Routing of a VPN from Site to site to remote VPN users
Hello
We have a site and remote vpn site configured in the same interface in ASA 5520 (software version 8.3). When the remote vpn users try to connect to the computers located at the far end of the site to site VPN, their request has failed. I tried No.-Nat between remote vpn IP private to the private IP address of remote site, also said the same split tunneling. I can't find even the tracert, ping has also expired.
Is there any solution to make this live thing.
Shankar.
There are a few things that need to be added to make it work:
(1) on the SAA where remote vpn users connect to, you must add "permit same-security-traffic intra-interface"
(2) you mention that you have added the LAN of remote site-to-site in the list of split tunnel, so that's good.
(3) on the SAA ending the vpn for remote access, you must also add the following text:
-Crypto ACL for the site to site VPN must include the following:
permit ip access list
(4) on the ASA site to remote site, you must add:
-Crypto ACL for the site to site VPN must include the following:
permit ip access list
-No - Nat: ip access list allow
Tags: Cisco Security
Similar Questions
-
It is possible to configure router CISCO1921/K9 from site to Site vpn behind a firewall?
I am looking to buy CISCO1921/K9 to configure vpn site to site with Amazon VPN. We are behind a firewall. I try to install the new CISCO1921/K9 router according to the scheme of quick text below. My setup work? and what are the ports will it transfer to my firewall?
INTERNET--> Modem to ISP---> firewall - CISCO1921/K9
Hi Paul,.
(192.168.1.0/24) - router (10.1.1.1)-(10.1.1.2) firewall(81.92.61.x/27)---Internet
The configuration is very simple...
1. There will be no modifications on the configuration of the VPN router with the exception that the interface of the router (turning to the firewall) will be to have private IP 10.1.1.1
2. you will need to take a public IP of your range of public (e.g. 81.92.61.2) and will share the same to your remote location which they set up as peers IP to their end.
3. now you have to configure 2 NAT type on your firewall.
NAT source:-when your router will initiate VPN
Before NAT: Destination - Source 10.1.1.1-(homologous remote IP)
After NAT: Destination - Source 81.92.61.2-(homologous remote IP)
Destination NAT:-when the remote location will launch the VPN
before NAT: Destination - Source (remote peer IP)-(81.92.61.2)
After NAT: Destination - Source (remote peer IP)-(10.1.1.1)
I hope this is clear :)
-
VPN from Site to Site and easy 871W
I have a problem with the configuration of Site to site and easy both together on the same router 871W
Something is working, but not everything.
x.x.x.x - address IP WAN
a.a.a.a - gw for WAN IP address
z.z.z.z - IP address of the VPN Site-to Site
192.168.201.0/25 - LAN
192.168.200.0/24 - easy VPN address
192.168.151.0/24 - Site-Site LANSite-to-site work properly, everythings fine, but no easy VPN.
Configuration of Cisco VPN Client:
Home - x.x.x.x, group auth name - RemoteGroup, pass *.
user test, pass *.I have a successful connection of Cisco VPN Client (I see a closed lock - connected status)
Connection gave me the address 192.168.200.5.
But I can't see LAN or LAN from Site to Site.
And I don't have any idea what may be wrong.
Finalny config:
Quote: Current configuration: 8860 bytes
!
version 12.4
no service button
horodateurs service debug datetime msec
Log service timestamps datetime msec
encryption password service
sequence numbers service
!
hostname moj-waw-rtr
!
boot-start-marker
boot-end-marker
!
logging buffered debugging 52000
Select the secret *.
!
AAA new-model
!
!
AAA authentication login default local
AAA authentication login local remoteusers
AAA authorization exec default local
AAA authorization RemoteGroup LAN
!
AAA - the id of the joint session
!
resources policy
!
IP subnet zero
IP cef
!
!
no ip domain search
IP domain name waw.moj.pl
name of the IP-server 194.204.152.34
name of the IP-server 193.178.240.2
!
!
Crypto pki trustpoint TP - self - signed-*.
enrollment selfsigned
the object cn = IOS-Self-Signed - Certificate name-
revocation checking no
rsakeypair TP - self - signed-*.
!
!
crypto TP - self - signed pki certificate chain-*.
certificate self-signed 01
quit smoking
privilege secret 15 user username
username secret privilege test 4 *.
!
!
!
crypto ISAKMP policy 1
BA 3des
preshared authentication
Group 2
ISAKMP crypto key * address y.y.y.y
the local address TOVPNPOOL pool-crypto isakmp client configuration
!
