cannot ping between remote vpn site?

Similar Questions

• Cannot ping via remote VPN

  Hi all

  I have a client who uses a 506e with the cleint 4.02 for the remote VPN Cisco. The pix is multiple inside roads. The first network inside is 192.168.1.X and E1 of the 506 is 192.168.1.1. The second network is 10.71.56.X.

  The problem is as soon as the VPN is connected I can ping any host on the 192.168.1.X, but not anything on the 10.71.56.X network. Without netbios or the other. From the PIX, I can ping hosts on two internal networks.

  Here is the config below. Thank you!

  6.2 (2) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the password xxxxx

  passwd xxxxxxx

  hostname GNB - PIX

  cisco.com-domain name

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  names of

  QUBEADMIN tcp service object-group

  Beach of port-object 444 444

  outside_access_in list access permit tcp any host 12.X.X.X eq pop3

  outside_access_in list access permit tcp any host 12.X.X.X eq smtp

  outside_access_in list access permit tcp any host 12.X.X.X EQ field

  outside_access_in list access permit tcp any host 12.X.X.X eq www

  outside_access_in list access permit tcp any host 12.X.X.X QUBEADMIN object-group

  outside_access_in list access permit icmp any any echo response

  access-list outside_access_in allow icmp all once exceed

  outside_access_in list access permit tcp any host 12.169.2.21 eq ssh

  GNB_splitTunnelAcl ip 10.71.56.0 access list allow 255.255.255.0 any

  outside_cryptomap_dyn_20 ip access list allow any 10.71.56.32 255.255.255.224

  pager lines 24

  opening of session

  timestamp of the record

  logging paused

  logging buffered stored notifications

  Logging trap errors

  notifications to the history of logging

  the logging queue 0

  host of logging inside the 10.71.55.10

  logging out of the 192.104.109.91 host

  interface ethernet0 car

  Auto interface ethernet1

  ICMP allow any inside

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside 12.X.X.X 255.255.254.0

  IP address inside 192.168.1.254 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  local IP VPNPOOL 10.71.56.40 pool - 10.71.56.50

  history of PDM activate

  ARP timeout 14400

  Global interface 10 (external)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 10 0.0.0.0 0.0.0.0 0 0

  public static 12.X.X.X (Interior, exterior) 192.168.1.1 mask subnet 255.255.255.255 0 0

  Access-group outside_access_in in interface outside

  Route outside 0.0.0.0 0.0.0.0 12.X.X.X 1

  Route inside 10.71.55.0 255.255.255.0 192.168.1.1 1

  Route inside 10.71.56.0 255.255.255.0 192.168.1.1 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  the ssh LOCAL console AAA authentication

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Dynamic crypto map outside_dyn_map 20 match address outside_cryptomap_dyn_20

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  ISAKMP allows outside

  part of pre authentication ISAKMP policy 20

  ISAKMP policy 20 3des encryption

  ISAKMP policy 20 chopping sha

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  vpngroup address VPNPOOL pool GUARD

  vpngroup dns-server 10.71.56.10 GNB 10.71.56.10

  GNB GNB_splitTunnelAcl vpngroup split tunnel

  vpngroup GNB 1800 idle time

  GNB vpngroup password *.

  Telnet timeout 5

  SSH timeout 60

  Terminal width 80

  Cryptochecksum:XXXXX

  : end

  [OK]

  GNB - PIX #.

  You use 10.71.56.0 255.255.255.0 in two places

  you route to it via 192.168.1.1, but you're also allocation of addresses for vpn clients. Guests who are on the segment 10.71.56.0/24, if they manage to get the connected vpn client package (which is assigned a 10.71.56.x) address, would not send the response packet to this request on the local subnet, the router that has the 192.168.1.1 interface, which is what would be needed to make it work.

  You must use a different network for your vpn clients block - you cannot use the same ip through two different networks space.

• QuickVPN - could not do a ping the remote VPN router!

  Hello

  I have a RV042 (VPN router) and I have some problems to run properly using the QuickVPN client.

  Here is the Log of the QuickVPN client.

  2008-10-15 20:14:38 [STATUS] a network interface detected with 192.168.0.104 IP address
  2008-10-15 20:14:38 [STATUS] connection...
  2008-10-15 20:14:38 [STATUS] connection to a remote gateway with IP address: 96.20.174.84
  2008-10-15 20:14:38 [WARNING] server certificate does not exist on your local computer.
  2008-10-15 20:14:44 remote gateway [STATE] has been reached with https...
  2008-10-15 20:14:44 [STATUS] commissioning...
  2008-10-15 20:14:51 [STATUS] Tunnel is connected successfully.
  2008-10-15 20:14:51 [STATUS] verification of network...
  2008-10-15 20:14:55 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:14:58 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:01 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:05 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:08 [WARNING] failed to do a ping the remote VPN router!
  2008-10-15 20:15:11 [WARNING] Ping has been blocked, which can be caused by an unexpected disconnection.
  2008-10-15 20:15:19 [STATUS] disconnection...
  2008-10-15 20:15:25 [STATUS] Tunnel is disconnected successfully.

