Cisco VPN Client cannot ping from LAN internal IP
Hello
I apologize in advance for my lack of knowledge about it, but I got a version of the software running ASA 5510 7.2 (2) and has been invited to set up a site with a client, I managed to get this configured and everything works fine. In addition, I created a group of tunnel ipsec-ra for users to connect to a particular server 192.168.10.100/24 remote, even if the connection is made successfully, I can not ping any IP on the LAN 192.168.10.0/24 located behind the ASA and when I ping inside the interface on the ASA it returns the public IP address of the external interface.
If someone out there could give me a little push in the right direction, it would be much appreciated! This is the current configuration of the device.
Thanks in advance.
: Saved
:
ASA Version 7.2 (2)
!
hostname ciscoasa5510
domain.local domain name
activate the password. 123456789 / encrypted
names of
!
interface Ethernet0/0
nameif outside
security-level 0
PPPoE client vpdn group ISP
12.34.56.789 255.255.255.255 IP address pppoe setroute
!
interface Ethernet0/1
nameif inside
security-level 100
IP 192.168.10.1 255.255.255.0
!
interface Ethernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
management only
!
passwd encrypted 123456789
passive FTP mode
clock timezone GMT/UTC 0
summer time clock GMT/BDT recurring last Sun Mar 01:00 last Sun Oct 02:00
DNS server-group DefaultDNS
domain.local domain name
permit outside_20_cryptomap to access extended list ip 192.168.10.0 255.255.255.0 host 10.16.2.124
permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 host 10.16.2.124
access-list Split_Tunnel_List note the network of the company behind the ASA
Split_Tunnel_List list standard access allowed 192.168.10.0 255.255.255.0
pager lines 24
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
management of MTU 1500
IP local pool domain_vpn_pool 192.168.11.1 - 192.168.11.254 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 522.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 0.0.0.0 0.0.0.0 12.34.56.789 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout, uauth 0:05:00 absolute
internal domain_vpn group policy
attributes of the strategy of group domain_vpn
value of 212.23.3.100 DNS server 212.23.6.100
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list Split_Tunnel_List
username domain_ra_vpn password 123456789 encrypted
username domain_ra_vpn attributes
VPN-group-policy domain_vpn
encrypted utilisateur.123456789 password username
encrypted utilisateur.123456789 password username
privilege of username user password encrypted passe.123456789 15
encrypted utilisateur.123456789 password username
the ssh LOCAL console AAA authentication
AAA authentication enable LOCAL console
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.10.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto-map dynamic outside_dyn_map 20 set pfs
Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA
card crypto outside_map 20 match address outside_20_cryptomap
peer set card crypto outside_map 20 987.65.43.21
outside_map crypto 20 card value transform-set ESP-3DES-SHA
3600 seconds, duration of life card crypto outside_map 20 set - the security association
map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
aes-256 encryption
sha hash
Group 5
life 86400
crypto ISAKMP policy 30
preshared authentication
3des encryption
sha hash
Group 2
life 86400
tunnel-group 987.65.43.21 type ipsec-l2l
IPSec-attributes tunnel-group 987.65.43.21
pre-shared-key *.
tunnel-group domain_vpn type ipsec-ra
tunnel-group domain_vpn General-attributes
address domain_vpn_pool pool
Group Policy - by default-domain_vpn
domain_vpn group of tunnel ipsec-attributes
pre-shared-key *.
Telnet 192.168.10.0 255.255.255.0 inside
Telnet timeout 5
Console timeout 0
VPDN group ISP request dialout pppoe
VPDN group ISP localname [email protected] / * /
VPDN group ISP ppp authentication chap
VPDN username [email protected] / * / password *.
dhcpd dns 212.23.3.100 212.23.6.100
dhcpd lease 691200
dhcpd ping_timeout 500
domain.local domain dhcpd
!
dhcpd address 192.168.10.10 - 192.168.10.200 inside
dhcpd allow inside
!
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:1234567890987654321
: end
Hello
Seems to me that you are atleast lack the NAT0 configuration for your VPN Client connection.
This configuration is intended to allow the VPN Client to communicate with the local network with their original IP addresses. Although the main reason that this is necessary is to avoid this traffic to the normal rule of dynamic PAT passing this traffic and that traffic is falling for the corresponding time.
You can add an ACL rule to the existing ACL NAT0, you have above and the NAT configuration should go next
Add this
permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.11.0 255.255.255.0
Hope this helps
Let me know how it goes
-Jouni
Tags: Cisco Security
Similar Questions
-
Hello
IPhone 4 s last IOS5 V 5.1.1 installed
I'm not able to make the native IPSEC VPN connection upset my company Cisco 877
Instead, all my computer laptop and netbook with Cisco VPN Client work installed fine when they connect remotely to society 877
Turn debugging 877, it seems Iphone successfully passes the 1 connection ike (actually Iphone wonder phase2 user/pass), but it hung to phase2 give me the error 'Negotiation with the VPN server has no' back
An idea or a known issue on this?
This is how I configured my VPN 877 part:
R1 (config) # aaa new-model
R1 (config) # aaa authentication default local connection
R1 (config) # aaa authentication login vpn_xauth_ml_1 local
R1 (config) # aaa authentication login local sslvpn
R1 (config) # aaa authorization network vpn_group_ml_1 local
R1 (config) # aaa - the id of the joint session
Crypto isakmp policy of R1 (config) # 1
R1(config-ISAKMP) # BA 3des
# Preshared authentication R1(config-ISAKMP)
Group R1(config-ISAKMP) # 2
R1(config-ISAKMP) #.
R1(config-ISAKMP) #crypto isakmp policy 2
R1(config-ISAKMP) # BA 3des
Md5 hash of R1(config-ISAKMP) #.
# Preshared authentication R1(config-ISAKMP)
Group R1(config-ISAKMP) # 2
Output R1(config-ISAKMP) #.
R1 (config) # CUSTOMER - VPN crypto isakmp client configuration group
R1(config-ISAKMP-Group) # key xxxxxxxx
R1(config-ISAKMP-Group) # 192.168.0.1 dns
R1(config-ISAKMP-Group) # VPN - pool
ACL R1(config-ISAKMP-Group) # 120
R1(config-ISAKMP-Group) max-users # 5
Output R1(config-ISAKMP-Group) #.
R1 (config) # ip local pool VPN-pool 192.168.0.20 192.168.0.25
R1 (config) # crypto ipsec transform-set encrypt-method-1 esp-3des esp-sha-hmac
R1 (config) # crypto ipsec VPN-profile-1 profile
R1(IPSec-Profile) # set the transform-set encrypt method 1
Tunnel type interface virtual-Template2 R1 (config) #.
