Client connected to the remote access VPN, but got the wrong default gateway
Hi all
I struggled for a few days and really need some help here. My PC (192.168.254.x) is on the same vlan with external interface (192.168.254.171) to my PIX506E. When I run the Cisco VPN client, my PC shows connected and gets the IP address of 10.9.0.150 that is expected. However, it also gets the entry door of 10.9.0.1 that I have no idea where it came from. So my PC can not access any external or internal network.
I've listed below the configuration of my and highlighted the part that I typed in. PIX version 7.1 (2) is the latest version that I can install on PIX506E. Help, please. Thank you very much.
pixfirewall # sh run
: Saved
:
PIX Version 7.1 (2)
!
pixfirewall hostname
activate 2KFQnbNIdI.2KYOU encrypted password
names of
!
interface Ethernet0
nameif outside
security-level 0
IP 192.168.254.171 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
IP 10.10.10.1 255.255.255.0
!
2KFQnbNIdI.2KYOU encrypted passwd
Flash: / pix712.bin starting system
passive FTP mode
pager lines 24
Enable logging
timestamp of the record
logging buffered information
Outside 1500 MTU
Within 1500 MTU
10.9.0.150 mask - local 10.9.0.160 ROBERT-pool IP 255.255.255.0
don't allow no asdm history
ARP timeout 14400
Route outside 0.0.0.0 0.0.0.0 192.168.254.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00
Timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
Timeout, uauth 0:05:00 absolute
internal group strategy Robert-GP
attributes of Group Policy GP-Robert
value of server DNS 8.8.8.8
username cisco password encrypted privilege 15 3USUcOPFUiMCO4Jk
robert yXUoa8oHzS0Ncp2O of encrypted password username
robert username attributes
Strategy Group-VPN-Robert-GP
the ssh LOCAL console AAA authentication
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT
Dynamic crypto map DYN1 1 set of transformation-RIGHT
Dynamic crypto map DYN1 1jeu reverse-road
map MYMAP 1 ipsec-isakmp dynamic DYN1 crypto
MYMAP outside crypto map interface
ISAKMP allows outside
part of pre authentication ISAKMP policy 1
ISAKMP policy 1 3des encryption
ISAKMP policy 1 sha hash
Group of ISAKMP policy 1 2
ISAKMP policy 1 life 43200
ISAKMP nat-traversal 30
tunnel-GROUP ROBERT type ipsec-ra
tunnel-group ROBERT-General-attributes
address-pool ROBERT-
Group Policy - by default-Robert-GP
tunnel-group ROBERT-GROUP ipsec-attributes
pre-shared-key *.
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH 0.0.0.0 0.0.0.0 inside
SSH timeout 60
SSH version 2
Console timeout 0
SSL rc4 - md5 encryption
Cryptochecksum:7157c6095f2abae2aae9e15c1caa81aa
: end
pixfirewall #.
disconnect from the vpn session after adding the new ACL to the external interface and try again?
Disconnect the vpn session and try again and if does not apply this line.
permit same-security-traffic intra-interface
See the ipsec crytop her.
Please post this output.
Thank you
Tags: Cisco Security
Similar Questions
-
Unable to connect to other remote access (ASA) VPN clients
Hello
I have a cisco ASA 5510 appliance configured with remote VPN access
I can connect all hosts on the INSIDE and DMZ network, but not able to access other clients connected to the same VPN.
For example, if I have 2 clients connected to the VPN, customer and CustomerB, with a pool of vpn IP addresses such as 10.40.170.160 and 10.40.170.161 respectively, these two clients are not able to communicate with each other.
Any help is welcome.
Thanks in advance.
Hello
I'm a little rusty on the old format NAT, but would be what I would personally try to configure NAT0 on the 'outer' interface.
It seems to me that you currently have dynamic PAT configured for the VPN users you have this
NAT (outside) 1 10.40.170.0 255.255.255.0
If your traffic is probably corresponding to it.