  I don't know how it is implemented, but if WuickVPN wait a form ping my router, it will not happen. I was never able to ping my router ouside of my ISP network.

  There is a way to disable the Ping process and continue with the VPN connection?

  QuickVPN try ping on the router via the VPN tunnel to check the connection. It should work without worrying about whether your ISP filters ICMP messages or not. The tunnel is encrypted your ISP won't know what you're doing.

  Please post the corresponding on the RV042 VPN log. That is expected to see how far you get.

  You have a firewall running on the computer? I think that some firewalls have difficulty with the traffic of ESP.

  What is the router that is connected to the computer? How is it that is configured?

• Routing of traffic between two VPN Site-to-Site Tunnels

  Hi people,

  I am trying to establish routing between two vpn Site-to-Site tunnels which are destined for the same outside the interface of my Cisco ASA.

  Please find attached flowchart for the same thing. All used firewalls are Cisco ASA 5520.

  Two VPN tunnels between Point A and Point B, Point B and Point C is too much upward. I activated same command to permit security level interface also intra.

  How can I activate the LAN subnets traffic behind Point to join LAN subnets behind C Point without having to create a tunnel separated between Point A and Point C

  Thank you very much.

  Hello

  Basically, you will need to NAT0 and VPN rules on each site to allow this traffic.

  I think that the configurations should look something like below. Naturally you will already probably a NAT0 configuration and certainly the L2L VPN configuration

  Site has

  access-list NAT0 note NAT0 rule for SiteA SiteC traffic

  access-list allowed NAT0 ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

  NAT (inside) 0 access-list NAT0

  Note L2L-VPN-CRYPTO-SITEB access-list interesting traffic for SiteA to SiteC

  access-list L2L-VPN-CRYPTO-SITEB permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

  Where

  • NAT0 = is the ACL to be used in the NAT0 rules that will exempt SiteA SiteC NAT traffic
  • NAT = is the line of configuration NAT0
  • L2l-VPN-CRYPTO-SITEB = LCA in configurations VPN L2L that defines the SiteA LAN to LAN SiteC traffic must use the VPN L2L existing SiteB

  Site B

  access list OUTSIDE-NAT0 note NAT0 rule for SiteA SiteC traffic

  OUTSIDE-NAT0 allowed 192.168.1.0 ip access list 255.255.255.0 192.168.3.0 255.255.255.0

  NAT (outside) 0-list of access OUTSIDE-NAT0

  Note L2L-VPN-CRYPTO-SITEA access-list traffic for SiteA to SiteC through a Tunnel between A - B

  access-list L2L-VPN-CRYPTO-SITEA ip 192.168.3.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  Note L2L-VPN-CRYPTO-SITEC access-list traffic for SiteA to SiteC through a Tunnel between B - C

  access-list L2L-VPN-CRYPTO-SITEC permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

  Where

  • OUTSIDE-NAT0 = is the ACL to be used in the NAT0 rules that will exempt SiteA SiteC NAT traffic. It is this time tied to the 'outer' interface, as traffic will be coming in and out through this interface to SiteB
  • NAT = is the line of configuration NAT0
  • L2l-VPN-CRYPTO-SITEA (and SITEC) = are the ACL in the configurations of VPN L2L that defines the SiteA LAN to LAN SiteC traffic should use existing VPN L2L connections.

  Site C

  access-list NAT0 note NAT0 rule for SiteC SiteA traffic

  NAT0 192.168.3.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

  NAT (inside) 0 access-list NAT0

  Note list-access-L2L-VPN-CRYPTO-SITEB SiteC to SiteA interesting traffic

  L2L-VPN-CRYPTO-SITEB 192.168.3.0 ip access list allow 255.255.255.0 192.168.1.0 255.255.255.0

  Where

  • NAT0 = is the ACL to be used in the NAT0 rules that will exempt SiteC to SiteA NAT traffic
  • NAT = is the line of configuration NAT0
  • L2l-VPN-CRYPTO-SITEB = LCA in configurations VPN L2L that defines the SiteC LAN to LAN SiteA traffic must use the VPN L2L existing SiteB

  To my knowledge, the foregoing must manage the selection NAT0 and traffic for VPN L2L connections. Naturally, the Interface/ACL names may be different depending on your current configuration.

  Hope this helps

  -Jouni

• Cisco ASA 5520 cannot ping between VPN Tunnels

  I have the main site and sites A and B.  A to connect to the hand and B connects to the main.  I can ping from A hand and has for main.  I can ping from main to B and B to main.  However, I can not ping from A to B.  A and B are sonicwall 2040 and main is a 5520.  The question should not be with the 5520 none allowing traffic between the two VPN Tunnels, but I can't understand why it does not work.  Can someone give an idea on that?  Thanks in advance.

  Hello

  I see that you use ASDM. Always makes my eyes bleed when I need to look at the DM_INLINE of named objects and try to make sense the CLI format

  Seems to me that there are problems with the NAT.

