On ASA 5510 VPN works do not but the work stations

We have an ASA 8.2 (3) running and have two VPN site to site running on it.  The second VPN we just establish the other day, and of the SAA itself, it seems to work.  We are able to ping remote hosts from the ASA without problem.  However, on this second VPN all hosts on our local network cannot reach the remote party...  Trying to understand what could happen.  Applicable config below (please forgive the mistakes and formatting):

interface Ethernet0/0

nameif outside

security-level 0

address IP WAN. IP. ADDR 255.255.255.224

!

interface Ethernet0/1

nameif inside

security-level 100

IP 192.168.21.1 255.255.255.0

!

interface Ethernet0/2

Shutdown

nameif intf2

security-level 0

no ip address

!

interface Ethernet0/3

Shutdown

No nameif

no level of security

no ip address

!

interface Management0/0

Shutdown

nameif management

security-level 100

no ip address

management only

!

access extensive list ip 192.168.21.0 outside_cryptomap allow 255.255.255.0 10.50.50.0 255.255.255.0

Access-group acl_out in interface outside

Crypto ipsec transform-set esp-3des esp-sha-hmac ATLAS-TS

life crypto ipsec security association seconds 28800

card crypto mymap 2 match address outside_cryptomap

card crypto mymap 2 together peer PEER. WAN. IP. DEA

card crypto mymap 2 game of transformation-ATLAS-TS

map mymap 65535-isakmp ipsec crypto dynamic dynmap

mymap outside crypto map interface

crypto isakmp identity address

crypto ISAKMP allow outside

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

ISAKMP crypto 10 nat-traversal

tunnel-group of PEERS. WAN. IP. ADDR type ipsec-l2l

tunnel-group of PEERS. WAN. IP. ADDR ipsec-attributes

pre-shared key *.

Hello

Seems to me that his dynamic State PAT shot meant for Internet traffic

Phase: 6

Type: NAT

Subtype:

Result: ALLOW

Config:

NAT (inside) 1 0.0.0.0 0.0.0.0

is the intellectual property inside everything outside of any

dynamic translation of hen 1 (WAN. IP. ADDR.162 [Interface PAT])

translate_hits = 6186208, untranslate_hits = 145616

Additional information:

Translation dynamic 192.168.21.100/0 to WAN. IP. ADDR.162/12936 using subnet mask 255.255.255.255

So you might miss the NAT0 configuration for this connection

Do the following

Issue the command "Display running nat" and you should see a NAT0 configuration for the 'inside' interface. Something like that

NAT (inside) - 0 access list

Next, you will need to check the ACL configuration

See the list of access running

You can add local and remote network that need to communicate through that VPN L2L connection to this ACL

So for examples sake lets assume that your ASAs directly related "inside" subnet needs to access the remote network, and then you would add

ip 192.168.21.0 access list allow 255.255.255.0 10.50.50.0 255.255.255.0

So use the above configuration format with good source and network of destination, as well as the correct name of the ACL and add the required ACL lines and then try to host LAN connections.

Hope this helps

Remember to mark a reply as the answer if it answered your question.

Feel free to ask more if necessary

-Jouni

Tags: Cisco Security

Similar Questions

  • Cisco ASA 5510 VPN Site to Site with Sonicwall

    I am trying to configure a tunnel between a Cisco ASA 5510 VPN (Version 8.2 (2)) and TZ200 Sonicwall. I rose tunnel and go and I am able to ping the internal IP address of Cisco ASA of the Sonicwall LAN but nothing work. When I try to ping a host behind the Cisco ASA of the Sonicwall LAN I get the following message "rules asymmetrical NAT matched for flows forward and backward; Connection for tcp src outside:10.20.10.x/xxxx dst inside:10.20.2.x/xxxx refused due to failure of reverse path of NAT"on the SAA

    Googling the error above shows the problems with version 8.3 or later that resembled the nat commands have been changed SAA, train is still on 8.2 but I another common question does not add an exemption of NAT I have double-triple checked that I did add an exception rule of NAT of the hosts on the network from cisco for the guests of the Sonicwall network. Looks like I hit a road block so any help would be appreciated. Thank you

    Here are a few excertps of the config file (10.20.2.0 behind the cisco) and 10.20.10.0 behind the sonicwall

    NAT (inside) 0 access-list sheep

    ..

