No Internet access when VPNd in ASA 5505

My problem is just like the title implies. Any internal host can access internet with on all issues. When I VPN in the network I can access all internal networks but can't access Internet sites.

I have used packet tracers in ASDM with the following parameters: an address from the pool of the vpn and the address of a site with all ports. Plotter package says that the package should be allowed.

In addition, the connection series to debug I never see what a hit the newspaper package that is intended for the land of the Internet.

DNS seems to work as it should.

What I'm missing! Thanks in advance for all your help.

Hi, from your description seems just configured RA vpn full tunnel? If this is the case could you confirm you are from your vpn for outgoing network...

typically for RA full outgoing internet tunnel you would nat pool vpn network and allow return traffic

the same interface, it came with dry even allow intra interface statement.

NAT (outside) 1

permit same-security-traffic intra-interface

Have a look here for reference

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

Concerning

Tags: Cisco Security

Similar Questions

VPN Tunnel access to several subnets ASA 5505

Greetings,

We spent a little time trying to configure our ASA 5505 in order to TUNNEL into several different subnets. Subnets include 192.168.1.0 / 192.168.2.0 / 192.168.10.0

Someone is about to review this setup running and indicate where we have gone wrong. When I connect via the VPN Client, I can access the 192.168.1.0 network, no problem. But fail to reach the other two. Thank you very much.

Output from the command: 'show running-config '.

: Saved

:

ASA Version 8.2 (5)

!

hostname BakerLofts

activate kn7RHw13Elw2W2eU encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 12

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.254 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP 74.204.54.4 255.255.255.248

!

interface Vlan12

nameif Inside2

security-level 100

IP address 192.168.10.254 255.255.255.0

!

passive FTP mode

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

vpn_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0

outside_access_in of access allowed any ip an extended list

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.3.0 255.255.255.0

Inside2_access_in of access allowed any ip an extended list

permit Inside2_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0

pager lines 24

Enable logging

asdm of logging of information

Within 1500 MTU

Outside 1500 MTU

MTU 1500 Inside2

IP local pool vpn 192.168.3.1 - 192.168.3.254 mask 255.255.255.0

no failover

ICMP unreachable rate-limit 1 burst-size 1

don't allow no asdm history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (outside) 0 192.168.3.0 255.255.255.0 outside

NAT (Inside2) 0-list of access Inside2_nat0_outbound

NAT (Inside2) 1 0.0.0.0 0.0.0.0

Access-group outside_access_in in interface outside

Access-group Inside2_access_in in the interface Inside2

Route outside 0.0.0.0 0.0.0.0 74.204.54.1 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

Floating conn timeout 0:00:00

dynamic-access-policy-registration DfltAccessPolicy

AAA authentication enable LOCAL console

AAA authentication LOCAL telnet console

Enable http server

http 192.168.1.0 255.255.255.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

outside_map interface card crypto outside

Crypto ca trustpoint _SmartCallHome_ServerCA

Configure CRL

Crypto ca certificate chain _SmartCallHome_ServerCA

certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130

010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a

30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504

0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269

65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d

65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b

30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65

74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332

68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329

302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f

63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d

010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597

a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc

7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd

18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201

082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868

7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101

ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff

45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777

2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a

1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406

03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973

69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403

02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1

6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b

c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973

69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30

1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603

445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04

1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d

2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101

4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e

b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a

99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018

481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16

b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0

5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8

6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28

6c2527b9 deb78458 c61f381e a4c4cb66

quit smoking

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet 192.168.1.0 255.255.255.0 inside

Telnet timeout 5

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

a basic threat threat detection

Statistics-list of access threat detection

no statistical threat detection tcp-interception

WebVPN

internal vpn group policy

attributes of vpn group policy

value of server DNS 8.8.8.8

Protocol-tunnel-VPN IPSec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list vpn_splitTunnelAcl

username, password samn aXJbUl92B77AGcc. encrypted privilege 0

samn attributes username

Strategy-Group-VPN vpn

username password encrypted QUe2MihLFbj2.Iw0 privilege 0 jmulwa

username jmulwa attributes

Strategy-Group-VPN vpn

jangus Uixpk4uuyEDOu9eu username encrypted password

username jangus attributes

Strategy-Group-VPN vpn

vpn tunnel-group type remote access

VPN tunnel-group general attributes

vpn address pool

Group Policy - by default-vpn

Tunnel vpn ipsec-attributes group

pre-shared key *.