  If you don't mind a small break between the main Site and remote locations, I'd say changing some follows the NAT configuration

  Remove old

  no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_9 DM_INLINE_NETWORK_10 DM_INLINE_NETWORK_10 non-proxy-arp-search of route static destination

  no nat source (indoor, outdoor) public static DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_11 DM_INLINE_NETWORK_12 DM_INLINE_NETWORK_12 non-proxy-arp-search of route static destination

  Add a new

  object-group network NETWORK-2790

  object-network 10.217.0.0 255.255.255.0

  object-network 10.217.1.0 255.255.255.0

  object-group network NETWORK-3820

  object-network 10.216.0.0 255.255.255.0

  object-network 10.216.1.0 255.255.255.0

  object-group network NETWORK-COLO

  object-net 10.8.0.0 255.255.255.0

  destination of NETWORK of NETWORK-2790-2790 static NAT (outside, outside) static source NETWORK - 3820 - 3820

  NAT static destination of NETWORK of NETWORK-COLO-COLO (indoor, outdoor) static source NETWORK - 2790 - 2790

  NAT static destination of NETWORK of NETWORK-COLO-COLO (indoor, outdoor) static source NETWORK - 3820 - 3820

  The first new line of configuring NAT manages the NAT0 configuration for traffic between SiteA and SiteB. The following configurations of NAT 2 manage the NAT0 for traffic between the main Site - hand Site SiteA - SiteB

  -Jouni

• Cannot access remote VPN site-to-site VPN

  Internal network: 192.168.0.0/16

  The remote VPN Clients: 192.168.0.100 - 192.168.0.254

  Remote (L2L) network: 10.10.10.0/26

  Remote VPN Clients are able to access the internal network without problem, but are unable to access the remote 10.10.10.0. Is it possible to debug this? "packet - trace" show no problem...

  Hi Ben,

  Please create a no. - nat on the external interface, because your customers to vpn-remote and remote-L2L tunnels are located on outside interface (i.e. from the outside).  You should treat your outside network identical to your inside network, as you would create a no. - nat for your inside networks.

  The ACL you create for the no - nat outside must be in both directions as below.

  permit access ip 192.168.0.0 scope list outside_nat0 255.255.255.0 10.10.10.0 255.255.255.192

  outside_nat0 to access extended list ip 10.10.10.0 allow 255.255.255.192 192.168.0.0 255.255.255.0

  NAT (outside) 0-list of access outside_nat0

  permit same-security-traffic intra-interface

  Pls let me know, if this is useful.

  Thank you

  Rizwan James

• Cannot ping ASA remote on an L2L

  I have an ASA5520, and about 10 of 5505. Site running all at the Sites. The tunnels are in place and everything worked fine. Well on the side room, I cannot ping the ASA remote, but I can ping all devices behind it. On the remote side I ping the 5520 and everything else on my network I encouraged. When I look at the newspaper of the ASDM on the 5520, that there is no evidence related to the ping for the 5505. I don't see where it blocks the ICMP on the 5505. It just says:

  "6 August 14, 2008 05:40:49 302020 10.0.3.69 192.168.1.101 built outgoing ICMP connection for faddr gaddr laddr 192.168.1.101/0 192.168.1.101/0 10.0.3.69/512.

  and

  "6 August 14, 2008 05:40:49 302021 10.0.3.69 192.168.1.101 connection disassembly ICMP for faddr gaddr laddr 192.168.1.101/0 192.168.1.101/0 10.0.3.69/512.

  It is a normal traffic for a S2S I guess. While I am trying to get this to work I have it configured,.

  ICMP allow any inside

  "ICMP allow all outside.

  Any suggestions?

  If you try to ping inside the interface through the tunnel, try to add...

  management-access inside

• Can not pass traffic from the VPN client to remote VPN site to site

  Hello

  I can't get the traffic flowing between my VPN clients and my remote site-to-site VPN, I did step by step in this link:

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

  my firewall says that the package is abandoned by statefull inspection.

  But this should be the command "same-security-traffic..." "this problem must be resolved

  % ASA-6-302020: built ICMP incoming connections for faddr gaddr laddr (nworks) 10.48.100.2/0 10.48.100.2/0 10.45.231.163/1

  % ASA-6-302020: built outgoing ICMP connection for faddr gaddr laddr 10.45.231.163/1 10.45.231.163/1 10.48.100.2/0

  % ASA-6-302021: disassembly ICMP connection for faddr gaddr laddr (nworks) 10.48.100.2/0 10.48.100.2/0 10.45.231.163/1

  % ASA-6-302021: disassembly ICMP connection for faddr gaddr laddr 10.45.231.163/1 10.45.231.163/1 10.48.100.2/0

  Is it all what you might think that I'm missing?

  Best regards

  Erik

  Erik,

  Please check it out because no decaps means the ASA does not what it is the other side of the tunnel.

  If you send traffic and you will see the crypt increment... but nothing in return... 99% sure that the problem is at the other end.