    IP 10.20.2.0 allow Access-list extended sheep 255.255.255.0 10.20.10.0 255.255.255.0

    access extensive list ip 10.20.2.0 outside_1_cryptomap allow 255.255.255.0 10.20.10.0 255.255.255.0

    ..

    card crypto outside_map 1 match address outside_1_cryptomap

    card crypto outside_map 1 set counterpart x.x.x.x

    card crypto outside_map 1 set of transformation-ESP-3DES-SHA

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    ..

    crypto ISAKMP allow outside

    crypto ISAKMP policy 5

    preshared authentication

    3des encryption

    sha hash

    Group 2

    lifetime 28800

    ..

    internal SiteToSitePolicy group strategy

    attributes of Group Policy SiteToSitePolicy

    VPN-idle-timeout no

    Protocol-tunnel-VPN IPSec

    Split-tunnel-network-list no

    ..

    tunnel-group x.x.x.x type ipsec-l2l

    tunnel-group x.x.x.x General attributes

    Group Policy - by default-SiteToSitePolicy

    tunnel-group ipsec-attributes x.x.x.x

    pre-shared key *.

    ..

    Added some excerpts from the configuration file

    Hello Manjitriat,

    Okay, detected IPSEC parody is normal, that means you are trying to send unencrypted on a line of encrypted packets.

    Now, if you see on the plotter of package that traffic will hollow the VPN channel all its fine in your site.

    Now the packet tracer must be something like this:

    entrance to Packet-trace inside private_ip_lan destination_private_ip_lan 1025 tcp 80

    Please provide us with the result of the following instructions after you run the packet tracer.

    See the crypto Isakamp SA

    See the crypto Ipsec SA

    Kind regards

    Julio

  • touchscreen not working not but the digitizer pen is for x 201

    x 201 3093-a15 touch does not but the digitizer pen is but you can see it touch the hardware on the Device Manager and then you go to the control panel pen tablet properties are and click on him and say touch in water from the tap also same Pen and touch too touch does not work but feather even turn round screen to see to see if it works , but nothing happens. I'm using a windows 7 with i7 and 1 TB and 8 GB of ram. Thank you for reading this hope of getting help with this

    In my opinion, they all load the multitouch drivers. You can try to get a copy of moninfo (free). It can give you the FRU, or you could look here:

    http://support.Lenovo.com/en_US/product-and-parts/partsLookup.page

  • ASA-6-110003: routing could not locate the next hop

    Hello

    I have a problem with our ASA firewall. I have a firewall that's inside, outside and DMZ interface. I have VPN clients that connect correctly and can access the internal network. However, for profiles that I have configured to connect via VPN to the DMZ network fails with the following messages.

    ASA-6-110003: routing could not locate the next hop

    &

    ASA-6-302014: disassembly of the TCP connection... No contiguity valid

    I have connections in the DMZ, but aren't VPN via internal and external interfaces without problem.

    The routing table has a route to this network and I have a nat in place - I'm quite puzzled by the present.

    Thank you

    Ed

    Hello Ed,

    Well, Nat seems good but you can do the following for me please:

    network of the DMZ_subnet object

    10.1.213.0 subnet 255.255.255.0

    network of the VPN_Subnet object

    subnet 255.255.x.x x.x.x.x

    public static DMZ_subnet DMZ_subnet destination NAT source (dmz - 2 outside) public static VPN_Subnet VPN_Subnet

    Kind regards

    Julio

  • Cisco ASA 5510 - Cisco Client can connect to the VPN but cannot Ping!

    Hello

    I have an ASA 5510 with the configuration below. I have configure the ASA as vpn server for remote access with cisco vpn client, now my problem is that I can connect but I can not ping.

    Config

    ciscoasa # sh run

    : Saved

    :

    ASA Version 8.0 (3)

    !

    ciscoasa hostname

    activate the 5QB4svsHoIHxXpF password / encrypted

    names of

    xxx.xxx.xxx.xxx SAP_router_IP_on_SAP name

    xxx.xxx.xxx.xxx ISA_Server_second_external_IP name

    xxx.xxx.xxx.xxx name Mail_Server

    xxx.xxx.xxx.xxx IncomingIP name

    xxx.xxx.xxx.xxx SAP name

    xxx.xxx.xxx.xxx Web server name

    xxx.xxx.xxx.xxx cms_eservices_projects_sharepointold name

    isa_server_outside name 192.168.2.2

    !