The only thing I can think of at the moment would be to configure
Note of VPN-CLIENT-NAT0-access-list NAT0 for traffic between VPN Clients
list of access VPN-CLIENT-NAT0 permit ip 10.40.170.0 255.255.255.0 10.40.170.0 255.255.255.0
NAT (outside) 0-list of access VPN-CLIENT-NAT0
I don't know if it works. I did not really have to configure it on any ASAs running older software. There was some similar questions here on the forums for the new format.
-Jouni
-
How to prohibit remote access vpn client to use the local DNS server
Hello
I'm on ASA5505 remote access vpn configuration.
Everything works fine so far, except when the client got connected, he always used the local DNS server provided by the ISP. How can I force the customer to use the DNS server configured on ASA?
Thank you.
Kind regards
The command "Activate dns split-tunnel-all" is supported only on SSL VPN and VPN IKEv2. Since you're using IKEv1, this command is not supported.
Here's the order reference:
http://www.Cisco.com/en/us/docs/security/ASA/asa82/command/reference/S8.html#wp1533793
You configure no split tunnel? If you are, then you need to configure "tunnelall" split tunnel policy, and that will force the dns resolution and everything else through the VPN tunnel.
-
remote access VPN not connected - no access inside
Hi, I have successfully configured remote access VPN router, it is connected, but no access to the inside, none of my ip addresses. I do not know SPLIT_ACL is ok and I've denied NATting them. For me, everything is ok. I did a lot in ASA, without anyproblem. Thanks for the comments.
enable secret 5 $1$ y0AJ$ rhrjbrpe5NDiAyHGlfeNi.
!
AAA new-model
!
!
AAA authentication login bcc_users local
AAA authorization bcc_group LAN
!
crypto ISAKMP policy 10
BA aes
preshared authentication
Group 2
!
ISAKMP crypto client configuration group ra_vpn_bcc
key *.
DNS 8.8.8.8
bcc.local field
pool vpn_pool
ACL SPLIT_ACL
Max-users 7
netmask 255.255.255.0
!
!
Crypto ipsec transform-set RIGHT aes - esp esp-sha-hmac
tunnel mode
!
!
!
Crypto-map dynamic dynmap 10
Set transform-set RIGHT
market arriere-route
!
!
card crypto client CRYPTO_VPN of authentication list bcc_users
card crypto isakmp authorization list bcc_group CRYPTO_VPN
crypto card for the CRYPTO_VPN client configuration address respond
map CRYPTO_VPN 10-isakmp ipsec crypto dynamic dynmap
!
!
interface GigabitEthernet0/0/4
IP address %.
NAT outside IP
auto negotiation
BFD interval 50 50 5 min_rx multiplier
card crypto CRYPTO_VPN
!
!
IP local pool vpn_pool 172.31.255.0 172.31.255.250
NAT extended IP access list
deny ip 10.0.0.0 0.255.255.255 172.31.255.0 0.0.0.255
deny ip 172.16.0.0 0.0.255.255 172.31.255.0 0.0.0.255
deny ip 192.168.0.0 0.0.255.255 172.31.255.0 0.0.0.255
IP address 172.16.0.0 allow 0.15.255.255 all
IP 192.168.0.0 allow 0.0.255.255 everything
IP 10.0.0.0 allow 0.255.255.255 everything
SPLIT_ACL extended IP access list
IP 10.0.0.0 allow 0.255.255.255 172.31.255.0 0.0.0.255
IP address 172.16.0.0 allow 0.0.255.255 172.31.255.0 0.0.0.255
IP 192.168.0.0 allow 0.0.255.255 172.31.255.0 0.0.0.255
Take a look at the delivery.
You do not have a route to the VPN pool on a nearby device.
-
Remote access VPN with ASA 5510 by using the DHCP server
Hello
Can someone please share your knowledge to help me find out why I'm not able to receive an IP address on the remote access VPN connection so that I can get an IP local pool DHCP?
I'm trying to set up remote access VPN with ASA 5510. It works with dhcp local pool but does not seem to work when I tried to use an existing DHCP server. It is tested in an internal network as follows:
!
ASA Version 8.2 (5)
!
interface Ethernet0/1
nameif inside
security-level 100
IP 10.6.0.12 255.255.254.0
!
