Ports VPN Client NAT Traversal

Similar Questions

• Design site to Site VPN w/NAT traversal issue

  Hi, I have a number of site to site VPN that end on a PIX. I intend to migrate these VPN to a router that sits on a demilitarized zone connected to the PIX. Before doing that I'm going to set up a private network new virtual to end on the router but I also need than VPNS that end on the PIX to be not affected.

  If I configure NAT traversal on the PIX, affected my other VPN?

  Thanks in advance

  DOM

  Hi Dom,

  Why do you want to configure NAT-Traversal on PIX, if you wish to terminate your VPN router (which is on the DMZ).

  Do you do any NAT on PIX thru the router?

  If you want to configure NAT-Traversal, it must be configured on the end (on the router in your case) devices.

  Example:

  When a user with Cisco client or Cisco router behind NAT wants to connect to another device (such as PIX, ASA, or router) NAT - T must be configured on the machine (which will be the PIX or ASA)

  Hope that helps.

  * Please indicate the post

• VPN client and contradictory static NAT entries

  Hello, we have a VPN IPSEC implemented on a router for remote access. It works very well, for the most part. We have also a few PAT static entries to allow access to a web server, etc. from the outside. We deny NATting from the range of IP addresses for the range of VPN client and it works except for entries that also have PAT configurations.

  So, for example, we have web server 10.0.0.1 and a PAT redirection port 10.0.0.1: 80 to the IP WAN port 80. If a VPN client tries to connect to 10.0.0.1: 80, the syn - ack packet back to the customer WAN IP VPN on the router! If the VPN client connects to the RDP server 10.0.0.2:3389, it works very well that this server is not a static entry PAT.

  Is there a way to get around this?

  Thank you!

  There is a way to get around, use the same settings you have for your dynamic nat in your nat staitc entries, something like this:

  Currently, it should show as:

  IP nat inside source static XXXXX XXXX 80 80

  you need to take it

  IP nat inside source static 80 XXXX XXXX 80 map route AAAA

  When your itinerary map YYY refers to something with an acl that you refuse traffic from inside your router for the pool of vpn

  IP Access-list ext nonat

  deny ip 10.0.0.0 0.0.0.255

  Licensing ip 10.0.0.0 0.0.0.255 any

  route allowed AAAA 10 map

  match ip address sheep

  You even need all the static PAT

  HTH

  Ivan

• What are the ports used by the Cisco VPN Client?

  Hello

  I need to open my outgoing traffic on my firewall to allow two interns (LAN) Cisco VPN Client to connect to their Internet virtual private network.

  I already opened the port 500/UDP, but they are not able to connect. If I open all outgoing ports, they can connect.

  What are the ports used by the Cisco VPN Client?

  Thank you

  You need to open:

  UDP 500

  ESP protocol

  You must also open the UDP 4500 port (if using NAT - T).

  In addition, if the clients are connecting to a VPN 3000 Concentrator series and it is configured for all other options of NAT-transparency, corresponding ports must be open. By default:

  1. If using IPSec over TCP 10000, then open TCP 10000.

  2. If using IPSec over UDP 10000, open UDP 1000.

• Cisco VPN Client - what are the ports I need to open the 1841?

  Hello. As it says on the Tin really, what are the ports I need to allow my access on our 1841 list to allow the Cisco VPN client on through it?

  Ta

  UDP 500 (isakmp)

  UDP 4500 (nat - t)

  Protocol ESP 50

• VPN client: What ports and protocols?

  Anyone know which ports and protocols are used by the cisco VPN client? (Telco needs this info, because the VPN client does not work in its network)

  I know of UDP/500 (ISAKMP)

  Erik

  Erik,

  In addition to ISAKMP, Protocol ESP 50 you and, possibly, NAT - T which is UDP/4500.

  Andy

• Remote access via NAT VPN client

  I currently have a PIX506e configured to provide access to the Cisco VPN Clients remote vpn. A single client can connect successfully and have access to the planned network. However, as soon as I connect an additional client to the firewall from the same place (the two addresses are translated under the same address) the two tunnels will stop working or could not connect.