R1(Config-if) # ip unnumbered FastEthernet0/0
R1(Config-if) # tunnel mode ipsec ipv4
Ipsec protection tunnel R1(Config-if) # VPN - profile - 1 profile
Profile of R1 (config) # isakmp crypto vpn-ike-profile-1
R1(conf-ISA-Prof) # match group identity CUSTOMER VPN
R1(conf-ISA-Prof) # vpn_xauth_ml_1 list client authentication
R1(conf-ISA-Prof) # isakmp authorization list vpn_group_ml_1
R1(conf-ISA-Prof) # client configuration address respond
R1(conf-ISA-Prof) virtual-model # 2
Then run AccessList 120 for desired traffic ("access-list 120 now allows ip any any")
I have configured my VPN Cisco "CUSTOMER-VPN" clients and relative password
Whenever they connect, they are prompted for the password and username phase2 then they join the VPN with an IP address from local subnet released.
With the same parameters required and confirmed in section ipsec VPN Iphone it does not work.
It's 877 isakmp debug output after that Iphone wonder name of user and password (then I suppose that phase 1 completed):
* 14:29:30.731 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport CONF_XAUTH
* 14:29:30.735 May 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID =-1427983983
* 14:29:30.735 May 19: ISAKMP: Config payload RESPONSE
* 14:29:30.735 May 19: ISAKMP/xauth: response XAUTH_USER_NAME_V2 attribute
* 14:29:30.735 May 19: ISAKMP/xauth: response XAUTH_USER_PASSWORD_V2 attribute
* 14:29:30.735 May 19: ISAKMP: (2081): node-1427983983 error suppression FALSE reason "made with Exchange of request/response xauth.
* 14:29:30.735 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_REPLY
* 14:29:30.735 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_REQ_SENT = IKE_XAUTH_AAA_CONT_LOGIN_AWAIT
* 14:29:30.743 May 19: ISAKMP: node set 1322685842 to CONF_XAUTH
* 19 May 14:29:30.747: ISAKMP: (2081): launch peer 151.38.197.143 config. ID = 1322685842
* 19 May 14:29:30.747: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) CONF_XAUTH
* 14:29:30.747 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.
* 14:29:30.747 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_AAA, IKE_AAA_CONT_LOGIN
* 14:29:30.747 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_AAA_CONT_LOGIN_AWAIT = IKE_XAUTH_SET_SENT
* 14:29:31.299 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport CONF_XAUTH
* 14:29:31.299 May 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID = 1322685842
* 14:29:31.299 May 19: ISAKMP: Config payload ACK
* 19 May 14:29:31.303: ISAKMP: (2081): XAUTH ACK processed
* 14:29:31.303 May 19: ISAKMP: (2081): error suppression node 1322685842 FALSE basis "Mode of Transaction.
* 14:29:31.303 May 19: ISAKMP: (2081): talking to a customer of the unit
* 14:29:31.303 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_ACK
* 14:29:31.303 May 19: ISAKMP: (2081): former State = new State IKE_XAUTH_SET_SENT = IKE_P1_COMPLETE
* 14:29:31.303 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
* 14:29:31.303 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE
* 19 May 14:29:31.303: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
* 14:29:31.315 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
* 14:29:31.315 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE
* 14:29:31.623 may 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport QM_IDLE
* 14:29:31.623 may 19: ISAKMP: node set-851463821 to QM_IDLE
* 14:29:31.623 may 19: ISAKMP: (2081): responsible for operation of 151.38.197.143 of treatment. Message ID =-851463821
* 14:29:31.623 may 19: ISAKMP: Config payload REQUEST
* 14:29:31.623 may 19: ISAKMP: (2081): verification of claim:
* 14:29:31.623 may 19: ISAKMP: IP4_ADDRESS
* 14:29:31.623 may 19: ISAKMP: IP4_NETMASK
* 14:29:31.623 may 19: ISAKMP: IP4_DNS
* 14:29:31.623 may 19: ISAKMP: IP4_NBNS
* 14:29:31.623 may 19: ISAKMP: ADDRESS_EXPIRY
* 14:29:31.623 may 19: ISAKMP: APPLICATION_VERSION
* 14:29:31.623 may 19: ISAKMP: MODECFG_BANNER
* 14:29:31.623 may 19: ISAKMP: domaine_par_defaut
* 14:29:31.623 may 19: ISAKMP: SPLIT_DNS
* 14:29:31.623 may 19: ISAKMP: SPLIT_INCLUDE
* 14:29:31.623 may 19: ISAKMP: INCLUDE_LOCAL_LAN
* 14:29:31.623 may 19: ISAKMP: PFS
* 14:29:31.623 may 19: ISAKMP: MODECFG_SAVEPWD
* 14:29:31.623 may 19: ISAKMP: FW_RECORD
* 14:29:31.623 may 19: ISAKMP: serveur_sauvegarde
* 14:29:31.623 may 19: ISAKMP: MODECFG_BROWSER_PROXY
* 14:29:31.627 May 19: ISAKMP/author: author asks for CUSTOMER-VPNsuccessfully group AAA
* 14:29:31.627 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_CFG_REQUEST
* 14:29:31.627 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_CONFIG_AUTHOR_AAA_AWAIT
* 14:29:31.627 May 19: ISAKMP: (2081): attributes sent in the message:
* 19 May 14:29:31.627: address: 0.2.0.0
* 19 May 14:29:31.627: ISAKMP: (2081):address of 192.168.0.21 assignment
* 14:29:31.627 May 19: ISAKMP: sending private address: 192.168.0.21
* 14:29:31.627 May 19: ISAKMP: send the subnet mask: 255.255.255.0
* 14:29:31.631 May 19: ISAKMP: sending IP4_DNS server address: 192.168.0.1
* 14:29:31.631 May 19: ISAKMP: sending ADDRESS_EXPIRY seconds left to use the address: 3576
* 14:29:31.631 May 19: ISAKMP: string APPLICATION_VERSION sending: Cisco IOS software, software C870 (C870-ADVIPSERVICESK9-M), Version 12.4 (15) T7, VERSION of the SOFTWARE (fc3)
Technical support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Updated Friday 14 August 08 07:43 by prod_rel_team
* 14:29:31.631 May 19: ISAKMP: split shipment include the name Protocol 120 network 0.0.0.0 mask 0.0.0.0 0 src port 0, port 0 DST
* 14:29:31.631 May 19: ISAKMP: sending save the password answer value 0
* 19 May 14:29:31.631: ISAKMP: (2081): respond to peer 151.38.197.143 config. ID =-851463821
* 19 May 14:29:31.631: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) CONF_ADDR
* 14:29:31.631 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.
* 14:29:31.631 May 19: ISAKMP: (2081): node-851463821 error suppression FALSE reason "error no.".
