EZVPN 861 connects but sees no VPN network

Similar Questions

• L2TP VPN connects but won't see network drives

  Hi all

  I just got a MacBook Pro with El Capitan. I joined it to my area of work and I have implemented SonicWall VPN Client Mobile and I tested it on and it works - only if my network, I am connected to and the VPN will not have the same IP range.

  I would like to use the integrated VPN L2TP client, but I have questions here. I have configurted on my Dell SonicWall and connect this VPN from a remote location, it will connect and show the data transfer (sending / reception are green) but I can not access my network drives.

  Once I have switch back to Mobile Client VPN SonicWall, everything works well.

  Any idea?

  Routing on L2TP or PPTP will probably work or at all, if both ends of the VPN tunnel terminate on the same CIDR network block. Which is why people never give a one VPN server address local 192.168.1.0/24. the network block is much too common. Please use something in 10.x.x.x.

• Connectivity to the remote VPN site adjacent networks

  Star topology with Corporate office which acts as hub (192.168.1.x) and remote sites connected by relay frames, except for another network (172.16.x.x) in the building served by 3560 switch company.

  On my remote site vpn (10.0.1.x) I can ping network 172.16.x.x, but not the 192.168.1.x network. What I'm trying to do is to allow the network traffic remote 10.0.1.x (which connects directly via the VPN network 172.16.x.x) to reach the network 192.168.1.x and vice versa.

  I'm sure its a combination of NAT/routing issue I forget.

  I'm new to PIX / ASA in general and it's the first vpn L2L I install. If someone can point me in the right direction, I would appreciate it.

  Thank you.

  It looks like this?

  10.0.1.x->-> Corp. ASA L2L tunnel - >->-> 192.168.1.x 3560 172.16.x.x

  and that you can currently communicate via the tunnel between 10.0 and 172.16? In order to communicate between 10.0 and 192.168.1, you will need to define this interesting traffic and add it to your crypto and nat exemption acl.

  Corp site

  extended access-list allow ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0

  extended access-list allow ip 192.168.1.0 255.255.255.0 10.0.1.0 255.255.255.0

  NAT (inside) - 0 access list

  Remote site

  access-list extended ip 10.0.1.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  access-list extended ip 10.0.1.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  NAT (inside) - 0 access list

• Try to create a new VPN connection but Creat new network connection is grayed out

  Hello world

  Thank you for your help in advance.

  I would like to ask why I could not create a new VPN connection as the "Creat new network connection" is grayed out. I'm also sure that remote access connection manager, and another car once are started.

  I can create an account with my domain administrator account. But once I passed the orginary user, the shortcut to the connection could not be accessed. I also tried to add the user to the local Administrators group, and the result is the same.

  HOEP that you can help.

  Thank you.

  Windows XP Service Pack 3?

  Do you have any software security 3rd party running on this computer?  Or maybe something in group policy that limits access to create a new network connection?

  -B-
  http://www.officeforlawyers.com | http://www.OneNote-tips.com
  Author: Guide to counsel for Microsoft Outlook

• VPN IS CONNECTED BUT CANNOT ACCESS THE INTERNAL NETWORK

  I tried to set up a simple customer vpn using this document

  http://www.Cisco.com/en/us/products/sw/secursw/ps2308/products_configuration_example09186a00801e71c0.shtml

  VPN IS CONNECTED BUT CANNOT ACCESS THE INTERNAL NETWORK BEHIND "RA"...

  6.3 (5) PIX version

  interface ethernet0 car

  Auto interface ethernet1

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the encrypted password of VmHKIhnF4Gs5AWk3

  VmHKIhnF4Gs5AWk3 encrypted passwd

  hostname VOIPLABPIX

  domain voicelab.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list 101 permit ip 172.10.2.0 255.255.255.0 172.10.3.0 255.255.255.0

  access-list 101 permit ip 172.10.1.0 255.255.255.0 172.10.3.0 255.255.255.0

  access-list 102 permit ip 172.10.2.0 255.255.255.0 172.10.3.0 255.255.255.0

  access-list 102 permit ip 172.10.1.0 255.255.255.0 172.10.3.0 255.255.255.0

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside 208.x.x.11 255.255.255.0

