Remote VPN users

Hello

I would just ask how many simultaneous remote client VPN users is allowed for a Cisco1841 router? Are there licenses required?

Also, will there be a degradation of the performance of the router if there as 15 concurrent users active remote client and VPN L2L 2?

Thank you!

For IPSEC, I don't think that there are all the necessary licenses. For SSL, they (but it still works without the license, but unethical).

Concerning

Farrukh

Tags: Cisco Security

Similar Questions

Routing of a VPN from Site to site to remote VPN users

Hello

We have a site and remote vpn site configured in the same interface in ASA 5520 (software version 8.3). When the remote vpn users try to connect to the computers located at the far end of the site to site VPN, their request has failed. I tried No.-Nat between remote vpn IP private to the private IP address of remote site, also said the same split tunneling. I can't find even the tracert, ping has also expired.

Is there any solution to make this live thing.

Shankar.

There are a few things that need to be added to make it work:

(1) on the SAA where remote vpn users connect to, you must add "permit same-security-traffic intra-interface"

(2) you mention that you have added the LAN of remote site-to-site in the list of split tunnel, so that's good.

(3) on the SAA ending the vpn for remote access, you must also add the following text:

-Crypto ACL for the site to site VPN must include the following:

permit ip access list

(4) on the ASA site to remote site, you must add:

-Crypto ACL for the site to site VPN must include the following:

permit ip access list

-No - Nat: ip access list allow

Remote VPN users cannot reach OSPF Inter networks

Hi all

Area0 & Grenier1. Grenier1 ASA has remote VPN configuration where users also use split tunneling. When the VPN plug-in users, accessing all respurces successfully in the area euro1, but unable to reach Area0 resources.

But Area0 PCs can 'ping' on addresses IP VPN component software plug-in. I tried 'debug icmp trace', but not poping up even one message upwards all to initiate the 'ping' of the computer laptop VPN users.

FYI... Grenier1 N/w: 10.251.0.0/16 and 10.251.40.0/24 has been used for VPN DHCP users. Everything works well except for the Area0 accessibility.

Any suggestions... ?

Thank you

MS

access-list extended sheep ip SiteA 255.255.0.0 255.255.255.0 SiteAVPN allow

access-list extended sheep ip SiteB 255.255.0.0 255.255.255.0 SiteAVPN allow

Urgent issue: remote vpn users cannot reach server dmz

Hi all

I have an asa5510 firewall in which remote vpn client users can connect but they cannot ping or access the dmz (192.168.3.5) Server

They also can't ping the out interface (192.168.2.10), below is the show run, please help.

