure server
!
VPN_ACL extended IP access list
IP 172.16.100.0 allow 0.0.0.255 any
!
Dialer-list 1 ip protocol allow
not run cdp
!
!

Simon,

Basically when you connect through a VPN Client PC routing table is updated automatically as soon as the connection is established. If you do not need to manually add routes. You can check this by doing a "route print" once you are connected.

Ideally, you need to put your pool of VPN on subnet that does not exist on your physical network, the router would be to route traffic between the IP pool and internal subnet.

Now, you said that you have a web server with a public IP address that you need to access through the VPN, that host also as a private IP addresses on the 172.16.100.0? If it isn't then the ACL that I proposed should work. If she only has a public IP then your ACL VPN address must have something like

IP 172.16.100.0 allow 0.0.0.255 192.168.100.0 0.0.0.255

219.xxx.yyy.192 ip 0.0.0.7 permit 192.168.100.0 0.0.0.255

Who says the router and the client to encrypt all traffic between the subnets behind your router and your VPN pool.

I hope this helps.

Luis Raga

Cannot access remote network by VPN Site to Site ASA

Hello everyone

First of all I must say that I have configured the VPN site-to site a million times before. Stuck with it. First of all I can't ping outside the interface of my ASA remote. Secondly, VPN is in place, but no connectivity between local networks

ASA local:
hostname gyd - asa
domain bct.az
activate the encrypted password of XeY1QWHKPK75Y48j
XeY1QWHKPK75Y48j encrypted passwd
names of
DNS-guard
!
interface GigabitEthernet0/0
Shutdown
nameif vpnswc
security-level 0
IP 10.254.17.41 255.255.255.248
!
interface GigabitEthernet0/1
Vpn-turan-Baku description
nameif outside Baku
security-level 0
IP 10.254.17.9 255.255.255.248
!
interface GigabitEthernet0/2
Vpn-ganja description
nameif outside-Ganja
security-level 0
IP 10.254.17.17 255.255.255.248
!
interface GigabitEthernet0/2.30
Description remote access
VLAN 30
nameif remote access
security-level 0
IP 85.*. *. * 255.255.255.0
!
interface GigabitEthernet0/3
Description BCT_Inside
nameif inside-Bct
security-level 100
IP 10.40.50.65 255.255.255.252
!
interface Management0/0
nameif management
security-level 100
IP 192.168.251.1 255.255.255.0
management only
!
boot system Disk0: / asa823 - k8.bin
passive FTP mode
DNS server-group DefaultDNS
name-server 192.168.1.3
domain bct.az
permit same-security-traffic intra-interface
object-group network obj - 192.168.121.0
object-group network obj - 10.40.60.0
object-group network obj - 10.40.50.0
object-group network obj - 192.168.0.0
object-group network obj - 172.26.0.0
object-group network obj - 10.254.17.0
object-group network obj - 192.168.122.0
object-group service obj-tcp-eq-22
object-group network obj - 10.254.17.18
object-group network obj - 10.254.17.10
object-group network obj - 10.254.17.26
access-list 110 scope ip allow a whole
NAT list extended access permit tcp any host 10.254.17.10 eq ssh
NAT list extended access permit tcp any host 10.254.17.26 eq ssh
access-list extended ip allowed any one sheep
icmp_inside list extended access permit icmp any one
icmp_inside of access allowed any ip an extended list
access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh
RDP list extended access permit tcp any host 192.168.45.3 eq 3389
rdp extended permitted any one ip access list
sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0
NAT-vpn-internet access-list extended ip 192.168.121.0 allow 255.255.255.0 any
NAT-vpn-internet access-list extended ip 172.26.0.0 allow 255.255.255.0 any
NAT-vpn-internet access-list extended ip 192.168.122.0 allow 255.255.255.0 any
access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 10.40.60.0 255.255.255.0
access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 10.40.50.0 255.255.255.0
access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 192.168.0.0 255.255.0.0
access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 172.26.0.0 255.255.255.0
access-list sheep-vpn-city scope ip 192.168.121.0 allow 255.255.255.0 10.254.17.0 255.255.255.0
GHC-ganja-internet access-list extended ip 192.168.45.0 allow 255.255.255.0 any
Standard access list Split_Tunnel_List allow 192.168.16.0 255.255.255.0
azans 192.168.69.0 ip extended access-list allow 255.255.255.0 any
permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.121.0 255.255.255.0
permit inside_nat0_outbound to access extended list ip 192.168.0.0 255.255.0.0 192.168.80.0 255.255.255.0
pager lines 24
Enable logging
emblem of logging
recording of debug console
recording of debug trap
asdm of logging of information
Interior-Bct 192.168.1.27 host connection
flow-export destination inside-Bct 192.168.1.27 9996
vpnswc MTU 1500
outside Baku MTU 1500
outside-Ganja MTU 1500
MTU 1500 remote access
Interior-Bct MTU 1500
management of MTU 1500
IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0
IP local pool ssl 192.168.121.130 - 192.168.121.200 mask 255.255.255.0
no failover
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any outside Baku
ICMP allow access remotely
ICMP allow any interior-Bct
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
global (outside-Baku) 1 interface
global (outside-Ganja) interface 2
3 overall (RAS) interface
azans access-list NAT 3 (outside-Ganja)
NAT (remote access) 0 access-list sheep-vpn-city
NAT 3 list nat-vpn-internet access (remote access)
NAT (inside-Bct) 0-list of access inside_nat0_outbound
NAT (inside-Bct) 2-nat-ganja access list
NAT (inside-Bct) 1 access list nat
Access-group rdp on interface outside-Ganja
!
Router eigrp 2008
No Auto-resume
neighbor 10.254.17.10 interface outside Baku
neighbor 10.40.50.66 Interior-Bct interface
Network 10.40.50.64 255.255.255.252
Network 10.250.25.0 255.255.255.0
Network 10.254.17.8 255.255.255.248
Network 10.254.17.16 255.255.255.248
redistribute static
!
Access remote 0.0.0.0 0.0.0.0 85.*. *. * 1
Outside-Baku route 10.0.11.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 10.0.33.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 10.0.150.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 10.0.170.0 255.255.255.0 10.254.17.10 1
Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1
Route outside Baku 10.254.17.32 255.255.255.248 10.254.17.10 1
Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 192.168.27.0 255.255.255.0 10.254.17.10 1
Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1
Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1
Route outside-Ganja 192.168.66.0 255.255.255.0 10.254.17.18 1
Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1
Outside-Baku route 192.168.80.0 255.255.255.0 10.254.17.11 1
Access remote 192.168.121.0 255.255.255.0 85.132.43.1 1
Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1
Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1
Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1
Route inside-Bct 192.168.254.0 255.255.255.0 10.40.50.66 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
AAA-server protocol Ganymede GANYMEDE +.
AAA-server GANYMEDE (Interior-Bct) 192.168.1.8
key *.
AAA-server GANYMEDE (Interior-Bct) 192.168.22.46
key *.
RADIUS protocol AAA-server TACACS1
AAA-server TACACS1 (Interior-Bct) host 192.168.1.8
key *.
AAA-server TACACS1 (Interior-Bct) host 192.168.22.46
key *.
authentication AAA ssh console LOCAL GANYMEDE
Console to enable AAA authentication RADIUS LOCAL
Console Telnet AAA authentication RADIUS LOCAL
AAA accounting ssh console GANYMEDE
Console Telnet accounting AAA GANYMEDE
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.1.0 255.255.255.0 Interior-Bct
http 192.168.139.0 255.255.255.0 Interior-Bct
http 192.168.0.0 255.255.255.0 Interior-Bct
Survey community SNMP-server host inside-Bct 192.168.1.27
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
Crypto ipsec transform-set newset aes - esp esp-md5-hmac
Crypto ipsec transform-set esp-3des esp-sha-hmac myset2
Crypto ipsec transform-set esp-3des esp-md5-hmac raccess
Crypto ipsec transform-set esp-3des esp-sha-hmac vpnclienttrans
Crypto ipsec transform-set vpnclienttrans transport mode
life crypto ipsec security association seconds 2147483646
Crypto ipsec kilobytes of life security-association 2147483646
raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map
correspondence address card crypto mymap 10 110
card crypto mymap 10 peers set 10.254.17.10
card crypto mymap 10 transform-set RIGHT
correspondence address card crypto mymap 20 110
card crypto mymap 20 peers set 10.254.17.11
mymap 20 transform-set myset2 crypto card
card crypto mymap interface outside Baku
correspondence address card crypto ganja 10 110
10 ganja crypto map peer set 10.254.17.18
card crypto ganja 10 transform-set RIGHT
card crypto interface outside-Ganja ganja
correspondence address card crypto vpntest 20 110
peer set card crypto vpntest 20 10.250.25.1
newset vpntest 20 transform-set card crypto
card crypto vpntest interface vpnswc
vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1
card crypto interface for remote access vpnclientmap
Crypto ca trustpoint ASDM_TrustPoint0
registration auto
name of the object CN = gyd - asa .az .bct
sslvpnkeypair key pair
Configure CRL
map of crypto DefaultCertificateMap 10 ca certificate