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

maximum message length automatic of customer

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

Review the ip options

!

global service-policy global_policy

context of prompt hostname

anonymous reporting remote call

Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e

: end

I see two problems:

1. your ASA has not an interior road to the Incas inside networks. You must add:

Route inside 192.168.2.0 255.255.255.0

Route inside 192.168.10.0 255.255.255.0

.. .specifying your gateway address of these networks.

2. the statement "access-list standard vpn_splitTunnelAcl permit 192.168.1.0 255.255.255.0" sends only a route for 192.168.1.0/24 to your customer. You need to add entries for the other two networks.

Office Pavilion Elite e9220y: name of the Internet access when you hover over said tskbr network 5. is that HP name or co cable. ?

Hello

I have a desktop Pavilion Elite e9220y Home Premium; Win 7; 64-bit computer.

I'm wired; but have wireless for other things (Kindle, etc..)

When I open internet access in the bar of tasks and under the "wireless network connection", I see MY connection (and the name I gave my connection) and 5 solid green bars (no problem).

Above this section, there is an article with a picture of a House (provided by HP, I'm sure), and he says:

' Currently logged on:

and just below it says: (to the right of the photo of the House) network 5

and just below it says: internet access

That's all it lists the wireless network connection with my name and the names of other connections in the district.

My question:

the name "network 5"?

HP says it is my cable provider; my cable provider says it's at HP.

This can be changed?

Thank you!

Hello Denise,.

Thank you for visiting the HP Forums! A place where you can find solutions for your problems with the help of the community!

I understand that you have a problem with wireless networks.

Windows will think it's in a new network whenever it detects a new router. If you have changed your router or the router configuration. Windows creates a new network. But do not worry.

If you don't want the name of the connection to be listed under active connection, follow the steps.

(1) open the "Control Panel".

(2) select and open "network and sharing Center."

(3) click on the ' icon "(une icône de la maison pour moi) less 'show your active networks'.". " This will open the dialogue "set network properties." Here, you can rename a network connection or a change as the network connection icon.

4) click on "Merge or delete network locations" to view the list of network connections that are stored. You can merge or remove connections

Let me know if it helps.

Have a great day!

No internet access when it is connected to the modem

HI I have an Ethernet cable modem BEFMCU10 model v3 connected to a Netgear n100 v2 wireless router. The modem works only when it is connected with the wireless router. When I try to connect Ethernet. Modem to PC, it does not connect, there is no internet access. My ISP is Comcast (Xfinity). It's really weird because how is it possible that theres internet via wireless, but when I connect my modem via Ethernet, I have no internet access

I remember the first time I activated my modem there is xfinity software that did something to my modem but I don't think it has to do with anything he just install something in my laptop. I did a clean install of the software or anything has been removed.

> Sometimes I download things and I prefer to use the physical connection because its faster.

You will get the same benefits and an easier time using a wired connection to your router, rather than the modem.

> My prolem is resolved, I followed your instructions, thank you

You are welcome. Please mark as replied to close the issue.

> is - this quite useful to purchase a Docsis 3.0 modem

You can check this with your cable provider, but probably not. Unless you have a very high speed (usually of company type) cable plan there would be no advantage. You also must be sure that any modem you purchase is compatible.

No internet access when you're connected to my wireless router

I have a laptop Compaq Presario CQ62

OS: Windows 7 64-bit,

Processor: AMD V120 processor 2.20 GHz

Network adapter: Broadcom 4313 802.11b/g/n and Microsoft Virtual WiFi Miniport

A month ago, I was using internet and then it suddenly stopped working. I am connected to the wireless connection, but there is no Internet access. I tried to leave the network and joining, turn off the router for 5 minutes, but nothing seems to work. What can I do?

Keiron Wilce

Thanks for all the help guys, but it seems that my anti-virus just need to update that was made by another computer and do pass through a pen-drive. Once again thank you for all the help.