  Federico.

• Tunnel remote VPN Site to Site

  Hello

  I am facing a problem with my remote VPN users, I describe my network here. I have a site to another tunnel for my USA, tht IP 169.X.X.X. office client, we are able to connect this tunnel. now I configured remote vpn for users of my home, my office inside the IP is 192.168.2.X and once I connect to home, in the office through vpn cisco client, then, my ip is 192.168.3.X I put the IP in ASA pool, now 192.168.3.X and 192.168.2.X communicates correctly , but I need to access my Tunnel IP 169.1.X.X also from 192.168.3.X (Home).

  203.92.X.X is my static public Ip address that is allowed in the client side for the tunnel.

  If something confussing please let me know.

  Thank you

  Nitin

  Nitin,

  It is not possible to have a NATing on 192.168.3.0/24 to public ip address because it has default route (which you can reach L2L remote host) on the SAA pointing to the external interface. This default route will be redirect/road traffic on the external interface only vpn client so NATing will reach us.

  HTH

  Sangaré

• Cannot ping via the VPN client host when static NAT translations are used

  Hello, I have a SRI 3825 configured for Cisco VPN client access.

  There are also several hosts on the internal network of the static NAT translations have a services facing outwards.

  Everything works as expected with the exception that I cannot ping hosts on the internal network once connected via VPN client that is internal IP addresses have the static NAT translations in external public addresses, I ping any host that does not have static NAT translation.

  For example, in the example below, I cannot ping 192.168.1.1 and 192.168.1.2, but I can ping to the internal interface of the router, and any other host on the LAN, I can ping all hosts in the router itself.

  Any help would be appreciated.

  Concerning

  !

  session of crypto consignment

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group vpnclient

  key S3Cu4Ke!

  DNS 192.168.1.1 192.168.1.2

  domain domain.com

  pool dhcppool

  ACL 198

  Save-password

  PFS

  netmask 255.255.255.0

  !

  !

  Crypto ipsec transform-set-SECURE 3DES esp-3des esp-sha-hmac

  !

  Crypto-map dynamic dynmap 10

  86400 seconds, life of security association set

  game of transformation-3DES-SECURE

  market arriere-route

  !

  card crypto client cryptomap of authentication list drauthen

  card crypto isakmp authorization list drauthor cryptomap

  client configuration address card crypto cryptomap answer

  map cryptomap 65535-isakmp ipsec crypto dynamic dynmap

  !

  interface GigabitEthernet0/0

  NAT outside IP

  IP 1.2.3.4 255.255.255.240

  cryptomap card crypto

  !

  interface GigabitEthernet0/1

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  !

  IP local pool dhcppool 192.168.2.50 192.168.2.100

  !

  Note access-list 198 * Split Tunnel encrypted traffic *.
  access-list 198 allow ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

  !
  Note access-list 199 * NAT0 ACL *.
  access-list 199 deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
  access-list 199 permit ip 192.168.1.0 0.0.0.255 any

  !

  Sheep allowed 10 route map
  corresponds to the IP 199

  !
  IP nat inside source map route sheep interface GigabitEthernet0/0 overload

  !

  IP nat inside source static 192.168.1.1 1.2.3.5
  IP nat inside source static 192.168.1.2 1.2.3.6

  The problem seems to be that static NAT take your nat exemption.

  The solution would be:

  IP nat inside source static 192.168.1.1 1.2.3.5 sheep map route
  IP nat inside source static 192.168.1.2 1.2.3.6 sheep map route

  HTH

  Herbert

• problem with users to access remote vpn site to site vpn network

  I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

  execution of the configuration of my asa 5510 is

  Result of the command: "show run"
  : Saved
  
      :
  
      ASA Version 8.4(2)
  
      !
  
      hostname asa5510
  
      domain-name dri.local
  
      enable password 8Ry2YjIyt7RRXU24 encrypted
  
      passwd 2KFQnbNIdI.2KYOU encrypted
  
      names
  
      !
  
      interface Ethernet0/0
  
      nameif outside
  
      security-level 0
  
      ip address x.x.x.178 255.255.255.248
  
      !
  
      interface Ethernet0/1
  
      nameif inside
  
      security-level 100
  
      ip address 192.168.0.10 255.255.255.0
  
      !
  
      interface Ethernet0/2
  
      description Mreza za virtualne masine- mail server, wsus....
  
      nameif DMZ
  
      security-level 50
  
      ip address 172.16.20.1 255.255.255.0
  
      !
  
      interface Ethernet0/3
  
      shutdown
  
      no nameif
  
      no security-level
  
      no ip address
  
      !
  
      interface Management0/0
  
      nameif management
  
      security-level 100
  
      ip address 192.168.1.1 255.255.255.0
  
      management-only
  
      !
  