* 14:29:31.631 May 19: ISAKMP: (2081): talking to a customer of the unit
* 14:29:31.631 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_AAA, IKE_AAA_GROUP_ATTR
* 14:29:31.631 May 19: ISAKMP: (2081): former State = new State IKE_CONFIG_AUTHOR_AAA_AWAIT = IKE_P1_COMPLETE
* 14:29:31.635 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
* 14:29:31.635 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_P1_COMPLETE
Here the Iphone remains unused for a few seconds...
* 14:29:48.391 May 19: ISAKMP (0:2081): received 151.38.197.143 packet 500 Global 500 (R) sport dport QM_IDLE
* 14:29:48.391 May 19: ISAKMP: node set 1834509506 to QM_IDLE
* 19 May 14:29:48.391: ISAKMP: (2081): HASH payload processing. Message ID = 1834509506
* 19 May 14:29:48.391: ISAKMP: (2081): treatment of payload to DELETE. Message ID = 1834509506
* 14:29:48.391 May 19: ISAKMP: (2081): peer does not paranoid KeepAlive.
* 14:29:48.395 May 19: ISAKMP: (2081): peer does not paranoid KeepAlive.
* 14:29:48.395 May 19: ISAKMP: (2081): removal of HIS right State 'No reason' (R) QM_IDLE (post 151.38.197.143)
* 14:29:48.395 May 19: ISAKMP: (2081): error suppression node 1834509506 FALSE reason 'informational (en) State 1.
* 19 May 14:29:48.395: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
* 19 May 14:29:48.395: IPSEC (key_engine_delete_sas): rec would notify of ISAKMP
* 19 May 14:29:48.395: IPSEC (key_engine_delete_sas): remove all SAs shared with peer 151.38.197.143
* 14:29:48.395 May 19: ISAKMP: node set-1711408233 to QM_IDLE
* 19 May 14:29:48.395: ISAKMP: (2081): lot of 151.38.197.143 sending my_port 500 peer_port 500 (R) QM_IDLE
* 14:29:48.395 May 19: ISAKMP: (2081): sending a packet IPv4 IKE.
* 14:29:48.399 May 19: ISAKMP: (2081): purge the node-1711408233
* 14:29:48.399 May 19: ISAKMP: (2081): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL
* 14:29:48.399 May 19: ISAKMP: (2081): former State = new State IKE_P1_COMPLETE = IKE_DEST_SA
* 14:29:48.399 May 19: ISAKMP: (2081): removal of HIS right State 'No reason' (R) QM_IDLE (post 151.38.197.143)
* 14:29:48.399 May 19: ISAKMP: (0): cannot decrement IKE Call Admission Control incoming_active stat because he's already 0.
* 14:29:48.399 May 19: ISAKMP (0:2081): return address 192.168.0.21 to pool
* 14:29:48.399 May 19: ISAKMP: Unlocking counterpart struct 0 x 84084990 for isadb_mark_sa_deleted(), count 0
* 14:29:48.399 May 19: ISAKMP: return address 192.168.0.21 to pool
* 14:29:48.399 May 19: ISAKMP: delete peer node by peer_reap for 151.38.197.143: 84084990
* 14:29:48.399 May 19: ISAKMP: return address 192.168.0.21 to pool
* 14:29:48.403 May 19: ISAKMP: (2081): node-1427983983 error suppression FALSE reason 'IKE deleted.
* 14:29:48.403 May 19: ISAKMP: (2081): error suppression node 1322685842 FALSE reason 'IKE deleted.
* 14:29:48.403 May 19: ISAKMP: (2081): node-851463821 error suppression FALSE reason 'IKE deleted.
* 14:29:48.403 May 19: ISAKMP: (2081): error suppression node 1834509506 FALSE reason 'IKE deleted.
* 14:29:48.403 May 19: ISAKMP: (2081): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH
* 14:29:48.403 May 19: ISAKMP: (2081): former State = new State IKE_DEST_SA = IKE_DEST_SA
* 19 May 14:29:48.403: IPSEC (key_engine): had an event of the queue with 1 KMI message (s)
It seems 877 comes even to assign a local ip address of LAN for Iphone (192.168.0.21) but then something goes wrong...
Any idea or suggestion on this?
Thank you very much
Hi Federico,.
Please let us know.
Please mark this message as answered while others will be able to learn the lessons.
Thank you.
Portu.
-
ASA 5520: Remote VPN Clients cannot ping LAN, Internet
I've set up a few of them in my time, but I am confused with this one. Can I establish connect via VPN tunnel but I can't ping or go on the internet. I searched the forum for similar and found a little issues, but none of the fixes seem to match. I noticed a strange thing is when I run ipconfig/all of the vpn client, the IP address that has been leased over the Pool of the VPN is also the default gateway!
I have attached the config. Help, please.
Thank you!
Exemption of NAT ACL has not yet been applied.
NAT (inside) 0-list of access Inside_nat0_outbound
In addition, you have not split tunnel, not sure you were using internet ASA for the vpn client internet browsing.
You can also enable icmp inspection if you test in scathing:
Policy-map global_policy
class inspection_defaultinspect the icmp
Hope that helps.
-
The VPN Clients cannot Ping hosts
I'll include a post my config. I have clients that connect through the VPN tunnel on the 180.0.0.0/24 network, 192.168.1.0/24 is the main network for the office.
I can connect to the VPN, and I received a correct address assignment. I belive tunneling can be configured correctly in the aspect that I can always connect to the internet then on the VPN, but I can't ping all hosts on the 192.168.1.0 network. In the journal of the ASDM debugging, I see pings to the ASA, but no response is received on the client.
6 February 21, 2013 21:54:26 180.0.0.1 53508 192.168.1.1 0 Built of ICMP incoming connections for faddr gaddr laddr 192.168.1.1/0 (christopher) 192.168.1.1/0 180.0.0.1/53508 Any help would be greatly appreciated, I'm currently presuring my CCNP so I would get a deeper understanding of how to resolve these issues.
