No rules on addresses IP POOL for VPN Tunnel?

Similar Questions

• Limit bandwidth for VPN users

  Hi guys,.

  I use ASA Version 8.2 (1), I want to limit vpn users to use less bandwidth of my Interlink to access something on the inside of the network

  example: source vpn pool

  Destn: inside the network

  Please let me know how to achieve this with QOS config.

  Hello

  Probably the best would be to match groups of tunnel.

  class-map TG1-best-effort 

  match tunnel-group Tunnel-Group-1 

  match flow ip destination-address 

  Then this traffic in police policy-map and apply the service policy to the external interface (since you want to traffic police from your home). You can also use the pool for vpn access lists.

  For more details, please see:

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/QoS.html

• Unique IP address redirection by user VPN

  Hi all

  I'm having a problem with the VPN user. For users connected via the AnyConnect VPN client, all their Internet traffic out of their local Internet connection, since I was on the split tunneling. However, I need a specific IP address public through the VPN tunnel and on the diameter of the main office, rather than the internet connection at the user's local. I managed to have this IP address through the tunnel of the ASA headquarters, but it seems that it gets stuck somewhere here, or maybe the return traffic gets blocked. I use an ASA 5520 at Headquarters, with the software version 8.3. Can someone help me?

  Thank you!

  Hi Nathalie,.

  This is what you need:

  network vpn-pool objects

  subnet 192.168.1.0 255.255.255.0

  !

  external-server object from network

  host 7.7.7.7

  !

  NAT (outside, outside) 1 source vpn-pool dynamic interface external-server static external-server destination

  permit same-security-traffic intra-interface

  That should allow the u-turn on the external interface, so the customers out to the Internet with the external IP of the FW when trying to reach the 7.7.7.7 server.

  Let me know.

  Thank you.

  Portu.

  Please note any workstation that you be useful.

• Interpret what is allowed on the VPN tunnel

  Hello

  I work with Cisco PIX equipment for the first time and I'm trying to understand what is allowed on one of the VPN tunnels which are established on the PIX.

  I interpret this PIX did by reading the running configuration. I was able to understand most of it (with the help of the cisco site), so I'm starting to get comfortable with it. I'm looking for more help in the interpretation of what is allowed by a good VPN tunnel. Here are some details:

  map Cyril 2 ipsec-isakmp crypto

  Cyril 2 crypto card matches the acl-vpntalk address

  access list acl-vpntalk allowed ip object-group my_inside_network 172.17.144.0 255.255.255.0

  So, if I interpret it correctly, then the traffic matching ACL acl-vpntalk will go on the VPN tunnel.

  As far as the lists others access dedicated, my inner interface I have:

  Access-group acl-Interior interface inside

  With ACL-Interior:

  access list acl-Interior ip allow a whole

  So nothing complicated there.

  Now, just because of all this I conclude I encouraged all remote network traffic in my site. If all traffic 172.17.144.0/24 is allowed to join my network.

  However, I don't know if this conclusion is correct.

  This ACL is also applied:

  Access-group acl-outside in external interface

  And it looks like:

  deny access list acl-outside ip a

  I'm not sure if this ACL applies to vehicles coming from the IPSEC peer. It's for sure inbound on the external interface, but if it is valid for the IPSEC traffic I don't know.

  If it is valid, then am I had reason to conclude that only connections initiated from my inside network to the remote control can come back?

  Thanks in advance for your ideas.

  With sincere friendships.

  Kevin

  Hey Kevin,

  Here are my comments, hope you find them useful:

  1. the ACL called "acl-vpntalk" sets traffic who will visit the IPSec tunnel, so you got that right. All traffic from the group called "my_inside_network" will 172.17.144.0/24 will pass through the tunnel, and there should be a similar to the other VPN end opposite ACL.

  2. the 'acl-inside' applied to the inside interface allows any ip traffic coming out of the isnide to any destination.

  3. the 'acl-outside' rejects all traffic from entering your home network, but the IPSec traffic is free and will cross because you will find a "sysopt connection permit-ipsec' configured on your PIX command that tells the operating system to allow all traffic destined for VPN tunnels without explicitly enabling it through the inbound ACL. If you have stopped the "sysopt" should stop your traffic and you will have more control on your tunnel traffic.