IP local pool testpool 10.6.240.150 - 10.6.240.159 a mask of 255.255.248.0. (worked with it)
!
Route inside 0.0.0.0 0.0.0.0 10.6.0.1 1
!
Crypto ipsec transform-set esp-3des esp-md5-hmac FirstSet
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic dyn1 1jeu transform-set FirstSet
dynamic mymap 1 dyn1 ipsec-isakmp crypto map
mymap map crypto inside interface
crypto ISAKMP allow inside
crypto ISAKMP policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 43200
!
VPN-addr-assign aaa
VPN-addr-assign dhcp
!
internal group testgroup strategy
testgroup group policy attributes
DHCP-network-scope 10.6.192.1
enable IPSec-udp
IPSec-udp-port 10000
!
username testlay password * encrypted
!
tunnel-group testgroup type remote access
tunnel-group testgroup General attributes
strategy-group-by default testgroup
DHCP-server 10.6.20.3
testgroup group tunnel ipsec-attributes
pre-shared key *.
!
I got following output when I test connect to the ASA with Cisco VPN client 5.0
Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: (4) SA (1) + KE + NUNCIO (10) + ID (5), HDR + VENDO
4024 bytesR copied in 3,41 0 seconds (1341 by(tes/sec) 13) of the SELLER (13) seller (13) + the SELLER (13), as well as the SELLER (13) ++ (0) NONE total length: 853
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, SA payload processing
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, processing ke payload
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ISA_KE
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, nonce payload processing
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing ID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received xauth V6 VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, DPD received VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received Fragmentation VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, IKE Peer included IKE fragmentation capability flags: Main Mode: real aggressive Mode: false
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, received NAT-Traversal worm 02 VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: IP = 10.15.200.108, the customer has received Cisco Unity VID
Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, connection landed on tunnel_group testgroup
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA payload processing
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, IKE SA proposal # 1, turn # 9 entry overall IKE acceptable matches # 1
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build the payloads of ISAKMP security
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building ke payload
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building nonce payload
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, Generating keys for answering machine...
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of payload ID
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of Cisco Unity VID
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing payload V6 VID xauth
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, building dpd vid payload
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, constructing the payload of the NAT-Traversal VID ver 02
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, NAT-discovery payload construction
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, construction of Fragmentation VID + load useful functionality
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads VID
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, send Altiga/Cisco VPN3000/Cisco ASA GW VID
Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 0) with payloads: HDR SA (1) KE (4) NUNCIO (10) + ID (5) + HASH (8) + SELLER (13) + the SELLER (13) + the SELLER (13) + the SELLER (13) NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) total length: 440
Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 0) with payloads: HDR + HASH (8) + NOTIFY (11) + NAT - D (130) + NAT - D (130) of the SELLER (13) + the seller (13) + NONE (0) overall length: 168
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing hash payload
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash for ISAKMP
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, processing notify payload
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload NAT-discovery of treatment
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, calculation of hash discovered NAT
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, useful treatment IOS/PIX Vendor ID (version: 1.0.0 capabilities: 00000408)
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, payload processing VID
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, the customer has received Cisco Unity VID
Jan 16 15:39:21 [IKEv1]: Group = testgroup, I
[OK]
KenS-mgmt-012 # P = 10.15.200.108, status of automatic NAT detection: remote end is NOT behind a NAT device this end is NOT behind a NAT device
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, empty building hash payload
Jan 16 15:39:21 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, build payloads of hash qm
Jan 16 15:39:21 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 72
Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = d4ca48e4) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 87
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, process_attr(): enter!
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, IP = 10.15.200.108, transformation MODE_CFG response attributes.
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: primary DNS = authorized
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: secondary DNS = authorized
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized primary WINS
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: = authorized secondary WINS
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Compression IP = disabled
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: Split Tunneling political = disabled
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: setting Proxy browser = no - modify
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKEGetUserAttributes: browser Local Proxy bypass = disable
Jan 16 15:39:26 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, (testlay) the authenticated user.
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm
Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 64
Jan 16 15:39:26 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 6b1b471) with payloads: HDR + HASH (8) + ATTR (14) + NONE (0) overall length: 60
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!