crypto isakmp identity address
ISAKMP crypto enable vpnswc
ISAKMP crypto enable outside-Baku
ISAKMP crypto enable outside-Ganja
crypto ISAKMP enable remote access
ISAKMP crypto enable Interior-Bct
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 20
preshared authentication
aes encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 40
preshared authentication
aes encryption
sha hash
Group 2
life 86400
Crypto isakmp nat-traversal 30
No vpn-addr-assign aaa
Telnet timeout 5
SSH 192.168.0.0 255.255.255.0 Interior-Bct
SSH timeout 35
Console timeout 0
priority queue outside Baku
queue-limit 2046
TX-ring-limit 254
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
Server NTP 192.168.1.3
SSL encryption, 3des-sha1 rc4 - md5 aes128-sha1 sha1-aes256
SSL-trust point ASDM_TrustPoint0 to vpnlb-ip remote access
SSL-trust ASDM_TrustPoint0 remote access point
WebVPN
turn on remote access
SVC disk0:/anyconnect-win-2.4.1012-k9.pkg 1 image
enable SVC
tunnel-group-list activate
attributes of Group Policy DfltGrpPolicy
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
internal group ssl policy
attributes of group ssl policy
banner welcome to SW value
value of DNS-server 192.168.1.3
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
group-lock value SSL
WebVPN
value of the SPS URL-list
internal vpn group policy
attributes of vpn group policy
value of DNS-server 192.168.1.3
Protocol-tunnel-VPN IPSec l2tp ipsec
disable the PFS
BCT.AZ value by default-field
ssl VPN-group-strategy
WebVPN
value of the SPS URL-list
IPSec-attributes tunnel-group DefaultL2LGroup
ISAKMP retry threshold 20 keepalive 5
attributes global-tunnel-group DefaultRAGroup
raccess address pool
Group-RADIUS authentication server
Group Policy - by default-vpn
IPSec-attributes tunnel-group DefaultRAGroup
pre-shared key *.
ISAKMP retry threshold 20 keepalive 5
IPSec-attributes tunnel-group DefaultWEBVPNGroup
ISAKMP retry threshold 20 keepalive 5
tunnel-group 10.254.17.10 type ipsec-l2l
IPSec-attributes tunnel-group 10.254.17.10
pre-shared key *.
ISAKMP retry threshold 20 keepalive 5
type SSL tunnel-group remote access
attributes global-group-tunnel SSL
ssl address pool
Authentication (remote access) LOCAL servers group
Group Policy - by default-ssl
certificate-use-set-name username
Group-tunnel SSL webvpn-attributes
enable SSL group-alias
Group-url https://85. *. *. * / activate
tunnel-group 10.254.17.18 type ipsec-l2l
IPSec-attributes tunnel-group 10.254.17.18
pre-shared key *.
ISAKMP retry threshold 20 keepalive 5
tunnel-group 10.254.17.11 type ipsec-l2l
IPSec-attributes tunnel-group 10.254.17.11
pre-shared key *.
ISAKMP retry threshold 20 keepalive 5
type tunnel-group DefaultSWITGroup remote access
attributes global-tunnel-group DefaultSWITGroup
raccess address pool
Group-RADIUS authentication server
Group Policy - by default-vpn
IPSec-attributes tunnel-group DefaultSWITGroup
pre-shared key *.
!
type of policy-card inspect dns migrated_dns_map_1
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the migrated_dns_map_1 dns
inspect the rsh
inspect the rtsp
inspect sqlnet
inspect sunrpc
inspect xdmcp
inspect the netbios
Review the ip options
class flow_export_cl
flow-export-type of event all the destination 192.168.1.27
class class by default
flow-export-type of event all the destination 192.168.1.27
Policy-map Voicepolicy
class voice
priority
The class data
police release 80000000
!
global service-policy global_policy
service-policy interface outside Baku Voicepolicy
context of prompt hostname

