Remote RDP client VPN access on ASA 5510

Hello.

We have configured the VPN tunnel from site of offshore to the location of the customer using ASA5510 and access to RDP to the location of the customer. Also been configured remote VPN access in offshore location. But using the remote VPN client, we are able to get the RDP of officeshore location but not able to access to the location of the RDP client. Are there any additional changes required?

Thank you

Hi Salsrinivas,

so to summarize:

the VPN client connects to the ASA offshore

the VPN client can successfully RDP on a server at the offshore location

the VPN client cannot NOT RDP on a server at the location of the customer

offshore and the location of the customer are connected by a tunnel L2L

(and between the 2 sites RDP works very well)

is that correct?

Things to check:

-the vpn in the ACL crypto pool?

-you're exemption nat for traffic between the vpn pool and 'customer' LAN? is the exemption outside (vpn clients are coming from the outside)?

-you have "same-security-traffic permitted intra-interface" enabled (traffic will appear outside and go back outside)?

If you need help more could you put a config (sterilized) Please?

HTH
Herbert

Tags: Cisco Security

Similar Questions

  • Client VPN access to VLAN native only

    I have a router 2811 (config below) with VPN set up.  I can connect through the VPN devices and access on the VLAN native but I can't access the 10.77.5.0 (VLAN 5) network (I do not access the 10.77.10.0 - network VLAN 10).  This question has been plagueing me for quite a while.  I think it's a NAT device or ACL problem, but if someone could help me I would be grateful.  Client VPN IP pool is 192.168.77.1 - 192.168.77.10.  Thanks for the research!

    Current configuration: 5490 bytes

    !

    version 12.4

    horodateurs service debug datetime msec

    Log service timestamps datetime msec

    encryption password service

    !

    2811-Edge host name

    !

    boot-start-marker

    boot-end-marker

    !

    enable secret 5 XXXX

    !

    AAA new-model

    !

    AAA authentication login userauthen local

    AAA authorization groupauthor LAN

    !

    AAA - the id of the joint session

    !

    IP cef

    No dhcp use connected vrf ip

    DHCP excluded-address IP 10.77.5.1 10.77.5.49

    DHCP excluded-address IP 10.77.10.1 10.77.10.49

    !

    dhcp Lab-network IP pool

    import all

    Network 10.77.5.0 255.255.255.0

    router by default - 10.77.5.1

    !

    pool IP dhcp comments

    import all

    Network 10.77.10.0 255.255.255.0

    router by default - 10.77.10.1

    !

    domain IP HoogyNet.net

    inspect the IP router-traffic tcp name FW

    inspect the IP router traffic udp name FW

    inspect the IP router traffic icmp name FW

    inspect the IP dns name FW

    inspect the name FW ftp IP

    inspect the name FW tftp IP

    !

    Authenticated MultiLink bundle-name Panel

    !

    voice-card 0

    No dspfarm

    !

    session of crypto consignment

    !

    crypto ISAKMP policy 1

    BA aes 256

    preshared authentication

    Group 2

    life 7200

    !

    Configuration group customer isakmp crypto HomeVPN

    key XXXX

    HoogyNet.net field

    pool VPN_Pool

    ACL vpn

    Save-password

    Max-users 2

    Max-Connections 2

    Crypto isakmp HomeVPN profile

    match of group identity HomeVPN

    client authentication list userauthen

    ISAKMP authorization list groupauthor

    client configuration address respond

    !

    Crypto ipsec transform-set esp - aes 256 esp-sha-hmac vpn

    !

    Crypto-map dynamic vpnclient 10

    Set transform-set vpn

    HomeVPN Set isakmp-profile

    market arriere-route

    !

    dynamic vpn 65535 vpnclient ipsec-isakmp crypto map

    !

    username secret privilege 15 5 XXXX XXXX

    username secret privilege 15 5 XXXX XXXX

    Archives

    The config log

    hidekeys

    !