Windows 7 network system tray icon displays "Internet access" when there is none

I recently had this episodic and deeply frustrating problem with a laptop. Sometimes the internet works, other times not, even if Windows reports that it has access to the internet. I was wondering if there could be a firewall issue, tried to remove and reinstall the driver of NIC in addition to other things but the problem kept reappearing. I just managed to find the answer so I hope this will be useful for someone else who feels the same.

The problem is caused by the Apple Hello service installed by Adobe Creative Suite CS3. It's pretty old now, but I installed it recently because I needed to use one of the applications. The Bonjour service adds the default gateway 0.0.0.0 and therefore stops the internet access.

The problem and the solution is given here:
http://helpx.Adobe.com/Creative-Suite/KB/Bonjour-Windows-CS3-CS4.html

This site is also very useful:
http://www.petenetlive.com/kb/article/0000332.htm

The only thing I would add is to run the CLI window with administrative rights so that the commands to run (type "cmd" in the start menu > search and then right-click on cmd.exe to run with admin rights).

HTH

Andrew

Hello

Thanks for sharing the information.

I don't know that this information would help the other users of the Forum community Microsoft.

1 computer think network doesn't have internet access when it does

I have a modem ActionTec with AT & T service and a LinkSys Router. My roommate's computer and my work computer can connect to it wirelessly and have internet, no problem. My computer connects to my network, but then said that my network has 'no Internet' which is obviously untrue as 2 other computers can use internet on this network. I have disconnected, turned off, turned on, you call it. I also know that my computer can still connect wirelessly because it works on a public wireless network. Possibly associated, turn on my computer, a RunDLL error message about how he doesn't get DisplayOnlineTray. Everything worked fine with these 3 devices (modem, router and my computer) to the AT & T had service problems last week. When the internet came back, my roommate's computer and my work computer were fine, but my computer can't see the connection to the Internet. Why my computer is blind in this regard and how can I fix this problem?

Please provide the following diagnostic information from your "personal computer":

What version of XP, including service pack (click right my computer and select Properties, if you do not know)?
- Open a command prompt window (start > run > cmd > OK)
- In the black command prompt window, type each of the following lines and press ENTER after each one
ipconfig/all > "% userprofile%\Desktop\ipinfo.txt".
ping 192.168.1.1 > '% userprofile%\Desktop\ipinfo.txt '.
ping google.com > '% userprofile%\Desktop\ipinfo.txt '.
Notepad '% userprofile%\Desktop\ipinfo.txt '.

Please note that there is a > in the first line and two > in the second and third lines
- Copy and paste the contents of the Notepad window in your answer here
- You can close the command prompt window and the window of Notepad and remove ipinfo.txt from your desktop.

Win XP - internet has suddenly stopped working - can't ping IPs - but Internet access web/mail/messenger

Hello

This Windows XP desktop PC is connected to the Internet via a connection by modem.

The connection by modem connects fine, but I have no Internet access when you're connected.
Other computers using the same remote access settings still work fine.

The owner says that the problem started after a game hard reboot computer crash and following.

I tried IE, Firefox, Messenger, Thunderbird, etc.
All these programs fail instantly when you are trying to connect, as they do not recognize that there is an Internet connection.

I can ping IP Internet addresses, but I cannot ping names of site like www.google.com.
I can't connect to an IP with IE, so it doesn't seem to be just a DNS issue.

This remote access connection using a proxy (filter.voicenet.com:8241).
I checked the proxy for the modem connection settings are correct in IE and Firefox.
I have reset the TCP/IP stack.
I also ran the Winsock XP fix tool.

Norton is installed, but I ran Norton removal tool to completely remove the software.
The Windows Firewall is disabled.
No other security software is installed as I know.

I'm open to any ideas...

Thanks for your time,

Kendall

See if this response to another question from the forum by Azeez N help.
Boulder computer Maven
Most Microsoft Valuable Professional

ASA 5505 VPN sessions maximum 25?

Hello friend´s

The company I work when acquired several ASA 5505, so now we will be able to connect several branches at Headquarters. But, now, I know that the ASA 5505 just scalates to 25 VPN sessions, I think that it won´t be enough to support the operations of an office. I have a lot of questions about this:

Is - what the number 25 menas supporting up to 25 L2L tunnels? Or it means 25 sessions, regardless of the amount of L2L tunnels?