      ftp mode passive
  
      clock timezone CEST 1
  
      clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
  
      dns server-group DefaultDNS
  
      domain-name dri.local
  
      object network VPN-POOL
  
      subnet 192.168.50.0 255.255.255.0
  
      description VPN Client pool
  
      object network LAN-NETWORK
  
      subnet 192.168.0.0 255.255.255.0
  
      description LAN Network
  
      object network NETWORK_OBJ_192.168.0.0_24
  
      subnet 192.168.0.0 255.255.255.0
  
      object network 192.168.0.10
  
      host 192.168.0.10
  
      object service ssl
  
      service tcp destination eq 465
  
      object service tls
  
      service tcp destination eq 995
  
      object network mail_server
  
      host 172.16.20.201
  
      object service StartTLS
  
      service tcp destination eq 587
  
      object service admin_port
  
      service tcp destination eq 444
  
      object service ODMR
  
      service tcp destination eq 366
  
      object service SSL-IMAP
  
      service tcp destination eq 993
  
      object network remote
  
      host 172.16.20.200
  
      object network test
  
      host 192.168.0.22
  
      object network mail
  
      host 172.16.20.200
  
      object network DMZ
  
      host 172.16.20.200
  
      object network Inside_DMZ
  
      host 192.168.0.20
  
      object service rdp
  
      service tcp destination eq 3389
  
      object network DRI_PS99
  
      host 192.168.0.54
  
      object service microsoft_dc
  
      service tcp destination eq 445
  
      object service https448
  
      service tcp destination eq 448
  
      object network mail_server_internal
  
      host 172.16.20.201
  
      object service Acronis_remote
  
      service tcp destination eq 9876
  
      object service Acronis_25001
  
      service tcp destination eq 25001
  
      object service HTTP3000
  
      service tcp destination eq 3000
  
      object network VPNPOOL
  
      subnet 192.168.50.0 255.255.255.0
  
      object-group network PAT-SOURCE-NETWORKS
  
      description Source networks for PAT
  
      network-object 192.168.0.0 255.255.255.0
  
      object-group service DM_INLINE_SERVICE_1
  
      service-object object admin_port
  
      service-object object ssl
  
      service-object object tls
  
      service-object object https448
  
      object-group service DM_INLINE_SERVICE_2
  
      service-object object admin_port
  
      service-object object https448
  
      service-object object ssl
  
      service-object object tls
  
      service-object tcp destination eq pop3
  
      service-object tcp destination eq smtp
  
      object-group service DM_INLINE_SERVICE_3
  
      service-object object admin_port
  
      service-object object https448
  
      service-object object ssl
  
      service-object tcp destination eq smtp
  
      service-object object tls
  
      service-object object Acronis_remote
  
      service-object tcp destination eq www
  
      service-object object Acronis_25001
  
      service-object object microsoft_dc
  
      object-group protocol DM_INLINE_PROTOCOL_1
  
      protocol-object ip
  
      protocol-object tcp
  
      object-group service DM_INLINE_SERVICE_4
  
      service-object object Acronis_25001
  
      service-object object Acronis_remote
  
      service-object object microsoft_dc
  
      service-object tcp destination eq www
  
      service-object tcp
  
      service-object ip
  
      access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
  
      access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
  
      access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
  
      access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
  
      access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
  
      access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
  
      access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
  
      access-list DMZ extended deny tcp any any eq smtp
  
      pager lines 24
  
      logging enable
  
      logging asdm informational
  
      mtu outside 1500
  
      mtu inside 1500
  
      mtu DMZ 1500
  
      mtu management 1500
  
      ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
  
      icmp unreachable rate-limit 1 burst-size 1
  
      no asdm history enable
  
      arp timeout 14400
  
      nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
  
      !
  
      object network mail_server
  
      nat (DMZ,outside) static x.x.x.179
  
      object network mail
  
      nat (DMZ,outside) static x.x.x.180
  
      access-group outside_access_in in interface outside
  
      access-group DMZ in interface DMZ
  
      route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
  
      timeout xlate 3:00:00
  
      timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  
      timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  
      timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  
      timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  
      timeout tcp-proxy-reassembly 0:01:00
  
      timeout floating-conn 0:00:00
  
      dynamic-access-policy-record DfltAccessPolicy
  
      action terminate
  
      dynamic-access-policy-record dripolisa
  
      aaa-server DRI protocol ldap
  
      aaa-server DRI (inside) host 192.168.0.20
  
      ldap-base-dn DC=dri,DC=local
  
      ldap-scope subtree
  
      ldap-naming-attribute sAMAccountName
  
      ldap-login-password *****
  
      ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
  
      server-type microsoft
  
      user-identity default-domain LOCAL
  
      aaa authentication enable console LOCAL
  
      aaa authentication http console LOCAL
  
      aaa authentication serial console LOCAL
  
      aaa authentication telnet console LOCAL
  
      aaa authorization command LOCAL
  
      http server enable
  
      http 192.168.1.0 255.255.255.0 management
  
      http 192.168.0.0 255.255.255.0 inside
  
      no snmp-server location
  
      no snmp-server contact
  
      snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
  
      virtual telnet 192.168.1.12
  
      crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  
      crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
  