    IP port ssh XXXX 1 rotary

    !

    interface Loopback0

    IP 172.17.1.10 255.255.255.248

    !

    interface FastEthernet0/0

    DHCP IP address

    IP access-group ENTERING

    NAT outside IP

    inspect the FW on IP

    no ip virtual-reassembly

    automatic duplex

    automatic speed

    No cdp enable

    vpn crypto card

    !

    interface FastEthernet0/1

    no ip address

    automatic duplex

    automatic speed

    No cdp enable

    !

    interface FastEthernet0/1.1

    encapsulation dot1Q 1 native

    IP 10.77.1.1 255.255.255.0

    IP nat inside

    IP virtual-reassembly

    !

    interface FastEthernet0/1.5

    encapsulation dot1Q 5

    IP 10.77.5.1 255.255.255.0

    IP nat inside

    IP virtual-reassembly

    !

    interface FastEthernet0/1.10

    encapsulation dot1Q 10

    IP 10.77.10.1 255.255.255.0

    IP access-group 100 to

    IP nat inside

    IP virtual-reassembly

    !

    interface FastEthernet0/0/0

    no ip address

    Shutdown

    automatic duplex

    automatic speed

    !

    interface FastEthernet0/1/0

    no ip address

    Shutdown

    automatic duplex

    automatic speed

    !

    router RIP

    version 2

    10.0.0.0 network

    network 172.17.0.0

    network 192.168.77.0

    No Auto-resume

    !

    IP pool local VPN_Pool 192.168.77.1 192.168.77.10

    no ip forward-Protocol nd

    !

    IP http server

    no ip http secure server

    overload of IP nat inside source list NAT interface FastEthernet0/0

    !

    IP extended INBOUND access list

    permit tcp any any eq 2277 newspaper

    permit any any icmp echo response

    allow all all unreachable icmp

    allow icmp all once exceed

    allow tcp any a Workbench

    allow udp any any eq isakmp

    permit any any eq non500-isakmp udp

    allow an esp

    allowed UDP any eq field all

    allow udp any eq bootps any eq bootpc

    NAT extended IP access list

    IP 10.77.5.0 allow 0.0.0.255 any

    IP 10.77.10.0 allow 0.0.0.255 any

    IP 192.168.77.0 allow 0.0.0.255 any

    list of IP - vpn access scope

    IP 10.77.1.0 allow 0.0.0.255 192.168.77.0 0.0.0.255

    IP 10.77.5.0 allow 0.0.0.255 192.168.77.0 0.0.0.255

    !

    access-list 100 permit udp any eq bootpc host 255.255.255.255 eq bootps

    access-list 100 permit udp host 0.0.0.0 eq bootpc host 10.77.5.1 eq bootps

    access-list 100 permit udp 10.77.10.0 0.0.0.255 eq bootpc host 10.77.5.1 eq bootps

    access-list 100 deny tcp 10.77.10.0 0.0.0.255 any eq telnet

    access-list 100 deny ip 10.77.10.0 0.0.0.255 10.77.5.0 0.0.0.255

    access-list 100 deny ip 10.77.10.0 0.0.0.255 10.77.1.0 0.0.0.255

    access ip-list 100 permit a whole

    !

    control plan

    !

    Line con 0

    session-timeout 30

    password 7 XXXX

    line to 0

    line vty 0 4

    Rotary 1

    transport input telnet ssh

    line vty 5 15

    Rotary 1

    transport input telnet ssh

    !

    Scheduler allocate 20000 1000

    !

    WebVPN cef

    !

    end

    If you want to say, that after the way nat rules which I have proposed, you lost the connection to the VLAN native, so yes, it's because the subnet VLANs native has not been included in this acl with Deny statement. So that the ACL should look like this:

    NAT extended IP access list

    deny ip 10.77.5.0 0.0.0.255 192.168.77.0 0.0.0.255

    deny ip 10.77.1.0 0.0.0.255 192.168.77.0 0.0.0.255 //This is not respected

    allow an ip

    In addition, if you want to go throug the other tunnel inside the subnet not listed above, then you should include that subnet to the NAT exemption rule with Deny statement.