Is this the way number 25 supporting up to 25 users in the Branch Office? Or it means that a user can use several sessions?

I'm the stage of testing in a laboratory where one PC connects to many applications, at - it now someone if there is a command in the SAA to check how many VPN sessions is used?

Please, do not hesitate to ask as much as necessary information. Any comments or document will be appreciated.

Kind regards!

Hi Alex,

The assistance session 25 ASA 5505 VPN as max for IKEv1 or IPSEC tunnels customers it could be up to 25 L2L tunnels or 25 users using ikev1 (Legacy IPSEC client) and another 25 sessions for Anyconnect or Webvpn in this case are used in function.

To check how many sessions VPN is currently running, run the command 'Show vpn-sessiondb' and 'display the summary vpn-sessiondb '.

Find the official documentation for the ASA5505 on the following link:

http://www.Cisco.com/c/en/us/products/collateral/security/ASA-5500-series-next-generation-firewalls/datasheet-C78-733510.html

Rate if helps.

-Randy-

Please help, unidentified network, Internet access without problem...

Hello world...

I have a Toshiba Satellite C850 performer windows 8 64-bit, and it was working fine, suddenly the wifi doesn't connect now and said internet access, when I press on troubleshoot it says "wifi is not a valid IP configuration", and also tried to connect through a LAN cable, it does not either, but other laptops and mobile phones perfectly connects to the network It happened after I installed Skype. !!! I know it's a coincidence, but thought I should say...

I tried to disable the two network adapters, forget network then connection, tried to remove the 'Hello' in the firewall, but I was not even have Hello... I'm going crazy with her...

I tried to disable the firewall, anti-virus uninstall, I got avast, I tried to disable IPv6.

tried these commands cmd

netsh winsock reset catalog

netsh int ip reset reset.log hit

ipconfig/flushdns

He said

«"«reset the interface...»»» Ok!
"something that I don't remember now" reset OK!
reset failed
Access is denied

«' There is no user specified parameters to be re-armed»»»

Although I chose command prompt (admin)...

also tried

ipconfig/release

ipconfig/renew

It was the result

Although I was connected at this time...

Tried another router wifi at home with my brother, with no other connected devices but this win8 one, didn't work either...

Tried to boot into "Safe Mode with network" no longer works...

I tried to uninstall the driver and install the last, also did not work,

I also disabled the (avast NDSI firewall driver) and the (avast firewall driver), didn't work...

This is the screenshot of the ipconfig/all command

I tried to take the IP address and the subnet mask and default gateway and DNS servers, since a working laptop and enter manually on this laptop from win8 but did not work, but now there is no 'limited access and no yellow triangle', but still no internet connectivity...

Here are a few screenshots:

My network is the first...

and ALL this applies for WiFi AND cable LAN, and also I tried to connect my Samsung galaxy phone and tried 3 G connect via it's also did not work, but it used to work before the problem

HEEEEEEEELP PLEEEEEEEEAAAAAAAAAASE...

Hello

Please contact Microsoft Community.

We appreciate your efforts and the provision of information in detail about the issue. As you have already tried some troubleshooting and your computer still does not connect to the internet. I suggest you to consult the article below and check if it helps.

How to refresh, reset or restore your PC;

Warning: When you use system restore to restore the computer to a previous state, the programs and updates that you have installed are removed.

http://Windows.Microsoft.com/en-us/Windows-8/restore-refresh-reset-PC

Important: refer to the section "restore your PC to an earlier point in time."

Note: Try to restore your system to an earlier date when everything worked correctly.

Meet us, then we can help you further.

ASA 5505 VPN works great but can't access internet via the tunnel to customers

We have an ASA 5505 ASA 8.2.1 running and using IPSec for Remote access clients in the main office. Remote access is a lot of work, with full access to network resources in the main office and the only thing I can't get to work is access to internet through the tunnel. I don't want to use split tunneling. I use ASDM 6.2.1 for configuration. Any help is appreciated. I'm probably missing something simple and it looked so much, I'm probably looking at right beyond the error. Thanks in advance for your time and help! Jim

Add a statement of nat for your segment of customer on the external interface

NAT (outside) - access list

then allow traffic routing back on the same interface, it is entered in the

permit same-security-traffic intra-interface

*

*

* more than information can be found here:

http://www.Cisco.com/en/us/products/ps6120/products_tech_note09186a00807...