  IP address inside 172.10.2.2 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool voicelabpool 172.10.3.100 - 172.10.3.254

  history of PDM activate

  ARP timeout 14400

  NAT (inside) - 0 102 access list

  Route outside 0.0.0.0 0.0.0.0 208.x.x.11 1

  Route inside 172.10.1.0 255.255.255.0 172.10.2.1 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 172.0.0.0 255.0.0.0 inside

  http 0.0.0.0 0.0.0.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set esp-aes-256 trmset1, esp-sha-hmac

  Crypto-map dynamic map2 10 set transform-set trmset1

  map map1 10 ipsec-isakmp crypto dynamic map2

  client authentication card crypto LOCAL map1

  map1 outside crypto map interface

  ISAKMP allows outside

  ISAKMP identity address

  part of pre authentication ISAKMP policy 10

  ISAKMP policy 10 encryption aes-256

  ISAKMP policy 10 sha hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup address voicelabpool pool cuclab

  vpngroup dns 204.x.x.10 Server cuclab

  vpngroup cuclab by default-field voicelab.com

  vpngroup split tunnel 101 cuclab

  vpngroup idle 1800 cuclab-time

  vpngroup password cuclab *.

  Telnet timeout 5

  SSH 208.x.x.11 255.255.255.255 outside

  SSH 0.0.0.0 0.0.0.0 outdoors

  SSH 172.10.1.2 255.255.255.255 inside

  SSH timeout 60

  Console timeout 0

  username labadmin jNEF0yoDIDCsaoVQ encrypted password privilege 2

  Terminal width 80

  Cryptochecksum:b03a349e1ac9e6022432523bbb54504b

  : end

  Try to turn on NAT - T

  PIX (config) #isakmp nat-traversal 20

  http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807e0aca.shtml#Solution1

  HTH

• Cisco ASA 8.4 (3) remote access VPN - client connects but cannot access inside the network

  I have problems to access the resources within the network when connecting with the Cisco VPN client for a version of 8.4 (3) operation of the IOS Cisco ASA 5510. I tried all new NAT 8.4 orders but cannot access the network interior. I can see traffic in newspapers when ping. I can only assume I have NAT evil or it's because the inside interface of the ASA is on the 24th of the same subnet as the network interior? Please see config below, any suggestion would be appreciated. I configured a VPN site to another in this same 5510 and it works well

  Thank you

  interface Ethernet0/0

  Speed 100

  full duplex

  nameif outside

  security-level 0

  IP x.x.x.x 255.255.255.240

  !

  interface Ethernet0/1

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.88.10.254 255.255.255.0

  !

  interface Management0/0

  Shutdown

  nameif management

  security-level 0

  no ip address

  !

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  network of the PAT_to_Outside_ClassA object

  10.88.0.0 subnet 255.255.0.0

  network of the PAT_to_Outside_ClassB object

  subnet 172.16.0.0 255.240.0.0

  network of the PAT_to_Outside_ClassC object

  Subnet 192.168.0.0 255.255.240.0

  network of the LocalNetwork object

  10.88.0.0 subnet 255.255.0.0

  network of the RemoteNetwork1 object

  Subnet 192.168.0.0 255.255.0.0

  network of the RemoteNetwork2 object

  172.16.10.0 subnet 255.255.255.0

  network of the RemoteNetwork3 object

  10.86.0.0 subnet 255.255.0.0

  network of the RemoteNetwork4 object

  10.250.1.0 subnet 255.255.255.0

  network of the NatExempt object

  10.88.10.0 subnet 255.255.255.0

  the Site_to_SiteVPN1 object-group network

  object-network 192.168.4.0 255.255.254.0

  object-network 172.16.10.0 255.255.255.0

  object-network 10.0.0.0 255.0.0.0

  outside_access_in deny ip extended access list a whole

  inside_access_in of access allowed any ip an extended list

  11 extended access-list allow ip 10.250.1.0 255.255.255.0 any

  outside_1_cryptomap to access extended list ip 10.88.0.0 255.255.0.0 allow object-group Site_to_SiteVPN1

  mask 10.250.1.1 - 10.250.1.254 255.255.255.0 IP local pool Admin_Pool

  NAT static NatExempt NatExempt of the source (indoor, outdoor)