      crypto ipsec ikev2 ipsec-proposal DES
  
      protocol esp encryption des
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal 3DES
  
      protocol esp encryption 3des
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal AES
  
      protocol esp encryption aes
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal AES192
  
      protocol esp encryption aes-192
  
      protocol esp integrity sha-1 md5
  
      crypto ipsec ikev2 ipsec-proposal AES256
  
      protocol esp encryption aes-256
  
      protocol esp integrity sha-1 md5
  
      crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
  
      crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
  
      crypto map outside_map 1 match address outside_cryptomap
  
      crypto map outside_map 1 set peer 195.222.96.223
  
      crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
  
      crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
  
      crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  
      crypto map outside_map interface outside
  
      crypto ikev2 policy 1
  
      encryption aes-256
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 10
  
      encryption aes-192
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 20
  
      encryption aes
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 30
  
      encryption 3des
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 policy 40
  
      encryption des
  
      integrity sha
  
      group 5 2
  
      prf sha
  
      lifetime seconds 86400
  
      crypto ikev2 enable outside
  
      crypto ikev1 enable outside
  
      crypto ikev1 policy 10
  
      authentication pre-share
  
      encryption 3des
  
      hash sha
  
      group 2
  
      lifetime 86400
  
      telnet 192.168.0.0 255.255.255.0 inside
  
      telnet timeout 5
  
      ssh timeout 5
  
      console timeout 0
  
      dhcpd auto_config outside
  
      !
  
      dhcpd address 192.168.0.14-192.168.0.45 inside
  
      !
  
      dhcpd address 172.16.20.2-172.16.20.150 DMZ
  
      dhcpd dns x.x.x.177 interface DMZ
  
      dhcpd auto_config outside interface DMZ
  
      dhcpd option 6 ip x.x.x.177 interface DMZ
  
      dhcpd enable DMZ
  
      !
  
      dhcpd address 192.168.1.2-192.168.1.254 management
  
      dhcpd enable management
  
      !
  
      threat-detection basic-threat
  
      threat-detection statistics port
  
      threat-detection statistics protocol
  
      threat-detection statistics access-list
  
      no threat-detection statistics tcp-intercept
  
      webvpn
  
      group-policy GroupPolicy_x.x.x.223 internal
  
      group-policy GroupPolicy_x.x.x.223 attributes
  
      vpn-tunnel-protocol ikev1 ikev2
  
      group-policy drivpn internal
  
      group-policy drivpn attributes
  
      dns-server value 192.168.0.20 192.168.0.254
  
      vpn-simultaneous-logins 10
  
      vpn-idle-timeout 30
  
      vpn-tunnel-protocol ikev1 l2tp-ipsec
  
      split-tunnel-network-list value Split_Tunnel_List
  
      default-domain value dri.local
  
      username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
  
      tunnel-group drivpn type remote-access
  
      tunnel-group drivpn general-attributes
  
      address-pool vpnadrese
  
      authentication-server-group DRI
  
      default-group-policy drivpn
  
      tunnel-group drivpn ipsec-attributes
  
      ikev1 pre-shared-key *****
  
      tunnel-group x.x.x.223 type ipsec-l2l
  
      tunnel-group x.x.x.223 general-attributes
  
      default-group-policy GroupPolicy_x.x.x.223
  
      tunnel-group x.x.x.223 ipsec-attributes
  
      ikev1 pre-shared-key *****
  
      ikev2 remote-authentication pre-shared-key *****
  
      ikev2 local-authentication pre-shared-key *****
  
      !
  
      class-map inspection_default
  
      match default-inspection-traffic
  
      !
  
      !
  
      policy-map type inspect dns preset_dns_map
  
      parameters
  
        message-length maximum client auto
  
        message-length maximum 512
  
      policy-map global_policy
  
      class inspection_default
  
        inspect dns preset_dns_map
  
        inspect ftp
  
        inspect h323 h225
  
        inspect h323 ras
  
        inspect rsh
  
        inspect rtsp
  
        inspect sqlnet
  
        inspect skinny 
  
        inspect sunrpc
  
        inspect xdmcp
  
        inspect sip 
  
        inspect tftp
  
        inspect ip-options
  
        inspect netbios
  
        inspect icmp
  
        inspect http
  
      !
  
      service-policy global_policy global
  
      prompt hostname context
  
      no call-home reporting anonymous
  
      Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
  
      : end
  

  running config asa 5505

  Result of the command: "show run"
  : Saved
  
      :
  
      ASA Version 8.2(1)
  
      !
  
      hostname ciscoasa
  
      enable password csq7sfr0bQJqMGET encrypted
  
      passwd 2KFQnbNIdI.2KYOU encrypted
  
      names
  
      name 192.168.5.0 PALATA
  
      !
  
      interface Vlan1
  
      nameif inside
  
      security-level 100
  
      ip address 192.168.0.17 255.255.255.0
  
      !
  
      interface Vlan2
  
      nameif outside
  
      security-level 0
  
      ip address 10.13.74.33 255.255.255.0
  
      !
  