  Personally, I usually disable the "sysopt" and control the VPN traffic in my incoming ACL.

  Just a quick note, if you look more deeply into the ACL on the PIX functionality, you will find that no traffic moves inside, if she is not allowed on the external interface. For example, you can allow traffic between "inside" and "dmz" interfaces by adding an entry 'allow' on one of the ACLS applied to one of these interfaces. But when you want to allow traffic from the external interface (security level 0), you will need to allow in the inbound ACL applied on the external interface.

  I could have written something vague, but I hope you get my point.

  Thank you.

  Salem.

• Rule of NAT for vpn access... ?

  Hey, putting in place the vpn ssl via the client Anyconnect on a new ASA 5510, ASA ASDM 6.4.5 8.4.2.

  I am able to 'connect' through the anyconnect client, & I am assigned an ip address from the pool of vpn that I created, but I can't ping or you connect to internal servers.

  I think that I have configured the split tunneling ok following the guide below, I can browse the web nice & quickly while connected to the vpn but just can't find anything whatsoever on the internal network.

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080975e83.shtml

  I suspect her stockings for a nat rule, but I am a bit stuck if it should be a rule of nat object network or if it must be dynamic/static & if its between the external interface or external ip & network inside or the VPN (I created the pool on a different subnet), or a 'Beach' (but then I am getting overlapping ip errors when I try to create a rule for a range of IP addresses.

  Any advice appreciated,

  Hi Eunson,

  After have connected you to the ASA that clients receive an IP address, let's say 192.168.10.0/24 pool, the network behind the ASA is 192.168.20.0/24.

  On the SAA, you would need an NAT exemption for 192.168.20.0 to 192.168.10.0

  Create two groups of objects, for pool VPN and your itnernal LAN.

  object-group network object - 192.168.20.0

  object-network 192.168.20.0 255.255.255.0

  object-group network object - 192.168.10.0

  object-network 192.168.10.0 255.255.255.0

  NAT (inside, outside) 1 source static object - 192.168.20.0 object - 192.168.20.0 destination static object - 192.168.10.0 object - 192.168.10.0 non-proxy-arp-search to itinerary

  At the inside = interface behind which is your LOCAL lan

  Outside = the interface on which the Clients connect.

  If you can't still access then you can take the shot on the inside interface,

  create and acl

  access-list allowed test123 ip host x.x.x.x y.y.y.y host

  access-list allowed test123 ip host host x.x.x.x y.y.y.y

  interface test123 captures inside test123 access list

  view Cape test123

  It will show if the packages are extinguished inside the interface and if we see that the answers or not. If we have all the answers, this means that there might be a routing on the internal LAN problem as devices know may not be not to carry the traffic of 192.168.10.0 return to the ASA inside the interface.

  Or maybe it's that there is a firewall drop packets on your internal LAN.

  HTH

• Can the NAT of ASA configuration for vpn local pool

  We have a group of tunnel remote ipsec, clients address pool use 172.18.33.0/24 which setup from command "ip local pool. The remote cliens must use full ipsec tunnel.

  Because of IP overlap or route number, we would like to NAT this local basin of 172.18.33.0 to 192.168.3.0 subnet when vpn users access certain servers or subnet via external interface of the ASA.  I have nat mapping address command from an interface to another interface of Armi. The pool local vpn is not behind any physical interface of the ASA. My question is can ASA policy NAT configuration for vpn local pool.  If so, how to set up this NAT.

  Thank you

  Haiying

  Elijah,

  NAT_VPNClients ip 172.18.33.0 access list allow 255.255.255.0 10.1.1.0 255.255.255.0

  public static 192.168.33.0 (external, outside) - NAT_VPNClients access list

  The above configuration will be NAT 172.18.33.0/24 to 192.168.33.0/24 when you go to 10.1.1.0/24 (assuming that 10.1.1.0/24 is your subnet of servers).