On Wednesday, 27 January 2010, at 23:12, jimcanova

ASA 5505 - order Internet access for users

Hi all

I have a Cisco ASA 5505 connect my LAN over the internet using NAT/PAT. I want to restrict access to the internet on ports 80 and 443 on a per user basis.

That is to say access to management staff while limiting the general staff.

I understand how this on a per device level by creating an access list to block certain IP addresses to the internet, but I would limit some users.

I guess they will have to authenticate to the ASA some how.

Pointers?

TIA.

You need to set up the Cup via proxy in ASA.

Here is the configuration that we add on ASA:-

access-list WEBAUTH permit tcp any any eq 80

access-list WEBAUTH permit tcp any any eq 443

AAA authentication WEBAUTH indoor soccer match

AAA authentication secure-http-client

AAA authentication listener http inside port www redirect

Redirect the AAA authentication listener https within the https port

http://www.Cisco.com/en/us/docs/security/ASA/asa72/configuration/guide/fwaaa.html#wp1043431

http://www.Cisco.com/en/us/docs/security/ASA/asa72/command/reference/a1_72.html#wp1437427

Kind regards

~ JG

Note the useful messages

No Internet connectivity with ASA 5505 VPN remote access

Hello

I configured ASA 5505 for remote access VPN to allow a remote user to connect to the Remote LAN officce. VPN works well, users can access Office Resource of LAN with sahred etc., but once they have connected to the VPN, they are unable to browse the internet?

Internet navigation stop working as soon as their customer VPN connect with ASA 5505 t, once they are disconnected from VPN, once again they can browse the internet.

Not ASA 5505 blocking browsing the internet for users of VPN? Is there anything else that I need congfure to ensure that VPN users can browse the internet?

I have to configure Split Tunnleing, NATing or routing for VPN users? or something else.

Thank you very much for you help.

Concerning

Salman

Salman

What you run into is a default behavior of the ASA in which she will not route traffic back on the same interface on which he arrived. So if the VPN traffic arrived on the external interface the ASA does not want to send back on the external interface for Internet access.

You have at least 2 options:

-You can configure split tunneling, as you mention, and this would surf the Internet to continue during the use of VPN.

-You can set an option on the ASA to allow traffic back on the same interface (this is sometimes called crossed). Use the command

permit same-security-traffic intra-interface

HTH

Rick

VPN on ASA 5506 without internet access, help with NAT?

Hello

I have upgraded to a Cisco ASA 5505 to a 5506 X and as such have climbed to ASA 9.5

For this reason, I'm a bit stuck on how to implement the VPN. I followed the wizard and I can now establish inbound connections, but when connected (all traffic is tunnel) there is no internet connectivity.

Our offices internal (inside) network is 192.168.2.0/24

Our VPN pool is 192.168.4.0/24

I guess that I'm missing a NAT rule, but in all honesty, I'm a user ASDM and as everything is changed, I am struggling to recreate it?

Here is my config:

Result of the command: "sh run"