-Chris
hostname RegencyRE - ASA
domain regencyrealestate.info
activate 2/VA7dRFkv6fjd1X of encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
name 180.0.0.0 Regency
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
link to the description of REGENCYSERVER
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
link to the description of RegencyRE-AP
!
interface Vlan1
nameif inside
security-level 100
192.168.1.120 IP address 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP x.x.x.x 255.255.255.248
!
passive FTP mode
clock timezone PST - 8
clock summer-time recurring PDT
DNS lookup field inside
DNS domain-lookup outside
DNS server-group DefaultDNS
Server name 208.67.220.220
name-server 208.67.222.222
domain regencyrealestate.info
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 Regency 255.255.255.224
RegencyRE_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
outside_access_in list extended access permit icmp any one
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
mask Regency 180.0.0.1 - 180.0.0.20 255.255.255.0 IP local pool
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM 255.255.255.0 inside Regency location
ASDM location 192.168.0.0 255.255.0.0 inside
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
Access-group outside_access_in in interface outside
Route outside 0.0.0.0 0.0.0.0 12.186.110.2 1
Route inside 192.0.0.0 255.0.0.0 192.168.1.102 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
LOCAL AAA authentication serial console
http server enable 8443
http 0.0.0.0 0.0.0.0 outdoors
http 0.0.0.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 inside
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 15
SSH version 2
Console timeout 0
dhcprelay Server 192.168.1.102 inside
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 69.25.96.13 prefer external source
NTP server 216.171.124.36 prefer external source
WebVPN
internal RegencyRE group strategy
attributes of Group Policy RegencyRE
value of server DNS 208.67.220.220 208.67.222.222
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list RegencyRE_splitTunnelAcl
username password encrypted adriana privilege 0
christopher encrypted privilege 15 password username
irene encrypted password privilege 0 username
type tunnel-group RegencyRE remote access
attributes global-tunnel-group RegencyRE
Regency address pool
Group Policy - by default-RegencyRE
IPSec-attributes tunnel-group RegencyRE
pre-shared key R3 & eNcY1.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
Review the ip options
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
Cryptochecksum:35bc3a41701f7f8e9dde5fa35532896d
: end
Hello
-be sure that the destination host 192.168.1.x has a route towards 180.0.0.0 by the ASA gateway.
-Configure the following figure:
capture capin interface inside match icmp 192.168.1.x host 180.0.0.x
capture ASP asp type - drop all
then make a continuous ping and get 'show capin cap' and 'asp cap.
-then check the ping, the 'encrypted' counter is increasing in the VPN client statistics
I would like to know about it, hope this helps
----
Mashal
-
Cisco ASA 5510 - Cisco Client can connect to the VPN but cannot Ping!
Hello
I have an ASA 5510 with the configuration below. I have configure the ASA as vpn server for remote access with cisco vpn client, now my problem is that I can connect but I can not ping.
Config
ciscoasa # sh run
: Saved
:
ASA Version 8.0 (3)
!
ciscoasa hostname
activate the 5QB4svsHoIHxXpF password / encrypted
names of
xxx.xxx.xxx.xxx SAP_router_IP_on_SAP name
xxx.xxx.xxx.xxx ISA_Server_second_external_IP name
xxx.xxx.xxx.xxx name Mail_Server
xxx.xxx.xxx.xxx IncomingIP name
xxx.xxx.xxx.xxx SAP name
xxx.xxx.xxx.xxx Web server name
xxx.xxx.xxx.xxx cms_eservices_projects_sharepointold name
isa_server_outside name 192.168.2.2
!
interface Ethernet0/0
nameif outside
security-level 0
address IP IncomingIP 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
IP 192.168.2.1 255.255.255.0
!
interface Ethernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
nameif management
security-level 100
IP 192.168.1.253 255.255.255.0
management only
!
passwd 123
passive FTP mode
clock timezone IS 2
clock summer-time EEDT recurring last Sun Mar 03:00 last Sun Oct 04:00
TCP_8081 tcp service object-group
EQ port 8081 object
DM_INLINE_TCP_1 tcp service object-group
EQ port 3389 object
port-object eq ftp
port-object eq www
EQ object of the https port
EQ smtp port object
EQ Port pop3 object
port-object eq 3200
port-object eq 3300
port-object eq 3600
port-object eq 3299
port-object eq 3390
EQ port 50000 object
port-object eq 3396
port-object eq 3397
port-object eq 3398
port-object eq imap4
EQ port 587 object
port-object eq 993
port-object eq 8000
EQ port 8443 object
port-object eq telnet
port-object eq 3901
purpose of group TCP_8081
EQ port 1433 object
port-object eq 3391
port-object eq 3399
EQ object of port 8080
EQ port 3128 object
port-object eq 3900
port-object eq 3902
port-object eq 7777
port-object eq 3392
port-object eq 3393
port-object eq 3394
Equalizer object port 3395
port-object eq 92
port-object eq 91
port-object eq 3206
port-object eq 8001
EQ port 8181 object
object-port 7778 eq
port-object eq 8180
port-object 22222 eq
port-object eq 11001
port-object eq 11002
port-object eq 1555
port-object eq 2223
port-object eq 2224
object-group service RDP - tcp
EQ port 3389 object
3901 tcp service object-group
3901 description
port-object eq 3901
object-group service tcp 50000
50000 description
EQ port 50000 object
Enable_Transparent_Tunneling_UDP udp service object-group
port-object eq 4500
access-list connection to SAP Note inside_access_in
inside_access_in to access extended list ip 192.168.2.0 allow 255.255.255.0 host SAP_router_IP_on_SAP
access-list inside_access_in note outgoing VPN - PPTP
inside_access_in list extended access permitted tcp 192.168.2.0 255.255.255.0 any eq pptp
access-list inside_access_in note outgoing VPN - GRE
inside_access_in list extended access allow accord 192.168.2.0 255.255.255.0 any
Comment from inside_access_in-list of access VPN - GRE
inside_access_in list extended access will permit a full
access-list inside_access_in note outgoing VPN - Client IKE
inside_access_in list extended access permitted udp 192.168.2.0 255.255.255.0 any isakmp eq
Comment of access outgoing VPN - IPSecNAT - inside_access_in-list T
inside_access_in list extended access permitted udp 192.168.2.0 255.255.255.0 any eq 4500
Note to inside_access_in of outgoing DNS list access
inside_access_in list extended access udp allowed any any eq field
Note to inside_access_in of outgoing DNS list access
inside_access_in list extended access permit tcp any any eq field
Note to inside_access_in to access list carried forward Ports
inside_access_in list extended access permitted tcp 192.168.2.0 255.255.255.0 any DM_INLINE_TCP_1 object-group
access extensive list ip 172.16.1.0 inside_access_in allow 255.255.255.0 any
outside_access_in of access allowed any ip an extended list
outside_access_in list extended access permit tcp any any eq pptp
outside_access_in list extended access will permit a full
outside_access_in list extended access allowed grateful if any host Mail_Server
outside_access_in list extended access permit tcp any host Mail_Server eq pptp
outside_access_in list extended access allow esp a whole
outside_access_in ah allowed extended access list a whole
outside_access_in list extended access udp allowed any any eq isakmp
outside_access_in list of permitted udp access all all Enable_Transparent_Tunneling_UDP object-group
list of access allowed standard VPN 192.168.2.0 255.255.255.0
corp_vpn to access extended list ip 192.168.2.0 allow 255.255.255.0 172.16.1.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