Cryptochecksum:4f35f975ba7a0c11f7f46dfd541d266f
: end
GYD - asa #.

ASA remote:
ASA Version 8.2 (3)
!
ciscoasa hostname
activate the encrypted password of XeY1QWHKPK75Y48j
2KFQnbNIdI.2KYOU encrypted passwd
names of
DNS-guard
!
interface Ethernet0/0
nameif inside
security-level 100
IP 192.168.80.14 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
IP 10.254.17.11 255.255.255.248
!
interface Ethernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
Shutdown
nameif management
security-level 100
no ip address
management only
!
boot system Disk0: / asa823 - k8.bin
passive FTP mode
access-list 110 scope ip allow a whole
192.168.80.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.0.0 255.255.0.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
management of MTU 1500
Within 1500 MTU
no failover
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow all outside
ICMP allow any inside
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
NAT (inside) 0 access-list sheep
Route outside 0.0.0.0 0.0.0.0 10.254.17.9 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.80.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
Crypto ipsec transform-set newset aes - esp esp-md5-hmac
Crypto ipsec transform-set esp-3des esp-sha-hmac myset2
life crypto ipsec security association seconds 2147483646
Crypto ipsec kilobytes of life security-association 2147483646
correspondence address card crypto mymap 10 110
card crypto mymap 10 peers set 10.254.17.9
mymap 10 transform-set myset2 crypto card
mymap outside crypto map interface
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 20
preshared authentication
aes encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 40
preshared authentication
aes encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH timeout 5
Console timeout 0
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN

tunnel-group 10.254.17.9 type ipsec-l2l
IPSec-attributes tunnel-group 10.254.17.9
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns migrated_dns_map_1
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the migrated_dns_map_1 dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
context of prompt hostname

Cryptochecksum:1c1ac60e2fb84f65269d15d53f27c21b
: end
ciscoasa # $

Still, I can't ping ASA remote outside from outside of the Local interface. And there is no connectivity between the 192.168.80.0 distance and local don't say 192.168.1.0. I have run out of ideas

Would appreciate any help. Thank you in advance...

If the tunnel is up (phase 1), but no traffic passing the best test is the following:

Add order management-access to the Interior , and then try to PING the intellectual property inside ASA counterpart.

inside x.x.x.x ping --> x.x.x.x is the IP of the ASA peer inside

The test above shows if the traffic passes through the tunnel (check encrypted/decrypted packets of sh cry ips its).

Test on both directions.

Please post the results.

Federico.

Another problem with the configuration of Cisco VPN Client access VPN Site2site

We have a Cisco ASA 5505 at our CORP. branch I configured the VPN Site2Site to our COLO with a Juniper SRX220h, to another site works well, but when users access the home Cisco VPN client, they cannot ping or SSH through the Site2Site. JTACS contacted and they said it is not on their end, so I tried to contact Cisco TAC, no support. So here I am today, after for the 3 days (including Friday of last week) of searching the Internet for more than 6 hours per day and try different examples of other users. NO LUCK. The VPN client shows the route secure 10.1.0.0

Sorry to post this, but I'm frustrated and boss breathing down my neck to complete it.

CORP netowrk 192.168.1.0

IP VPN 192.168.12.0 pool

Colo 10.1.0.0 internal ip address

Also, here's an example of my config ASA

: Saved

:

ASA Version 8.2 (1)

!

hostname lwchsasa

names of

name 10.1.0.1 colo

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

!

interface Vlan2

backup interface Vlan12

nameif outside_pri

security-level 0

IP 64.20.30.170 255.255.255.248

!

interface Vlan12

nameif backup

security-level 0

IP 173.165.159.241 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

switchport access vlan 12

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

object-group network NY

object-network 192.168.100.0 255.255.255.0

BSRO-3387 tcp service object-group

port-object eq 3387

BSRO-3388 tcp service object-group

port-object eq 3388

BSRO-3389 tcp service object-group

EQ port 3389 object

object-group service tcp OpenAtrium

port-object eq 8100

object-group service Proxy tcp

port-object eq 982

VOIP10K - 20K udp service object-group

10000 20000 object-port Beach

the clientvpn object-group network

object-network 192.168.12.0 255.255.255.0

APEX-SSL tcp service object-group

Description of Apex Dashboard Service

port-object eq 8586

object-group network CHS-Colo

object-network 10.1.0.0 255.255.255.0

the DM_INLINE_NETWORK_1 object-group network

object-network 192.168.1.0 255.255.255.0

host of the object-Network 64.20.30.170

object-group service DM_INLINE_SERVICE_1

the purpose of the ip service

ICMP service object

service-object icmp traceroute

the purpose of the service tcp - udp eq www

the tcp eq ftp service object

the purpose of the tcp eq ftp service - data

the eq sqlnet tcp service object

EQ-ssh tcp service object

the purpose of the service udp eq www

the eq tftp udp service object

object-group service DM_INLINE_SERVICE_2

the purpose of the ip service

ICMP service object

EQ-ssh tcp service object

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 clientvpn object-group

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo

inside_nat0_outbound list of allowed ip extended access any 192.168.12.0 255.255.255.0