  Is the problem that I face, because two customers have the same address public after NAT, or is - it something else? Is there a way to get around this?

  Hello

  A lot of THAT NAT will not work if you use ESP.

  The solution for this is to allow NAT - t on PIX and VPN client.

  PIX:

  The following command active NAT - T (for codes plus late 6.3)

  ISAKMP nat-traversal

  The VPN Client:

  On the Transport tab, under the tab "Enable Transport Tunneling" & select "IPSec over UDP (NAT/PAT).

  HTH

  Kind regards

  GE.

• NAT Traversal on site to site VPN pix

  I don't think it's possible to implement NAT traversal between a site to IPSEC VPN using ESP tunnels?

  Our ISP to the remote end will provide only a public IP address and which is attributed to their router...

  Sites are using pre-shared keys and IKE

  for example...

  LAN-PIX1-ISPROUTER-INTERNET-ISPPATROUTER-PIX2-LAN

  I have attached the card encryption for more info

  Thanks in advance...

  I guess that NAT - T is most commonly used in a customer VPN environment, but I'm sure that its not limited to this type of connection.

  I just set up a VPN this morning with the help of a customer on a router running 12.2.15T and tested connection with NAT - T works very well by using IP addresses.

  NAT - T enabled by a NAT detection process, and there is that to protect the ESP of a change should work in both environments.

  I'll have a go in my lab, see if I can implement and check it.

  However by going to the original post, you say that only one address is available from the ISP, it is on the router for pix link?

  Where are the limits of NAT, I expect to be in the PIX, but it must be a public IP address on you interfaces also. You can then use the external address as endpoints IPSec, don't need NAT - T in any case.

• How can I get the Client VPN or NAT - ted connection

  I installed a router on a customer site to replace a PC that made the NAT on a cable modem connection.

  On the router THAT NAT is done to get all the s PC on the LAN to access the Internet.

  But... one of the users use a VPN client to get to his office. With the PC, there is no problem, but given that the router is in place it can not connect.

  Because I specialized on switched networks my knowledge; edge of NAT and VPN clients.

  Is there anyone who knows how to get this VPN client-session user to be NAT - ted?

  Kind regards

  Martijn Koopsen

  If you have some onfigured of overload, then you tap the traffic. In all cases, you should at least be able to establish a connection, as IPSec uses UDP 500 for the negotiation of the tunnel. If you are not able to pass all traffic, it is another question. Once the tunnel is established, the traffic can be encrypted using the Protocol ESP who cannot be tapped under normal circumstances. If this is a cisco IPsec client, then you must discover which is the feature of termination. If it's a hub 3K, you could activate IPSec over UDP to the problem of circumvention the ESP

  Hope that helps

  Jean Marc

• Cannot ping inside the vpn client hosts. It's a NAT problem

  Hello everyone, I'm running into what seems to be a cause of exclusion with an IOS IPSEC VPN NAT/nat. I can connect to the VPN with cisco IPSEC VPN client, and I am able to authenticate. Once I have authenticate, I'm not able to reach one of the guests inside. Below is my relevant config. Any help would be greatly appreciated.

  AAA new-model

  !

  !

  AAA authentication login default local

  radius of group AAA authentication login userauthen

  AAA authorization exec default local

  AAA authorization groupauthor LAN

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group businessVPN

  key xxxxxx

  DNS 192.168.10.2

  business.local field

  pool vpnpool

  ACL 108

  Crypto isakmp VPNclient profile

  businessVPN group identity match

  client authentication list userauthen

  ISAKMP authorization list groupauthor

  client configuration address respond

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  Define VPNclient isakmp-profile

  market arriere-route

  !

  !

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  interface Loopback0

  IP 10.1.10.2 255.255.255.252

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP virtual-reassembly

  !