management of MTU 1500
pool POOL 172.16.1.10 - 172.16.1.20 255.255.255.0 IP mask
no failover
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 603.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global (outside) 2 Mail_Server netmask 255.0.0.0
Global 1 interface (outside)
Global interface (2 inside)
NAT (inside) 0-list of access corp_vpn
NAT (inside) 1 0.0.0.0 0.0.0.0
static (inside, outside) tcp Mail_Server 8001 8001 ISA_Server_second_external_IP netmask 255.255.255.255
static (inside, outside) tcp Mail_Server 8000 ISA_Server_second_external_IP 8000 netmask 255.255.255.255
static (inside, outside) tcp Mail_Server pptp pptp netmask 255.255.255.255 isa_server_outside
public static tcp (indoor, outdoor) Mail_Server smtp smtp isa_server_outside mask 255.255.255.255 subnet
static (inside, outside) tcp 587 Mail_Server isa_server_outside 587 netmask 255.255.255.255
static (inside, outside) tcp Mail_Server 9444 isa_server_outside 9444 netmask 255.255.255.255
static (inside, outside) tcp 9443 Mail_Server 9443 netmask 255.255.255.255 isa_server_outside
static (inside, outside) tcp 3389 3389 netmask 255.255.255.255 isa_server_outside Mail_Server
static (inside, outside) tcp 3390 Mail_Server 3390 netmask 255.255.255.255 isa_server_outside
static (inside, outside) tcp Mail_Server 3901 isa_server_outside 3901 netmask 255.255.255.255
static (inside, outside) tcp SAP 50000 50000 netmask 255.255.255.255 isa_server_outside
static (inside, outside) tcp SAP 3200 3200 netmask 255.255.255.255 isa_server_outside
static (inside, outside) SAP 3299 isa_server_outside 3299 netmask 255.255.255.255 tcp
static (inside, outside) tcp Mail_Server www isa_server_outside www netmask 255.255.255.255
static (inside, outside) tcp Mail_Server https isa_server_outside https netmask 255.255.255.255
static (inside, outside) tcp Mail_Server pop3 pop3 netmask 255.255.255.255 isa_server_outside
static (inside, outside) tcp imap4 Mail_Server imap4 netmask 255.255.255.255 isa_server_outside
static (inside, outside) tcp cms_eservices_projects_sharepointold 9999 9999 netmask 255.255.255.255 isa_server_outside
public static 192.168.2.0 (inside, outside) - corp_vpn access list
Access-group outside_access_in in interface outside
inside_access_in access to the interface inside group
Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout, uauth 0:05:00 absolute
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.2.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 management
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp - esp-md5-hmac transet
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto-map dynamic dynmap 10 set pfs
Crypto-map dynamic dynmap 10 transform-set ESP-3DES-SHA transet
cryptomap 10 card crypto ipsec-isakmp dynamic dynmap
cryptomap interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
3des encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 192.168.2.0 255.255.255.0 inside
Telnet 192.168.1.0 255.255.255.0 management
Telnet timeout 5
SSH timeout 5
Console timeout 0
dhcpd dns xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx interface inside
dhcpd domain.local domain inside interface
!
a basic threat threat detection
host of statistical threat detection
Statistics-list of access threat detection
Management Server TFTP 192.168.1.123.
internal group mypolicy strategy
mypolicy group policy attributes
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value VPN
Pseudo vpdn password 123
vpdn username attributes
VPN-group-policy mypolicy
type of remote access service
type mypolicy tunnel-group remote access
tunnel-group mypolicy General attributes
address-pool
strategy-group-by default mypolicy
tunnel-group mypolicy ipsec-attributes
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
inspect the pptp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:b8bb19b6cb05cfa9ee125ad7bc5444ac
: end
Thank you very much.
Hello
You probably need
Policy-map global_policy
class inspection_default
inspect the icmp
inspect the icmp error
Your Tunnel of Split and NAT0 configurations seem to.
-Jouni
-
The VPN Clients cannot access any internal address
Without a doubt need help from an expert on this one...
Attempting to define a client access on an ASA 5520 VPN that was used only as a
Firewall so far. The ASA has been recently updated to Version 7.2 (4).
Problem: Once connected, VPN client cannot access anything whatsoever. Client VPN cannot
ping any address on internal networks, or even the inside interface of the ASA.
(I hope) Relevant details:
(1) the tunnel seems to be upward. Customers are the authenticated by the SAA and
are able to connect.
(2) by many other related posts, I ran a ' sh crypto ipsec her "to see the output: it
appears that the packets are décapsulés and decrypted, but NOT encapsulated or
encrypted (see the output of "sh crypto ipsec his ' home).
(3) by the other related posts, we've added commands associated with inversion of NAT (crypto
ISAKMP nat-traversal 20
crypto ISAKMP ipsec-over-port tcp 10000). These were in fact absent from our
Configuration.
(4) we tried encapsulation TCP and UDP encapsulation with experimental client
profiles: same result in both cases.
(5) if I (attempt) ping to an internal IP address of the connected customer, the
real-time log entries ASA show the installation and dismantling of the ICMP requests to the
the inner target customer.
(6) the capture of packets to the internal address (one that we try to do a ping of the)
VPN client) shows that the ICMP request has been received and answered. (See attachment
shooting).
(7) our goal is to create about 10 VPN client of different profiles, each with
different combinations of access to the internal VLAN or DMZ VLAN. We do not have
preferences for the type of encryption or method, as long as it is safe and it works: that
said, do not hesitate to recommend a different approach altogether.
We have tried everything we can think of, so any help or advice would be greatly
Sanitized the ASA configuration is also attached.
appreciated!
Thank you!
It should be the last step :)
on 6509
IP route 172.16.100.0 255.255.255.0 172.16.20.2
and ASA
no road inside 172.16.40.0 255.255.255.0 172.16.20.2
-
Cannot access remote resources - Cisco VPN Client
I'm having a problem with my Cisco VPN Client. I am new to VPN configuration, so this is probably something easy I'm missing. I have a my internet gateway for my LAN 2611XM router and my VPN server. I do all my tests of a society with a high card laptop mobile broadband. VPN connects, but anytime I ping anything in the network Cabinet, he returned with the public IP address of the external interface. I have NAT overload configured so any network can access the internet, inside which it looks like may be causing my problem. I don't know how to fix it. My config running is attatched. No one knows what might happen.
Oh, almost forgot to add. When I remove the nat overload on my interface fa0/1, the vpn will connect to any resource on the inside.
Your nat configuration seems to be the origin of the problem. If you are using an ACL to match the source for NAT, then it will be necessary to add the line 1A refuse for the local ip pool for your vpn clients to one only. try that to see how it goes.
Sent by Cisco Support technique iPhone App
-
WAG320N - LAN clients cannot ping clients WLAN.
Hi all
I wonder if you can help. I currently have a router WAG320N, which seems to work out for a small problem.
However, the problem I am facing is that my LAN clients cannot ping my clients wireless and vice versa.
I googled this problem which has recommended that the AP isolation is off which is was by default.