  NAT (inside, outside) static source any any static destination RemoteNetwork4 RemoteNetwork4-route search

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork1 RemoteNetwork1

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork2 RemoteNetwork2

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork3 RemoteNetwork3

  NAT (inside, outside) static source LocalNetwork LocalNetwork static destination RemoteNetwork4 RemoteNetwork4-route search

  !

  network of the PAT_to_Outside_ClassA object

  NAT dynamic interface (indoor, outdoor)

  network of the PAT_to_Outside_ClassB object

  NAT dynamic interface (indoor, outdoor)

  network of the PAT_to_Outside_ClassC object

  NAT dynamic interface (indoor, outdoor)

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

  dynamic-access-policy-registration DfltAccessPolicy

  Sysopt connection timewait

  Service resetoutside

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-ikev1 esp-md5-hmac bh-series

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto-map dynamic dynmap 10 set pfs

  Crypto-map dynamic dynmap 10 set transform-set bh - set ikev1

  life together - the association of security crypto dynamic-map dynmap 10 28800 seconds

  Crypto-map dynamic dynmap 10 kilobytes of life together - the association of safety 4608000

  Crypto-map dynamic dynmap 10 the value reverse-road

  card crypto mymap 1 match address outside_1_cryptomap

  card crypto mymap 1 set counterpart x.x.x.x

  card crypto mymap 1 set transform-set ESP-AES-256-SHA ikev1

  card crypto mymap 86400 seconds, 1 lifetime of security association set

  map mymap 1 set security-association life crypto kilobytes 4608000

  map mymap 100-isakmp ipsec crypto dynamic dynmap

  mymap outside crypto map interface

  crypto isakmp identity address

  Crypto isakmp nat-traversal 30

  Crypto ikev1 allow outside

  IKEv1 crypto ipsec-over-tcp port 10000

  IKEv1 crypto policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 1

  life 86400

  IKEv1 crypto policy 50

  preshared authentication

  the Encryption

  md5 hash

  Group 2

  life 86400

  IKEv1 crypto policy 60

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 70

  preshared authentication

  aes-256 encryption

  sha hash

  Group 1

  life 86400

  IKEv1 crypto policy 90

  preshared authentication

  aes encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  Console timeout 0

  management-access inside

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal BACKDOORVPN group policy

  BACKDOORVPN group policy attributes

  value of VPN-filter 11

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelall

  BH.UK value by default-field

  type tunnel-group BACKDOORVPN remote access

  attributes global-tunnel-group BACKDOORVPN

  address pool Admin_Pool

  Group Policy - by default-BACKDOORVPN

  IPSec-attributes tunnel-group BACKDOORVPN

  IKEv1 pre-shared-key *.

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group ipsec-attributes x.x.x.x

  IKEv1 pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  Excellent.

  Evaluate the useful ticket.

  Thank you

  Rizwan James

• Can connect to the IPSec VPN, but can not see the internal network

  I have several users that can connect to our rooms of ussing IPSec VPN on a 5505. I have a user who can connect, but cannot see the internal network. This user is using DSL with a speedstream 4100. However, I have another user with the same configuration that can connect and see the internal network. Newspapers in ASDM show the link, but do not seem to show any errors trying to access internal. Any help will be greatly appreciated. Thank you, Bill.

  Add...

  ISAKMP nat-traversal crypto

• VPN connected but no visible network

  so I have a windows 7 (VPN server) desktop computer and a windows laptop 7 (VPN client) and I have set up the incoming VPN connection on my desktop and a client VPN connection on my laptop. When I go and establish a VPN connection, it says that I'm connected on my laptop and my desktop but I can't access my network resources. Ive been cracking as a result for a few weeks now and have gotten nowhere with it, any help would be greatly appreciated. Thank you!