ISAKMP crypto client configuration group RemoteGroup
key *.
pool TOVPNPOOL
ISAKMP crypto vpnclient profile
RemoteGroup group identity match
function identity address 192.168.201.111 255.255.255.255
client authentication list remoteusers
ISAKMP authorization list RemoteGroup
client configuration address respond
!
!
Crypto ipsec transform-set esp-3des esp-sha-hmac vpntowaw
Crypto ipsec transform-set esp-3des esp-md5-hmac vpnwaw
!
Crypto dynamic-map DYNAMICS 10
Set transform-set vpnwaw
vpnclient Set isakmp-profile
market arriere-route
!
!
vpn_wro_waw 1 ipsec-isakmp crypto map
defined peer y.y.y.y
Set transform-set vpntowaw
PFS Group1 Set
match address 104
vpn_wro_waw card crypto 65535-isakmp ipsec dynamic DYNAMICS
!
Bridge IRB
!
!
interface FastEthernet0
spanning tree portfast
!
interface FastEthernet1
spanning tree portfast
!
interface FastEthernet2
spanning tree portfast
!
interface FastEthernet3
spanning tree portfast
!
interface FastEthernet4
Description $ETH - LAN$
IP x.x.x.x 255.255.255.0
IP access-group 102 to
Check IP unicast reverse path
no ip redirection
no ip unreachable
no ip proxy-arp
NAT outside IP
IP virtual-reassembly
route IP cache flow
automatic duplex
automatic speed
vpn_wro_waw card crypto
!
interface Dot11Radio0
no ip address
no ip redirection
no ip unreachable
no ip proxy-arp
route IP cache flow
!
algorithms for encryption tkip encryption mode
!
encryption vlan 1 tkip encryption mode
!
SSID TO - WAW
VLAN 1
open authentication
authentication wpa key management
Comments-mode
WPA - psk ascii *.
!
base speed - 1.0 2.0 basic basic-5, 5 6.0 9.0 basic-11, 0 12.0 18.0 24.0 36.0 48.0 54.0
root of station-role
No dot11 extensions aironet
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no link-status of snmp trap
No cdp enable
Bridge-Group 1
Bridge-group subscriber-loop-control 1
Bridge-Group 1 covering-disabled people
Bridge-Group 1 block-unknown-source
No source of bridge-Group 1-learning
unicast bridge-Group 1-floods
!
interface Vlan1
Description $ETH - SW - LAUNCH, INTF-INFO-HWIC $$ $4ESW
no ip address
no ip redirection
no ip unreachable
no ip proxy-arp
IP virtual-reassembly
route IP cache flow
IP tcp adjust-mss 1452
Bridge-Group 1
!
interface BVI1
IP 192.168.201.1 255.255.255.128
IP access-group 101 in
IP nat inside
IP virtual-reassembly
!
local IP TOVPNPOOL 192.168.200.2 pool 192.168.200.101
IP classless
IP route 0.0.0.0 0.0.0.0 a.a.a.a
!
IP http server
1 class IP http access
local IP http authentication
IP http secure server
IP http timeout policy slowed down 60 life 86400 request 10000
IP nat inside source static tcp 192.168.201.3 80 80 FastEthernet4 interface
IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
!
Remark SDM_ACL category of access list 1 = 1
access-list 1 permit 192.168.201.0 0.0.0.127
access-list 1 permit 192.168.151.0 0.0.0.255
access-list 1 deny all
Access-list 100 category SDM_ACL = 2 Note
Note access-list 100 IPSec rule
access-list 100 deny ip 192.168.201.0 0.0.0.127 192.168.3.0 0.0.0.255
access-list 100 deny ip 192.168.201.0 0.0.0.127 192.168.2.0 0.0.0.255
access-list 100 deny ip 192.168.201.0 0.0.0.127 192.168.151.0 0.0.0.255
access-list 100 deny ip 192.168.201.0 0.0.0.127 192.168.200.0 0.0.0.255
access-list 100 permit ip 192.168.201.0 0.0.0.127 all
access list 101 remark self-generated by the configuration of the firewall SDM
Note access-list 101 = 1 SDM_ACL category
access-list 101 deny ip x.x.x.x 0.0.0.255 everything
access-list 101 deny ip 255.255.255.255 host everything
access-list 101 deny ip 127.0.0.0 0.255.255.255 everything
access list 101 ip allow a whole
Allow Access - list 101 tcp a whole
access list 101 allow udp a whole
access-list 101 permit icmp any one
access-list 102 permit icmp any host x.x.x.x
access-list 102 permit udp host 194.204.152.34 eq field host x.x.x.x
access-list 102 permit udp host 193.178.240.2 eq field host x.x.x.x
access-list 102 permit udp host host eq non500-isakmp x.x.x.x y.y.y.y
access-list 102 permit udp host host eq isakmp x.x.x.x y.y.y.y
access-list 102 permit esp host host x.x.x.x y.y.y.y