      interface Ethernet0/0
  
      switchport access vlan 2
  
      !
  
      interface Ethernet0/1
  
      !
  
      interface Ethernet0/2
  
      !
  
      interface Ethernet0/3
  
      !
  
      interface Ethernet0/4
  
      !
  
      interface Ethernet0/5
  
      !
  
      interface Ethernet0/6
  
      !
  
      interface Ethernet0/7
  
      !
  
      ftp mode passive
  
      clock timezone CEST 1
  
      clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
  
      object-group service DM_INLINE_SERVICE_1
  
      service-object ip
  
      service-object tcp
  
      service-object icmp echo
  
      service-object icmp echo-reply
  
      service-object tcp eq domain
  
      service-object tcp eq ldap
  
      service-object tcp eq smtp
  
      object-group service DM_INLINE_SERVICE_2
  
      service-object ip
  
      service-object tcp eq domain
  
      service-object tcp eq www
  
      service-object tcp eq https
  
      service-object tcp eq smtp
  
      object-group service Sharepoint8080 tcp
  
      port-object eq 8080
  
      access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
  
      access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
  
      access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
  
      access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
  
      access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
  
      pager lines 24
  
      logging enable
  
      logging asdm informational
  
      logging mail errors
  
      logging from-address
  
      logging recipient-address  level debugging
  
      mtu inside 1500
  
      mtu outside 1500
  
      icmp unreachable rate-limit 1 burst-size 1
  
      no asdm history enable
  
      arp timeout 14400
  
      global (outside) 1 interface
  
      nat (inside) 0 access-list inside_nat0_outbound_1
  
      nat (inside) 1 192.168.0.0 255.255.255.0
  
      static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
  
      static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
  
      access-group inside_access_in in interface inside
  
      access-group outside_access_in in interface outside
  
      route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
  
      route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
  
      timeout xlate 3:00:00
  
      timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  
      timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  
      timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  
      timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  
      timeout tcp-proxy-reassembly 0:01:00
  
      dynamic-access-policy-record DfltAccessPolicy
  
      aaa authentication telnet console LOCAL
  
      http server enable
  
      http 10.13.74.0 255.255.255.0 outside
  
      http 192.168.0.0 255.255.255.0 inside
  
      http 10.15.100.0 255.255.255.0 outside
  
      no snmp-server location
  
      no snmp-server contact
  
      snmp-server enable traps snmp authentication linkup linkdown coldstart
  
      virtual telnet 192.168.0.53
  
      crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  
      crypto ipsec security-association lifetime seconds 28800
  
      crypto ipsec security-association lifetime kilobytes 4608000
  
      crypto map outside_map 1 match address outside_2_cryptomap
  
      crypto map outside_map 1 set pfs
  
      crypto map outside_map 1 set peer 10.15.100.15
  
      crypto map outside_map 1 set transform-set ESP-3DES-SHA
  
      crypto map outside_map interface outside
  
      crypto isakmp enable outside
  
      crypto isakmp policy 10
  
      authentication pre-share
  
      encryption 3des
  
      hash sha
  
      group 2
  
      lifetime 86400
  
      telnet 192.168.0.0 255.255.255.0 inside
  
      telnet timeout 5
  
      ssh timeout 5
  
      console timeout 0
  
      dhcpd auto_config outside
  
      !
  threat-detection basic-threat
  
      threat-detection statistics access-list
  
      no threat-detection statistics tcp-intercept
  
      webvpn
  
      username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
  
      tunnel-group 10.15.100.15 type ipsec-l2l
  
      tunnel-group 10.15.100.15 ipsec-attributes
  
      pre-shared-key *
  
      !
  
      class-map inspection_default
  
      match default-inspection-traffic
  
      !
  
      !
  
      policy-map type inspect dns preset_dns_map
  
      parameters
  
        message-length maximum 512
  
      policy-map global_policy
  
      class inspection_default
  
        inspect dns preset_dns_map
  
        inspect ftp
  
        inspect h323 h225
  
        inspect h323 ras
  
        inspect rsh
  
        inspect rtsp
  
        inspect esmtp
  
        inspect sqlnet
  
        inspect skinny 
  
        inspect sunrpc
  
        inspect xdmcp
  
        inspect sip 
  
        inspect netbios
  
        inspect tftp
  
        inspect icmp
  
      !
  
      service-policy global_policy global
  
      smtp-server 173.194.79.109
  
      prompt hostname context
  
      Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
  
      : end
  

  Thank you

  Hello

  I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

  EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"
  

  So you don't really have any of those.

  Please mark the question answers and/or assess response

  Ask more if necessary

  -Jouni

• Remote VPN site to site vpn on ASA?

  Hello

  I would like to know if it is possible to have this configuration with an ASA5510:

  (1) - remote access VPN (access by the external interface)

  (2) - site to site VPN (same access interface)

  The goal: users of vpn (1) can access the server remote vpn (2) and vice versa.

  Is it possible? and what is the best practice to do?