Any other ideas?
Thanking in advance.
Sprite
As you are not able to ping customers wireless to wireline customers. Turn on the isolation of the AP.
See if that helps you.
-
Cannot access network resources - Cisco VPN client
Please see attached the network topology.
I can connect using the Cisco VPN client and access to all resources of the 192.168.3.0 network
I can't ping / access to all hosts on the network 192.168.5.0.
Any ideas?
Thanks for the help in advance
AD
Quite correct.
Please add has the access list:
CPA list standard access allowed 192.168.5.0 255.255.255.0
-
Cisco vpn client to connect but can not access to the internal network
Hi all
I have a VPN configured on cisco 5540. My vpn was working fine, but suddenly there is a question that the cisco vpn client to connect but can not access to the internal network
Any help would be much appreciated.
Hi Samir,
I suggest that you go to the ASA and check the configuration to make sure that it complies with the requirements according to the reference below link:
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml
(The link above includes split tunneling, but this is just an option.
Please paste the output of "sh cry ipsec his" here so that we can check if phase 2 is properly trained. I would say as you go to IPSEC vpn client on your PC and check increment in packets sent and received in the window 'status '.
Let me know if this can help,
See you soon,.
Christian V
-
Cisco VPN Client anything cannot access through VPN on an ASA5505 8.4
Hello
Completely new to Cisco ASA and the need to get this working ASAP.
8.4 (1) ASA 5505 is the secondary FW and I need to authorize all out and block everything coming, but for the VPN clients. Since a jerk of Cisco, I used the ASDM and it's sorcerers to make this work, which may explain my situation.
192.168.101.0/24 is the local network
192.168.101.5 is the IP of ASA
192.168.101.2 is the primary FW (and the default gateway for servers, I have to access through the VPN)
10.10.101.0/24 is the VPN IP range (this can be what you want, I'm not married to it somehow)
My Cisco VPN Client connects to the ASA and receives 10.10.101.1 IP address, but I get no connectivity to the ASA or any other 192.168.101.x or service server (tried RDP, telnet, ping, etc.)
Configuration file is attached.
Help pretty please!
Thank you.
Did you add a route for the VPN Pool on the main firewall to the ASA?
Best regards
Peer
Sent by Cisco Support technique iPad App
-
Dear all,
I have cisco vpn client v5.0.05.
1 / when I lunch the customer, it connect to the asa, so I can't reach the network behind my ASA
2 / when connected to the vpn client, I can not use my access to the internet, I configured splitunnel, but does not.
3 / sometimes, cisco vpn client disable my network ip of the gateway card.
Please, can someone help me?
Concerning
Can you please share the configuration of the SAA. There is no specific configuration that must be done on the vpn client.
-
PIX: Cisco VPN Client connects but no routing
Hello
We have a Cisco PIX 515 with software 7.1 (2). He accepts Cisco VPN Client connections with no problems, but no routing does to internal networks directly connected to the PIX. For example, my PC is affected by the IP 172.16.2.57 and then ping does not respond to internal Windows server 172.16.0.12 or trying to RDP. The most irritating thing is that these attempts are recorded in the system log, but always ended with "SYN timeout", as follows:
2009-01-06 23:23:01 Local4.Info 217.15.42.214% 302013-6-PIX: built 3315917 for incoming TCP connections (172.16.2.57/1283) outside:172.16.2.57/1283 inside: ALAI2 / 3389 (ALAI2/3389)
2009-01-06 23:23:31 Local4.Info 217.15.42.214% 302014-6-PIX: TCP connection disassembly 3315917 for outside:172.16.2.57/1283 inside: ALAI2 / 3389 duration 0:00:30 bytes 0 SYN Timeout
2009-01-06 23:23:31 Local4.Debug 217.15.42.214% 7-PIX-609002: duration of disassembly-outside local host: 172.16.2.57 0:00:30
We tried to activate and deactivate "nat-control", "permit same-security-traffic inter-interface" and "permit same-security-traffic intra-interface", but the results are the same: the VPN connection is successfully established, but remote clients cannot reach the internal servers.
I enclose the training concerned in order to understand the problem:
interface Ethernet0
Speed 100
full duplex
nameif outside
security-level 0
IP address xx.yy.zz.tt 255.255.255.240
!
interface Ethernet1
nameif inside
security-level 100
172.16.0.1 IP address 255.255.255.0
!
access extensive list ip 172.16.0.0 inside_nat0_outbound allow 255.255.255.0 172.16.2.56 255.255.255.248
!
access extensive list ip 172.16.0.0 outside_cryptomap_dyn_20 allow 255.255.255.0 172.16.2.56 255.255.255.248
!
VPN_client_group_splitTunnelAcl list standard access allowed 172.16.0.0 255.255.255.0
!
IP local pool pool_vpn_clientes 172.16.2.57 - 172.16.2.62 mask 255.255.255.248
!
NAT-control
Global xx.yy.zz.tt 12 (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 12 172.16.0.12 255.255.255.255
!
internal VPN_clientes group strategy
attributes of Group Policy VPN_clientes
xxyyzz.NET value by default-field
internal VPN_client_group group strategy
attributes of Group Policy VPN_client_group
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list VPN_client_group_splitTunnelAcl
xxyyzz.local value by default-field
!
I join all the details of the cryptographic algorithms because the VPN is successfully completed, as I said at the beginning. In addition, routing tables are irrelevant in my opinion, because the inaccessible hosts are directly connected to the internal LAN of the PIX 515.
Thank you very much.
can you confirm asa have NAT traversal allow otherwise, activate it in asa and vpn clients try again.
PIX / ASA 7.1 and earlier versions
PIX (config) #isakmp nat-traversal 20
PIX / ASA 7.2 (1) and later versions
PIX (config) #crypto isakmp nat-traversal 20
-
Another problem with the configuration of Cisco VPN Client access VPN Site2site
We have a Cisco ASA 5505 at our CORP. branch I configured the VPN Site2Site to our COLO with a Juniper SRX220h, to another site works well, but when users access the home Cisco VPN client, they cannot ping or SSH through the Site2Site. JTACS contacted and they said it is not on their end, so I tried to contact Cisco TAC, no support. So here I am today, after for the 3 days (including Friday of last week) of searching the Internet for more than 6 hours per day and try different examples of other users. NO LUCK. The VPN client shows the route secure 10.1.0.0
Sorry to post this, but I'm frustrated and boss breathing down my neck to complete it.