: Saved

:
: Serial Number: JAD194306H5
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.5(1)
!
hostname ciscoasanew
domain-name work.internal
enable password ... encrypted
names
ip local pool RemoteVPNPool 192.168.4.1-192.168.4.254 mask 255.255.255.0
!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address 192.168.3.4 255.255.255.0
!
interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.2.197 255.255.255.0
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management1/1
 management-only
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
ftp mode passive
clock timezone GMT 0
dns domain-lookup inside
dns domain-lookup management
dns server-group DefaultDNS
 name-server 192.168.2.199
 domain-name work.internal
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network 173.0.82.0
 host 173.0.82.0
object network 173.0.82.1
 subnet 66.211.0.0 255.255.255.0
object network 216.113.0.0
 subnet 216.113.0.0 255.255.255.0
object network 64.4.0.0
 subnet 64.4.0.0 255.255.255.0
object network 66.135.0.0
 subnet 66.135.0.0 255.255.255.0
object network a
 host 192.168.7.7
object network devweb
 host 192.168.2.205
object network DevwebSSH
 host 192.168.2.205
object network DEV-WEB-SSH
 host 192.168.2.205
object network DEVWEB-SSH
 host 192.168.2.205
object network vpn-network
 subnet 192.168.4.0 255.255.255.0
object network NETWORK_OBJ_192.168.4.0_24
 subnet 192.168.4.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_24
 subnet 192.168.2.0 255.255.255.0
object-group network EC2ExternalIPs
 network-object host 52.18.73.220
 network-object host 54.154.134.173
 network-object host 54.194.224.47
 network-object host 54.194.224.48
 network-object host 54.76.189.66
 network-object host 54.76.5.79
object-group network PayPal
 network-object object 173.0.82.0
 network-object object 173.0.82.1
 network-object object 216.113.0.0
 network-object object 64.4.0.0
 network-object object 66.135.0.0
object-group service DM_INLINE_SERVICE_1
 service-object icmp
 service-object icmp6
 service-object icmp alternate-address
 service-object icmp conversion-error
 service-object icmp echo
 service-object icmp information-reply
 service-object icmp information-request
access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object DEVWEB-SSH eq ssh
access-list outside_access_in remark AWS Servers
access-list outside_access_in extended permit tcp object-group EC2ExternalIPs object devweb eq ssh log debugging inactive
access-list outside_access_in extended permit ip any any inactive
access-list outside_access_in remark Ping reply
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any interface outside
access-list outside_access_in remark Alarm
access-list outside_access_in extended permit tcp any interface outside eq 10001
access-list outside_access_in remark CCTV
access-list outside_access_in extended permit tcp any interface outside eq 7443
access-list outside_access_in extended deny ip any any
access-list workvpn_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.255.0
access-list workvpn_splitTunnelAcl_1 standard permit 162.13.130.12 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 162.13.133.72 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 164.177.128.200 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.16 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 164.177.132.72 255.255.255.252
access-list workvpn_splitTunnelAcl_1 standard permit 212.64.147.184 255.255.255.248
access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.116 255.255.255.254
access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.118 255.255.255.254
access-list workvpn_splitTunnelAcl_1 standard permit host 95.138.147.118
access-list workvpn_splitTunnelAcl_1 standard permit 95.138.147.120 255.255.255.254
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list workvpn2_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
access-list workVPN2016_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging buffer-size 16000
logging asdm-buffer-size 512
logging asdm warnings
logging flash-bufferwrap
mtu outside 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 7200
no arp permit-nonconnected
nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup
!
object network obj_any
 nat (any,outside) dynamic interface
object network DEVWEB-SSH
 nat (inside,outside) static interface service tcp ssh ssh
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.3.3 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.2.197,CN=ciscoasanew
 keypair ASDM_LAUNCHER
 crl configure

snip

dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
no threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ssl-client
group-policy workVPN2016 internal
group-policy workVPN2016 attributes
 dns-server value 192.168.2.199
 vpn-tunnel-protocol ikev1
 split-tunnel-policy tunnelall
 ipv6-split-tunnel-policy tunnelall
 default-domain value work.internal
 split-dns value work.internal
 split-tunnel-all-dns enable
dynamic-access-policy-record DfltAccessPolicy

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous
hpm topN enable
Cryptochecksum:
: end

Hi Ben-

What you are trying to accomplish is called VPN crossed. Depending on your initial configuration, you have 2 NAT problems. The first has to do with the NAT you place your order. In the code later that we are dealing with two NAT ASA 8.3 times and who are ranked 2 sections going on before and after the device NAT. object

My general rule for control of NAT is like this:

Twice NAT (front) - use this section for exemptions from NAT or unusual configurations that have to go first
Purpose of NAT - Use this section to the static NAT instructions for servers
Twice NAT (after) - use this section to your global declarations of NAT, basically a catch-all

Then, never use 'all' as an interface for all training of NAT. This may seem like a good idea, but it will bite you. Remember, it is more the notion of control NAT, then 'all' interface is bit VPN configurations and similar DMZ. Always be specific about your interface for NAT pairs.