  • AnyConnect VPN license on ASA 5510

    Hello

    We have ASA 5510 IPS with basic license. We must now Anyconnect support for more than 2 users.

    Anyconnect (tunnel mode) but essentially Anyconnect license enough? Do need me a license for SSL VPN peers?

    What about Anyconnect without customer, I see that I need a premium license?

    This one is pretty ASA5510-SSL50-K9? It's really expensive compared the Anyconnect Essentials.

    Here is my worm out sh:

    The devices allowed for this platform:
    The maximum physical Interfaces: unlimited
    VLAN maximum: 50
    Internal hosts: unlimited
    Failover: disabled
    VPN - A: enabled
    VPN-3DES-AES: enabled
    Security contexts: 0
    GTP/GPRS: disabled
    SSL VPN peers: 2
    The VPN peers total: 250
    Sharing license: disabled
    AnyConnect for Mobile: disabled
    AnyConnect Cisco VPN phone: disabled
    AnyConnect Essentials: disabled
    Assessment of Advanced endpoint: disabled
    Proxy sessions for the UC phone: 2
    Total number of Sessions of Proxy UC: 2
    Botnet traffic filter: disabled

    This platform includes a basic license.

    Yes, AnyConnect Premium includes all the SSL features (including the complete tunnel mode AnyConnect - which is what sustains essential AnyConnect).

    So if you buy the 50 user for AnyConnect Premium license, you can have up to 50 SSL VPN connections, if they are the combination of all without customer, or combination of tunnel without customer and full, or just full tunnel. All with a maximum of 50 simultaneous SSL tunnels.

  • Client VPN und Cisco asa 5505 tunnel work but no traffic

    Hi all

    I am new to this forum and Don t have a lot of experience with Cisco, so I hope I can get help from specialists.

    I have the following problem:

    I installed und konfigured ASA 5505 for use with vpn client. I would like to access the local network from outside through vpn.

    To test, I installed ASA 5505 with ADSL (pppoe) and tried to give access to the internal network.

    Of course whenever I have recive the supplier's different IP address, but it didn't is not a problem reconfigure in the vpn client.

    After the connection is established (vpn tunnel work) I can see my external network packets. But I Don t have any connection to the internal network.

    I erased my setup yesterday and tried to reconfigure ASA again. I didn t tested yesterday, because it was too late. And I know that I Don t have the authorization rule at present by the ACL. But I think I'm having the same problem again. (tunnel but no traffic).

    What I did wrong. Could someone let me know what I have to do today.

    With hope for your help Dimitri.

    ASA configuration after reset and basic configuration: works to the Internet from within the course.

    : Saved

    : Written by enable_15 to the CEDT 20:29:18.909 Sunday, August 29, 2010

    !

    ASA Version 8.2 (2)

    !

    ciscoasa hostname

    activate 2KFQnbNIdI.2KYOU encrypted password

    2KFQnbNIdI.2KYOU encrypted passwd

    names of

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 192.168.1.1 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    PPPoE client vpdn group home

    IP address pppoe setroute

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    boot system Disk0: / asa822 - k8.bin

    passive FTP mode

    clock timezone THATS 1

    clock to summer time CEDT recurring last Sun Mar 02:00 last Sun Oct 03:00

    DNS domain-lookup outside

    DNS server-group DefaultDNS

    Server name 194.25.0.60

    Server name 194.25.0.68

    DM_INLINE_TCP_1 tcp service object-group

    port-object eq www

    EQ object of the https port

    inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 no matter what eq field open a debug session

    inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any object-group DM_INLINE_TCP_1 open a debug session