    interface Ethernet0/0

    nameif outside

    security-level 0

    address IP IncomingIP 255.255.255.248

    !

    interface Ethernet0/1

    nameif inside

    security-level 100

    IP 192.168.2.1 255.255.255.0

    !

    interface Ethernet0/2

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Ethernet0/3

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Management0/0

    nameif management

    security-level 100

    IP 192.168.1.253 255.255.255.0

    management only

    !

    passwd 123

    passive FTP mode

    clock timezone IS 2

    clock summer-time EEDT recurring last Sun Mar 03:00 last Sun Oct 04:00

    TCP_8081 tcp service object-group

    EQ port 8081 object

    DM_INLINE_TCP_1 tcp service object-group

    EQ port 3389 object

    port-object eq ftp

    port-object eq www

    EQ object of the https port

    EQ smtp port object

    EQ Port pop3 object

    port-object eq 3200

    port-object eq 3300

    port-object eq 3600

    port-object eq 3299

    port-object eq 3390

    EQ port 50000 object

    port-object eq 3396

    port-object eq 3397

    port-object eq 3398

    port-object eq imap4

    EQ port 587 object

    port-object eq 993

    port-object eq 8000

    EQ port 8443 object

    port-object eq telnet

    port-object eq 3901

    purpose of group TCP_8081

    EQ port 1433 object

    port-object eq 3391

    port-object eq 3399

    EQ object of port 8080

    EQ port 3128 object

    port-object eq 3900

    port-object eq 3902

    port-object eq 7777

    port-object eq 3392

    port-object eq 3393

    port-object eq 3394

    Equalizer object port 3395

    port-object eq 92

    port-object eq 91

    port-object eq 3206

    port-object eq 8001

    EQ port 8181 object

    object-port 7778 eq

    port-object eq 8180

    port-object 22222 eq

    port-object eq 11001

    port-object eq 11002

    port-object eq 1555

    port-object eq 2223

    port-object eq 2224

    object-group service RDP - tcp

    EQ port 3389 object

    3901 tcp service object-group

    3901 description

    port-object eq 3901

    object-group service tcp 50000

    50000 description

    EQ port 50000 object

    Enable_Transparent_Tunneling_UDP udp service object-group

    port-object eq 4500

    access-list connection to SAP Note inside_access_in

    inside_access_in to access extended list ip 192.168.2.0 allow 255.255.255.0 host SAP_router_IP_on_SAP

    access-list inside_access_in note outgoing VPN - PPTP

    inside_access_in list extended access permitted tcp 192.168.2.0 255.255.255.0 any eq pptp

    access-list inside_access_in note outgoing VPN - GRE

    inside_access_in list extended access allow accord 192.168.2.0 255.255.255.0 any

    Comment from inside_access_in-list of access VPN - GRE

    inside_access_in list extended access will permit a full

    access-list inside_access_in note outgoing VPN - Client IKE

    inside_access_in list extended access permitted udp 192.168.2.0 255.255.255.0 any isakmp eq

    Comment of access outgoing VPN - IPSecNAT - inside_access_in-list T

    inside_access_in list extended access permitted udp 192.168.2.0 255.255.255.0 any eq 4500

    Note to inside_access_in of outgoing DNS list access

    inside_access_in list extended access udp allowed any any eq field

    Note to inside_access_in of outgoing DNS list access

    inside_access_in list extended access permit tcp any any eq field

    Note to inside_access_in to access list carried forward Ports

    inside_access_in list extended access permitted tcp 192.168.2.0 255.255.255.0 any DM_INLINE_TCP_1 object-group

    access extensive list ip 172.16.1.0 inside_access_in allow 255.255.255.0 any

    outside_access_in of access allowed any ip an extended list

    outside_access_in list extended access permit tcp any any eq pptp

    outside_access_in list extended access will permit a full

    outside_access_in list extended access allowed grateful if any host Mail_Server

    outside_access_in list extended access permit tcp any host Mail_Server eq pptp

    outside_access_in list extended access allow esp a whole

    outside_access_in ah allowed extended access list a whole

    outside_access_in list extended access udp allowed any any eq isakmp

    outside_access_in list of permitted udp access all all Enable_Transparent_Tunneling_UDP object-group

    list of access allowed standard VPN 192.168.2.0 255.255.255.0

    corp_vpn to access extended list ip 192.168.2.0 allow 255.255.255.0 172.16.1.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Outside 1500 MTU