  To allow the ASA to redirect rewritten traffic the same interface in which he receive, you must also order:

  permit same-security-traffic intra-interface

  Federico.

• Need help to configure VPN NAT traffic to ip address external pool ASA

  Hello

  I need to configure vpn NAT ip address traffic external pool ASA

  For example.

  Apart from the ip address is 1.1.1.10

  VPN traffic must be nat to 1.1.1.11

  If I try to configure policy nat or static nat ASA gives me error "global address of overlap with mask.

  Please, help me to solve this problem.

  Thank you best regards &,.

  Ramanantsoa

  Thank you, and since you are just 1 IP 1.1.1.11 Polo, the traffic can only be initiated from your site to the remote end.

  Here is the configuration of NAT:

  access list nat - vpn ip 192.168.1.0 allow 255.255.255.0 10.0.0.0 255.255.0.0

  NAT (inside) 5 access list nat - vpn

  Overall 5 1.1.1.11 (outside)

  In addition, the ACL crypto for the tunnel from site to site should be as follows:

  access-list allow 1.1.1.11 ip host 10.0.0.0 255.255.0.0

  Hope that helps.

• Need of the ACL kung fu for VPN from Site to Site ACL problem

  Group,

  Have a little problem I know is related to ACL. I wanted to have a few experts to take a look at my config please. Here's the question:

  Attempt to create a site between two offices, but for some reason any that they cannot ping each other. It is a strange thing.

  97.XX.231.22 <-->71.xx.160.123

  I can ping both firewalls from the outside using a computer to another, but from the internal firewall utilities, they cannot ping each other. At the same time I can ping to their respective gateways.

  Secondly, I did an interior outside translation as you can see here for 80 & 443 preventing me from browsing http and https via VPN for Remote LAN, can it be modified to allow access? I can access when I dial in via VPN client but not via permanent VPN tunnel. Here is the config.

  no ip nat service sip 5060 udp port

  IP nat inside source map route SDM_RMAP_1 interface GigabitEthernet0/0 overload

  IP nat inside source static tcp 10.41.14.103 80 71.xx.160.123 80 extensible

  IP nat inside source static tcp 10.41.14.103 71.xx.160.123 expandable 443 443

  IP route 0.0.0.0 0.0.0.0 71.xx.160.121

  IP route 10.67.188.32 255.255.255.224 10.41.14.99 6 permanent

  IP route 10.67.188.96 255.255.255.224 10.41.14.99 8 permanent

  IP route 10.200.107.0 255.255.255.0 10.41.14.99 9 permanent

  IP route 10.200.110.0 255.255.254.0 10.41.14.99 7 permanent

  IP route 74.200.107.0 255.255.255.0 10.41.14.99 5 permanent

  IP route 74.200.110.0 255.255.254.0 10.41.14.99 4 permanent

  IP route 208.67.188.32 255.255.255.224 10.41.14.99 2 Permanent

  IP route 208.67.188.96 255.255.255.224 10.41.14.99 3 permanent

  !