Jan 16 15:39:26 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cfg ACK processing attributes
Jan 16 15:39:27 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = 49ae1bb8) with payloads: HDR + HASH (8) + ATTR (14) + (0) NONE total length: 182
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, process_attr(): enter!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, treatment cfg request attributes
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 address!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the IPV4 network mask!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for DNS server address.
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the address of the WINS server.
Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, transaction mode attribute unhandled received: 5
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the banner!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting save PW!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: receipt of request for default domain name!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for Split-Tunnel list!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for split DNS!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for PFS setting!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Proxy Client browser setting!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the list of backup peer ip - sec!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for setting disconnect from the Client Smartcard Removal!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the Version of the Application.
Jan 16 15:39:27 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, Type of Client: Windows NT Client Application Version: 5.0.07.0440
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for FWTYPE!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: request received for the DHCP for DDNS hostname is: DEC20128!
Jan 16 15:39:27 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, MODE_CFG: application received for the UDP Port!
Jan 16 15:39:32 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets. No last packet retransmit.
Jan 16 15:39:37 [IKEv1]: IP = 10.15.200.108, IKE_DECODE RECEIPT Message (msgid = b04e830f) with payloads: HDR + HASH (8) + NOTIFY (11) + (0) NONE total length: 84
Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing hash payload
Jan 16 15:39:37 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, processing notify payload
Jan 16 15:39:37 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, in double Phase 2 detected packets. No last packet retransmit.
Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE has received the response from type [] at the request of the utility of IP address
Jan 16 15:39:39 [IKEv1]: Group = testgroup, Username = testlay, IP = 10.15.200.108, cannot get an IP address for the remote peer
Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE TM V6 WSF (struct & 0xd8030048)
, : TM_DONE, EV_ERROR--> TM_BLD_REPLY, EV_IP_FAIL--> TM_BLD_REPLY NullEvent--> TM_BLD_REPLY, EV_GET_IP--> TM_BLD_REPLY, EV_NEED_IP--> TM_WAIT_REQ, EV_PROC_MSG--> TM_WAIT_REQ, EV_HASH_OK--> TM_WAIT_REQ, NullEvent Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, case of mistaken IKE AM Responder WSF (struct & 0xd82b6740)
, : AM_DONE, EV_ERROR--> AM_TM_INIT_MODECFG_V6H, EV_TM_FAIL--> AM_TM_INIT_MODECFG_V6H NullEvent--> AM_TM_INIT_MODECFG, EV_WAIT--> AM_TM_INIT_XAUTH_V6H, EV_CHECK_QM_MSG--> AM_TM_INIT_XAUTH_V6H, EV_TM_XAUTH_OK--> AM_TM_INIT_XAUTH_V6H NullEvent--> AM_TM_INIT_XAUTH_V6H, EV_ACTIVATE_NEW_SA Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, IKE SA AM:bd3a9a4b ending: 0x0945c001, refcnt flags 0, tuncnt 0
Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, sending clear/delete with the message of reason
Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, empty building hash payload
Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, constructing the payload to delete IKE
Jan 16 15:39:39 [IKEv1 DEBUG]: Group = testgroup, Username = testlay, IP = 10.15.200.108, build payloads of hash qm
Jan 16 15:39:39 [IKEv1]: IP = 10.15.200.108, IKE_DECODE SEND Message (msgid = 9de30522) with payloads: HDR HASH (8) + DELETE (12) + (0) NONE total length: 80
Kind regards
Lay
For the RADIUS, you need a definition of server-aaa:
Protocol AAA - NPS RADIUS server RADIUS
AAA-server RADIUS NPS (inside) host 10.10.18.12
key *.
authentication port 1812
accounting-port 1813
and tell your tunnel-group for this server:
General-attributes of VPN Tunnel-group
Group-NPS LOCAL RADIUS authentication server
--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni -
Remote access VPN VPN Ping from ASA clients
I would like to know if it is normal to not being able to traceroute or ping for VPN clients connected from the ASA command line? The VPN client and the connection works well at the moment. I can't ping / connect to the VPN and vice versa internal hosts. I can't ping however the ASA VPN client IP address himself well. I'm so split tunnel but that seems to work correctly based on the determination of route I ran.