  Null0 interface

  no ip unreachable

  !

  interface FastEthernet0/0

  IP 111.111.111.138 255.255.255.252

  IP access-group outside_in in

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  NAT outside IP

  inspect the outgoing IP outside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  clientmap card crypto

  !

  the integrated-Service-Engine0/0 interface

  description Locator is initialized with default IMAP group

  IP unnumbered Loopback0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP virtual-reassembly

  ip address of service-module 10.1.10.1 255.255.255.252

  Service-module ip default gateway - 10.1.10.2

  interface BVI1

  IP 192.168.10.1 255.255.255.0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  IP virtual-reassembly

  IP nat inside source static tcp 192.168.10.2 25 interface FastEthernet0/0 25

  IP nat inside source static tcp 192.168.10.2 443 interface FastEthernet0/0 443

  IP nat inside source static tcp 192.168.10.2 3389 interface FastEthernet0/0 3389

  IP nat inside source map route nat interface FastEthernet0/0 overload

  nat extended IP access list

  deny ip 192.168.10.0 0.0.0.255 192.168.109.0 0.0.0.255

  refuse the 10.1.1.0 ip 0.0.0.255 192.168.109.0 0.0.0.255

  ip licensing 10.1.1.0 0.0.0.255 any

  permit ip 192.168.10.0 0.0.0.255 any

  sheep extended IP access list

  permit ip 192.168.10.0 0.0.0.255 192.168.109.0 0.0.0.255

  ip permit 10.1.10.0 0.0.0.255 192.168.109.0 0.0.0.255

  ip licensing 10.1.1.0 0.0.0.255 192.168.109.0 0.0.0.255

  outside_in extended IP access list

  permit tcp object-group Yes_SMTP host 111.111.111.138 eq smtp

  permit any any eq 443 tcp

  permit tcp 20.20.20.96 0.0.0.31 host 111.111.111.138 eq 3389

  permit tcp 20.20.20.96 0.0.0.31 host 111.111.111.138 eq 22

  allow any host 111.111.111.138 esp

  allow any host 111.111.111.138 eq isakmp udp

  allow any host 111.111.111.138 eq non500-isakmp udp

  allow any host 111.111.111.138 ahp

  allow accord any host 111.111.111.138

  access-list 108 allow ip 192.168.109.0 0.0.0.255 192.168.10.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.1.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.10.0 0.0.0.255

  !

  !

  !

  !

  route nat allowed 10 map

  match ip address nat

  1 channel ip bridge

  In my view, the acl applied to customer is back. It must allow traffic from the internal network to the pool of customers.

  To confirm, you can open the Cisco VPN client statistics (after login) then go in the route Details tab. We should see the networks you should be able to reach the customer. Make sure that the good ones are here.

  Kind regards

• [SRP527w] NAT Traversal unavailable options VPN!

  Hello

  I'm so disappointed to find such a light and incomplete VPN on the SRP527w menu.

  Cisco certified network engineer, I test because my company needs about twenty ADSL + Router 3G backup and Cisco seems to offer the best solution.

  We must create a VPN in 3G if the ADSL link fails. Unfortunately, access 3G in France are routed through a large private network before you get to the Internet. This isn't a question for one of our routers Zyxel, that include the feature NAT Traversal (or NAT - T). But with this Cisco, it is impossible to traffic through the VPN.

  Please tell me that this feature should be included in the next version of the firmware!

  Kind regards

  Gaultier

  Hello

  Yes, late NAT - T is included in MR3.  (Unfortunately end NAT - T missed this version, but will be in the next).

  Kind regards

  Andy

• % 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection refused because of the failure of the path opposite. NAT VPN clients problems after that put 8.3.2 to level.

  I've recently updated to 8.3.2 and I have been informed of these NAT changes, but even after reading the https://supportforums.cisco.com/docs/DOC-12569 I am still unable to rectify the communication network 192.168.100.0 VPN with hosts on 172.16.1.0 and 172.16.9.0. VPN clients connect to the external interface, and I try to ping inside and the demilitarized zone, respectable 172.16.1.0 and 172.16.9.0 hosts. VPN client shows that the two previously mentioned networks such as roads of security, but still not to the ping pong.