    inside_access_in list extended access deny ip any any debug log

    inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 192.168.0.0 255.255.0.0

    permit inside_nat0_outbound to access extended list ip 192.168.10.0 255.255.255.0 192.168.10.0 255.255.255.128

    homegroup_splitTunnelAcl list standard access allowed 192.168.10.0 255.255.255.0

    pager lines 24

    Enable logging

    asdm of logging of information

    Outside 1500 MTU

    Within 1500 MTU

    IP local pool homepool 192.168.10.1 - 192.168.10.100 mask 255.255.255.0

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm-625 - 53.bin

    ASDM location 192.168.0.0 255.255.0.0 inside

    ASDM location 192.168.10.0 255.255.255.0 inside

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 0.0.0.0 0.0.0.0

    inside_access_in access to the interface inside group

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    dynamic-access-policy-registration DfltAccessPolicy

    Enable http server

    http 192.168.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet timeout 5

    SSH timeout 5

    Console timeout 0

    VPDN group home request dialout pppoe

    VPDN group House localname 04152886790

    VPDN group House ppp authentication PAP

    VPDN username 04152886790 password 1

    dhcpd outside auto_config

    !

    dhcpd address 192.168.1.5 - 192.168.1.36 inside

    dhcpd allow inside

    !

    a basic threat threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    TFTP server 192.168.1.5 inside c:/tftp-root

    WebVPN

    Group Policy inner residential group

    attributes of the strategy of group home group

    value of 192.168.1.1 DNS server

    Protocol-tunnel-VPN IPSec

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list homegroup_splitTunnelAcl

    username user01 encrypted password privilege 0 v5P40l1UGvtJa7Nn

    user01 username attributes

    VPN-strategy group home group

    tunnel-group home group type remote access

    attributes global-tunnel-group home group

    address homepool pool

    Group Policy - by default-homegroup

    tunnel-group group residential ipsec-attributes

    pre-shared-key ciscotest

    !

    class-map inspection_default

    match default-inspection-traffic

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    inspect the rsh

    inspect the rtsp

    inspect esmtp

    inspect sqlnet

    inspect the skinny

    inspect sunrpc

    inspect xdmcp

    inspect the sip

    inspect the netbios

    inspect the tftp

    Review the ip options

    !

    global service-policy global_policy

    context of prompt hostname

    Cryptochecksum:930e6cddf25838e47ef9633dc2f07acb

    : end

    Hello

    Normally, you want a static public IP address on the ASA to allow it to receive connections from VPN clients (avoid to change the IP address all the time).

    If you connect via VPN, check the following:

    1. the tunnel is established:

    HS cry isa his

    Must say QM_IDLE or MM_ACTIVE

    2 traffic is flowing (encrypted/decrypted):

    HS cry ips its

    3. Enter the command:

    management-access inside

    And check if you can PING the inside ASA VPN client IP.

    4. check that the default gateway for the LAN internal ASA within intellectual property (or there is a road to the ASA to send traffic to the VPN clients).

    Federico.

  • Help with a VPN tunnel between ASA 5510 and Juniper SSG20

    Hello

    We have a customer wanting to configure a VPN Site to Site tunnel between a new purchased 5510 of ASA located in his direction with its Juniper SSG20 Office, located in the main office. We contacted HP and they send us a Cisco professional to do the job.

    After 2 days from 16:00 to 22:00 and error and countless hours of research online and nunerous calls, we are still unable to get traffic from the network of agencies to enter the tunnel.

    Main branch
    1.1.1.2                                 1.1.1.1
    -----                                               -----------
    192.168.8.0/24 | ASA|-----------------------------------| Juniper |    192.168.1.0/24
    -----                                               -----------
    192.168.8.254 192.168.1.254

    According to Cisco professionals, the tunnel is now in place but no traffic through. We are unable to ping anything on the network on the other side (192.168.1.0/24). We receive timeout ping all the time. The Cisco professional told us it's a routing or NAT problem and he's working on a solution!