Can I have an IKEv1 and IKEv2 for VPN IPSEC configuration? I try to keep the IKEv1 VPN for the legacy Cisco VPN client while I began to roll on the AnyConnect IKEv2 client. Just end up creating a new configuration of VPN for the AnyConnect VPN (easier)?
What is the purpose of the injection of the route the other way around? It seems to be against intuitive. I was hoping it say for VPN DHCP pool 32 come to me so I would not add static routes on my heart to point to the ASA for these ranges. This ASA is reserved for the VPN firewall not this traffic is not normally head to it. Right now I have just the static route for the 24 I use in the DHCP pool on carrots. I have of course the possibility to redistribute the beach many other ways with EIGRP / OSPF / RIP it seems to me that RRI was a nice way to do, but it doesn't seem to be.
It probably all comes from me probably do not understand exactly how bits to pass through the firewall to the actual machine of the VPN client. You see only not an interface layer 3 for part of the ASA in the tunnel, according to me, is part of what confuses me.
Basically, I followed this guide and added split tunnel and aaa via RADIUS which seem to work well. I can't emphasize enough that for all intent and purposes, it seems that the VPN works as it should now. Wait for this time I broke it a few hours while I was playing with various other orders lol.
Thank you
Tim
Reference:
ASA 5505 (base right now, license #labgear) 9.2 (4) runningIt is normal to not be able to ping remote VPN clients to the ASA's. To be able to do outside the ASA IP address must be included in the field of encryption, which is not normally.
Yes, you can use IKEv1 and IKEv2 at the same time. However if you change consider using SSL. It is best taken in charge and less painful.
If you choose to ignore this advice, then I would create a new IKEv2 VPN rather than modify the existing and then migrate users through him.
The reverse route injection does exactly what you describe. They appear as static routes on the SAA, you will then need to redistribute in any routing protocol you like. I wouldn't normally use for traffic of users, but for the traffic of a site when managing more complex failover scenarios.
I recommend to stick to the single 24 static road in your kernel.
-
Configure ASA5055 as a remote access VPN client
Hello world
I'm trying to configure a 5505 as a remote access VPN client. I have several old hubs VPN 3002, but in the new sites I'll use a 5505 instead of these 3002.
I think that the configuration is very simple. I have the IP address of the peer (remote server), I know it is an IPsec tunnel without certificate and I have passwords and user name and group.
How can I translate this configuration for an ASA5505? I have attached a screenshot.
Here ya go:
http://www.Cisco.com/en/us/docs/security/ASA/asa83/configuration/guide/ezvpn505.html
Federico.
-
Unable to SSH/telnet through the remote access VPN to ASA interface
Hi all - im trying to SSH/telnet to my ASA in my remote access VPN tunnel but
can't get this to work. what Miss me?
remote access VPN subnet: 192.168.25.0
LAN subnet: 192.168.1.0
config is attached. THX-
Please enter the command
Private access Managament
and you will be able to telnet/ssh to the asa on this ip 192.168.1.253
-
Connections to remote access VPN active
Hi all
How can I check the connections of active remote access to my ASA VPN
Thanks in advance,
Shijo.
Hello
Please, use the command...
ASA vpn-sessiondb #show remote control
If you want discoonect a user...
VPN-sessiondb logoff remote name (you can even use IP as well)
HTH
MS
-
active monitoring of remote access vpn connections
Hi all
I use asa 5520, and asa 5540 for remote access vpn connections. Is it possible to active my vpn connections monitoring so that there would be alerts for vpn tunnels which fail to implement for other reasons other than the authentication of users? Pls advise. Thks in advance.
Kiwi Syslog will work fine - as long as you have a licensed version, a 'free' version does not support e-mail extras.
See the url below and search for "VPN", you will see what VPN syslog codes you can choose from.
http://www.Cisco.com/en/us/docs/security/ASA/asa83/system/message/logmsgs.html
HTH >
-
ODA IP ASA when you browse the web via remote access vpn
Hi all
I was wondering if it is possible to configure an ASA5510 in a way to allow users remote access VPN use external IP of the ASA when browsing the web. So what I'm looking for is a solution to hide my IP address and use the IP address of the ASA, when browsing.