outside_pri_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY

outside_pri_access_in list extended access permit tcp any interface outside_pri eq www

outside_pri_access_in list extended access permit tcp any outside_pri eq https interface

outside_pri_access_in list extended access permit tcp any interface outside_pri eq 8100

outside_pri_access_in list extended access permit tcp any outside_pri eq idle ssh interface

outside_pri_access_in list extended access permit icmp any any echo response

outside_pri_access_in list extended access permit icmp any any source-quench

outside_pri_access_in list extended access allow all unreachable icmp

outside_pri_access_in list extended access permit icmp any one time exceed

outside_pri_access_in list extended access permit tcp any 64.20.30.168 255.255.255.248 eq 8586

levelwingVPN_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0

levelwingVPN_splitTunnelAcl list standard access allowed 10.1.0.0 255.255.255.0

outside_pri_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo

backup_nat0_outbound list extended access allowed object-group DM_INLINE_NETWORK_1 192.168.12.0 ip 255.255.255.0

outside_pri_cryptomap_1 list extended access allow DM_INLINE_SERVICE_2 of object-group 192.168.1.0 255.255.255.0 10.1.0.0 255.255.255.0

outside_19_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0

inside_nat0_outbound_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo

VPN-Corp-Colo extended access list permits object-group DM_INLINE_SERVICE_1 192.168.12.0 255.255.255.0 10.1.0.0 255.255.255.0

Note to OUTSIDE-NAT0 NAT0 customer VPN remote site access-list

OUTSIDE-NAT0 192.168.12.0 ip extended access list allow 255.255.255.0 10.1.0.0 255.255.255.0

L2LVPN to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0

pager lines 24

Enable logging

debug logging in buffered memory

exploitation forest asdm warnings

record of the rate-limit unlimited level 4

destination of exports flow inside 192.168.1.1 2055

timeout-rate flow-export model 1

Within 1500 MTU

outside_pri MTU 1500

backup of MTU 1500

local pool LVCHSVPN 192.168.12.100 - 192.168.12.254 255.255.255.0 IP mask

no failover

ICMP unreachable rate-limit 100 burst-size 5

ICMP allow any inside

ICMP allow any outside_pri

don't allow no asdm history

ARP timeout 14400

NAT-control

interface of global (outside_pri) 1

Global 1 interface (backup)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (outside_pri) 0-list of access OUTSIDE-NAT0

backup_nat0_outbound (backup) NAT 0 access list

static TCP (inside outside_pri) interface https 192.168.1.45 https netmask 255.255.255.255 dns

static TCP (inside outside_pri) interface 192.168.1.45 www www netmask 255.255.255.255 dns

static TCP (inside outside_pri) interface 8586 192.168.1.45 8586 netmask 255.255.255.255 dns

static (inside, inside) tcp interface 8100 192.168.1.45 8100 netmask 255.255.255.255 dns

Access-group outside_pri_access_in in the outside_pri interface

Route 0.0.0.0 outside_pri 0.0.0.0 64.20.30.169 1 track 1

Backup route 0.0.0.0 0.0.0.0 173.165.159.246 254

Timeout xlate 03:00

Conn Timeout 0:00:00 half-closed 0:30:00 udp icmp from 01:00 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 01:00 uauth uauth absolute inactivity from 01:00

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

AAA authentication enable LOCAL console

AAA authentication http LOCAL console

the ssh LOCAL console AAA authentication

http server enable 981

http 192.168.1.0 255.255.255.0 inside

http 0.0.0.0 0.0.0.0 outside_pri

http 0.0.0.0 0.0.0.0 backup

SNMP server group Authentication_Only v3 auth

SNMP-server host inside 192.168.1.47 survey community lwmedia version 2 c

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Sysopt connection tcpmss 1200

monitor SLA 123

type echo protocol ipIcmpEcho 216.59.44.220 interface outside_pri

Annex ALS life monitor 123 to always start-time now

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set esp-3des-sha1 esp-3des esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto ipsec df - bit clear-df outside_pri

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

card crypto outside_pri_map 1 match address outside_pri_1_cryptomap

card crypto outside_pri_map 1 set pfs

peer set card crypto outside_pri_map 1 50.75.217.246

card crypto outside_pri_map 1 set of transformation-ESP-AES-256-MD5

card crypto outside_pri_map 2 match address outside_pri_cryptomap

peer set card crypto outside_pri_map 2 216.59.44.220

card crypto outside_pri_map 2 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

86400 seconds, duration of life card crypto outside_pri_map 2 set security-association

card crypto outside_pri_map 3 match address outside_pri_cryptomap_1

peer set card crypto outside_pri_map 3 216.59.44.220

outside_pri_map crypto map 3 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_pri_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

card crypto outside_pri_map interface outside_pri

crypto isakmp identity address

ISAKMP crypto enable outside_pri

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 10

preshared authentication

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 50

preshared authentication

aes encryption

md5 hash

Group 2

life 86400

!

track 1 rtr 123 accessibility

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH timeout 5

Console timeout 0

management-access inside

dhcpd auto_config outside_pri

!

dhcpd address 192.168.1.51 - 192.168.1.245 inside

dhcpd dns 8.8.8.8 8.8.4.4 interface inside

rental contract interface 86400 dhcpd inside

dhcpd field LM inside interface

dhcpd allow inside

!