SH run

ASA5510 (config) # sh run
: Saved
:
: Serial number: JMX1243L2BE
: Material: ASA5510, 256 MB RAM, Pentium 4 Celeron 1599 MHz processor
:
ASA 5,0000 Version 55
!
Majed hostname
activate the encrypted password of UFWSxxKWdnx8am8f
2KFQnbNIdI.2KYOU encrypted passwd
names of
DNS-guard
!
interface Ethernet0/0
nameif outside
security-level 0
IP 192.168.2.10 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
192.168.1.10 IP address 255.255.255.0
!
interface Ethernet0/2
nameif servers
security-level 90
192.168.3.10 IP address 255.255.255.0
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
Shutdown
No nameif
no level of security
no ip address
!
boot system Disk0: / asa825-55 - k8.bin
passive FTP mode
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
acl_outside to access extended list ip 192.168.5.0 allow 255.255.255.0 192.168.1.0 255.255.255.0
acl_outside list extended access allow icmp 192.168.5.0 255.255.255.0 192.168.1.0 255.255.255.0
acl_outside of access allowed any ip an extended list
acl_outside list extended access permit icmp any one
acl_inside list extended access allowed host ip 192.168.1.150 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host icmp 192.168.1.150 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host ip 192.168.1.200 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host icmp 192.168.1.200 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host ip 192.168.1.13 192.168.5.0 255.255.255.0
acl_inside list extended access allowed host icmp 192.168.1.13 192.168.5.0 255.255.255.0
acl_inside to access ip 192.168.1.0 scope list allow 255.255.255.0 host 192.168.3.5
acl_inside list extended access allow icmp 192.168.1.0 255.255.255.0 host 192.168.3.5
acl_inside list extended access deny ip 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
acl_inside list extended access deny icmp 192.168.1.0 255.255.255.0 192.168.5.0 255.255.255.0
acl_inside of access allowed any ip an extended list
acl_inside list extended access permit icmp any one
acl_server of access allowed any ip an extended list
acl_server list extended access permit icmp any one
Local_LAN_Access list standard access allowed 10.0.0.0 255.0.0.0
Local_LAN_Access list standard access allowed 172.16.0.0 255.240.0.0
Local_LAN_Access list standard access allowed 192.168.0.0 255.255.0.0
access-list nat0 extended ip 192.168.0.0 allow 255.255.0.0 192.168.0.0 255.255.0.0
allow acl_servers to access extensive ip list a whole
acl_servers list extended access allow icmp a whole
pager lines 24
Outside 1500 MTU
Within 1500 MTU
MTU 1500 servers
IP local pool 192.168.5.1 - 192.168.5.100 mask 255.255.255.0 vpnpool
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
Global 1 interface (outside)
interface of global (servers) 1
NAT (inside) 0 access-list nat0
NAT (inside) 1 192.168.1.4 255.255.255.255
NAT (inside) 1 192.168.1.9 255.255.255.255
NAT (inside) 1 192.168.1.27 255.255.255.255
NAT (inside) 1 192.168.1.56 255.255.255.255
NAT (inside) 1 192.168.1.150 255.255.255.255
NAT (inside) 1 192.168.1.200 255.255.255.255
NAT (inside) 1 192.168.2.5 255.255.255.255
NAT (inside) 1 192.168.1.0 255.255.255.0
NAT (inside) 1 192.168.1.96 192.168.1.96
NAT (servers) - access list 0 nat0
NAT (servers) 1 192.168.3.5 255.255.255.255
static (inside, servers) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
static (servers, inside) 192.168.3.5 192.168.3.5 netmask 255.255.255.255
Access-group acl_outside in interface outside
Access-group acl_servers in the servers of the interface
Route outside 0.0.0.0 0.0.0.0 192.168.2.15 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.1.0 255.255.255.0 inside
http 192.168.3.5 255.255.255.255 servers
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic outside_dyn_map 10 the value transform-set ESP-3DES-SHA
Crypto-map dynamic outside_dyn_map 10 set security-association life seconds288000
Crypto-map dynamic outside_dyn_map 10 kilobytes of life together - the association of safety 4608000
Crypto-map dynamic outside_dyn_map 10 the value reverse-road
map Outside_map 10-isakmp ipsec crypto dynamic outside_dyn_map
Outside_map interface card crypto outside
ISAKMP crypto identity hostname
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
3des encryption
sha hash
Group 2
life 86400
No encryption isakmp nat-traversal
Telnet 192.168.2.0 255.255.255.0 outside
Telnet 192.168.1.0 255.255.255.0 inside
Telnet 192.168.3.0 255.255.255.0 servers
Telnet 192.168.38.0 255.255.255.0 servers
Telnet timeout 5
SSH timeout 5
Console timeout 0
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal vpn group policy
attributes of vpn group policy
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list Local_LAN_Access
allow to NEM
password encrypted qaedah Ipsf4W9G6cGueuSu user name
password encrypted moneef FLlCyoJakDnWMxSQ user name
chayma X7ESmrqNBIo5eQO9 username encrypted password
sanaa2 zHa8FdVVTkIgfomY encrypted password username
sanaa x5fVXsDxboIhq68A encrypted password username
sanaa1 x5fVXsDxboIhq68A encrypted password username
bajel encrypted DygNLmMkXoZQ3.DX privilege 15 password username
daris BgGTY7d1Rfi8P2zH username encrypted password
taiz Ip3HNgc.pYhYGaQT username encrypted password
damt gz1OUfAq9Ro2NJoR encrypted privilege 15 password username
aden MDmCEhcRe64OxrQv username encrypted password
username hodaidah encrypted password of IYcjP/rqPitKHgyc
username yareem encrypted password ctC9wXl2EwdhH2XY
AMMD ZwYsE3.Hs2/vAChB username encrypted password
haja Q25wF61GjmyJRkjS username encrypted password
cisco 3USUcOPFUiMCO4Jk encrypted password username
ibbmr CNnADp0CvQzcjBY5 username encrypted password
IBBR oJNIDNCT0fBV3OSi encrypted password username
ibbr 2Mx3uA4acAbE8UOp encrypted password username
ibbr1 wiq4lRSHUb3geBaN encrypted password username
password username: TORBA C0eUqr.qWxsD5WNj encrypted
username, password shibam xJaTjWRZyXM34ou. encrypted
ibbreef 2Mx3uA4acAbE8UOp encrypted password username
username torbah encrypted password r3IGnotSy1cddNer
thamar 1JatoqUxf3q9ivcu encrypted password username
dhamar pJdo55.oSunKSvIO encrypted password username
main jsQQRH/5GU772TkF encrypted password username
main1 ef7y88xzPo6o9m1E encrypted password username
password username Moussa encrypted OYXnAYHuV80bB0TH
majed 7I3uhzgJNvIwi2qS encrypted password username
lahj qOAZDON5RwD6GbnI encrypted password username
vpn tunnel-group type remote access
VPN tunnel-group general attributes
address vpnpool pool
Group Policy - by default-vpn
Tunnel vpn ipsec-attributes group
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!

Hello brother Mohammed.

"my asa5510 to work easy as Server & client vpn at the same time.?

Yes, it can work as a client and a server at the same time.

I have never seen anyone do it but many years of my understanding, I have no reason to think why it may be because the two configurations (client/server) are independent of each other.

Your ASA function as server uses the "DefaultL2LGroup" or it uses standard group policy and tunnel-group are mapped to the remote clients ASA?

Thank you

Remote VPN users cannot access tunnel from site to site

Cisco ASA5505.

I have a tunnel of site-to-site set up from our office to our Amazon AWS VPC. I'm not a network engineer and have spent way too much time just to get to this point.

It works very well since within the office, but users remote VPN can not access the tunnel from site to site. All other remote access looks very good.

The current configuration is here: https://gist.github.com/pmac72/f483ea8c7c8c8c254626

Any help or advice would be greatly appreciated. It is probably super simple for someone who knows what they're doing to see the question.

Hi Paul.

Looking at your configuration:

Remote access:

internal RA_GROUP group policy
RA_GROUP group policy attributes
value of server DNS 8.8.8.8 8.8.4.4
Protocol-tunnel-VPN IPSec
value of Split-tunnel-network-list Split_Tunnel_List

permit same-security-traffic intra-interface

type tunnel-group RA_GROUP remote access
attributes global-tunnel-group RA_GROUP
address RA_VPN_POOL pool
Group Policy - by default-RA_GROUP
IPSec-attributes tunnel-group RA_GROUP
pre-shared key *.

local pool RA_VPN_POOL 10.0.0.10 - 255.255.255.0 IP 10.0.0.50 mask

Site to site:
```
  
```
card crypto outside_map 1 match address acl-amzn

card crypto outside_map 1 set pfs

peer set card crypto outside_map 1 AWS_TUNNEL_1_IP AWS_TUNNEL_2_IP

card crypto outside_map 1 set of transformation transformation-amzn

I recommend you to use a local IP address pool with a different IP address that deals with the inside interface uses, now you are missing NAT are removed from the IP local pool to the destination of the site to site:

NAT_EXEMPT list of ip 10.0.0.0 access allow 255.255.255.0 172.17.0.0 255.255.0.0

NAT (outside) 0-list of access NAT_EXEMPT

Now, there's a dynamically a NAT exempt allowing traffic to go out and are not translated.