  auto discovering IP sla

  Logging trap errors

  host 192.168.10.29 record

  access-list 2 Note HTTP access class

  Note access-list category 2 CCP_ACL = 1

  Note access-list 2 Platinum LAN

  access-list 2 permit 10.41.14.0 0.0.0.255

  access-list 2 refuse any

  Access-list 101 remark rules Master

  Note access-list 101 category CCP_ACL = 1

  Note access-list 101 FaxFinder WWW traffic

  access-list 101 permit tcp any host 71.xx.160.123 eq www

  Note access-list 101 traffic HTTPS FaxFinder

  access-list 101 permit tcp any host 71.xx.160.123 eq 443

  Note access-list 101 NTP Time Protocol

  access-list 101 permit udp any host 71.xx.160.123 eq ntp

  Access-list 101 remark IPSEC protocols

  access-list 101 permit udp any host 71.xx.160.123 eq non500-isakmp

  Access-list 101 remark IPSEC protocols

  access-list 101 permit udp any host 71.xx.160.123 eq isakmp

  Note access-list 101 traffic ESP

  access-list 101 permit esp any host 71.xx.160.123

  Note the access list 101 General License

  access list 101 ip allow a whole

  Note access-list 102 CCP_ACL category = 2

  access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.76.0 0.0.0.255

  Note access-list 102 IPSec rule

  access-list 102 deny ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255

  Note access-list 102 IPSec rule

  access-list 102 deny ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31

  Access-list 102 remark Platinum LAN NAT rule

  access-list 102 permit ip 10.41.14.0 0.0.0.255 any

  Note category from the list of access-104 = 4 CCP_ACL

  Note access-list 104 IPSec rule

  access-list 104. allow ip 10.41.14.0 0.0.0.255 192.168.10.0 0.0.0.31

  Note access-list 108 CCP_ACL category = 4

  access-list 108 allow ip 10.41.14.0 0.0.0.255 any

  Note access-list 109 IPSec rule

  Note access-list 109 CCP_ACL category = 4

  access-list 109 allow ip 10.41.14.0 0.0.0.255 192.168.76.0 0.0.0.255

  Note access-list 110 CCP_ACL category = 4

  Note access-list 110 IPSec rule

  access-list 110 permit ip 10.41.14.0 0.0.0.255 10.0.2.0 0.0.0.255

  not run cdp

  !

  allowed SDM_RMAP_1 1 route map

  corresponds to the IP 102

  There is more then one way how you can achieve this goal.

  (1) the best way is possible if the two VPN counterparts are IOS routers. Then you can migrate to virtual VPN - tunnel interfaces (VTI). With this, the external interface doesn't mix - and non-VPN-traffic VPN.

  (2) if VTI is not possible, you can restrict the translation to only non - VPN traffic using a roadmap:

  object-group network RFC1918

  10.0.0.0 255.0.0.0

  172.16.0.0 255.240.0.0

  192.168.0.0 255.255.0.0

  NAT-SERVER - 10.41.14.103 allowed 10 route map

  corresponds to the TRAFFIC-NAT-SERVER IP - 10.41.14.103

  TRAFFIC-NAT-SERVER extended IP access list - 10.41.14.103

  deny ip host 10.41.14.103 object-group RFC1918

  permit tcp host 10.41.14.103 eq 80 a

  allow a host EQ 10.41.14.103 tcp 443

  IP nat inside source static 10.41.14.103 71.xx... map route NAT-SERVER - 10.41.14.103

  What makes that?

  When your server communicates with a system with an address in the range RFC1918, then the road map does not correspond and the translation is not used. It is you, the VPN scenario. But if the server communicates with a non-RFC1918 address, then the translation is used and the server can be reached.

  --
  Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
  http://www.Kiva.org/invitedBy/karsteni

• Making the NAT for VPN through L2L tunnel clients

  Hi.I has the following situation in my network. We need for users who log on our site with the VPN clients to connect to another site via a tunnel L2L. The problem is that I need NAT addresses from the pool of VPN client in another beach before going on the L2L tunnel because on the other side, we have duplication of networks.

  I tried to do NAT with little success as follows:

  ACL for pool NAT of VPN:

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.0.0 255.255.255.0

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.5.0 255.255.255.0

  NAT:

  Global 172.20.105.1 - 172.20.105.254 15 (outdoor)

  NAT (inside) 15 TEST access-list

  CRYPTO ACL:

  allowed ro access list extended LAN ip 255.255.0.0 192.168.0.0 255.255.255.0

  allowed ro access list extended LAN ip 255.255.0.0 192.168.5.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.0.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.5.0 255.255.255.0

  permit same-security-traffic intra-interface

  Am I missing something here? Something like this is possible at all?

  Thanks in advance for any help.

  We use the ASA 5510 with software version 8.0 (3) 6.

  You need nat to the outside, not the inside.