    Through research, I came across a post on Experts-Exchange (here) [the 1st comment on the original post] which States "...". that both sides of the VPN must have a different class of LAN for the VPN to work... " Would that be our problem?

    It has become a critical issue to the point that he had to replace the Cisco ASA with a temporary Juniper SSG5 on another subnet (192.168.7.0/24) to get the tunnel upward and through traffic until the ASA VPN issue is resolved and I didn't need to say that the client is killing us!

    Help is very appreciated.

    Thank you

    1. Yes, ping package from the interface of the ASA is considered valuable traffic to the LAN of Juniper.

    SAA, need you traffic from the interface source ASA's private, because interesting to determine by crypto ACL MYLIST traffic between 192.168.8.0/24 and 192.168.1.0/24.

    You will also need to add the following configuration to be able to get the ping of the interface of the ASA:

    management-private access

    To initiate the ping of the private interface ASA:

    ping 192.168.1.254 private

    2. the default time before the next generation of new key is normally 28800 seconds, and if there is no interesting traffic flowing between 2 subnets, he'll tear the VPN tunnel down. As soon as there is interesting traffic, the VPN tunnel will be built automatically into the next generation of new key. However, if there is traffic before generating a new key, the new tunnel will be established, and VPN tunnel will remain standing and continue encrypt and decrypt traffic.

    Currently, your configuration has been defined with ITS lifetime of 3600 seconds GOLD / 4608000 kilobytes of traffic before the next generate a new key (it will be either 3600 seconds, or 4608000 kilobytes period expires first). You can certainly change it by default to 28800 seconds without configuring kilobytes. SA life is negotiated between the ASA and Juniper, and whatever is the lowest value will be used.

    Hope that helps.

  • VPN site-to-site between two PIX 501 with Client VPN access

    Site A and site B are connected with VPN Site to Site between two PIX 501.

    Also, site A is configured for remote access VPN client. If a remote client connects to Site A, it can only get access to the LAN of Site A, it cannot access anything whatsoever behind PIX on Site B.

    How is that possible for a VPN client connected to Site A to Site B?

    Thank you very much.

    Alex

    Bad and worse news:

    Bad: Not running the 7.0 series PIX cannot route traffic on the same interface, the traffic is recived. Version 7.0 solves this ipsec traffic.

    Even worse: PIX 501 can not be upgraded to 7.0...

    A couple of things to think about would be the upgrade to hardware that can run the new IOS or allowing a VPN R.A. on site B.

    HTH Please assess whether this is the case.

    Thank you

  • Client VPN access router to the Internet through the same router! How?

    Hi all

    I already setup VPN users connect to our router 1841 and corporate network. Use Cisco VPN Client and connection ends on the interface Dialer1 in 1841. This interface is also our ADSL Internet connection.

    I need the VPN users out to the Internet via this VPN connection (it is through this Dialer1), rather than use the split tunneling and Internet browsing from their Local Internet service providers.

    Of course, this Dialer1 is also 'nat outside' and FastEthernet is LAN and "nat inside '.

    So I'll need NAT these VPN-pool addresses to address IP Dialer1. But what would be 'nat inside' in this case...

    Can anyone help?

    a loopback interface must be configured to "nat inside '.

    for example

    Loopback int 1

    IP 1.1.1.1 255.255.255.0

    No tap

    IP nat inside

    access-list 199 refuse ip<1841 private="" net=""><1841 private="" net="" mask="">

    access-list 199 ip allow a

    allowed policy-road route map 10

    corresponds to the IP 199

    set ip next-hop 1.1.1.2

    interface Dialer0

    political map of IP policy-road route

  • Wacky VPN access problem of ASA

    Hi people,

    I am currenty a situation, and I am in real need of advice...

    The situation is that, if ASA helps my remote branches to access my home network and its allowing people to visit Internet inside, its not allowing the remote VPN client VPN access... R V to aid VPN client version of Cisco 4.6...