a basic threat threat detection

statistical threat detection port

Statistical threat detection Protocol

Statistics-list of access threat detection

a statistical threat detection host number rate 2

no statistical threat detection tcp-interception

WebVPN

port 980

allow inside

Select outside_pri

enable SVC

attributes of Group Policy DfltGrpPolicy

VPN-idle-timeout no

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

internal GroupPolicy2 group strategy

attributes of Group Policy GroupPolicy2

Protocol-tunnel-VPN IPSec svc

internal levelwingVPN group policy

attributes of the strategy of group levelwingVPN

Protocol-tunnel-VPN IPSec svc webvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list levelwingVPN_splitTunnelAcl

username password encrypted Z74.JN3DGMNlP0H2 privilege 0 aard

aard attribute username

VPN-group-policy levelwingVPN

type of remote access service

rcossentino 4UpCXRA6T2ysRRdE encrypted password username

username rcossentino attributes

VPN-group-policy levelwingVPN

type of remote access service

bcherok evwBWqKKwrlABAUp encrypted password username

username bcherok attributes

VPN-group-policy levelwingVPN

type of remote access service

rscott nIOnWcZCACUWjgaP encrypted password privilege 0 username

rscott username attributes

VPN-group-policy levelwingVPN

sryan 47u/nJvfm6kprQDs password encrypted username

sryan username attributes

VPN-group-policy levelwingVPN

type of nas-prompt service

username, password cbruch a8R5NwL5Cz/LFzRm encrypted privilege 0

username cbruch attributes

VPN-group-policy levelwingVPN

type of remote access service

apellegrino yy2aM21dV/11h7fR password encrypted username

username apellegrino attributes

VPN-group-policy levelwingVPN

type of remote access service

username rtuttle encrypted password privilege 0 79ROD7fRw5C4.l5

username rtuttle attributes

VPN-group-policy levelwingVPN

username privilege 15 encrypted password vJFHerTwBy8dRiyW levelwingadmin

username password nbrothers Amjc/rm5PYhoysB5 encrypted privilege 0

username nbrothers attributes

VPN-group-policy levelwingVPN

clong z.yb0Oc09oP3/mXV encrypted password username

clong attributes username

VPN-group-policy levelwingVPN

type of remote access service

username, password finance 9TxE6jWN/Di4eZ8w encrypted privilege 0

username attributes finance

VPN-group-policy levelwingVPN

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

type of remote access service

IPSec-attributes tunnel-group DefaultL2LGroup

Disable ISAKMP keepalive

tunnel-group 50.75.217.246 type ipsec-l2l

IPSec-attributes tunnel-group 50.75.217.246

pre-shared-key *.

Disable ISAKMP keepalive

type tunnel-group levelwingVPN remote access

tunnel-group levelwingVPN General-attributes

address LVCHSVPN pool

Group Policy - by default-levelwingVPN

levelwingVPN group of tunnel ipsec-attributes

pre-shared-key *.

tunnel-group 216.59.44.221 type ipsec-l2l

IPSec-attributes tunnel-group 216.59.44.221

pre-shared-key *.

tunnel-group 216.59.44.220 type ipsec-l2l

IPSec-attributes tunnel-group 216.59.44.220

pre-shared-key *.

Disable ISAKMP keepalive

!

!

!

Policy-map global_policy

!

context of prompt hostname

Cryptochecksum:ed7f4451c98151b759d24a7d4387935b

: end

Hello

It seems to me that you've covered most of the things.

You however not "said" Configuring VPN L2L that traffic between the pool of VPN and network camp should be in tunnel

outside_pri_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 object-group CHS-Colo

Although naturally the remote end must also the corresponding configurations for users of VPN clients be able to pass traffic to the site of the camp.

-Jouni

Unable to connect using the Cisco VPN client

Hi all. I recently configured a 5510 ASA to allow remote access using the Cisco VPN client. The problem is that everything works fine when I connect using a modem classic or on a computer with a public address that I use for testing purposes, but whenever I try to connect with on an ADSL line, I can't access to the resources. I have connection and after that nothing, I can not achieve anything.

I enclose the relevant configuration information in the attachment. Any help is welcome.

Depending on the version, add...

ISAKMP nat-traversal

or

ISAKMP nat-traversal crypto

Should be all you need.

VPN clients cannot access remote sites - PIX, routing problem?

I have a problem with routing to remote from our company websites when users connect via their VPN client remotely (i.e. for home workers)

Our headquarters contains a PIX 515E firewall. A number of remote sites to connect (via ADSL) to head office using IPSEC tunnels, ending the PIX.

Behind the PIX is a router 7206 with connections to the seat of LANs and connections to a number of ISDN connected remote sites. The default route on 7206 points to the PIX from traffic firewall which sits to ADSL connected remote sites through the PIX. Internal traffic for LAN and ISDN connected sites is done via the 7206.

Very good and works very well.

When a user connects remotely using their VPN client (connection is interrupted on the PIX) so that they get an IP address from the pool configured on the PIX and they can access resources located on local networks to the office with no problems.

However, the problem arises when a remote user wants access to a server located in one of the remote sites ADSL connected - it is impossible to access all these sites.

On the remote site routers, I configured the access lists to allow access from the pool of IP addresses used by the PIX. But it made no difference. I think that the problem may be the routes configured on the PIX itself, but I don't know what is necessary to solve this problem.

Does anyone have suggestions on what needs to be done to allow access to remote sites for users connected remotely via VPN?

(Note: I suggested a workaround, users can use a server on LAN headquarters as a "jump point" to connect to remote servers from there)

with pix v6, no traffic is allowed to redirect to the same interface.

for example, a remote user initiates an rdp session for one of the barns adsl. PIX decrypts the packet coming from the external interface and looks at the destination. because the destination is one of adsl sites, pix will have to return traffic to the external interface. Unfortunately, pix v6.x has a limitation that would force the pix to drop the packet.

with the v7, this restriction has been removed with the "same-security-traffic control intra-interface permits".

http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

Cisco VPN Client anything cannot access through VPN on an ASA5505 8.4

Hello

Completely new to Cisco ASA and the need to get this working ASAP.

8.4 (1) ASA 5505 is the secondary FW and I need to authorize all out and block everything coming, but for the VPN clients. Since a jerk of Cisco, I used the ASDM and it's sorcerers to make this work, which may explain my situation.

192.168.101.0/24 is the local network

192.168.101.5 is the IP of ASA

192.168.101.2 is the primary FW (and the default gateway for servers, I have to access through the VPN)

10.10.101.0/24 is the VPN IP range (this can be what you want, I'm not married to it somehow)

My Cisco VPN Client connects to the ASA and receives 10.10.101.1 IP address, but I get no connectivity to the ASA or any other 192.168.101.x or service server (tried RDP, telnet, ping, etc.)

Configuration file is attached.

Help pretty please!

Thank you.