The firmware version of the ASA is 9.1 (6)
Thanks in advance
Hello
What you want to achieve is calles u-turn.
You must enable the feature allowed same-security-traffic intra-interface
For the configuration of the asa, here's the Cisco documentation (I don't copy paste on the post):
http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...
Thank you
PS: Please do not forget to rate and score as good response if this solves your problem
-
Hi all
I need help with remote access vpn configuration. I want to some remote users who have access to the internet on their system to connect and access an application server in my seat social cisco vpn client user. I use Cisco 881. I am unable to use the SDM configuration because it seems that SDM is not supported by the router so I'm using command line. I'd appreciate any help I can get. Thank you.
This is the configuration I have:
VPNROUT #sho run
Building configuration...Current configuration: 6832 bytes
!
! Last configuration change at 10:50:45 UTC Saturday, May 30, 2015, by thomas
version 15.2
no service button
horodateurs service debug datetime msec
Log service timestamps datetime msec
no password encryption service
!
hostname VPNROUT
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
AAA new-model
!
!
AAA authentication login default local
AAA authentication login userauthen1 local
AAA authorization groupauthor1 LAN
!
!
!
!
!
AAA - the id of the joint session
iomem 10 memory size
!
Crypto pki trustpoint TP-self-signed-1632305899
enrollment selfsigned
name of the object cn = IOS - Self - signed - certificate - 1632305899
revocation checking no
rsakeypair TP-self-signed-1632305899
!
!
TP-self-signed-1632305899 crypto pki certificate chain
certificate self-signed 01
3082022B 30820194 02020101 300 D 0609 2A 864886 F70D0101 05050030 A0030201
2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30
69666963 31363332 33303538 6174652D 3939301E 170 3134 30313233 31323132
33325A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D
4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 36333233 65642D
30353839 3930819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101
8100BC0C 341CD79B A38572CE 1F0F9A91 F96B133C A889B564 E8352034 1CF5EE4B
B505616B 6014041B EC498C0A F6C5CD2B F5BF62DA BD6E1C44 0C7B9089 1FD0C6E5
299CEB40 28CD3F3B ADE3468A B07AAA9F AC42F0A7 4087172A 33C4013D 9A50884D
5778727E 53A4940E 6E622460 560C F597DD53 3B 261584 E45E8776 A848B73D 5252
92 50203 010001A 3 53305130 1 130101 FF040530 030101FF 301F0603 0F060355 D
551 2304 18301680 14E85AD0 DEF133D8 E09516FD 0AA5FDAD E10EAB1A FA301D06
03551D0E E85AD0DE 04160414 F133D8E0 9516FD0A A5FDADE1 0EAB1AFA 300 D 0609
2A 864886 818100A 5 05050003 5B23ED5B 9A380E1F 467ABB03 BAB1070B F70D0101
7A 218377 73089DC1 D32DA585 C5FD7ECE 0D000F96 7F3AB6CC 71509E8F 3F1C55AE
E37536A3 1008FBF9 A29329D5 6F76DDC0 AA1C70AE 958AAE5D 32388BE4 2C1C6839
0369 D 533 027B612C 8D199C35 C008FE00 F7E1DF62 9C73E603 85C3240A 63611D 93
854A61E2 794F8EF5 DA535DCC B209DA
quit smoking
!
!
!
no record of conflict ip dhcp
DHCP excluded-address IP 10.10.10.1
DHCP excluded-address IP 172.20.0.1 172.20.0.50
!
DHCP IP CCP-pool
import all
Network 10.10.10.0 255.255.255.248
default router 10.10.10.1
Rental 2 0
!
IP dhcp pool 1
network 172.20.0.0 255.255.240.0
domain meogl.net
router by default - 172.20.0.1
172.20.0.4 DNS server 41.79.4.11 4.2.2.2 8.8.8.8
8 rental
!
!
!
no ip domain search
IP domain name meogl.net
name of the IP-server 172.20.0.4
name of the IP-server 41.79.4.11
IP-server names 4.2.2.2
8.8.8.8 IP name-server
IP cef
No ipv6 cef
!