    See a presentation of basic network that illustrates our network and configuration of the ASA...

    Advice to solve this problem will be greatly appreciated...

    Kind regards

    Noman Bari

    I see what rou are... Please see my attchement...

    Please rate if it helps!

  • SRP526W to transmit or provide VPN access to clients

    Hello

    We have a SRP526W here, which replaced a cheap, simple router. Now, we would like to set up VPN access for outside clients again. So far, this was done by sending PPTP (TCP 1723 and GRE) for the Routing and Windows 2000 RAS server within the network.

    According to this post SRP521W, and therefore I guess so the SRP526W, are not able to pass the GRE: https://supportforums.cisco.com/thread/2093204

    Is it possible to provide external client VPN access with this router? Perhaps with L2TP (but then you should transmit ESP) or IPSec (ESP and AH as far as I know)?

    If there is no solution, we need to replace this device again once with a cheap, simple, router that is able to convey the Grateful - as you can imagine, we would like to save this shame Cisco.

    Kind regards

    Dominik

    Hello Dominik,

    The SRP520 only supports IPSec site-to-site at this time.

    Advancements are made, please check in the new year.

    Andy

  • PIX - PIX VPN and Client VPN - cannot access core network

    I hub and spoke PIX and a VPN Client that connects to speak it PIX, much the same as the example configuration here: -.

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00800948b8.shtml

    This example shows the client VPN access to the network behind PIX RADIUS. I want the client to also be able to access the central network, i.e. the client connects to the pix speaks via vpn, and traffic is routed through the vpn to PIX - PIX to the central site.

    How this would change the configuration contained in the example?

    See you soon,.

    Jon

    You can not do this, the PIX cannot route a package back on the same interface, it is entered in the. The only way to do that is to have the client connect to the hub PIX, but then they would not be able to get to the network behind PIX distance either.

    Or that the customer would connect on a different interface in the PIX of distance, but this would mean another connection ISP on this PIX. Example of config is here: http://www.cisco.com/warp/public/110/client-pixhub.html

  • The VPN Clients need access to the subnet on another router

    Hello

    We have a pix 515e PIX Version 8.0 (2)

    We have two subnet 10.1.x.x/16 and 10.2.x.x/16

    The firewall is on 10.1.x.x and vpn clients can access this subnet.

    The firewall can ping 10.2.x.y where x is a server in the other subnet.

    On the 10.2.x.x customers out the firewall.

    The problem is that vpn clients cannot access the server of 10.2.x.y even if the pix can ping 10.2.x.y and the road for him.

    What I need to check that the vpn rules are correct in the pix 515e?

    I think it is a rule of exemption nat or something like that not exactly sure.

    Everything would be a great help.

    Thank you

    Hello

    For clients VPN access to these subnets, check the following:

    1 NAT exemption include these subnets (if not using NAT)... it's the NAT0 ACL command

    2. these subnets is included in the split tunneling

    3. these subnets have a route to the PIX to send traffic to the VPN client pool.

    4. There are no ACLs not applied to the inside interface of the PIX deny this communication.

    Federico.

  • VPN access to the not directly connected networks

    Hello

    I have a 5510 which is used for Client VPN access and there is something simple that I can't work.

    The VPN part works very well with AAA on a CBS.

    But what does not is access to networks that are not directly connected to the inside interface.

    That is to say the VPN users can connect to the network within the Interface (say 192.168.0.0/24) but not a 10.0.0.0/8 network which is connected through 192.168.0.1 router.

    I have the static routes in Routing and firewall all showing the way back to the firewall on all the other networks, but I don't get more far the 192.168.0.1 router...

    I use split tunneling and pass all of the private over the VPN - internet networks is used through the own local access to clients.

    Can someone help me out here?

    Thank you.

    Fraser

    PS: have the same type of access on a 7206VXR and soft, everything can be consulted and which is necessary - but I would like to move this service to the ASA.