Did you add a route for the VPN Pool on the main firewall to the ASA?

Best regards

Peer

Sent by Cisco Support technique iPad App

AnyConnect VPN users cannot access remote subnets?

I googled this until blue in the face without result. I don't understand why Cisco this so difficult? When clients connect to the anyconnect vpn, they can access the local subnet, but cannot access the resources in remote offices. What should I do to allow my anyconnect vpn clients access to my remote sites?

Cisco 5510 8.4

Hello

What are remote sites using as Internet gateway? Their default route here leads to the ASA or have their own Internet gateway? If they use this ASA for their Internet connection while they should already have a default route that leads traffic to the VPN to the pool, even if they had no specific route for the VPN itself pool. If they use their own local Internet gateway and the default route is not directed to this ASA then you would naturally have a route on the remote site (and anything in between) indicating the remote site where to join the pool of 10.10.224.0/24 VPN network.

In addition to routing, you must have configured for each remote site and the VPN pool NAT0

Just a simple example of NAT0 configuration for 4 networks behind the ASA and simple VPN field might look like this

object-group network to REMOTE SITES

object-network 10.10.10.0 255.255.255.0

object-network 10.10.20.0 255.255.255.0

object-network 10.10.30.0 255.255.255.0

object-network 10.10.40.0 255.255.255.0

network of the VPN-POOL object

10.10.224.0 subnet 255.255.255.0

NAT static destination DISTANCE-SITES SITES source (indoor, outdoor) REMOTE static VPN-VPN-POOL

The above of course assumes that the remote site are located behind the interface 'inside' (although some networks, MPLS) and naturally also the remote site networks are made for the sake of examples.

Since you are using Full Tunnel VPN should be no problem to the user VPN transfer traffic to this ASA in question.

My first things to check would be configuring NAT0 on the ASA and routing between remote sites and this ASA (regarding to reach the VPN pool, not the ASA network IP address)

Are you sure that the configuration above is related to this? Its my understanding that AnyConnect uses only IKEv2 and the foregoing is strictly defined for IKEv1?

-Jouni

Urgent! Users of remote access VPN connects but cannot access remote LAN (ping, folder,...)

Hello

I am setting up a VPN on a Cisco ASA 5510 version 8.4 remote access (4) 1.

When I try to connect via the Cisco VPN client software, I am able to connect however I am unable to access network resources.

However, I can ping the servers in the other site that is connected through the VPN site-to site to the main site!

VPN client--> main site (ping times on)--> Site connected with the main site with VPN S2S (successful ping)

Please help me I need to find a solution as soon as POSSIBLE!

Thank you in advance.

Hello

Please remove the NAT exemption and the re - issue the command but with #1, so it will place the NAT as first line:

No nat (SERVERS, external) static source SERVERS_LAN SERVERS_LAN NETWORK_OBJ_10.10.40.8_29 NETWORK_OBJ_10.10.40.8_29 non-proxy-arp-search of route static destination

NAT (SERVERS, external) 1 static source SERVERS_LAN SERVERS_LAN NETWORK_OBJ_10.10.40.8_29 NETWORK_OBJ_10.10.40.8_29 non-proxy-arp-search of route static destination

After re-configured this way, make sure that this command is also available:

Sysopt connection permit VPN

This sysopt will allow traffic regardles any ACL a fall, just in case. Please continue to run a package tracer and post it here,

Packet-trace entry Server icmp XXXXXX 8 0 detailed YYYYY

XXXX--> server IP

AAAA--> VPN IP of the user

Don't forget to do the two steps and a just in case, capture Please note and mark it as correct the useful message!

Thank you

David Castro,

[SOLVED] Native Iphone4s Cisco VPN client cannot establish the tunnel (victory clients do)

Hello

IPhone 4 s last IOS5 V 5.1.1 installed

I'm not able to make the native IPSEC VPN connection upset my company Cisco 877

Instead, all my computer laptop and netbook with Cisco VPN Client work installed fine when they connect remotely to society 877

Turn debugging 877, it seems Iphone successfully passes the 1 connection ike (actually Iphone wonder phase2 user/pass), but it hung to phase2 give me the error 'Negotiation with the VPN server has no' back

An idea or a known issue on this?

This is how I configured my VPN 877 part:

R1 (config) # aaa new-model

R1 (config) # aaa authentication default local connection

R1 (config) # aaa authentication login vpn_xauth_ml_1 local

R1 (config) # aaa authentication login local sslvpn

R1 (config) # aaa authorization network vpn_group_ml_1 local

R1 (config) # aaa - the id of the joint session

Crypto isakmp policy of R1 (config) # 1

R1(config-ISAKMP) # BA 3des

# Preshared authentication R1(config-ISAKMP)

Group R1(config-ISAKMP) # 2

R1(config-ISAKMP) #.

R1(config-ISAKMP) #crypto isakmp policy 2

R1(config-ISAKMP) # BA 3des

Md5 hash of R1(config-ISAKMP) #.

# Preshared authentication R1(config-ISAKMP)

Group R1(config-ISAKMP) # 2

Output R1(config-ISAKMP) #.

R1 (config) # CUSTOMER - VPN crypto isakmp client configuration group

R1(config-ISAKMP-Group) # key xxxxxxxx

R1(config-ISAKMP-Group) # 192.168.0.1 dns

R1(config-ISAKMP-Group) # VPN - pool

ACL R1(config-ISAKMP-Group) # 120

R1(config-ISAKMP-Group) max-users # 5

Output R1(config-ISAKMP-Group) #.

R1 (config) # ip local pool VPN-pool 192.168.0.20 192.168.0.25

R1 (config) # crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac

R1 (config) # crypto ipsec VPN-profile-1 profile

R1(IPSec-Profile) # set the transform-set encrypt method 1

Tunnel type interface virtual-Template2 R1 (config) #.