I would like to know how it works!

Please don't forget to rate and score as correct the helpful post!

Kind regards

David Castro,

Auth of remote VPN through LDAP allow all users!

Hello

I have 5505 firewall and security license. I have configure remote VPN on firewall through CLI with the commands below. Remote VPN works well, but the problem is, it allows all remote VPN users. I need to restrict remote VPN access bit user, I need to configure via CLI, I don't want to go through ASDM, can someone help me with CLI?

ASDM I can able to perfom below things I'm not able to perform through CLI

Configuration-> access to the network (Client)-> dynamic access policies

Through ASDM I'm able to set the VPN users are allow to remote VPN access, how to set up same thing through CLI

Here's my CLI:

LDAP attribute-map CISCOMAP

name of the KFG IETF Radius-class card

map-value VPN CN = VPN, DC = domain, DC = com noaccess_pri

map-value VPN CN = VPN, DC = domain, DC = com noaccess_bk

map-value VPN CN = VPN, DC = domain, DC = com splitgroup_pri

map-value VPN CN = VPN, DC = domain, DC = com splitgroup_bk

AAA-server ldapgroup protocol ldap

ldapgroup AAA-server (inside) host 10.1.10.5

LDAP-base-dn dc = domain, dc = com

LDAP-scope subtree

LDAP-naming-attribute sAMAccountName

LDAP-login-password Inf0rmati0n1

LDAP-connection-dn cn = VPN, dc = domain, dc = com

microsoft server type

LDAP-attribute-map CISCOMAP

internal noaccess_pri group policy

attributes of the strategy of group noaccess_pri

VPN - concurrent connections 0

output

internal noaccess_bk group policy

attributes of the strategy of group noaccess_bk

VPN - concurrent connections 0

output

internal splitpolicy_pri group policy

Protocol-tunnel-VPN IPSEC l2tp ipsec

tunnel-group splitgroup_pri General-attributes

ldapgroup group-LOCAL authentication server

internal splitpolicy_bk group policy

Protocol-tunnel-VPN IPSEC l2tp ipsec

tunnel-group splitgroup_bk General-attributes

ldapgroup group-LOCAL authentication server

Thank you

Abhishek

Hello

You cannot configure the DAP via CLI Protocol because the configuration is saved in a file dap.xml and is stored in flash of the SAA.

You can configure the DAP protocol using the following link:

http://www.ciscosystems.com/en/us/products/ps6120/products_white_paper09186a00809fcf38.shtml#T4

Also note that the link mentions the following:

Note:

The dap.xml file that contains the attributes of selection policies DAP, is stored in flash of the SAA. Although you can export the file dap.xml out, the edit box (if you know about the xml syntax), and re - import again, be very careful, because you might ASDM stop treatment of DAP files if you have misconfigured something. There is no CLI to handle this part of the configuration.

I hope this helps.

Kind regards

Anisha

P.S.: Please mark this message as answered if you feel that your query is resolved. Note the useful messages.

Tunnel remote VPN Site to Site

Hello

I am facing a problem with my remote VPN users, I describe my network here. I have a site to another tunnel for my USA, tht IP 169.X.X.X. office client, we are able to connect this tunnel. now I configured remote vpn for users of my home, my office inside the IP is 192.168.2.X and once I connect to home, in the office through vpn cisco client, then, my ip is 192.168.3.X I put the IP in ASA pool, now 192.168.3.X and 192.168.2.X communicates correctly , but I need to access my Tunnel IP 169.1.X.X also from 192.168.3.X (Home).

203.92.X.X is my static public Ip address that is allowed in the client side for the tunnel.

If something confussing please let me know.

Thank you

Nitin

Nitin,

It is not possible to have a NATing on 192.168.3.0/24 to public ip address because it has default route (which you can reach L2L remote host) on the SAA pointing to the external interface. This default route will be redirect/road traffic on the external interface only vpn client so NATing will reach us.

HTH

Sangaré

Cisco ASA 5510 VPN user Auth

Hi all.

I search the internet to find a way or all first, whether it is possible to do what I want to do, but I can't find anything corresponding to what I'm looking for. Possible that I don't have the right keyword.

We change our old Pix 515e this weekend and for any new ASA 5510.

With this new facility, I want to implement Radius Authentication for the user remote vpn. Change the firewall of the company is an important factor and for the first phase, the user will keep authenticate locally but I need that in phase 2, they will be authenticated through a radius server.

Is there a way to configure both user authentication remote vpn?

For example.

All users will be authenticated locally unless the service member COMPUTER that is authenticated by the radius to the testing server.

I have remote vpn users anywhere in the world if I don't want these users are blocked by the radius authentication test. What I want is that users in Group1 will be authenticated locally on the SAA and users in group2 will be authenticated by the RADIUS. During the test will be done, all users will gradually transfer for radius authentication.

Is it possible

Thank you

Jonathan

Network administrator

Hi Jonathan,.