    Within 1500 MTU

    management of MTU 1500

    pool POOL 172.16.1.10 - 172.16.1.20 255.255.255.0 IP mask

    no failover

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 603.bin

    don't allow no asdm history

    ARP timeout 14400

    NAT-control

    Global (outside) 2 Mail_Server netmask 255.0.0.0

    Global 1 interface (outside)

    Global interface (2 inside)

    NAT (inside) 0-list of access corp_vpn

    NAT (inside) 1 0.0.0.0 0.0.0.0

    static (inside, outside) tcp Mail_Server 8001 8001 ISA_Server_second_external_IP netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server 8000 ISA_Server_second_external_IP 8000 netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server pptp pptp netmask 255.255.255.255 isa_server_outside

    public static tcp (indoor, outdoor) Mail_Server smtp smtp isa_server_outside mask 255.255.255.255 subnet

    static (inside, outside) tcp 587 Mail_Server isa_server_outside 587 netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server 9444 isa_server_outside 9444 netmask 255.255.255.255

    static (inside, outside) tcp 9443 Mail_Server 9443 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp 3389 3389 netmask 255.255.255.255 isa_server_outside Mail_Server

    static (inside, outside) tcp 3390 Mail_Server 3390 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp Mail_Server 3901 isa_server_outside 3901 netmask 255.255.255.255

    static (inside, outside) tcp SAP 50000 50000 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp SAP 3200 3200 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) SAP 3299 isa_server_outside 3299 netmask 255.255.255.255 tcp

    static (inside, outside) tcp Mail_Server www isa_server_outside www netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server https isa_server_outside https netmask 255.255.255.255

    static (inside, outside) tcp Mail_Server pop3 pop3 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp imap4 Mail_Server imap4 netmask 255.255.255.255 isa_server_outside

    static (inside, outside) tcp cms_eservices_projects_sharepointold 9999 9999 netmask 255.255.255.255 isa_server_outside

    public static 192.168.2.0 (inside, outside) - corp_vpn access list

    Access-group outside_access_in in interface outside

    inside_access_in access to the interface inside group

    Route outside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout, uauth 0:05:00 absolute

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 192.168.2.0 255.255.255.0 inside

    http 192.168.1.0 255.255.255.0 management

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp - esp-md5-hmac transet

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto-map dynamic dynmap 10 set pfs

    Crypto-map dynamic dynmap 10 transform-set ESP-3DES-SHA transet

    cryptomap 10 card crypto ipsec-isakmp dynamic dynmap

    cryptomap interface card crypto outside

    crypto isakmp identity address

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    md5 hash

    Group 2

    life 86400

    crypto ISAKMP policy 30

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    No encryption isakmp nat-traversal

    Telnet 192.168.2.0 255.255.255.0 inside

    Telnet 192.168.1.0 255.255.255.0 management

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    dhcpd dns xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx interface inside

    dhcpd domain.local domain inside interface

    !

    a basic threat threat detection

    host of statistical threat detection

    Statistics-list of access threat detection

    Management Server TFTP 192.168.1.123.

    internal group mypolicy strategy

    mypolicy group policy attributes

    Split-tunnel-policy tunnelspecified

    Split-tunnel-network-list value VPN

    Pseudo vpdn password 123

    vpdn username attributes

    VPN-group-policy mypolicy

    type of remote access service

    type mypolicy tunnel-group remote access

    tunnel-group mypolicy General attributes

    address-pool

    strategy-group-by default mypolicy

    tunnel-group mypolicy ipsec-attributes

    pre-shared-key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    inspect the pptp

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:b8bb19b6cb05cfa9ee125ad7bc5444ac

    : end

    Thank you very much.

    Hello

    You probably need

    Policy-map global_policy

    class inspection_default

    inspect the icmp

    inspect the icmp error

    Your Tunnel of Split and NAT0 configurations seem to.

    -Jouni

  • ASA 5510 VPN multiple tunnels through different interfaces

    Is it possible to create VPN tunnels on more than one interface to an ASA (specifically 5510 with 8.4), or I'm doing the impossible?

    We have 2 public interfaces on our ASA connected to 2 different suppliers.