R1(Config-if) # ip unnumbered FastEthernet0/0

R1(Config-if) # tunnel mode ipsec ipv4

Ipsec protection tunnel R1(Config-if) # VPN - profile - 1 profile

Profile of R1 (config) # isakmp crypto vpn-ike-profile-1

R1(conf-ISA-Prof) # match group identity CUSTOMER VPN

R1(conf-ISA-Prof) # vpn_xauth_ml_1 list client authentication

R1(conf-ISA-Prof) # isakmp authorization list vpn_group_ml_1

R1(conf-ISA-Prof) # client configuration address respond

R1(conf-ISA-Prof) virtual-model # 2

Then run AccessList 120 for desired traffic ("access-list 120 now allows ip any any")

I have configured my VPN Cisco "CUSTOMER-VPN" clients and relative password

Whenever they connect, they are prompted for the password and username phase2 then they join the VPN with an IP address from local subnet released.

With the same parameters required and confirmed in section ipsec VPN Iphone it does not work.

It's 877 isakmp debug output after that Iphone wonder name of user and password (then I suppose that phase 1 completed):

* 14:29:30.731 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport CONF_XAUTH

* 14:29:30.735 May 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID =-1427983983

* 14:29:30.735 May 19: ISAKMP: Config payload RESPONSE

* 14:29:30.735 May 19: ISAKMP/xauth: response XAUTH_USER_NAME_V2 attribute

* 14:29:30.735 May 19: ISAKMP/xauth: response XAUTH_USER_PASSWORD_V2 attribute

* 14:29:30.735 May 19: ISAKMP: (2081): node-1427983983 error suppression FALSE reason "made with Exchange of request/response xauth.

* 14:29:30.735 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_REPLY

* 14:29:30.735 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_REQ_SENT = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT

* 14:29:30.743 May 19: ISAKMP: node set 1322685842 to CONF_XAUTH

* 19 May 14:29:30.747: ISAKMP: (2081): launch peer 151.38.197.143 config. ID = 1322685842

* 19 May 14:29:30.747: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) CONF_XAUTH

* 14:29:30.747 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.

* 14:29:30.747 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN

* 14:29:30.747 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_AAA_CONT_LOGIN_AWAIT = IKE_XAUTH_SET_SENT

* 14:29:31.299 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport CONF_XAUTH

* 14:29:31.299 May 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID = 1322685842

* 14:29:31.299 May 19: ISAKMP: Config payload ACK

* 19 May 14:29:31.303: ISAKMP: (2081): XAUTH ACK processed

* 14:29:31.303 May 19: ISAKMP: (2081): error suppression node 1322685842 FALSE basis "Mode of Transaction.

* 14:29:31.303 May 19: ISAKMP: (2081): talking to a customer of the unit

* 14:29:31.303 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_ACK

* 14:29:31.303 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_SET_SENT = IKE_P1_COMPLETE

* 14:29:31.303 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

* 14:29:31.303 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

* 19 May 14:29:31.303: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

* 14:29:31.315 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

* 14:29:31.315 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

* 14:29:31.623 may 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport QM_IDLE

* 14:29:31.623 may 19: ISAKMP: node set-851463821 to QM_IDLE

* 14:29:31.623 may 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID =-851463821

* 14:29:31.623 may 19: ISAKMP: Config payload REQUEST

* 14:29:31.623 may 19: ISAKMP: (2081): verification of claim:

* 14:29:31.623 may 19: ISAKMP: IP4_ADDRESS

* 14:29:31.623 may 19: ISAKMP: IP4_NETMASK

* 14:29:31.623 may 19: ISAKMP: IP4_DNS

* 14:29:31.623 may 19: ISAKMP: IP4_NBNS

* 14:29:31.623 may 19: ISAKMP: ADDRESS_EXPIRY

* 14:29:31.623 may 19: ISAKMP: APPLICATION_VERSION

* 14:29:31.623 may 19: ISAKMP: MODECFG_BANNER

* 14:29:31.623 may 19: ISAKMP: domaine_par_defaut

* 14:29:31.623 may 19: ISAKMP: SPLIT_DNS

* 14:29:31.623 may 19: ISAKMP: SPLIT_INCLUDE

* 14:29:31.623 may 19: ISAKMP: INCLUDE_LOCAL_LAN

* 14:29:31.623 may 19: ISAKMP: PFS

* 14:29:31.623 may 19: ISAKMP: MODECFG_SAVEPWD

* 14:29:31.623 may 19: ISAKMP: FW_RECORD

* 14:29:31.623 may 19: ISAKMP: serveur_sauvegarde

* 14:29:31.623 may 19: ISAKMP: MODECFG_BROWSER_PROXY

* 14:29:31.627 May 19: ISAKMP/author: author asks for CUSTOMER-VPNsuccessfully group AAA

* 14:29:31.627 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST

* 14:29:31.627 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_CONFIG_AUTHOR_AAA_AWAIT

* 14:29:31.627 May 19: ISAKMP: (2081): attributes sent in the message:

* 19 May 14:29:31.627: address: 0.2.0.0

* 19 May 14:29:31.627: ISAKMP: (2081):address of 192.168.0.21 assignment

* 14:29:31.627 May 19: ISAKMP: sending private address: 192.168.0.21

* 14:29:31.627 May 19: ISAKMP: send the subnet mask: 255.255.255.0

* 14:29:31.631 May 19: ISAKMP: sending IP4_DNS server address: 192.168.0.1

* 14:29:31.631 May 19: ISAKMP: sending ADDRESS_EXPIRY seconds left to use the address: 3576

* 14:29:31.631 May 19: ISAKMP: string APPLICATION_VERSION sending: Cisco IOS software, software C870 (C870-ADVIPSERVICESK9-M), Version 12.4 (15) T7, VERSION of the SOFTWARE (fc3)

Technical support: http://www.cisco.com/techsupport

Copyright (c) 1986-2008 by Cisco Systems, Inc.

Updated Friday 14 August 08 07:43 by prod_rel_team

* 14:29:31.631 May 19: ISAKMP: split shipment include the name Protocol 120 network 0.0.0.0 mask 0.0.0.0 0 src port 0, port 0 DST

* 14:29:31.631 May 19: ISAKMP: sending save the password answer value 0

* 19 May 14:29:31.631: ISAKMP: (2081): respond to peer 151.38.197.143 config. ID =-851463821

* 19 May 14:29:31.631: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) CONF_ADDR

* 14:29:31.631 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.