CORP netowrk 192.168.1.0
IP VPN 192.168.12.0 pool
Colo 10.1.0.0 internal ip address
Also, here's an example of my config ASA
: Saved
:
ASA Version 8.2 (1)
!
hostname lwchsasa
names of
name 10.1.0.1 colo
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
interface Vlan2
backup interface Vlan12
nameif outside_pri
security-level 0
IP 64.20.30.170 255.255.255.248
!
interface Vlan12
nameif backup
security-level 0
IP 173.165.159.241 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport access vlan 12
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
object-group network NY
object-network 192.168.100.0 255.255.255.0
BSRO-3387 tcp service object-group
port-object eq 3387
BSRO-3388 tcp service object-group
port-object eq 3388
BSRO-3389 tcp service object-group
EQ port 3389 object
object-group service tcp OpenAtrium
port-object eq 8100
object-group service Proxy tcp
port-object eq 982
VOIP10K - 20K udp service object-group
10000 20000 object-port Beach
the clientvpn object-group network
object-network 192.168.12.0 255.255.255.0
APEX-SSL tcp service object-group
Description of Apex Dashboard Service
port-object eq 8586
object-group network CHS-Colo
object-network 10.1.0.0 255.255.255.0
the DM_INLINE_NETWORK_1 object-group network
object-network 192.168.1.0 255.255.255.0
host of the object-Network 64.20.30.170
object-group service DM_INLINE_SERVICE_1
the purpose of the ip service
ICMP service object
service-object icmp traceroute
the purpose of the service tcp - udp eq www
the tcp eq ftp service object
the purpose of the tcp eq ftp service - data
the eq sqlnet tcp service object
EQ-ssh tcp service object
the purpose of the service udp eq www
the eq tftp udp service object
object-group service DM_INLINE_SERVICE_2
the purpose of the ip service
ICMP service object
EQ-ssh tcp service object
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 clientvpn object-group
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY
inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo
inside_nat0_outbound list of allowed ip extended access any 192.168.12.0 255.255.255.0
outside_pri_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY
outside_pri_access_in list extended access permit tcp any interface outside_pri eq www
outside_pri_access_in list extended access permit tcp any outside_pri eq https interface
outside_pri_access_in list extended access permit tcp any interface outside_pri eq 8100
outside_pri_access_in list extended access permit tcp any outside_pri eq idle ssh interface
outside_pri_access_in list extended access permit icmp any any echo response
outside_pri_access_in list extended access permit icmp any any source-quench
outside_pri_access_in list extended access allow all unreachable icmp
outside_pri_access_in list extended access permit icmp any one time exceed
outside_pri_access_in list extended access permit tcp any 64.20.30.168 255.255.255.248 eq 8586
levelwingVPN_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
levelwingVPN_splitTunnelAcl list standard access allowed 10.1.0.0 255.255.255.0
outside_pri_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo
backup_nat0_outbound list extended access allowed object-group DM_INLINE_NETWORK_1 192.168.12.0 ip 255.255.255.0
outside_pri_cryptomap_1 list extended access allow DM_INLINE_SERVICE_2 of object-group 192.168.1.0 255.255.255.0 10.1.0.0 255.255.255.0
outside_19_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0
inside_nat0_outbound_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo
VPN-Corp-Colo extended access list permits object-group DM_INLINE_SERVICE_1 192.168.12.0 255.255.255.0 10.1.0.0 255.255.255.0
Note to OUTSIDE-NAT0 NAT0 customer VPN remote site access-list
OUTSIDE-NAT0 192.168.12.0 ip extended access list allow 255.255.255.0 10.1.0.0 255.255.255.0
L2LVPN to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0
pager lines 24
Enable logging
debug logging in buffered memory
exploitation forest asdm warnings
record of the rate-limit unlimited level 4
destination of exports flow inside 192.168.1.1 2055
timeout-rate flow-export model 1
Within 1500 MTU
outside_pri MTU 1500
backup of MTU 1500
local pool LVCHSVPN 192.168.12.100 - 192.168.12.254 255.255.255.0 IP mask
no failover
ICMP unreachable rate-limit 100 burst-size 5
ICMP allow any inside
ICMP allow any outside_pri
don't allow no asdm history
ARP timeout 14400
NAT-control
interface of global (outside_pri) 1
Global 1 interface (backup)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access
NAT (inside) 1 0.0.0.0 0.0.0.0
NAT (outside_pri) 0-list of access OUTSIDE-NAT0
backup_nat0_outbound (backup) NAT 0 access list
static TCP (inside outside_pri) interface https 192.168.1.45 https netmask 255.255.255.255 dns
static TCP (inside outside_pri) interface 192.168.1.45 www www netmask 255.255.255.255 dns
static TCP (inside outside_pri) interface 8586 192.168.1.45 8586 netmask 255.255.255.255 dns
static (inside, inside) tcp interface 8100 192.168.1.45 8100 netmask 255.255.255.255 dns
Access-group outside_pri_access_in in the outside_pri interface
Route 0.0.0.0 outside_pri 0.0.0.0 64.20.30.169 1 track 1
Backup route 0.0.0.0 0.0.0.0 173.165.159.246 254
Timeout xlate 03:00
Conn Timeout 0:00:00 half-closed 0:30:00 udp icmp from 01:00 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 01:00 uauth uauth absolute inactivity from 01:00
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
AAA authentication enable LOCAL console
AAA authentication http LOCAL console
the ssh LOCAL console AAA authentication
http server enable 981
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside_pri
http 0.0.0.0 0.0.0.0 backup
SNMP server group Authentication_Only v3 auth
SNMP-server host inside 192.168.1.47 survey community lwmedia version 2 c
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Sysopt connection tcpmss 1200
monitor SLA 123
type echo protocol ipIcmpEcho 216.59.44.220 interface outside_pri
Annex ALS life monitor 123 to always start-time now
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set esp-3des-sha1 esp-3des esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto ipsec df - bit clear-df outside_pri
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
card crypto outside_pri_map 1 match address outside_pri_1_cryptomap
card crypto outside_pri_map 1 set pfs
peer set card crypto outside_pri_map 1 50.75.217.246
card crypto outside_pri_map 1 set of transformation-ESP-AES-256-MD5
card crypto outside_pri_map 2 match address outside_pri_cryptomap
peer set card crypto outside_pri_map 2 216.59.44.220
card crypto outside_pri_map 2 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
86400 seconds, duration of life card crypto outside_pri_map 2 set security-association
card crypto outside_pri_map 3 match address outside_pri_cryptomap_1
peer set card crypto outside_pri_map 3 216.59.44.220
outside_pri_map crypto map 3 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
outside_pri_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
card crypto outside_pri_map interface outside_pri
crypto isakmp identity address
ISAKMP crypto enable outside_pri
crypto ISAKMP policy 5
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 10
preshared authentication
the Encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
md5 hash
Group 2
life 86400
crypto ISAKMP policy 50
preshared authentication
aes encryption
md5 hash
Group 2
life 86400
!
track 1 rtr 123 accessibility
Telnet timeout 5
SSH 192.168.1.0 255.255.255.0 inside
SSH timeout 5
Console timeout 0
management-access inside
dhcpd auto_config outside_pri
!