    We must work L2L tunnels of the SAA for remote offices through the interface that is our ISP 'primary' and also used as our default gateway for internet traffic.

    We are trying to install a remote office use our secondary connection for its tunnel (office of high traffic we would prefer separate away from the rest of our internet and VPN traffic).

    I can create the tunnel with the ACL appropriate for traffic tunnel, card crypto, etc., put in place a static route to force ASA to use the secondary interface for traffic destined for the public of the remote gateway IP address, and when I finished, traffic initiated by the remote site will cause the tunnel to negotiate and find - I can see the tunnel in Show crypto ikev1 his as L2L answering machine MM_ACTIVE , Show ipsec his with the right destination and correct traffic local or remote identities for interesting, but the ASA local never tries to send traffic through the tunnel.  If I use tracers of package, it never shows a VPN that is involved in the trafficking of the headquarters in the remote desktop, as if the SAA is not seeing this as for the corresponding VPN tunnel traffic.

    If I take the exact same access and crypo card statements list and change them to use the primary ISP connection (and, of course, change the remote desktop IP connects to), then the connection works as expected.

    What Miss me?

    Here is a sample of the VPN configuration: (PUBLIC_B is our second ISP link, 192.168.0.0/23 is MainOffice 192.168.3.0/24 is FieldOffice)

    permit access list range 192.168.0.0 PUBLIC_B_map 255.255.254.0 192.168.3.0 255.255.255.0

    NAT (Inside, PUBLIC_B) static source MainOffice MainOffice static FieldOffice FieldOffice

    card crypto PUBLIC_B_map 10 corresponds to the address PUBLIC_B_map

    card crypto PUBLIC_B_map 10 set counterpart x.x.x.x

    card crypto PUBLIC_B_map 10 set transform-set ESP-3DES-SHA ikev1

    PUBLIC_B_map PUBLIC_B crypto map interface

    tunnel-group x.x.x.x type ipsec-l2l

    tunnel-group ipsec-attributes x.x.x.x

    IKEv1 pre-shared-key *.

    Route PUBLIC_B x.x.x.32 255.255.255.224 y.y.y.y 1

    If I take this same exact configuration and change it to use PUBLIC (our primary connection) instead of PUBLIC_B, remove the instruction PUBLIC_B route and change the desktop to point to the ip address of the PUBLIC, then everything works, so my access list and crypto map statements must be correct.

    What I don't understand is why the ASA Head Office does not seem to recognize interesting for the tunnel traffic when the tunnel is for the second ISP connection, but works when it is intended for the main ISP.  There is no problem of connectivity with the ISP Internet B - as mentioned previously, the tunnel will come and negotiate properly when traffic is started from the desktop, but the traffic of main office is never sent to the bottom of the tunnel - it's as if the ASA does not think that traffic of 192.168.0.x to 192.168.3.x should pass through the VPN.

    Any ideas?

    Hello

    I think your problem is that there is no route for the actual remote network behind the VPN L2L through ISP B connection

    You could try adding add the following configuration

    card crypto PUBLIC_B_map 10 the value reverse-road

    This should automatically add a static route for all remote networks that are configured in the ACL Crypto, through the interface/link-ISP B.

    If this does not work, you can try to manually add a static route to the ISP B link/interface for all remote networks VPN L2L in question, and then try again.

    The route to the remote VPN peer through the ISP B does not to my knowledge.

    I would like to know if it works for you.

    It may be useful

    -Jouni

  • Cisco ASA 5510 VPN user Auth

    Hi all.

    I search the internet to find a way or all first, whether it is possible to do what I want to do, but I can't find anything corresponding to what I'm looking for. Possible that I don't have the right keyword.

    We change our old Pix 515e this weekend and for any new ASA 5510.

    With this new facility, I want to implement Radius Authentication for the user remote vpn. Change the firewall of the company is an important factor and for the first phase, the user will keep authenticate locally but I need that in phase 2, they will be authenticated through a radius server.

    Is there a way to configure both user authentication remote vpn?

    For example.

    All users will be authenticated locally unless the service member COMPUTER that is authenticated by the radius to the testing server.

    I have remote vpn users anywhere in the world if I don't want these users are blocked by the radius authentication test. What I want is that users in Group1 will be authenticated locally on the SAA and users in group2 will be authenticated by the RADIUS. During the test will be done, all users will gradually transfer for radius authentication.