!
license udi pid CISCO881-K9 sn FCZ1804C3SL
!
!
username secret privilege 15 thomas 4 JXSizd1r/hMqPpGz94vKBb5somtpZLy03k50rJvHO6c
username privilege 15 secret 4 mowe hlfv/rdDRCAeTUzRXbOIfdaKhJCl1onoGdaQeaQsAnw
!
!
!
!
!
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
!
ISAKMP crypto client configuration group moweclients
XXXXXXX key
DNS 172.20.0.4
meogl.net field
pool mowepool
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac moweset
tunnel mode
!
!
!
Dynmap crypto dynamic-map 1
Set transform-set moweset
market arriere-route
!
!
card crypto client mowemap of authentication list userauthen1
card crypto isakmp authorization list groupauthor1 mowemap
client configuration address card crypto mowemap answer
mowemap 1 card crypto ipsec-isakmp dynamic dynmap
!
!
!
!
!
interface Loopback0
IP 172.30.30.1 255.255.255.0
IP nat inside
IP virtual-reassembly in
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
switchport access vlan 100
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
IP 41.7.8.13 255.255.255.252
NAT outside IP
IP virtual-reassembly in
intellectual property policy map route VPN-CLIENT
Shutdown
automatic duplex
automatic speed
mowemap card crypto
!
interface Vlan1
Description $ETH_LAN$
IP 10.10.10.1 255.255.255.248
IP tcp adjust-mss 1452
!
interface Vlan100
IP 172.20.0.1 255.255.240.0
IP nat inside
IP virtual-reassembly in
!
local pool IP 192.168.1.1 mowepool 192.168.1.100
IP forward-Protocol ND
IP http server
23 class IP http access
local IP http authentication
IP http secure server
IP http timeout policy slowed down 60 life 86400 request 10000
!
IP nat inside source overload map route interface FastEthernet4 LAT
IP route 0.0.0.0 0.0.0.0 41.7.8.12
!
access-list 23 allow 10.10.10.0 0.0.0.7
access-list 23 allow 172.20.0.0 0.0.15.255
access-list 100 permit ip 172.20.0.0 0.0.15.255 everything
access-list 144 allow ip 192.168.1.0 0.0.0.255 any
not run cdp
!
LAT route map permit 1
corresponds to the IP 100
IP 41.7.8.12 jump according to the value
!
route VPN-CLIENT map permit 1
corresponds to the IP 144
!
Line con 0
no activation of the modem
line to 0
line vty 0 4
access-class 23 in
privilege level 15
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
transport input telnet ssh
!
!
endPlease the configuration above, give me the desired output.
Thank you.
Hello Thomas,.
I'm glad to hear that you have found useful in the example configuration.
I checked your configuration and everything seems ok with him, especially the statements of nat.
ip local pool mowepool 192.168.1.1 192.168.1.100 access-list 100 deny ip 172.20.0.0 0.0.15.255 192.168.1.0 0.0.0.255 access-list 100 permit ip 172.20.0.0 0.0.15.255 any route-map LAT permit 1 match ip address 100 ip nat inside source route-map LAT interface FastEthernet4 overload interface Vlan100 ip address 172.20.0.1 255.255.240.0 ip nat inside ip virtual-reassembly in
Try to generate ICMP traffic behind your 100 VLANS to the client VPN in order to answer the following questions:
-The router receives this traffic between VLAN100 unit?
-The router is encrypt this traffic, after receiving the ICMP packet?
#show crypto ipsec router its can help you with this question. Look for the program/decaps counters.
-The same, but the other way around (from VPN client to device behind VLAN100) try to locate the problem.
The following document explains more this crypto commands and debugs if necessary.
-
Remote access VPN fails after upgrading to 8.04
Hello:
Sorry if this has been posted, but I couldn't find it anywhere.
After the upgrade of my 2 of my 5510 s to 8.04, my remote access VPN does not work. I can connect via Radius without problem. Once connected, I can't do anything on the network. When I try to telnet to any device, I get a white screen with no response. As it is to find the device but it does not. E-mail, intranet, nothing works. Seems to be time. I tried to upgrade to the latest version of Windows Client, still no go.