  Thank you very much!

  J.

  Yes, you can do it.

  Same-security-traffic command traffic to enter and leave the interface even when used with the

  keyword intra-interface, that allows the VPN support has spoke-to-spoke.

  Here are a few examples.

  http://www.Cisco.com/en/us/products/ps6120/prod_configuration_examples_list.html

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00807f9a89.shtml

  PIX / ASA 7.X: Add a new Tunnel or remote access to an existing L2L VPN

  http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a008046f307.shtml

  PIX / ASA 7.x enhanced has spoken-to-Client VPN with the example of setting up authentication GANYMEDE +.

• Cannot ping between virtual servers on the same host

  I have a 5 ESXi host with 3 virtual copies of Windows Server 2008R2 running on them. The ESXi host is connected to my switch, which has the Windows 2008 R2 DC to my test network and my laptop management with VSphere branch above as well. I can ping host, mobile and ad server of each of the individual virtual servers and can ping and RDP for all 3 from other devices not on that host, but I cannot communicate between the three. I have Windows Firewall disabled on all three. I have no firewall, and all machines have an IP address in the 10.0.0.X range I deleted then recreated the only virtual switch on the host on which appear all 3. I've been VERY frustrated for the last 3 days on it. Why my virtual machine cannot talk to each other?

  When you have registered virtual machines in ESX you selected moved VM or Coiped VM? Go to editing parameters and watch the MAC addresses. My guess is that if you copied power (including the vmx files) then the MAC address is the same for all virtual machines. You can stop the machine and change for a MAC address mac address. You can also remove the network adapters, one of each, and then add the new network cards. Remember to reconfigure the IP addresses on the box and remove the ghost network maps after doing this.

  Check this KB to change the mac address.

  http://KB.VMware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalID=507

  Also, can you connect to the switch and look at the ARP table and see if the system VMs register here.

• Instances of VMware cannot ping between them somehow...

  This is the environment for my experience:

  Host: My Windows XP sp3

  Products VMware: Vmware Workstation 6.0.3

  Instances of VMware: one is installed Win2k3 with SP2 and a domain controller/DNS/Exchange server role, another is installed Win XP sp3 and play as a customer...

  IP of the domain controller configuration:

  Windows IP configuration

  Name of the host...: dc

  Suffix main Dns...: ge.com

  Node... type: hybrid

  Active... IP routing: No.

  Active... proxy WINS: No.

  ... DNS suffix search list: ge.com

  Ethernet connection to the Local card:

  The connection-specific DNS suffix. :

  ... Description: VMware accelerated AMD PCNet Adapter

  Physical address.... : 00-0C-29-56-FD-24

  DHCP active...: No.

  ... The IP address: 192.168.238.3

  ... Subnet mask: 255.255.255.0.

  ... Default gateway. :

  DNS servers...: 192.168.238.3.

  Configuration of the client IP as below:

  *********************************************************

  Windows IP configuration

  Name of the host...: client1

  Suffix main Dns...: ge.com

  ... Node type: unknown

  Active... IP routing: No.

  Active... proxy WINS: No.

  ... DNS suffix search list: ge.com

  Ethernet connection to the Local card:

  The connection-specific DNS suffix. :

  ... Description: VMware accelerated AMD PCNet Adapter

  Physical address.... : 00-0C-29-54-9D-B4

  DHCP active...: No.

  ... The IP address: 192.168.238.4

  ... Subnet mask: 255.255.255.0.

  ... Default gateway. :

  DNS servers...: 192.168.238.3.

  And here are the parameters of the DC on Vmware:

  

  And here's the VMware client settings:

  

  And settings of network virtual as below:

  

  

  My problem is:

  Today, two Merethe cannot ping each other all at ONCE, even if they worked very well without any problems.

  I tried to change the other IPs/remove and add maps network/restart on two instances but still no luck

  Please kindly help me friends :)

  Hmm so there is no problem with the NAT adapter, problem looks to with Bridge mode... Check if proceeding under in the cardiac control panels network connections is enabled for all vmware... cards try to disable and enable them

  If its possible to restart the virtual machine... try this

  -Remove the network card

  -Turn on the virtual computer.

  -Turning off the virtual computer.

  -Add the network adapter

  -Start the virtual machine. See if that helps.

  Concerning

  Anil

  Save the planet, go for green

  If you have found my reply to be useful, feel free to mark it as useful or Correct.

• Ping of ASA to remote VPN site

  I am haivng a weird question. I have two ASA in place with a VPN tunnel from site to site between the two. The traffic is through the tunnel without problem. I have a whole allowed for the two locations on the tunenl IP. The issue I'm having is that when I'm on the ASAs I'm not able to ping what anyone at the remote location. PC between locations communicates very well via the VPN tunnel however.

  The reason that I need is to have the ASAs information to syslog for my syslog server appliances. Y at - it something that I'm missing that will allow the ASA contact materials at the remote location?

  When you try to ping, do you "ping inside?

  Also, your custom logging, haven't you set up "logging inside the host"?