  I can't access something like \\ServerName\ShareName I can't do a ping them either. address ranges are not the same on the server or client networks. the funny this is that it says I am connected at both ends, the customer declares that ipv4 has no internet access on the vpn which is fine because all I want is access to the network and it shows that I have an ip address assigned on the vpn map. side server but it is said that ipv4 and ipv6 are not connected, but if I do "ipconfig/all" he shows me his ip address on the vpn.

  client side, I've disabled 'Gateway on remote network use default' so that I can still have access to the internet on the im client that is connected to the vpn. on the side server, I tried selecting "Assign addresses automatically using DHCP" as well as "specify IP addresses (with a beach which is on the client and the server ip address range).» I have also "Allow the calling computer to specify its own IP address" selected on the server.

  When I finally fell a VPN server on a Vista box I got the address assigned to the configuration of clients like that.

  http://theillustratednetwork.MVPs.org/Vista/PPTP/VPNSetup06.jpg

  The address range was the same that the server of the LAN address range, in this case, I used 192.168.10.X on the local network.

  http://theillustratednetwork.MVPs.org/Vista/PPTP/ExampleVistaVPNNetwork.PDF

  Customer recevrait.31 ou.32...

  Of course assumed that the customer was or would not be on a LAN 192.168.10.X to start. If it was so I could have problems connecting to shares on my LAN Server.

  MS - MVP Windows Desktop Experience
  "When all else fails try what the captain suggested before you started...". »

• Cisco vpn 5.0.07.0440 - k9 connected but not the network remote access to Windows 8.1 pro

  I use 5.0.07.0440 - k9 vpn Cisco and Cisco vpn 5.0.07.0290 - k9 both version on our 8.1 Windows Mobile pro.
  VPN connected successfully, but not remote access network and receive no ping.

  But when I try with wifi and vpn, then good job.

  Please help me as soon as possible.

  Thank you
  Sanjib

  It is very problematic on Windows 8 and EOL now.

  Kind regards

  Nehmaan

• Cisco vpn client to connect but can not access to the internal network

  Hi all

  I have a VPN configured on cisco 5540. My vpn was working fine, but suddenly there is a question that the cisco vpn client to connect but can not access to the internal network

  Any help would be much appreciated.

  Hi Samir,

  I suggest that you go to the ASA and check the configuration to make sure that it complies with the requirements according to the reference below link:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  (The link above includes split tunneling, but this is just an option.

  Please paste the output of "sh cry ipsec his" here so that we can check if phase 2 is properly trained. I would say as you go to IPSEC vpn client on your PC and check increment in packets sent and received in the window 'status '.

  Let me know if this can help,

  See you soon,.

  Christian V

• Ipad Cisco ipsec VPN connects but not access to the local network

  Hi guys,.

  I am trying to connect our ipads to vpn to access network resources. IPSec cisco ipad connects but not lan access and cannot ping anything not even not the interfaces of the router.

  If I configure the vpn from cisco on a laptop, it works perfectly, I can ping all and can access resources on the local network if my guess is that the traffic is not going in the tunnel vpn between ipad and desktop.

  Cisco 877.

  My config is attached.

  Any ideas?

  Thank you

  Build-in iPad-client is not useful to your configuration.

  You have three options:

  (1) remove the ACL of your vpn group. Without split tunneling client will work.

  2) migrate legacy config crypto-map style. Here, you can use split tunneling

  3) migrate AnyConnect.

  The root of the problem is that the iPad Gets the split tunneling-information. But instead of control with routing traffic should pass through the window / the tunnel and which traffic is allowed without the VPN of the iPad tries to build a set of SAs for each line in your split-tunnel-ACL. But with the model-virtual, SA only is allowed.

• VPN client connected but no ping nor access to privat network

  Hello

  I have a 1802w installed, a VPN client that can connect to the router and L2L connection, which works very well.

  On the router, I see that the client is connected, but no traffic passes. In sh crypto ipsec, I see that traffic is decrypted, but no packtets are encypted.

  Can someone point me in the right direction? I have the confs and debugs attached. Thanks for the help in advance.

  Erich

  Erich,

  Looking at your configuration, two things:

  1 - is the current running configuration. I see your Tunnel L2L is configured with an address of correspondence of 101, but I don't see a 101 ACL set on the router.