Everyone knows this at all? Any help appreciated.
TIA,
Brad
I saw the same problem after upgrading to 8.0.4. And it is caused by the "IP Compression" option enabled in group policy. After deactivation, it works. Cisco has just completed this bug recently:
Zhenning
-
Remote access VPN pix version 8.0 (3)
Hi all
First of all, I would like to thank to all members of the forum who got help in several messages on the configuration of the pix 515.
I am now configuring remote VPN access with radius authentication to my network, but I can't connect.
I use the cisco vpn client 5.0.03.0560, I have also tested my pix radius (inside) server authentication and works very well.
I already tried to retype the key of the cli, but I still can't remote access vpn to work.
I also tried to create another remote vpn with another name and local authentication, but I have the same problem.
I use 8.0 (3) version pix.
Can someone help me
I attach the log file of the cisco vpn client to help solve the problem, as well a configuration of the pix folder.
Thank you very much in advance and I seek prior information.
http://www.Cisco.com/en/us/docs/security/ASA/asa72/configuration/guide/vpnadd.html#wp999516
[Pls RATE if HELP]
-
How to use ACS 5.2 to create a static ip address user for remote access VPN
Hi all
I have the problem. Please help me.
Initially, I use ACS 4.2 to create the static ip address for VPN remote access user, it's easy, configuration simply to the user defined > address assignment IP Client > assign the static IP address, but when I use ACS 5.2 I don't ' t know how to do.
I'm trying to add the IPv4 address attribute to the user to read "how to use 5.2 ACS", it says this:
1Ajouter step to attribute a static IP address to the user attribute dictionary internal:
Step 2select System Administration > Configuration > dictionaries > identity > internal users.
Step 3click create.
Static IP attribute by step 4Ajouter.
5selectionnez users and identity of the stage stores > internal identity stores > users.
6Click step create.
Step 7Edit static IP attribute of the user.
I just did, but this isn't a job. When I use EasyVPN client to connect to ASA 5520, user could the success of authentication but will not get the static IP I set up on internal users, so the tunnel put in place failed. I'm trying to configure a pool of IP on ASA for ACS users get the IP and customer EasyVPN allows you to connect with ASA, everything is OK, the user authenticates successed.but when I kill IP pool coufigurations and use the "add a static IP address to the user 'configurations, EzVPN are omitted.
so, what should I do, if anyboby knows how to use ACS 5.2 to create a user for ip address static for remote access VPN, to say please.
Wait for you answer, no question right or not, please answer, thank you.
There are a few extra steps to ensure that the static address defined for the user is returned in the Access-Accept. See the instuctions in the two slides attached
Maybe you are looking for
-
Satellite U200 163: a bug in the bios with linux
on my u200 163 (with the new bios 1.3 works well on XP), linux (2.6.17) as Mandrvia 2007 or Ubuntu Edgy new distributions does not start ok. After grub starts, two lines talking about the bios bug and memory address not E820 reserved and not using MM
-
Change to a DVD - RW disc on a Blu - Ray player
Hello I have been wanting to upgrade my laptop for awhile drive DVD - RW existing, the laptop came with a Blu - Ray (reader or burner) drive, did a bit of research, but don't have so far not found something set apart on ebay. My laptop DV6-1323TX is
-
Hello So I have the HP Deskjet 3050 J610 and I just plugged my new modem from Actiontec C1000A wireless Qwest last week and my printer is not connecting on the radio I tried methods PIN and a WPS button and I get "WPS ERROR" on my printer. I tried t
-
Hello When I automate defragment.exe for monthly use then It wil run on the bottom. There wil I would like to know who is running and is it wil give me as a sign that the defragmentation task has been fulfilled. Thank you Johan
-
Photomerge panorama PS elements 14 does not work?
I can't make photomerge panorama. This is THE function I use in Photoshop Elements, so I'm a little disappointed now...I use PSE in expert mode. I miss the option I had in previous editions (file-> new-> fusion). Where can I find the photomerge panor