To this end, here is what I suggest that your NAT configuration should resemble:

nat (inside,outside) source static NETWORK_OBJ_192.168.2.0_24 NETWORK_OBJ_192.168.2.0_24 destination static NETWORK_OBJ_192.168.4.0_24 NETWORK_OBJ_192.168.4.0_24 no-proxy-arp route-lookup!object network DEVWEB-SSH nat (inside,outside) static interface service tcp ssh ssh !nat (inside,outside) after-auto source dynamic any interfacenat (outside,outside) after-auto source dynamic any interface

The key is that you need a NAT device explicitly reflecting the VPN traffic. PSC

ASA 5505 as internet gateway (must reverse NAT)

Hi all the Cisco guru

I have this diet:

Office-> Cisco 877-> Internet-> ASA 5505-> remote network

Office network: 192.168.10.0/24

Cisco 877 IP internal: 192.168.10.200

Cisco 877 external IP: a.a.a.a

ASA 5505 external IP: b.b.b.b

ASA 5505 internal IP: 192.168.1.3 and 192.168.17.3

Remote network: 192.168.17.0/24 and 192.168.1.0/24

VPN tunnel is OK and more. I have the Office Access to the remote network and the remote network access to the bureau by the tunnel.

But when I try to access the network remotely (there are 2 VLANS: management and OLD-private) to the internet, ASA answer me:

305013 *. * NAT rules asymetrique.64.9 matched 53 for flows forward and backward; Connection for udp src OLD-Private:192.168.17.138/59949 dst WAN:*.*.64.9/53 refused due to path failure reverse that of NAT

Ping of OLD-private interface to google result:

110003 192.168.17.2 0 66.102.7.104 0 routing cannot locate the next hop for icmp NP identity Ifc:192.168.17.2/0 to OLD-Private:66.102.7.104/0

Result of traceroute

How can I fix reverse NAT and make ASA as internet gateway?

There is my full config

!
ASA Version 8.2 (2)
!
hostname ASA2
domain default.domain.invalid
activate the encrypted password password
encrypted passwd password
names of
!
interface Vlan1
Description INTERNET
1234.5678.0002 Mac address
nameif WAN
security-level 100
IP address b.b.b.b 255.255.248.0
OSPF cost 10
!
interface Vlan2
OLD-PRIVATE description
1234.5678.0202 Mac address
nameif OLD-private
security-level 0
IP 192.168.17.3 255.255.255.0
OSPF cost 10
!
interface Vlan6
Description MANAGEMENT
1234.5678.0206 Mac address
nameif management
security-level 0
192.168.1.3 IP address 255.255.255.0
OSPF cost 10
!
interface Ethernet0/0
!
interface Ethernet0/1
Shutdown
!
interface Ethernet0/2
Shutdown
!
interface Ethernet0/3
Shutdown
!
interface Ethernet0/4
Shutdown
!
interface Ethernet0/5
Shutdown
!
interface Ethernet0/6
switchport trunk allowed vlan 2.6
switchport mode trunk
!
interface Ethernet0/7
Shutdown
!
connection of the banner * W A R N I N G *.
banner connect unauthorized access prohibited. All access is
connection banner monitored, and intruders will be prosecuted
connection banner to the extent of the law.
Banner motd * W A R N I N G *.
Banner motd unauthorised access prohibited. All access is
Banner motd monitored and trespassers will be prosecuted
Banner motd to the extent of the law.
boot system Disk0: / asa822 - k8.bin
passive FTP mode
DNS domain-lookup WAN
DNS server-group DefaultDNS
Server name dns.dns.dns.dns
domain default.domain.invalid
permit same-security-traffic intra-interface
object-group Protocol TCPUDP
object-protocol udp
object-tcp protocol
object-group service RDP - tcp
RDP description
EQ port 3389 object
Access extensive list ip 192.168.17.0 LAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Standard access list LAN_IP allow 192.168.17.0 255.255.255.0
WAN_access_in list of allowed ip extended access all any debug log
WAN_access_in list extended access permitted ip OLD-private interface WAN newspaper inactive debugging interface
WAN_access_in list extended access permit tcp any object-group RDP any RDP log debugging object-group
MANAGEMENT_access_in list of allowed ip extended access all any debug log
access-list extended OLD-PRIVATE_access_in any allowed ip no matter what debug log
access-list OLD-PRIVATE_access_in extended permit ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0 inactive debug log
OLD-PRIVATE_access_in allowed extended object-group TCPUDP host 192.168.10.7 access-list no matter how inactive debug log
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.10.254 interface private OLD newspaper inactive debugging
access-list OLD-PRIVATE_access_in allowed extended icmp host 192.168.17.155 interface private OLD newspaper debugging
access-list 101 extended allow host tcp 192.168.10.7 any eq 3389 debug log
Access extensive list ip 192.168.17.0 WAN_1_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
WAN_cryptomap_2 to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.10.0 255.255.255.0
Capin list extended access permit ip host 192.18.17.155 192.168.10.7
Capin list extended access permit ip host 192.168.10.7 192.168.17.155
LAN_access_in list of allowed ip extended access all any debug log
Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 192.168.10.0 255.255.255.0
Access extensive list ip 192.168.17.0 WAN_2_cryptomap allow 255.255.255.0 192.168.10.0 255.255.255.0

permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.17.0 255.255.255.0
pager lines 24
Enable logging
recording of debug trap
logging of debug asdm
Debugging trace record
Debug class auth record trap
MTU 1500 WAN
MTU 1500 OLD-private
MTU 1500 management
mask 192.168.1.150 - 192.168.1.199 255.255.255.0 IP local pool VPN_Admin_IP
no failover
ICMP unreachable rate-limit 1 burst-size 1
ICMP permitted host a.a.a.a WAN
ICMP deny any WAN
ICMP permitted host 192.168.10.7 WAN
ICMP permitted host b.b.b.b WAN
ASDM image disk0: / asdm - 631.bin
don't allow no asdm history
ARP timeout 14400
Global (OLD-private) 1 interface
Global interface (management) 1
NAT (WAN) 1 0.0.0.0 0.0.0.0

inside_nat0_outbound (WAN) NAT 0 access list
WAN_access_in access to the WAN interface group
Access-group interface private-OLD OLD-PRIVATE_access_in
Access-group MANAGEMENT_access_in in the management interface
Route WAN 0.0.0.0 0.0.0.0 b.b.b.185 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
local AAA authentication attempts 10 max in case of failure
Enable http server
http 192.168.1.0 255.255.255.0 WAN
http 0.0.0.0 0.0.0.0 WAN
http b.b.b.b 255.255.255.255 WAN
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Service resetoutside
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
card crypto WAN_map 1 corresponds to the address WAN_1_cryptomap
card crypto WAN_map 1 set peer a.a.a.a
WAN_map 1 transform-set ESP-DES-SHA crypto card game
card crypto WAN_map WAN interface
ISAKMP crypto enable WAN
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
the Encryption
sha hash
Group 1
life 86400
Telnet timeout 5
SSH a.a.a.a 255.255.255.255 WAN
SSH timeout 30
SSH version 2
Console timeout 0
dhcpd auto_config management
!

a basic threat threat detection
host of statistical threat detection
Statistics-list of access threat detection
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
NTP server 129.6.15.28 source WAN prefer
WebVPN
attributes of Group Policy DfltGrpPolicy
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
internal admin group strategy
group admin policy attributes
DNS.DNS.DNS.DNS value of DNS server
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list LAN_IP
privilege of encrypted password password username administrator 15
type tunnel-group admin remote access
tunnel-group admin general attributes
address pool VPN_Admin_IP
strategy-group-by default admin
tunnel-group a.a.a.a type ipsec-l2l
tunnel-group a.a.a.a general-attributes
strategy-group-by default admin
a.a.a.a group of tunnel ipsec-attributes
pre-shared-key *.
NOCHECK Peer-id-validate
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!

Thank you for your time and help

Why you use this NAT type?

Access extensive list ip 192.168.17.0 WAN_nat0_outbound allow 255.255.255.0 any
NAT (OLD-private) 0-list of access WAN_nat0_outbound

You are basically saying the ASA not NAT traffic. This private IP address range is not routed on the Internet. This traffic is destined to be sent over the Internet? If so, that LAC should then not be there.

If you want NAT traffic to one IP public outside the ASA, you must remove this line and let the NAT and GLOBAL work:

NAT (OLD-private) 1 0.0.0.0 0.0.0.0

Global (WAN) 1 interface

No Internet access when VPNd in ASA 5505

Similar Questions

Maybe you are looking for