The best way to go about this would be that you set up another group strategy & corresponding tunnel group named Test and set up Radius Authentication for VPN group using the link below: -.

http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a00806de37e.shtml

Ones you have done test and feel confident, you can change the type of authentication for the Production Group. The reverse could be implemented double authentication as RADIUS and if it does not use local but personally I'll put up a group of test and then those I am confident, that I'll change the strategy of Production Group to use the Radius Server to auth.

Manish

remote VPN and vpn site to site vpn remote users unable to access the local network

As per below config remote vpn and vpn site to site vpn remote users unable to access the local network please suggest me a required config

The local 192.168.215.4 not able ping server IP this server connectivity remote vpn works fine but not able to ping to the local network vpn users.

ASA Version 8.2 (2)
!
host name
domain kunchevrolet
activate r8xwsBuKsSP7kABz encrypted password
r8xwsBuKsSP7kABz encrypted passwd
names of
!
interface Ethernet0/0
nameif outside
security-level 0
PPPoE client vpdn group dataone
IP address pppoe
!
interface Ethernet0/1
nameif inside
security-level 50
IP 192.168.215.2 255.255.255.0
!
interface Ethernet0/2
nameif Internet
security-level 0
IP address dhcp setroute
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
Shutdown
No nameif
no level of security
no ip address
management only
!
passive FTP mode
clock timezone IST 5 30
DNS server-group DefaultDNS
domain kunchevrolet
permit same-security-traffic intra-interface
object-group network GM-DC-VPN-Gateway
object-group, net-LAN
access extensive list ip 192.168.215.0 sptnl allow 255.255.255.0 192.168.2.0 255.255.255.0
192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0
tunnel of splitting allowed access list standard 192.168.215.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
MTU 1500 Internet
IP local pool VPN_Users 192.168.2.1 - 192.168.2.250 mask 255.255.255.0
ICMP unreachable rate-limit 1 burst-size 1
enable ASDM history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 1 0.0.0.0 0.0.0.0
Route outside 0.0.0.0 0.0.0.0 59.90.214.1 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
the ssh LOCAL console AAA authentication
AAA authentication LOCAL telnet console
AAA authentication http LOCAL console
AAA authentication enable LOCAL console
LOCAL AAA authentication serial console
Enable http server
x.x.x.x 255.255.255.252 out http
http 192.168.215.0 255.255.255.252 inside
http 192.168.215.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic dynmap 65500 transform-set RIGHT
card crypto 10 VPN ipsec-isakmp dynamic dynmap
card crypto VPN outside interface
card crypto 10 ASA-01 set peer 221.135.138.130
card crypto 10 ASA - 01 the transform-set RIGHT value
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 65535
preshared authentication
the Encryption
sha hash
Group 2
lifetime 28800
Telnet 192.168.215.0 255.255.255.0 inside
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 outdoors
SSH timeout 5
Console timeout 0
management-access inside
VPDN group dataone request dialout pppoe
VPDN group dataone localname bb4027654187_scdrid
VPDN group dataone ppp authentication chap
VPDN username bb4027654187_scdrid password * local store
interface for identifying DHCP-client Internet customer
dhcpd dns 218.248.255.141 218.248.245.1
!
dhcpd address 192.168.215.11 - 192.168.215.254 inside
dhcpd allow inside
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
Des-sha1 encryption SSL
WebVPN
allow outside
tunnel-group-list activate
internal kun group policy
kun group policy attributes
VPN - connections 8
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value split tunnel
kunchevrolet value by default-field
test P4ttSyrm33SV8TYp encrypted password username
username kunauto password bSHrKTGl8PUbvus / encrypted privilege 15
username kunauto attributes
Strategy Group-VPN-kun
Protocol-tunnel-VPN IPSec
tunnel-group vpngroup type remote access
tunnel-group vpngroup General attributes
address pool VPN_Users
Group Policy - by default-kun
tunnel-group vpngroup webvpn-attributes
the vpngroup group alias activation
vpngroup group tunnel ipsec-attributes
pre-shared key *.
type tunnel-group test remote access
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group ipsec-attributes x.x.x.x
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
Review the ip options
inspect the netbios
inspect the rsh
inspect the rtsp
inspect the skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect the tftp
inspect the sip
inspect xdmcp
inspect the icmp
!
global service-policy global_policy
context of prompt hostname
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
Cryptochecksum:0d2497e1280e41ab3875e77c6b184cf8
: end
kunauto #.

Hello

Looking at the configuration, there is an access list this nat exemption: -.

192.168.215.0 IP Access-list extended sheep 255.255.255.0 allow 192.168.2.0 255.255.255.0

But it is not applied in the States of nat.

Send the following command to the nat exemption to apply: -.

NAT (inside) 0 access-list sheep

Kind regards

Dinesh Moudgil

P.S. Please mark this message as 'Responded' If you find this information useful so that it brings goodness to other users of the community

problem with users to access remote vpn site to site vpn network

I did the Setup: asa 5510 configured remote access vpn. My vpn users receive asa 5510 range 192.168.50.0/24 addresses and users access my local lan 192.168.0.0/24. the second side of the local lan 192.168.0.0/24 on asa 5505, I did a vpn site-to-site with network 192.168.5.0/24.on that both sides of a site are asa 5505. inside the interface asa 5510 Elise 192.168.0.10 and inside the interface asa 5505 have address 192.168.0.17.third asa 5505 networked 192.168.5.0/24 address 192.168.5.1. I want my remote access vpn users can access resources on network 192.168.5.0/24. I create the static route on inside the asa 5510 static route 192.168.5.0 interface 255.255.255.0 192.168.0.17 and a static route on inside the asa 5505 static route 192.168.50.0 interface 255.255.255.0 192.168.0.10, but it's not working. What do I do?

execution of the configuration of my asa 5510 is

Result of the command: "show run"