    Is it possible

    Thank you

    Jonathan

    Network administrator

    Hi Jonathan,.

    The best way to go about this would be that you set up another group strategy & corresponding tunnel group named Test and set up Radius Authentication for VPN group using the link below: -.

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00806de37e.shtml

    Ones you have done test and feel confident, you can change the type of authentication for the Production Group. The reverse could be implemented double authentication as RADIUS and if it does not use local but personally I'll put up a group of test and then those I am confident, that I'll change the strategy of Production Group to use the Radius Server to auth.

    Manish

  • ASA 5510 VPN - using a public IP address for the local network

    Hello, I have a problem which is probably very simple, but I can't seem to understand.

    I set up a site IPsec connection to another with a company, something I've done many times before without a problem. I use ASDM to configure this, because it is quick and painless, usually.

    We have one number of other site-to-site currently configured connections and works very well on this ASA, these are configured with the "Protected network - LAN" configured with the IP private of hosts within our network, we want to make available through the separate tunnels. This includes the configuration setting on our ASA for each connection to "guests aside ASA exempt from NAT.

    With this new link, however, the company asked us to use a public IP address for the host that we want to achieve through the tunnel. I don't know why, but they demand it. So I added a NAT rule for inside the host and set up the connection with the public IP address under "Local network". During the test to try to reach a host to their side, the tunnel didn't even try to open.

    What is the method here? I don't see where I'm wrong. I'm guessing that the 'host side ASA exempt from NAT' does not require for this, how if the ASA would know which internal host is the public IP address.

    Any ideas?

    Hi Leo,

    The steps are:

    1. Add the policy rule NAT for the specific host.

    2 - define the IP NAT as your LOCAL NETWORK address in the encryption settings.

    3 make sure that there is no rule NAT exempt for this host to the specific destination.

    What happens if you run a package tracer?

    Thank you.

  • How can I dedicate a single ip address to a client on asa 5510 vpn

    Hi all

    My question is...

    How can I dedicate a unique to a single customer VPN VPN NAT ip? I don't want this ip address used by another vpn client...

    I got an ASA 5510 with a

    DHCP pool.

    5.0 Cisco vpn client

    Thank you

    You are welcome. Please note the answers and mark your question answered to increase the value of the instance.

  • Internet not working not but the laptop says it's connected to the modem and "Internet access".

    My laptop says it's connected to our modem and having 'Internet access'. However, I can't use the Internet on any of my browsers. I tried to turn my Wi - Fi, and who have done nothing. I also tried to restart my laptop and modem, but who didn't do anything either. I checked the Device Manager to see if the NETWORK card worked properly. It said it was working fine. Unless it's lying to me. I plugged in an Ethernet cable to my laptop, but I still couldn't get on the Internet. I ran my computer in safe mode with networking with an ethernet cable but still could not access the Internet. I don't know what the problem is.

    I used troubleshooting and that's what he came back to me:
    "The connection between your access point, router or cable modem and the Internet is broken."
    I did what he told me to and restarted my modem... once again. It did not work.

    Does anyone know what I can do to fix this?

    I have the same problem.  My internet connection seems fine.  I can connect to the internet on my laptop to the company, xbox 360, roku and my cell phone, but not my laptop from Sony.  When I check the connection it says its fine but when I run a diagnostic it says "the DNS server is not responding."  I checked with my cable company and that they 'refreshed' my signal, but it would not connect.  Even than your wi - fi network or directly with an ethernet cable.

    If someone could help us both appreciate it.

    Thank you

    KD

  • X 200 speakers does not, but the headphones work

    The headset works but the computer speakers no longer work. I don't know why, all of a sudden, it stopped working. I tried searching forums and installed the latest drivers. I don't know why it doesn't work anymore. Help, please.

    Understood the problem and have a solution for this. (You mind I've updated to the latest drivers first!)

    Basically, the new driver has more than one audio output option and you must activate both of them.

    Here's how I did it,

    Control Panel => SMART AUDIO

    On the background, select the Audio DIRECTOR. From there, you will have 2 options to select among the CLASSICS (plays the sound only through headphones) and MULTISTREAMING (plays the sound to the speakers). I just changed the CLASSIC for MULTISTREAMING option and it works. After that, the volume mixer in the AUDIO SMART tab will have options to control the speaker and headset independently.