  # sh nat

  Manual NAT policies (Section 1)

  1 (inside) to the (whole) source static obj - 172.16.9.0 obj - 172.16.9.0 destination static obj - obj - unidirectional 192.168.100.0 192.168.100.0

  translate_hits = 0, untranslate_hits = 0

  2 (inside) to the (whole) source static obj - 172.16.1.0 obj - 172.16.1.0 destination static obj - obj - unidirectional 192.168.100.0 192.168.100.0

  translate_hits = 0, untranslate_hits = 0

  3 (inside) to the (whole) source static obj - 172.16.1.0 obj - 172.16.1.0 destination static obj - 172.16.12.0 obj - one-way 172.16.12.0

  translate_hits = 0, untranslate_hits = 0

  4 (dmz) to (outside) source static obj - 172.16.9.0 obj - 172.16.9.0 destination static obj - obj - unidirectional 192.168.100.0 192.168.100.0

  translate_hits = 0, untranslate_hits = 0

  5 (dmz) to (outside) source static obj - 172.16.9.0 obj - 172.16.9.0 destination static obj - 172.16.12.0 obj - one-way 172.16.12.0

  translate_hits = 0, untranslate_hits = 0

  Auto NAT policies (Section 2)

  1 (dmz), to the source (external) static obj - 172.16.9.5 interface tcp www www service

  translate_hits = 0, untranslate_hits = 142

  2 (dmz) (outdoor) source static obj - 172.16.9.5 - 01 interface service tcp 3389 3389

  translate_hits = 0, untranslate_hits = 2

  3 (dmz) (outdoor) source static obj - 172.16.9.5 - 02 interface tcp ldap ldap service

  translate_hits = 0, untranslate_hits = 0

  4 (dmz) (outdoor) source static obj interface - 172.16.9.5 - 03 service ftp ftp tcp

  translate_hits = 0, untranslate_hits = 0

  5 (dmz) to (outside) of the source static obj - 172.16.9.5 - 04 interface tcp smtp smtp service

  translate_hits = 0, untranslate_hits = 267

  6 (inside) source static obj - 172.16.9.0 172.16.9.0 (dmz)

  translate_hits = 4070, untranslate_hits = 224

  7 (inside) to (dmz) source static obj - 10.1.0.0 10.1.0.0

  translate_hits = 0, untranslate_hits = 0

  8 (inside) to (dmz) source static obj - 172.16.0.0 172.16.0.0

  translate_hits = 152, untranslate_hits = 4082

  9 (dmz) to dynamic interface of the obj - 172.16.9.0 - 01 source (outdoor)

  translate_hits = 69, untranslate_hits = 0

  10 (inside) to the obj_any interface dynamic source (external)

  translate_hits = 196, untranslate_hits = 32

  I think you must following two NAT config

  NAT (inside, outside) source static obj - 172.16.1.0 obj - 172.16.1.0 destination static obj - 192.168.100.0 obj - 192.168.100.0
  NAT (dmz, external) source static obj - 172.16.9.0 obj - 172.16.9.0 destination static obj - 192.168.100.0 obj - 192.168.100.0

  Please configure them and remove any additional NAT configuration and then try again.

• What are TCP/UDP ports must be open for version 4.8 of the VPN Client?

  What are TCP/UDP ports must be open for Cisco VPN Client version 4.8 working?

  Thank you

  Normally, you need the following ports and Protocol:

  UDP 500

  UDP 4500

  ESP

  In this case, you are using IPSec over TCP, you must open the port TCP 10000 or any other port that you want to use for (its configurable) IPSec connections.

  -Kanishka

• Cannot ping via the VPN client host when static NAT translations are used

  Hello, I have a SRI 3825 configured for Cisco VPN client access.

  There are also several hosts on the internal network of the static NAT translations have a services facing outwards.

  Everything works as expected with the exception that I cannot ping hosts on the internal network once connected via VPN client that is internal IP addresses have the static NAT translations in external public addresses, I ping any host that does not have static NAT translation.

  For example, in the example below, I cannot ping 192.168.1.1 and 192.168.1.2, but I can ping to the internal interface of the router, and any other host on the LAN, I can ping all hosts in the router itself.

  Any help would be appreciated.

  Concerning

  !

  session of crypto consignment

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group vpnclient

  key S3Cu4Ke!

  DNS 192.168.1.1 192.168.1.2

  domain domain.com

  pool dhcppool

  ACL 198

  Save-password

  PFS

  netmask 255.255.255.0

  !