: Saved
:
ASA Version 8.4(2)
!
hostname asa5510
domain-name dri.local
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.178 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.0.10 255.255.255.0
!
interface Ethernet0/2
description Mreza za virtualne masine- mail server, wsus....
nameif DMZ
security-level 50
ip address 172.16.20.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns server-group DefaultDNS
domain-name dri.local
object network VPN-POOL
subnet 192.168.50.0 255.255.255.0
description VPN Client pool
object network LAN-NETWORK
subnet 192.168.0.0 255.255.255.0
description LAN Network
object network NETWORK_OBJ_192.168.0.0_24
subnet 192.168.0.0 255.255.255.0
object network 192.168.0.10
host 192.168.0.10
object service ssl
service tcp destination eq 465
object service tls
service tcp destination eq 995
object network mail_server
host 172.16.20.201
object service StartTLS
service tcp destination eq 587
object service admin_port
service tcp destination eq 444
object service ODMR
service tcp destination eq 366
object service SSL-IMAP
service tcp destination eq 993
object network remote
host 172.16.20.200
object network test
host 192.168.0.22
object network mail
host 172.16.20.200
object network DMZ
host 172.16.20.200
object network Inside_DMZ
host 192.168.0.20
object service rdp
service tcp destination eq 3389
object network DRI_PS99
host 192.168.0.54
object service microsoft_dc
service tcp destination eq 445
object service https448
service tcp destination eq 448
object network mail_server_internal
host 172.16.20.201
object service Acronis_remote
service tcp destination eq 9876
object service Acronis_25001
service tcp destination eq 25001
object service HTTP3000
service tcp destination eq 3000
object network VPNPOOL
subnet 192.168.50.0 255.255.255.0
object-group network PAT-SOURCE-NETWORKS
description Source networks for PAT
network-object 192.168.0.0 255.255.255.0
object-group service DM_INLINE_SERVICE_1
service-object object admin_port
service-object object ssl
service-object object tls
service-object object https448
object-group service DM_INLINE_SERVICE_2
service-object object admin_port
service-object object https448
service-object object ssl
service-object object tls
service-object tcp destination eq pop3
service-object tcp destination eq smtp
object-group service DM_INLINE_SERVICE_3
service-object object admin_port
service-object object https448
service-object object ssl
service-object tcp destination eq smtp
service-object object tls
service-object object Acronis_remote
service-object tcp destination eq www
service-object object Acronis_25001
service-object object microsoft_dc
object-group protocol DM_INLINE_PROTOCOL_1
protocol-object ip
protocol-object tcp
object-group service DM_INLINE_SERVICE_4
service-object object Acronis_25001
service-object object Acronis_remote
service-object object microsoft_dc
service-object tcp destination eq www
service-object tcp
service-object ip
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_2 any object mail_server
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object mail
access-list Split_Tunnel_List extended permit ip 192.168.0.0 255.255.255.0 any
access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.5.0 255.255.255.0
access-list DMZ extended permit object-group DM_INLINE_SERVICE_4 172.16.20.0 255.255.255.0 any
access-list DMZ extended permit object-group DM_INLINE_SERVICE_3 host 172.16.20.201 any
access-list DMZ extended permit object-group DM_INLINE_PROTOCOL_1 172.16.20.0 255.255.255.0 any inactive
access-list DMZ extended deny tcp any any eq smtp
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
mtu management 1500
ip local pool vpnadrese 192.168.50.1-192.168.50.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static LAN-NETWORK LAN-NETWORK destination static VPN-POOL VPN-POOL
!
object network mail_server
nat (DMZ,outside) static x.x.x.179
object network mail
nat (DMZ,outside) static x.x.x.180
access-group outside_access_in in interface outside
access-group DMZ in interface DMZ
route outside 0.0.0.0 0.0.0.0 178.254.133.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
action terminate
dynamic-access-policy-record dripolisa
aaa-server DRI protocol ldap
aaa-server DRI (inside) host 192.168.0.20
ldap-base-dn DC=dri,DC=local
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn CN=dragan urukalo,OU=novisad,OU=sektor2,OU=REVIZIJA,DC=dri,DC=local
server-type microsoft
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
aaa authorization command LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
virtual telnet 192.168.1.12
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_cryptomap
crypto map outside_map 1 set peer 195.222.96.223
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.0.14-192.168.0.45 inside
!
dhcpd address 172.16.20.2-172.16.20.150 DMZ
dhcpd dns x.x.x.177 interface DMZ
dhcpd auto_config outside interface DMZ
dhcpd option 6 ip x.x.x.177 interface DMZ
dhcpd enable DMZ
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy GroupPolicy_x.x.x.223 internal
group-policy GroupPolicy_x.x.x.223 attributes
vpn-tunnel-protocol ikev1 ikev2
group-policy drivpn internal
group-policy drivpn attributes
dns-server value 192.168.0.20 192.168.0.254
vpn-simultaneous-logins 10
vpn-idle-timeout 30
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-network-list value Split_Tunnel_List
default-domain value dri.local
username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
tunnel-group drivpn type remote-access
tunnel-group drivpn general-attributes
address-pool vpnadrese
authentication-server-group DRI
default-group-policy drivpn
tunnel-group drivpn ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group x.x.x.223 type ipsec-l2l
tunnel-group x.x.x.223 general-attributes
default-group-policy GroupPolicy_x.x.x.223
tunnel-group x.x.x.223 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect tftp
inspect ip-options
inspect netbios
inspect icmp
inspect http
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:69c651e94663fc570b67e0c4c0dcbae1
: end

running config asa 5505

Result of the command: "show run"