* 14:29:31.631 May 19: ISAKMP: (2081): node-851463821 error suppression FALSE reason "error no.".

* 14:29:31.631 May 19: ISAKMP: (2081): talking to a customer of the unit

* 14:29:31.631 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_AAA, IKE_AAA_GROUP_ATTR

* 14:29:31.631 May 19: ISAKMP: (2081): former State = new State IKE_CONFIG_AUTHOR_AAA_AWAIT = IKE_P1_COMPLETE

* 14:29:31.635 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE

* 14:29:31.635 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE

Here the Iphone remains unused for a few seconds...

* 14:29:48.391 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport QM_IDLE

* 14:29:48.391 May 19: ISAKMP: node set 1834509506 to QM_IDLE

* 19 May 14:29:48.391: ISAKMP: (2081): HASH payload processing. Message ID = 1834509506

* 19 May 14:29:48.391: ISAKMP: (2081): treatment of payload to DELETE. Message ID = 1834509506

* 14:29:48.391 May 19: ISAKMP: (2081): peer does not paranoid KeepAlive.

* 14:29:48.395 May 19: ISAKMP: (2081): peer does not paranoid KeepAlive.

* 14:29:48.395 May 19: ISAKMP: (2081): removal of HIS right State 'No reason' (R) QM_IDLE (post 151.38.197.143)

* 14:29:48.395 May 19: ISAKMP: (2081): error suppression node 1834509506 FALSE reason 'informational (en) State 1.

* 19 May 14:29:48.395: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

* 19 May 14:29:48.395: IPSEC (key_engine_delete_sas): rec would notify of ISAKMP

* 19 May 14:29:48.395: IPSEC (key_engine_delete_sas): remove all SAs shared with peer 151.38.197.143

* 14:29:48.395 May 19: ISAKMP: node set-1711408233 to QM_IDLE

* 19 May 14:29:48.395: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) QM_IDLE

* 14:29:48.395 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.

* 14:29:48.399 May 19: ISAKMP: (2081): purge the node-1711408233

* 14:29:48.399 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

* 14:29:48.399 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA

* 14:29:48.399 May 19: ISAKMP: (2081): removal of HIS right State 'No reason' (R) QM_IDLE (post 151.38.197.143)

* 14:29:48.399 May 19: ISAKMP: (0): cannot decrement IKE Call Admission Control incoming_active stat because he's already 0.

* 14:29:48.399 May 19: ISAKMP (0:2081): return address 192.168.0.21 to pool

* 14:29:48.399 May 19: ISAKMP: Unlocking counterpart struct 0 x 84084990 for isadb_mark_sa_deleted(), count 0

* 14:29:48.399 May 19: ISAKMP: return address 192.168.0.21 to pool

* 14:29:48.399 May 19: ISAKMP: delete peer node by peer_reap for 151.38.197.143: 84084990

* 14:29:48.399 May 19: ISAKMP: return address 192.168.0.21 to pool

* 14:29:48.403 May 19: ISAKMP: (2081): node-1427983983 error suppression FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): error suppression node 1322685842 FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): node-851463821 error suppression FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): error suppression node 1834509506 FALSE reason 'IKE deleted.

* 14:29:48.403 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

* 14:29:48.403 May 19: ISAKMP: (2081): former State = new State IKE_DEST_SA = IKE_DEST_SA

* 19 May 14:29:48.403: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)

It seems 877 comes even to assign a local ip address of LAN for Iphone (192.168.0.21) but then something goes wrong...

Any idea or suggestion on this?

Thank you very much

Hi Federico,.

Please let us know.

Please mark this message as answered while others will be able to learn the lessons.

Thank you.

Portu.

Cisco vpn client 5.0.07 no internet access

I am trying to configure access remote vpn for the ASA 5505 in my office.

The config is configured on my ASA, and I have cisco vpn client 5.0.07 installed on my laptop (64 bit) to Windows 7. I can start the vpn, put in my references and it seems that everything goes through, but once I'm connected, I lose access to the internet, and I cannot ping anything (4.2.2.2, 192.168.1.1 (gateway), etc...)

I keep seeing something uncheck the "use default gateway on remote network", but this option is available in the TCP/IP properties. Any suggestions?

Eric,

This should be the last change. Looks like you don't have inside the network split tunnel.

Here is the entry you need to do

TunnelSplit1 list standard access allowed 192.168.1.0 255.255.255.0

disconnect and reconnect. It should work like a charm.

Thank you

Bad Boy

How to allow access to a local area network behind the cisco vpn client

Hi, my question is about how to allow access to a local area network behind the cisco vpn client

With the help of:
- Cisco 5500 Series Adaptive Security Appliance (ASA) that is running version 8.2 software
- Cisco VPN Client version 5.0 software
Cisco VPN client allows to inject a local routes in the routing table Cisco ASA?

Thank you.

Hi Vladimir,.

Unfortunately this is not a supported feature if you connect through the VPN Client. With VPN Client, that the VPN Client can access the VPN Client LAN host/local machine, not host from the local network to business as customer VPN is not designed for access from the local company network, but to the local corporate network.

If you want to access from your local business to your LAN network, you need to configure LAN-to-LAN tunnel.

Cisco vpn client to connect but can not access to the internal network

Hi all

I have a VPN configured on cisco 5540. My vpn was working fine, but suddenly there is a question that the cisco vpn client to connect but can not access to the internal network

Any help would be much appreciated.

Hi Samir,

I suggest that you go to the ASA and check the configuration to make sure that it complies with the requirements according to the reference below link:

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

(The link above includes split tunneling, but this is just an option.

Please paste the output of "sh cry ipsec his" here so that we can check if phase 2 is properly trained. I would say as you go to IPSEC vpn client on your PC and check increment in packets sent and received in the window 'status '.

Let me know if this can help,

See you soon,.

Christian V

Cannot access remote resources - Cisco VPN Client

Similar Questions

Maybe you are looking for