    Fraser

    I don't understand the ASDM parts as you suggest. The code would be great.

    I would also recommend control ACL applied to the inside interface (if any) that it allows traffic as

    inside_access_in list of permitted access 10.0.0.0 255.0.0.0 vpnsubnet vpnnetmask

    If still no joy, attach your config sanitized, would be useful for me to diagnose.

    Concerning

  • AnyConnect VPN for Cisco ASA 5505 refused connections

    I'm trying to set up my Cisco 5505 with AnyConnect VPN client VPN access.  Here is the relevant information of my config:

    interface Vlan2
    
    mac-address xxxx.xxxx.xxxx
    
    nameif outside
    
    security-level 0
    
    ip address A.A.A.A 255.255.255.240
    
    !
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq pptp
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq https
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq ftp
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq https
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq ftp
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq www
    
    access-list outside_access_in extended permit tcp any host C.C.C.C eq smtp
    
    access-list outside_access_in extended permit icmp any any
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq ssh
    
    access-list outside_access_in extended permit tcp any host C.C.C.D eq 8080
    
    access-list outside_access_in extended permit gre any host C.C.C.C
    
    access-list outside_access_out extended permit ip any any
    
    access-list inside_access_in extended permit ip any any
    
    access-list inside_access_in extended permit ip any interface outside
    
    access-list inside_access_out extended permit ip any any
    

    access-group inside_access_in in interface inside
    
    access-group inside_access_out out interface inside
    
    access-group outside_access_in in interface outside
    
    access-group outside_access_out out interface outside
    

    webvpn
    
    enable inside
    
    enable outside
    
    svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
    
    svc enable
    

    group-policy DfltGrpPolicy attributes
    
    dns-server value X.X.X.X
    
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    
    split-tunnel-policy tunnelspecified
    
    split-tunnel-network-list value
    
    address-pools value palm
    
    webvpn
    
      svc rekey time 30
    
      svc rekey method ssl
    
      svc ask enable default webvpn
    

    policy-map global_policy
    
    class inspection_default
    
      inspect pptp
    
      inspect http
    
      inspect icmp
    
      inspect ftp
    
    !

    When I try to connect, I get this error in the real-time log viewer:

    TCP access denied by ACL from X.X.X.X/57356 to outside:A.A.A.A/443

    Here are the details of the license:

    Licensed features for this platform:
    
    Maximum Physical Interfaces  : 8
    
    VLANs                        : 3, DMZ Restricted
    
    Inside Hosts                 : Unlimited
    
    Failover                     : Disabled
    
    VPN-DES                      : Enabled
    
    VPN-3DES-AES                 : Enabled
    
    SSL VPN Peers                : 2
    
    Total VPN Peers              : 10
    
    Dual ISPs                    : Disabled
    
    VLAN Trunk Ports             : 0
    
    Shared License               : Disabled
    
    AnyConnect for Mobile        : Disabled
    
    AnyConnect for Linksys phone : Disabled
    
    AnyConnect Essentials        : Disabled
    
    Advanced Endpoint Assessment : Disabled
    
    UC Phone Proxy Sessions      : 2
    
    Total UC Proxy Sessions      : 2
    
    Botnet Traffic Filter        : Disabled
    

    This platform has a Base license.

    Can someone tell me what I am doing wrong or what access list I'm missing?

    I have two Cisco ASA 5510 firewall with a similar setup configuration and the AnyConnect SSL VPN works great.

    Hi Matt,

    You are probably landing on the tunnel-group by default - you will need to indicate which group to connect to the client. This can be done in different ways - I see that you already have a defined group aliases, but to be able to use that you must configure:

    WebVPN

    tunnel-group-list activate

    Alternatively, if you have only a single group, you can add 'group-url https://yourasa.yourcompany.com/ permit' to the webvpn attributes tunnel-group.