: Saved
:
ASA Version 8.2(1)
!
hostname ciscoasa
enable password csq7sfr0bQJqMGET encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.5.0 PALATA
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.17 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 10.13.74.33 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object-group service DM_INLINE_SERVICE_1
service-object ip
service-object tcp
service-object icmp echo
service-object icmp echo-reply
service-object tcp eq domain
service-object tcp eq ldap
service-object tcp eq smtp
object-group service DM_INLINE_SERVICE_2
service-object ip
service-object tcp eq domain
service-object tcp eq www
service-object tcp eq https
service-object tcp eq smtp
object-group service Sharepoint8080 tcp
port-object eq 8080
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_2 192.168.0.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
access-list outside_2_cryptomap extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 192.168.0.0 255.255.255.0 PALATA 255.255.255.0
pager lines 24
logging enable
logging asdm informational
logging mail errors
logging from-address
logging recipient-address level debugging
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound_1
nat (inside) 1 192.168.0.0 255.255.255.0
static (inside,outside) 10.13.74.35 192.168.0.22 netmask 255.255.255.255
static (inside,outside) 10.13.74.34 192.168.0.20 netmask 255.255.255.255 dns
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 10.13.74.1 1
route inside 0.0.0.0 0.0.0.0 192.168.0.17 tunneled
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication telnet console LOCAL
http server enable
http 10.13.74.0 255.255.255.0 outside
http 192.168.0.0 255.255.255.0 inside
http 10.15.100.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
virtual telnet 192.168.0.53
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_2_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 10.15.100.15
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username driadmin password AojCAMO/soZo8W.W encrypted privilege 15
tunnel-group 10.15.100.15 type ipsec-l2l
tunnel-group 10.15.100.15 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
smtp-server 173.194.79.109
prompt hostname context
Cryptochecksum:4767b6764cb597f0a7b8b138587d4192
: end

Thank you

Hello

I have previously edited the my initial response was in fact not necessary since you were actually using full Tunnel

EDIT: Actually just noticed the the VPN client isnt using Split Tunnel. Its Full Tunnel at the moment since it doesnt have the "split-tunnel-policy tunnelspecified"

So you don't really have any of those.

Please mark the question answers and/or assess response

Ask more if necessary

-Jouni

AnyConnectVPN users cannot access remote vpn site-to-site

Hello-

We have two 5510 s ASA one in 8.4 (4) and the other to 8.2 (5) in a site to site VPN configuration. All internal traffic is working smoothly.

A: site/subnet 192.160.0.0 - local (8.4 (4)) Site/subnet b: 192.260.0.0 - distance (8.2 (5)) VPN users: 192.160.40.0 - assigned by ASA

When you VPN into the network, all the hits of traffic A Site and everything on the subnet A is accessible.

However, the site B is totally inaccessible to users of VPN. All computers on subnet B, the firewall itself, etc. is not reachable by ping or otherwise.

There are also some NAT rules weird that I'm not happy with that were created after that I upgraded the Site to ASA to 8.4

A resident of the site: external 192.160.x.x: 55.55.555.201(main)/202(mail)

Site B (in addition to site to site) is external 192.260.x.x: 66.66.666.54 (all)

I've pretty much just the basic rules of the NAT for VPN, Email, Internet and site to site.

What I need to add for the VPN access to the network from site to site?

Here is my config NAT:

NAT (inside, outside) static source DOMAIN_LOCAL DOMAIN_LOCAL VPN_Network VPN_Network non-proxy-arp-search of route static destination

NAT (inside, outside) static source DOMAIN_LOCAL DOMAIN_LOCAL DOMAIN_REMOTE DOMAIN_REMOTE non-proxy-arp-search of route static destination

!

network of the DMZ_Network object

dynamic NAT interface (DMZ, outside)

network of the DOMAIN_LOCAL object

NAT dynamic interface (indoor, outdoor)

network of the EXCHANGE_Exchange object

NAT static Outside_Mail (any, any)

network of the DOMAINCTRL_DHCP object

NAT (inside, outside) interface static tcp ftp ftp service

Thank you very much in advance and I hope that I've been pretty thorough.

Let me know if you need anything that anyone else. Thank you!!

Theo,

You don't need the NAT rules outside (depending on your configuration).

Basically, you need to add the pool VPN L2L traffic and network remote to the ACL of split tunneling (if configured), also the "permit same-security-traffic intra-interface".

Please let me know.

Thank you.

Ver 7.0 remote VPN PIX

If I can do my VPN for remote users access to a DMZ Firewall even they use as NAS, I tried this, my users can get away with a problem inside network, but when they try to go to a demilitarized zone the syslog shows 'No route to DMZ_HOST_IP of REMOTE_HOST_IP'... I can ping the two IP addresses of the firewall, can anyone help?

Hello

Can you give us a little more detail on your network. IE, post your configs etc.

Therefore, terminate your VPN users on the external interface of the firewall, or they use a different VPN device.

I guess that your vpn and nat probaby access lists statements need to be changed.

Patrick

Site2Site and remote VPN

I have a site2site between PIX506 and 877 router VPN. Site A has PIX506 and Site B router a in 877. I configured site2site VPN and it worked fine. I also configured remote VPN on PIX 506 so that the remote user can access A site. But when I configure remote VPN on PIX506 site2site VPN works and both sides can ping each other. But site B users cannot access any resource network or application of the SiteA while site A can access resources of site B. After removing remote VPN site configuration B can access the resources of the Site I joined the configuration of the two sites. Someone help me please site2site and remote VPN work at the same time.

Please forgive me for not reading every line.

an add-on quick about the pix configuration:

change "isakmp key * address 213.181.169.8 netmask 255.255.255.255" at "isakmp key * address 213.181.169.8 netmask 255.255.255.255 No.-xauth No. config-mode.