  NAT (outside) 15 TEST access-list

• Mapping strategies for VPN remote access to specific accounts

  I have an ASA firewall with the Anyconnect VPN configuration on it. For this VPN policies are below:

  internal SSLClientPolicy group strategy
  attributes of Group Policy SSLClientPolicy
  value x.x.x.x DNS server
  client ssl-VPN-tunnel-Protocol
  by default-field x.x.x.x
  the address value SSLClientPool pools
  attributes of Group Policy DfltGrpPolicy
  value x.x.x.x DNS server
  by default-field x.x.x.x
  internal GroupPolicy1 group strategy
  attributes of Group Policy GroupPolicy1
  Ikev1 VPN-tunnel-Protocol

  type tunnel-group SSLClientProfile remote access
  attributes global-tunnel-group SSLClientProfile
  Group Policy - by default-SSLClientPolicy
  tunnel-group SSLClientProfile webvpn-attributes
  enable SSLVPNClient group-alias

  I want to activate tunneling split for one user, but current policy restricts it. Is there a way to create a separate policy for a user and map it to him somehow? I do not see where I'd

  Hello

  Yes, you can create a separate group for this user name policy, and then assign this group policy under the attribute of the user. For example:

  SPLIT_ACL standard access list allow X.X.X.0 255.255.255.0

  internal group USER_POLICY strategy
  USER_POLICY-group policy attributes
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list SPLIT_ACL

  username splituser password Cisco

  vpnuser username attributes
  VPN-group-policy USER_POLICY

• Policy NAT for VPN L2L

  Summary:

  We strive to establish a two-way VPN L2L tunnel with a partner. VPN traffic is one-to-many towards our partner, and our partner they need of a many-to-one to us (they need to access a host on our network). In addition, our partner has many VPN, so they force us to use a separate NAT with two private hosts addresses, one for each direction of the tunnel.

  My initial configuration of the tunnel on my grown up side of Phase 1, but not IPSec. Partner ran debug that revealed that my host did not address NAT'd in the NAT policy. We use an ASA5520, ver 7.0.

  Here is the config:

  # #List of OUR guests

  the OURHosts object-group network

  network-host 192.168.x.y object

  # Hosts PARTNER #List

  the PARTNERHosts object-group network

  network-host 10.2.a.b object

  ###ACL for NAT

  # Many - to - many outgoing

  access-list extended NAT2 allowed ip object-group OURHosts-group of objects PARTNERHosts

  # One - to - many incoming

  VIH3 list extended access permit ip host 192.168.c.d PARTNERHosts object-group

  # #NAT

  NAT (INSIDE) 2-list of access NAT2

  NAT (OUTSIDE) 2 172.20.n.0

  NAT (INSIDE) 3 access-list VIH3

  NAT (OUTSIDE) 3 172.20.n.1

  # #ACL for VPN

  access list permits extended VPN ip object-group objects PARTNERHosts OURHosts-group

  access allowed extended VPN ip host 192.168.c.d PARTNERHosts object-group list

  # #Tunnel

  tunnel-group type ipsec-l2l

  card <#>crypto is the VPN address

  card crypto <#>the value transform-set VPN

  card <#>crypto defined peer

  I realize that the ACL for the VPN should read:

  access allowed extended VPN ip host 172.20.n.0 PARTNERHosts object-group list

  access allowed extended VPN ip host 172.20.n.1 PARTNERHosts object-group list

  .. . If the NAT was working properly, but when this ACL is used, Phase 1 is not even negotiating, so I know the NAT is never translated.

  What am I missing to NAT guests for 172.20 addresses host trying to access their internal addresses via the VPN?

  Thanks in advance.

  Patrick

  Here is the order of operations for NAT on the firewall:

  1 nat 0-list of access (free from nat)

  2. match the existing xlates

  3. match the static controls

  a. static NAT with no access list

  b. static PAT with no access list

  4. match orders nat

  a. nat [id] access-list (first match)

  b. nat [id] [address] [mask] (best match)

  i. If the ID is 0, create an xlate identity

  II. use global pool for dynamic NAT

  III. use global dynamic pool for PAT

  If you can try

  (1) a static NAT with an access list that will have priority on instruction of dynamic NAT

  (2) as you can see on 4A it uses first match with NAT and access list so theoretically Exchange autour should do the trick.

  I don't see any negative consequences? -Well Yes, you could lose all connectivity. I don't think that will happen, but I can't promise if you do absolutely not this after-hours.