  2. your Split Tunnel must be reconfigured. Which means, the source and destination must be exchanged.

  SplitList extended IP access list

  permit ip 192.168.2.0 0.0.0.255 192.168.111.0 0.0.0.255

  Split Tunneling

  http://www.Cisco.com/en/us/Tech/tk59/technologies_configuration_example09186a00800a393b.shtml#Con4

  Also, the IP address pool you assign to clients, ensure that they are not part of a LAN on your side. If so, you can then run in routing problems.

  Kind regards

  Arul

  * Please note all useful messages *.

• I am trying to create a VPN connection, but when I get to the step that allows me to create the VPN, the radial buttons are greyed out.

  I am trying to create a VPN connection, but when I get to the step that allows me to create the VPN, the radial buttons are grayed out, it is a Windows component is missing and does not allow me to create VPN. I am running Windows XP Home addition. I recently got a Malware attack and had the quarantine and fix trojen attempts. After the restoration, I found that my previous VPN connection was broken. When I tried to add a new connection, I'm stuck on the screen connection virtual network in the the radial button private network connection wizard is grayed out, he could not check.

  Hello

  Your Windows XP question is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please post your question in the Windows XP TechNet forum. You can follow the link to your question:

  http://social.technet.Microsoft.com/forums/en/itproxpsp/threads

• I am trying to create a VPN connection, but it does not work

  I am trying to create a VPN connection, but it does not work
  The wizard cannot establish a connection. And if I try to record simply does not connect
  It does not work. If I try to click on find the problem, there simply
  do nothing.
  I tried it on another pc, where it worked. So the problem is not the
  router or data network. And the curious thing is that I installed it before, but only from one day to the other, the VPN connection was missing.

  It does not create even a the connection icon
  Thank you

  Try a system restore to a Date before the problem began:

  Restore point:

  http://www.howtogeek.com/HOWTO/Windows-Vista/using-Windows-Vista-system-restore/

  Do Safe Mode system restore, if it is impossible to do in Normal Mode.

  Try typing F8 at startup and in the list of Boot selections, select Mode safe using ARROW top to go there > and then press ENTER.

  Try a restore of the system once, to choose a Restore Point prior to your problem...

  Click Start > programs > Accessories > system tools > system restore > choose another time > next > etc.

  http://www.windowsvistauserguide.com/system_restore.htm

  Read the above for a very good graph shows how backward more than 5 days in the System Restore Points by checking the correct box.

  See you soon.

  Mick Murphy - Microsoft partner

• Urgent! Users of remote access VPN connects but cannot access remote LAN (ping, folder,...)

  Hello

  I am setting up a VPN on a Cisco ASA 5510 version 8.4 remote access (4) 1.

  When I try to connect via the Cisco VPN client software, I am able to connect however I am unable to access network resources.

  However, I can ping the servers in the other site that is connected through the VPN site-to site to the main site!

  VPN client--> main site (ping times on)--> Site connected with the main site with VPN S2S (successful ping)

  Please help me I need to find a solution as soon as POSSIBLE!

  Thank you in advance.

  Hello

  Please remove the NAT exemption and the re - issue the command but with #1, so it will place the NAT as first line:

  No nat (SERVERS, external) static source SERVERS_LAN SERVERS_LAN NETWORK_OBJ_10.10.40.8_29 NETWORK_OBJ_10.10.40.8_29 non-proxy-arp-search of route static destination

  NAT (SERVERS, external) 1 static source SERVERS_LAN SERVERS_LAN NETWORK_OBJ_10.10.40.8_29 NETWORK_OBJ_10.10.40.8_29 non-proxy-arp-search of route static destination

  After re-configured this way, make sure that this command is also available:

  Sysopt connection permit VPN

  This sysopt will allow traffic regardles any ACL a fall, just in case. Please continue to run a package tracer and post it here,

  Packet-trace entry Server icmp XXXXXX 8 0 detailed YYYYY

  XXXX--> server IP

  AAAA--> VPN IP of the user

  Don't forget to do the two steps and a just in case, capture Please note and mark it as correct the useful message!

  Thank you

  David Castro,