ASA Version 9.0 (1) - Ping works both inside and outside, WWW does not work for remote VPN

I am at a loss, I can connect VIA VPN and Ping inside the IPs (192.168.1.2) and outside (4.2.2.2) IPs of the remote VPN client, but can't surf WWW. Inside the network, all users have WWW access and the network is fine. I'm new on the revisions to ver 8.3 and don't see what I'm missing?

Info:

ASA-A # sh xl
in use, the most used 12 4
Flags: D - DNS, e - extended, I - identity, i - dynamics, r - portmap,
s - static, T - twice, N - net-to-net
NAT inside:192.168.1.0/24 to outside:24.180.x.x/24
flags s idle 0:10:46 timeout 0:00:00
NAT outside:192.168.2.0/24 to outside:24.180.x./24
flags s idle 0:00:59 timeout 0:00:00
NAT inside:192.168.1.0/24 to any:192.168.1.0/24
sitting inactive flags 0:11:51 timeout 0:00:00
NAT any:192.168.2.0/24 to inside:192.168.2.0/24
sitting inactive flags 0:11:51 timeout 0:00:00
ASA-A #.

ASA-A # sh nat
Manual NAT policies (Section 1)
1 (inside) to destination of (all) Inside_Net Inside_Net the VPN-NET VPN static static
translate_hits = 3, untranslate_hits = 3

Auto NAT policies (Section 2)
1 (inside) (outside) static source Inside_Net 24.180.x.x
translate_hits = 3, untranslate_hits = 184
2 (outdoor) (outdoor) static source VPN-net 24.180.x.x
translate_hits 97, untranslate_hits = 91 =
ASA-A #.

Journal of the Sho:

% 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection for udp src outside:192.168.2.10/137(LOCAL\User) dst outside:192.168.2.255/137 refused due to path failure reverse that of NAT
% ASA-609002 7: duration of outside local host: 192.168.2.255 disassembly 0:00:00
% ASA-609001 7: built outside local host: 192.168.2.255

% 305013-5-ASA: rules asymmetrical NAT matched for flows forward and backward; Connection for udp src outside:192.168.2.10/137(LOCAL\User) dst outside:192.168.2.255/137 refused due to path failure reverse that of NAT
% ASA-609002 7: duration of outside local host: 192.168.2.255 disassembly 0:00:00

Current config:

ASA Version 9.0 (1)
!
ASA-A host name
domain a.local
enable the encrypted password xxxxx
XXXXX encrypted passwd
names of
IP local pool vpnpool 192.168.2.10 - 192.168.2.20
!
interface Ethernet0/0
Inet connection description
switchport access vlan 2
!
interface Ethernet0/1
LAN connection description
switchport access vlan 3
!
interface Ethernet0/2
switchport access vlan 3
!
interface Ethernet0/3
switchport access vlan 3
!
interface Ethernet0/4
switchport access vlan 3
!
interface Ethernet0/5
switchport access vlan 3
!
interface Ethernet0/6
switchport access vlan 3
!
interface Ethernet0/7
switchport access vlan 3
!
interface Vlan1
No nameif
no level of security
no ip address
!
interface Vlan2
nameif outside
security-level 0
IP address 24.180.x.x 255.255.255.248
!
interface Vlan3
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
banner exec   ********************************************
banner exec   *                                          *
exec banner * ASA-A *.
banner exec   *                                          *
exec banner * CISCO ASA5505 *.
banner exec   *                                          *
exec banner * A Services Inc.              *
exec banner * xxx in car Street N. *.
exec banner * city, ST # *.
banner exec   *                                          *
banner exec   ********************************************
exec banner ^
passive FTP mode
DNS server-group DefaultDNS
domain a.local
permit same-security-traffic intra-interface
network obj_any object
subnet 0.0.0.0 0.0.0.0
network of the Inside_Net object
subnet 192.168.1.0 255.255.255.0
network of the VPN-net object
Subnet 192.168.2.0 255.255.255.0
access-list extended sheep permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
allowed incoming access extended gre a whole list
inbound udp allowed extended access list any host 24.180.x.x eq 1723
list of allowed inbound tcp extended access any host 24.180.x.x eq pptp
list of allowed inbound tcp extended access any host 24.180.x.x eq smtp
list of allowed inbound tcp extended access any host 24.180.x.x eq www
list of allowed inbound tcp extended access any host 24.180.x.x eq https
list of allowed inbound tcp extended access any host 24.180.x.x eq 987
inbound udp allowed extended access list any host 24.180.x.x eq 25
inbound udp allowed extended access list any host 24.180.x.x eq 443
inbound udp allowed extended access list any host 24.180.x.x eq www
inbound udp allowed extended access list any host 24.180.x.x eq 987
pager lines 24
Enable logging
debug logging in buffered memory
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow all outside
ICMP allow any inside
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
public static Inside_Net Inside_Net destination NAT (inside, all) static source VPN-NET VPN
!
network of the Inside_Net object
NAT static 24.180.x.x (indoor, outdoor)
network of the VPN-net object
24.180.x.x static NAT (outdoors, outdoor)
Access-group interface incoming outside
Route outside 0.0.0.0 0.0.0.0 24.180.x.x 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
Enable http server
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
Crypto ipsec transform-set ikev1 VPN remote esp-3des esp-md5-hmac
Crypto ipsec ikev2 VPN ipsec-proposal-remotetest
Protocol esp encryption aes - 256, aes - 192, aes, 3des and
Esp integrity sha-1 protocol
Crypto ipsec pmtu aging infinite - the security association
Crypto-map dynamic dyn1 1jeu ikev1 transform-set remote VPN
Crypto-map dynamic dyn1 1jeu reverse-road
map VPN - map 1-isakmp ipsec crypto dynamic dyn1
VPN-card interface card crypto outside
Crypto ca trustpoint _SmartCallHome_ServerCA
Configure CRL
trustpool crypto ca policy
Crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
308204 4 a0030201 d 308205ec 0202106e cc7aa5a7 032009b 8 cebcf4e9 52d 49130
010105 05003081 09060355 04061302 55533117 ca310b30 0d 864886f7 0d06092a
30150603 55040 has 13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
13165665 72695369 676e2054 72757374 204e6574 776f726b 313 has 3038 06035504
0b 133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
20617574 7a 656420 75736520 6f6e6c79 31453043 06035504 03133c 56 686f7269
65726953 69676e20 436c 6173 73203320 5075626c 69632050 72696 72792043 61 d
65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
30303230 38303030 3030305a 170d 3230 30323037 32333539 35395a 30 81b5310b
30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
496e632e 311f301d 06035504 0b 131656 65726953 69676e20 54727573 74204e65
74776f72 6b313b30 5465726d 20757365 20617420 73206f66 39060355 040b 1332
68747470 7777772e 733a2f2f 76657269 7369676e 2e636f6d 2f727061 20286329
302d 0603 55040313 26566572 69536967 61737320 33205365 6e20436c 3130312f
63757265 20536572 76657220 20473330 82012230 0d06092a 864886f7 4341202d
010101 05000382 010f0030 82010 0d has 02 b187841f 82010100 c20c45f5 bcab2597
a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
9c688b2e 957b899b 13cae234 34c1f35b f3497b62 d188786c 83488174 0253f9bc
7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8 63cd
18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 01 has 38201 02030100 df308201
082b 0601 05050701 01042830 26302406 082 b 0601 db303406 05050730 01861868
7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1 d 130101
ff040830 02010030 70060355 b 200469 30673065 060, 6086 480186f8 1 d 060101ff
45010717 03305630 2806082b 06010505 07020116 1 c 687474 70733a2f 2f777777
2e766572 69736967 6e2e636f 6d2f6370 73302 has 06 082 b 0601 05050702 02301e1a
1 c 687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
03551d1f 042d302b 3029 has 027 a0258623 68747470 3a2f2f63 726c2e76 65726973
69676e2e 636f6d2f 2d67352e 70636133 63726c 30 0e060355 1d0f0101 ff040403
02010630 6d06082b 06010505 07010c 59305730 55160969 5da05b30 04 61305fa1
6 d 616765 2f676966 3021301f 2b0e0302 30070605 1a04148f e5d31a86 ac8d8e6b
c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
1 b 311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301D 0603
445 1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355 c 1604140d 551d0e04
1 230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300 d 0609 d
2a 864886 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80 f70d0101
4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
b2227055 d9203340 3307c 265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
99 c 71928 8705 404167d 1 273aeddc 866d 24f78526 a2bed877 7d494aca 6decd018
481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
6c2527b9 deb78458 c61f381e a4c4cb66
quit smoking
Crypto ikev1 allow outside
IKEv1 crypto policy 1
preshared authentication
3des encryption
sha hash
Group 2
life 43200
Telnet timeout 5
SSH timeout 5
Console timeout 0