  Jon

• Profile VPN (tunnel group) under the same IP pool

  Hello

  I have on my clients VPN from Cisco ASA 5510 works perfectly. The thing is that now I want to create a new profile or a tunnel in order to create the new cause of ACL I want to restrict only to certain hosts. But I don't know if I can do it under the same IP pool. If the answer is yes how could bind the new tunnel group to the correct ACL.

  This is my config:

  vpnxxxx list of allowed ip extended access all 192.168.125.0 255.255.255.0

  IP local pool ippool 192.168.125.10 - 192.168.125.254

  NAT (outside) 1 192.168.125.0 255.255.255.0

  NAT (inside) 0-list of access vpnxxxx

  RADIUS Protocol RADIUS AAA server

  RADIUS protocol AAA-server partnerauth

  AAA-server partnerauth (inside) host xxxx.xxxx.xxxx.xxxx

  key xxxx

  Crypto-map dynamic dynmap1 20 set transform-set Myset1

  lifespan 20 set security-association crypto dynamic-map dynmap1 seconds 28800

  Crypto-map dynamic dynmap1 20 kilobytes of life together - the association of safety 4608000

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  internal group RA - VPN strategy

  attributes of RA-VPN-group policy

  Server DNS 172.16.1.100 value

  VPN-idle-timeout 30

  Protocol-tunnel-VPN IPSec l2tp ipsec webvpn

  Split-tunnel-policy tunnelspecified

  type tunnel-group RA - VPN remote access

  General-attributes of RA - VPN Tunnel-group

  ippool address pool

  authentication-server-group (outside partnerauth)

  Group Policy - by default-RA-VPN

  tunnel-group RA - VPN ipsec-attributes

  pre-shared-key *.

  Thank you

  The command is "vpn-filter" in the Group Policy section.

  Define a group policy for each group of tunnel and select it with 'by default-group-policy' in the section of the tunnel.

• How to change address on ASA 5520 VPN peer

  Environment:

  7.2 (1) running ASA 5520

  IPSEC VPN L2L established by using wizard.

  Change the IP address of the remote peer. Using ASDM, I can't change the name of the Tunnel Group (which is currently the address peer). I may change the address peer in the IPSec rule, but is that all that is necessary?

  I have to add a new group of tunnel using the new address of peers for the name? If yes how it is related to other objects that are required for a VPN?

  When you create a VPN using the wizard, it creates several objects that are difficult to track when changes are required. Is it better to remove all current VPN objects and create a new configuration using the wizard again?

  Is it's better to make the changes using the CLI? What lines must be changed for peer address when using the commands?

  Thanks in advance for any help!

  I may change the address peer in the IPSec rule, but is that all that is necessary?

  -No, tunnel group name must match the peer address.

  I have to add a new group of tunnel using the new address of peers for the name?

  -Yes.

  Is it's better to make the changes using the CLI?

  -I recommend it, but if you don't know you have no choice.

  Add new tunnel-group with group as new name address peer, same key etc. Add a new address peer settings under rule edit ipsec peer. Then you should be able to remove the old tunnel group. Hope this helps you, been a while since I made this way.

• Traffic permitted only one-way for VPN-connected computers

  Hello

  I currently have an ASA 5505.  I put up as a remote SSL VPN access. My computers can connect to the VPN very well.  They just cannot access the internal network (192.168.250.0).  They cannot ping the inside interface of the ASA, nor any of the machines.  It seems that all traffic is blocked for them.  The strange thing is that when someone is connected to the VPN, I can ping this ASA VPN connection machine and other machines inside the LAN.  It seems that the traffic allows only one way.  I messed up with ACL with nothing doesn't.  Any suggestions please?