  !

  Crypto ipsec transform-set-SECURE 3DES esp-3des esp-sha-hmac

  !

  Crypto-map dynamic dynmap 10

  86400 seconds, life of security association set

  game of transformation-3DES-SECURE

  market arriere-route

  !

  card crypto client cryptomap of authentication list drauthen

  card crypto isakmp authorization list drauthor cryptomap

  client configuration address card crypto cryptomap answer

  map cryptomap 65535-isakmp ipsec crypto dynamic dynmap

  !

  interface GigabitEthernet0/0

  NAT outside IP

  IP 1.2.3.4 255.255.255.240

  cryptomap card crypto

  !

  interface GigabitEthernet0/1

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  !

  IP local pool dhcppool 192.168.2.50 192.168.2.100

  !

  Note access-list 198 * Split Tunnel encrypted traffic *.
  access-list 198 allow ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

  !
  Note access-list 199 * NAT0 ACL *.
  access-list 199 deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
  access-list 199 permit ip 192.168.1.0 0.0.0.255 any

  !

  Sheep allowed 10 route map
  corresponds to the IP 199

  !
  IP nat inside source map route sheep interface GigabitEthernet0/0 overload

  !

  IP nat inside source static 192.168.1.1 1.2.3.5
  IP nat inside source static 192.168.1.2 1.2.3.6

  The problem seems to be that static NAT take your nat exemption.

  The solution would be:

  IP nat inside source static 192.168.1.1 1.2.3.5 sheep map route
  IP nat inside source static 192.168.1.2 1.2.3.6 sheep map route

  HTH

  Herbert

• Allowing the VPN Clients to the management network - nat woes

  Try to allow the VPNClient IPSEC access to the management network.  packet trace stops on the vpn encrypt even through phase 7 States it's NAT EXEMPT, he said his tent still NAT by a static.  The only thing I can think to put a rule of nat exempted for the subnet on the external interface.

  Please notify.  Thank you.

  Phase: 1
  Type: ACCESS-LIST
  Subtype:
  Result: ALLOW
  Config:
  Implicit rule
  Additional information:
  MAC access list

  Phase: 2
  Type: FLOW-SEARCH
  Subtype:
  Result: ALLOW
  Config:
  Additional information:
  Not found no corresponding stream, creating a new stream

  Phase: 3
  Type:-ROUTE SEARCH
  Subtype: entry
  Result: ALLOW
  Config:
  Additional information:
  in 0.0.0.0 0.0.0.0 outdoors

  Phase: 4
  Type: ACCESS-LIST
  Subtype: Journal
  Result: ALLOW
  Config:
  Access-group MANAGEMENT-IN in the management interface
  access-list MANAGEMENT-IN-scope ip allowed any one
  Additional information:

  Phase: 5
  Type: IP-OPTIONS
  Subtype:
  Result: ALLOW
  Config:
  Additional information:

  Phase: 6
  Type: FOVER
  Subtype: Eve-updated
  Result: ALLOW
  Config:
  Additional information:

  Phase: 7
  Type: NAT-FREE
  Subtype:
  Result: ALLOW
  Config:
  match ip MANAGEMENT 10.10.10.0 255.255.255.0 outside 172.18.0.32 255.255.255.240
  Exempt from NAT
  translate_hits = 3, untranslate_hits = 33
  Additional information:

  Phase: 8
  Type: NAT
  Subtype:
  Result: ALLOW
  Config:
  static (MANAGEMENT, outside) 203.23.23.75 10.10.10.10 netmask 255.255.255.255
  MANAGEMENT ip 10.10.10.10 host game OUTSIDE of any
  static translation at 203.23.176.75
  translate_hits = 0, untranslate_hits = 1
  Additional information:

  Phase: 9
  Type: NAT
  Subtype: host-limits
  Result: ALLOW
  Config:
  static (MANAGEMENT, outside) 203.23.23.75 10.10.10.10 netmask 255.255.255.255
  MANAGEMENT ip 10.10.10.10 host game OUTSIDE of any
  static translation at 203.23.23.75
  translate_hits = 0, untranslate_hits = 1
  Additional information:

  Phase: 10
  Type: VPN
  Subtype: encrypt
  Result: DECLINE
  Config:
  Additional information:

  Result:
  input interface: MANAGEMENT
  entry status: to the top
  entry-line-status: to the top
  output interface: OUTSIDE
  the status of the output: to the top
  output-line-status: to the top
  Action: drop
  Drop-reason: flow (acl-drop) is denied by the configured rule

  -EXCERPT FROM CONFIG-

  CorpVPN to access extended list ip 10.10.10.0 allow 255.255.255.0 172.18.0.32 255.255.255.240
  Access extensive list ip 172.18.0.32 CorpVPN allow 255.255.255.240 10.10.10.0 255.255.255.0

  mask 172.18.0.33 - 172.18.0.46 255.255.255.240 IP local pool CorpVPN

  access-list MANAGEMENT-extended permitted tcp 172.18.0.32 255.255.255.240 host 10.10.10.11 eq ssh
  access-list MANAGEMENT-extended permitted tcp 172.18.0.32 255.255.255.240 host 10.10.10.10 eq ssh
  access-list MANAGEMENT-extended permitted tcp 172.18.0.32 255.255.255.240 host 10.10.10.13 eq 3389

  access-list 101 extended allow ip 10.10.10.0 255.255.255.0 172.18.0.32 255.255.255.240

  NAT 0 access-list (MANAGEMENT) No.-NAT-DU-MGMT
  access-list no.-NAT-DU-MGMT scope ip 10.10.10.0 allow 255.255.255.0 172.18.0.32 255.255.255.240

  CorpVPN to access extended list ip 10.10.10.0 allow 255.255.255.0 172.18.0.32 255.255.255.240
  Access extensive list ip 172.18.0.32 CorpVPN allow 255.255.255.240 all

  internal CorpVPN group strategy
  attributes of Group Policy CorpVPN
  value of server DNS 203.23.23.23
  VPN - connections 8
  VPN-idle-timeout 720
  Protocol-tunnel-VPN IPSec l2tp ipsec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list CorpVPN
  the address value CorpVPN pools

  type tunnel-group CorpVPN remote access
  attributes global-tunnel-group CorpVPN
  address pool CorpVPN
  Group Policy - by default-CorpVPN
  IPSec-attributes tunnel-group CorpVPN
  pre-shared key

  First of all, there is overlap crypto ACL with the VPN static L2L:

  crypto ASA1MAP 10 card matches the address 101

  access-list 101 extended allow ip 10.10.10.0 255.255.255.0 172.18.0.32 255.255.255.240
  access-list 101 extended allow ip 172.18.0.32 255.255.255.240 10.10.10.0 255.255.255.0

  I would remove the 2 lines of ACL 101 above because it is incorrect.

  Secondly, from the output of ' cry ipsec to show his ", you seem to be getting the ip address of the"jdv1.australis.net.au", not"CorpVPN"pool pool. Therefore, the No. NAT ACL on the management interface is incorrect. I would just add a greater variety of education no. NAT so that it covers all your ip pool:

  access-list no.-NAT-DU-MGMT scope ip 10.10.10.0 allow 255.255.255.0 172.18.0.0 255.255.255.0

  Thirdly, even with your dynamic ACL 'OUTSIDE_cryptomap_65535.65535' crypto map, it only covers the 172.18.0.32/28, so I just want to add a wider range since it seems you get the ip address of the different pool:

  OUTSIDE_cryptomap_65535.65535 list of allowed ip extended access all 172.18.0.0 255.255.255.0

  Then I would disable the following group of access for purposes of test first:

  no access-group MANAGEMENT - OUT Interface MANAGEMENT

  Finally, please clear all the SA on your ASA and xlate, then reconnect to your vpn client and test it again:

  delete the ipsec cry his

  clear the isa cry his

  clear xlate

  Please let us know how it goes after the changes. If it still doesn't work, please please send again the last configuration and also to send the output of the following:

  See the isa scream his

  See the ipsec scream his

  and a screenshot of the page of statistics on your vpn client. Thank you.