dhcpd outside auto_config
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
user name UName encrypted password privilege 15 xxxxxxxxx
type tunnel-group remote VPN remote access
attributes global-tunnel-group VPN-remote controls
address vpnpool pool
tunnel-group, ipsec VPN-remote controls-attributes
IKEv1 pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp
!
global service-policy global_policy
context of prompt hostname
anonymous reporting remote call
Cryptochecksum:43db9ab2d3427289fb9a0fdb22b551fa
: end

Hello

Its propably because you do not have a DNS server configured for VPN users. Try this command:
```
 group-policy DfltGrpPolicy attributes dns-server value 8.8.8.8
```

Tunnel VPN remote Internet and VPN remote VPN from Site to Site traffic?

Hello

We try to remote traffic from our users VPN tunnel through our ASA 5510 as well as to allow the only access for remote user VPN traffic to the other end of the all our VPN site-to-site connected to the same ASA. Basically, we who want to VPN in the network in order to access all of our networks business. We try to get away with this without using split Tunneling.

I can currently get internal traffic from the remote user VPN to reach all other vpn site-to-site tunnels without the internet in tunnel. The problem is when I add the following statement to the NAT:

NAT (outside) 1 10.10.19.0 255.255.255.0 * 10.10.19.0 is the address of the remote VPN Client

Internet traffic to the remote VPN starts to get in the tunnel, but I lose the opportunity to reach one of the other tunnels from site to site by the remote VPN tunnel.

I also begin to receive the following errors in the journal of the ASA

3 July 1, 2009 12:34:18 305005 10.10.19.255 137 no group of translation not found for udp src outside:10.10.19.3/137 dst outside:10.10.19.255/137

Any help with how NAT statements must be defined for this work would be appreciated.

Thank you

Will be

Will,

the link of this post for your scenario of vpn hub & speak reference, you problem may be on exempt nat rules.

Have a second look at your sheep rules.

Be sure to eliminate tunnel rules related to rheumatoid arthritis, as appropriate, to not let him get in the way of splitting.

http://forums.Cisco.com/eForum/servlet/NetProf?page=NetProf&Forum=security&topic=firewalling&TopicId=.ee6e1fa&fromOutline=true&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc2e0f6/4

If always emits discribe topology for l2ls and info logic RA and sanatized hub config asa... but I think if you look at the thread above, you should be able to solve.

Concerning

Remote VPN users

Similar Questions

Maybe you are looking for