dhcpd address 192.168.1.51 - 192.168.1.245 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
rental contract interface 86400 dhcpd inside
dhcpd field LM inside interface
dhcpd allow inside
!
a basic threat threat detection
statistical threat detection port
Statistical threat detection Protocol
Statistics-list of access threat detection
a statistical threat detection host number rate 2
no statistical threat detection tcp-interception
WebVPN
port 980
allow inside
Select outside_pri
enable SVC
attributes of Group Policy DfltGrpPolicy
VPN-idle-timeout no
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
internal GroupPolicy2 group strategy
attributes of Group Policy GroupPolicy2
Protocol-tunnel-VPN IPSec svc
internal levelwingVPN group policy
attributes of the strategy of group levelwingVPN
Protocol-tunnel-VPN IPSec svc webvpn
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list levelwingVPN_splitTunnelAcl
username password encrypted Z74.JN3DGMNlP0H2 privilege 0 aard
aard attribute username
VPN-group-policy levelwingVPN
type of remote access service
rcossentino 4UpCXRA6T2ysRRdE encrypted password username
username rcossentino attributes
VPN-group-policy levelwingVPN
type of remote access service
bcherok evwBWqKKwrlABAUp encrypted password username
username bcherok attributes
VPN-group-policy levelwingVPN
type of remote access service
rscott nIOnWcZCACUWjgaP encrypted password privilege 0 username
rscott username attributes
VPN-group-policy levelwingVPN
sryan 47u/nJvfm6kprQDs password encrypted username
sryan username attributes
VPN-group-policy levelwingVPN
type of nas-prompt service
username, password cbruch a8R5NwL5Cz/LFzRm encrypted privilege 0
username cbruch attributes
VPN-group-policy levelwingVPN
type of remote access service
apellegrino yy2aM21dV/11h7fR password encrypted username
username apellegrino attributes
VPN-group-policy levelwingVPN
type of remote access service
username rtuttle encrypted password privilege 0 79ROD7fRw5C4.l5
username rtuttle attributes
VPN-group-policy levelwingVPN
username privilege 15 encrypted password vJFHerTwBy8dRiyW levelwingadmin
username password nbrothers Amjc/rm5PYhoysB5 encrypted privilege 0
username nbrothers attributes
VPN-group-policy levelwingVPN
clong z.yb0Oc09oP3/mXV encrypted password username
clong attributes username
VPN-group-policy levelwingVPN
type of remote access service
username, password finance 9TxE6jWN/Di4eZ8w encrypted privilege 0
username attributes finance
VPN-group-policy levelwingVPN
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
type of remote access service
IPSec-attributes tunnel-group DefaultL2LGroup
Disable ISAKMP keepalive
tunnel-group 50.75.217.246 type ipsec-l2l
IPSec-attributes tunnel-group 50.75.217.246
pre-shared-key *.
Disable ISAKMP keepalive
type tunnel-group levelwingVPN remote access
tunnel-group levelwingVPN General-attributes
address LVCHSVPN pool
Group Policy - by default-levelwingVPN
levelwingVPN group of tunnel ipsec-attributes
pre-shared-key *.
tunnel-group 216.59.44.221 type ipsec-l2l
IPSec-attributes tunnel-group 216.59.44.221
pre-shared-key *.
tunnel-group 216.59.44.220 type ipsec-l2l
IPSec-attributes tunnel-group 216.59.44.220
pre-shared-key *.
Disable ISAKMP keepalive
!
!
!
Policy-map global_policy
!
context of prompt hostname
Cryptochecksum:ed7f4451c98151b759d24a7d4387935b
: end
Hello
It seems to me that you've covered most of the things.
You however not "said" Configuring VPN L2L that traffic between the pool of VPN and network camp should be in tunnel
outside_pri_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 object-group CHS-Colo
Although naturally the remote end must also the corresponding configurations for users of VPN clients be able to pass traffic to the site of the camp.
-Jouni
-
Cisco VPN client + VPN site-to-site
Hi all
I have two ASA5505 with a site to site VPN.
One of the ASA is connected to the internal network 192.168.150.0.
It is connected to 192.168.151.0.
I also configured IPSec Cisco VPN client that is connected to 192.168.150.0.
I would like to know if it is possible for a connected with the Cisco VPN client to access the 192.168.151.0 by the site-to-site VPN network.
Thank you!
Hello
If you mean that the IP addresses of the VPN Pool are something like 192.168.150.x then I suggest to use a totally different network than those used on LANs.
At the software level 9.1 basically causes changes to how are the NAT0 configurations.
MAIN SITE
network of the VPN-POOL object
subnet x.x.x.x y.y.y.y
being REMOTE-LAN network
192.168.151.0 subnet 255.255.255.0
destination of static NAT VPN VPN-POOL POOL (outdoors, outdoor) static REMOTE - LAN LAN
REMOTE SITE
network of the VPN-POOL object
subnet x.x.x.x y.y.y.y
the object of the LAN network
192.168.151.0 subnet 255.255.255.0
NAT static destination LAN LAN (indoor, outdoor) static source VPN-VPN-POOL
Otherwise, I would imagine that the same kind of configurations above apply. You need the ' same-security-movement ' command to allow the 'outside' to ' outside ' of the movement. You will have to ensure that the ACL from Tunnel Split contains the remote site network. And of course, you should make sure that the ACL crypto sets / include traffic between VPN pool and the network 192.168.151.0/24 on both sides ASAs.
-Jouni
Maybe you are looking for
-
Need to install the offline version full of Firefox 36.0.4
I need to download the full version of Firefox 36.0.4 but the "Stub" version seems to be the only version that's out there. I always download from this site, 'https://www.mozilla.org/en-US/firefox/all/', but for some reason any the "Stub" version is
-
No idea is irrelevant: I turned off my computer before windows update has been completed
I turned my computer off without completing the update. I tried drinking it won't work. My recovery disk gives me error: 0100 1404 1405 1406 1407 140 a 1409 1415 2AC2. But it of the good Dvd and is the only one that does nothing (charges) on three di
-
Has anyone experience by accessing a generic Windows DLLS in LabView? I want to use properties Prode (see 'prode.com') for the calculation of the thermodynamic properties required by a control system based on LabView, I am able to access the C dll, C
-
Hello my Dell E6510 I have my hard drive put in RAID mode. I have problems using the eSata port, so I want to switch to AHCI. I followed the instructions here:http://support.microsoft.com/kb/922976. However, when I start my system after setting the d
-
How to upgrade an ASA 5510/20
I have several ASA 5510 and 5520 requiring an update and I tried to find a way to automate the process. Many of the features are running in active/active mode (primary is active and the secondary is in standby mode). I'm looking through the ADSM feat