  Pool DHCP-192.168.250.20 - 50--> for LAN

  Pool VPN: 192.168.250.100 and 192.168.250.101

  Outside interface to get the modem DHCP

  The inside interface: 192.168.1.1

  Courses Running Config:

  : Saved

  :

  ASA Version 8.2 (5)

  !

  hostname HardmanASA

  activate the password # encrypted

  passwd # encrypted

  names of

  !

  interface Ethernet0/0

  switchport access vlan 20

  !

  interface Ethernet0/1

  switchport access vlan 10

  !

  interface Ethernet0/2

  switchport access vlan 10

  !

  interface Ethernet0/3

  Shutdown

  !

  interface Ethernet0/4

  Shutdown

  !

  interface Ethernet0/5

  Shutdown

  !

  interface Ethernet0/6

  Shutdown

  !

  interface Ethernet0/7

  switchport access vlan 10

  !

  interface Vlan1

  No nameif

  no level of security

  no ip address

  !

  interface Vlan10

  nameif inside

  security-level 100

  IP 192.168.250.1 255.255.255.0

  !

  interface Vlan20

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  passive FTP mode

  DNS lookup field inside

  DNS domain-lookup outside

  pager lines 24

  Within 1500 MTU

  Outside 1500 MTU

  mask 192.168.250.100 - 192.168.250.101 255.255.255.0 IP local pool VPN_Pool

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  Global interface 10 (external)

  NAT (inside) 10 192.168.250.0 255.255.255.0

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  the ssh LOCAL console AAA authentication

  Enable http server

  http 192.168.250.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  life crypto ipsec security association seconds 28800

  Crypto ipsec kilobytes of life - safety 4608000 association

  Telnet timeout 5

  SSH 192.168.250.0 255.255.255.0 inside

  SSH timeout 5

  SSH version 2

  Console timeout 0

  dhcpd dns 8.8.8.8

  !

  dhcpd address 192.168.250.20 - 192.168.250.50 inside

  dhcpd allow inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  allow outside

  SVC disk0:/anyconnect-win-2.5.2014-k9.pkg 1 image

  SVC disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2 image

  Picture disk0:/anyconnect-linux-2.5.2014-k9.pkg 3 SVC

  enable SVC

  tunnel-group-list activate

  attributes of Group Policy DfltGrpPolicy

  value of server DNS 8.8.8.8

  Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

  tunnel-group AnyConnect type remote access

  tunnel-group AnyConnect General attributes

  address pool VPN_Pool

  tunnel-group AnyConnect webvpn-attributes

  enable AnyConnect group-alias

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  Review the ip options

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  call-home

  Profile of CiscoTAC-1

  no active account

  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

  email address of destination [email protected] / * /

  destination-mode http transport

  Subscribe to alert-group diagnosis

  Subscribe to alert-group environment

  Subscribe to alert-group monthly periodic inventory

  monthly periodicals to subscribe to alert-group configuration

  daily periodic subscribe to alert-group telemetry

  Cryptochecksum:30fadff4b400e42e73e17167828e046f

  : end

  Hello

  No worries

  As we change the config I would do as well as possible.

  First, it is strongly recommended to use a different range of IP addresses for VPN clients and the internal network

  No VPN_Pool 192.168.250.100 - 192.168.250.101 255.255.255.0 ip local pool mask

  mask 192.168.251.100 - 192.168.251.101 255.255.255.0 IP local pool VPN_Pool

  NAT_0 ip 192.168.250.0 access list allow 255.255.255.0 192.168.251.0 255.255.255.0

  NAT (inside) 0-list of access NAT_0

  Then give it a try and it work note this post hehe

• Local pool IP VPN

  We are testing the upgrade to version 8.2 to 8.4 on the ASA 5505 and ran into a problem. For VPN connections, we created pools. Some of the pools were limited to a single IP address. After the upgrade, the ASA rejects the pools which had only an IP address instead of a range. In the command line if you type a question mark after typing in the "local ip pool (pool keyword)' in config mode it says" specify an IP address or a range of IP addresses: start [-end] ' by the word 'or' sounds as it should, except a single IP address, but it doesn't. The error is "Please enter a valid IP range."

  Does anyone know the soultion to this problem as well as increase the range?

  Thanks for your comments.

  The syntax below worked for me on 5505 with ver 8.3

  test mask 192.168.10.1 IP 255.255.255.255 local pool

  Check if it works for you.

  HTH

  MS