    HTH

    Herbert

  • PIX-to-client VPN and how to reach on other interfaces systems

    Hi all

    I've implemented a Pix-to-Client VPN and it seems works ok.

    As you can see, customer gets the same inside the class address (192.168.100.x) so I can reach across systems.

    My questions are:

    If I give different subnet pool addresses, how can 1 I still reach inside systems?

    2 if I have other systems on these interfaces such dmz1 (192.168.10.0) dmz2 (192.168.20.0) how to get to these systems of the

    even the client vpn access?

    Concerning

    Alberto Brivio

    IP local pool vpnpool1 192.168.100.70 - 192.168.100.80

    access-list 102 permit ip 192.168.100.0 255.255.255.0 192.168.100.0 255.255.255.0

    NAT (inside) - 0 102 access list

    Permitted connection ipsec sysopt

    Crypto ipsec transform-set esp - esp-md5-hmac trmset1

    Crypto-map dynamic map2 10 set transform-set trmset1

    map map1 10 ipsec-isakmp crypto dynamic map2

    map1 outside crypto map interface

    ISAKMP allows outside

    ISAKMP identity address

    part of pre authentication ISAKMP policy 10

    encryption of ISAKMP policy 10

    ISAKMP policy 10 md5 hash

    10 2 ISAKMP policy group

    ISAKMP life duration strategy 10 86400

    vpngroup address vpnpool1 pool test

    vpngroup split tunnel 102 test

    vpngroup test 1800 idle time

    test vpngroup password *.

    It is generally preferable to use another range of IP addresses. The PIX will know that the VPN Client uses that vary and route it properly whitch is not the case when you are using the same IP range as the inside interface.

    To access another interface use the SHEEP (your ACL 102) access list which disables NAT between the VPN and the neworks to which you want to connect.

    Example of config:

    access-list allowed SHEEP Internalnet ISubnetMask VPN-pool 255.255.255.0 ip

    access-list allowed SHEEP DMZnet DMZSubnetMask VPN-pool 255.255.255.0 ip

    NAT (inside) 0 SHEEP

    AAA-server local LOCAL Protocol

    AAA authentication secure-http-client

    Permitted connection ipsec sysopt

    Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS

    Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS

    card crypto 65535 REMOTE ipsec-isakmp dynamic outside_dyn_map

    REMOTE client authentication card crypto LOCAL

    interface card crypto remotely outside

    ISAKMP allows outside

    ISAKMP identity address

    ISAKMP nat-traversal 20

    part of pre authentication ISAKMP policy 10

    ISAKMP policy 10 3des encryption

    ISAKMP policy 10 md5 hash

    10 2 ISAKMP policy group

    ISAKMP life duration strategy 10 86400

    IP pool local VPNPool x.y.z.1 - x.y.z.254

    vpngroup VPNGroup address pool VPNPool

    vpngroup VPNGroup dns-server dns1 dns2

    vpngroup VPNGroup default-domain localdomain

    vpngroup idle 1800 VPNGroup-time

    vpngroup VPNGroup password grouppassword

    username, password vpnclient vpnclient-password

    sincerely

    Patrick

  • L to L passing tunnel concentrator 3000 to ASA 5510

    Hello

    I'm looking in to Lan VPN configuration tunnel the Cisco VPN 3000 to ASA 5510 concentrator Lan. I noticed that this particular configuration has NAT enabled in the hub (Config-online policy management of-online traffic Mgmt-online NAT-online L to L rules)... There are 2 servers NATted to 192.168.1.1 et.2 addresses, so I need to do the same in ASA. Should what steps I take to reach the same configuration in SAA? Is it possible through SDM?

    Thank you

    Forman

    In ASDM-online-online NAT rules configuration, I can create static rule inside indoor int interface and then create the tunnel using 'translated the address' or 'translated network' local area network in the VPN configuration. Is this right?

    That is right.

    You should NAT the VPN traffic and set the VPN traffic from the translated addresses.

    Federico.

Maybe you are looking for