    See you soon!

  • Equium A200-1VO - touchpad does not but the fact external mouse

    I had a problem with my hard drive does not it just happened overnight so I replaced the hard drive no problem and rebooted the system.
    Everything is ok but the touchpad does not work.
    I tried FN + F9 it's ok, I have updated the touchpad program still does not.

    Help, please!

    XP or Vista?

    Did you use a Toshiba Recovery disk to install Windows? Or a generic version of the street of Windows?

    Maybe you should go to the Toshiba website and download the drivers.

  • No speakers on computer does not, but the head phones are for HP Pavilion Dv7

    The speakers on my Hp Pavilion DV7 - 3164cl have stopped working. The only time sound works when I use headphones or connect the computer to my tv. I have already uninstalled and reinstalled the IDT High Definition Audio Codec (Version 6.1.6345.0 driver) and the device high definition Audio ATI (Version 5.0.7000.6 driver) to my computer via the Device Manager. I've recently updated the HP support program for my computer, but even when I tried to do a system restore it does not solve the problem.  I'm starting to think it could be a problem of faulty wiring, but I don't know how to fix this. Any ideas?

    My operating system is Windows 7 home operating system

    Your time is appreciated.

    Speakers required thank you for replacement of assistance for everyone

  • can not play the radio station, but sometimes it plays very well

    I noticed that I can not always the old Jill FM which is now Playlist 92.7 FM. Happened to me before that far from Jill FM, they changed. When I try to play live, sometimes it will play, but other times I get a pop up that sayscan not initialize the built-in player. Please press STOP and PLAY retry.

    But sometimes, it plays very well! That is what it is?

    Hello

    ·        What program do you use to listen to the radio?

    ·        Outside this station, you are able to play other stations without any problem?

    I suggest you play another station and check if the problem persists.

    If you use Internet Explorer, then I suggest you delete temporary files and cookies and check if the problem persists. Follow the steps mentioned in the articles below.

    How to remove the contents of the temporary Internet files folder

    http://support.Microsoft.com/kb/260897

    How to delete cookie files in Internet Explorer

    http://support.Microsoft.com/kb/278835

    I suggest to install the latest Adobe flash player on the system and check if the problem is resolved.

    http://www.Adobe.com

    Also, I would say to contact the Radio station support for assistance.

    Thanks and regards.

    Thahaseena M
    Microsoft Answers Support Engineer.
    Visit our Microsoft answers feedback Forum and let us know what you think.

  • How can I change the model modules?  When I click on module it said I did not, but the model has 3.

    I'm new to Business Catalyst.  My site is litigationstore01.businesscatalyst.com.   3 modules are present in the model that I use which lead to 3 different product pages.  I can't find the place to change these modules.  When I click on modules in the left column a model of module group arrives, but not a way to edit what's already there. What Miss me?

    Hey there,

    Those who are not of the modules, they are produced by what I assume is the module recommended products. Depending on how this module is implemented it will use will be list or the backup from the list.

    Wise FTP it would be produced Layouts - OnlineShop - small and small backup product.

    The developer reference

Maybe you are looking for

  • Lockout MacBook to find my Mac

    I blocked my Mac thanks to find my mac. I know the code but I accidentally sent a text message the wrong code to my girlfriend that she entered a bunch of times and turned off my mac. It's on a loop to wait 60 Minutes now. After the waiting time, it

  • My cousin has deleted my Director.

    It happened some time ago and I can't get it back. Can I get free for XP? If yes where? I am at a loss, and this site is no help.

  • Hard drive Info

    I have a HP Envy Touchsmart M6 - k015dx Sleekbook. I thought to give it to my friend and the upgrade. However, I wanted to put a SSD and install some more memory. I'm curious how much of hard training this laptop is equipped with slots and how many m

  • Prevent covers Album in Windows Media Player download

    I spent a lot of time fixingand manually editing my music with images 500x500px album art.I read the article on http://social.answers.microsoft.com/Forums/en-US/w7music/thread/6ff8c9fd-d97f-4304-bad5-693f7dbb4532/ but is not my problem - I can add th

  • Query related to a red cross on the background icon

    Original title: cannot access windows 8 at the start of my laptop after entering my pin code it connect then returns to the main screen.where there a desktop icon with a red x at the bottom left of the screen then too the battery charge icon.any idea