access-list 102 permit ahp host host x.x.x.x y.y.y.y
access-list 102 permit ip 192.168.151.0 0.0.0.255 192.168.201.0 0.0.0.127
access-list 102 permit ip 192.168.200.0 0.0.0.255 192.168.201.0 0.0.0.127
access-list 102 permit ip 192.168.2.0 0.0.0.255 192.168.201.0 0.0.0.127
access-list 102 permit ip 192.168.3.0 0.0.0.255 192.168.201.0 0.0.0.127
access-list 102 permit ip 192.168.201.0 0.0.0.127 all
access-list 102 deny ip 10.0.0.0 0.255.255.255 everything
access-list 102 deny ip 172.16.0.0 0.15.255.255 all
access-list 102 deny ip 192.168.0.0 0.0.255.255 everything
access-list 102 deny ip 127.0.0.0 0.255.255.255 everything
access-list 102 deny ip 192.168.201.0 0.0.0.127 all
access-list 102 refuse host ip 255.255.255.255 everything
access-list 102 refuse host ip 0.0.0.0 everything
access ip-list 102 permit a whole
access-list 103 allow ip 192.168.200.0 0.0.0.255 any
access-list 103 allow ip 192.168.151.0 0.0.0.255 any
access-list 103 allow ip 192.168.201.0 0.0.0.127 all
access-list 103 permit ip 192.168.2.0 0.0.0.255 any
access-list 103 allow ip 192.168.3.0 0.0.0.255 any
access-list 103 allow y.y.y.y ip 0.0.0.7 one
access-list 103 deny ip any one
Remark SDM_ACL category from the list of access-104 = 4
Note access-list 104 IPSec rule
access-list 104. allow ip 192.168.201.0 0.0.0.127 192.168.151.0 0.0.0.255
access-list 104 allow 192.168.201.0 ip 0.0.0.127 192.168.2.0 0.0.0.255
access-list 104 allow 192.168.201.0 ip 0.0.0.127 192.168.3.0 0.0.0.255
access-list 104 allow 192.168.201.0 ip 0.0.0.127 192.168.200.0 0.0.0.255
not run cdp
allowed SDM_RMAP_1 1 route map
corresponds to the IP 100
!
!
control plan
!
Bridge Protocol ieee 1
1 channel ip bridge
!
Line con 0
no activation of the modem
line to 0
line vty 0 4
access-series 103 in
privilege level 15
entry ssh transport
!
max-task-time 5000 Planner
endBartosz,
If you want to ping on the other side of the IPsec-L2L tunnel system you must change your 104 ACL.
to read
IP RA_VPN_POOL subnet REMOTE_SUBNET_MASK to allow REMOTE_SUBNET.
access-list 104 allow 192.168.201.0 ip 0.0.0.127 192.168.200.0 0.0.0.255<---- this="" means="" ..="" put="" into="" the="" static="" l2l ="" tunnel="" traffic="" from="" my="" local="" subnet="" going="" to="" my="" remote="" access="" vpn="" ...="" seems="">---->
Marcin
-
Limit remote traffic in a VPN from Site to Site
I have a setup VPN from Site to Site in a lab using two ASA5505s environment. VPN site to Site is functional however, what I wanted to do is to deny all traffic between the Remote LAN and not allow a single host to access the local network. Is it convenient or can it be done? If so, what Miss me the following ACL do not seem to effect?
Remote LAN: 172.16.1.0/24
LAN: 192.168.1.0/24outside_access_in list extended access permitted tcp 172.16.1.100 host 192.168.1.100 lytic 5000 10000
outside_access_in list extended access deny ip 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0
Access-group outside_access_in in interface outsideAppreciate any help that anyone can give.
Hi tsabsuavyaj,
By default, the sysopt connection VPN-enabled command is enabled which will bypass your list of access-interface referenced for all VPN traffic.
To resolve this problem, you can:
- Run the command No sysopt connection VPN-enabled. Caution with this, because it has global effect, which means it will interrogate ACL interface for all incoming VPN traffic.
- Change your proxy-ACL (aka ACL interesting traffic) so that your remote control network is simply the address of the host that you would like to have access to your network. In so doing, nothing else is routed through your tunnel L2L at the remote end. This ACL must be mirrored on the other side (remote), so that the proxy-ACL must change so that its share of the 'Local network' is only the appropriate host and nothing else.
Please let me know if you have further questions/clarification.
Kind regards
Kevin
* Do not forget to note the useful messages but also to mark it as 'responded' once your problem is solved. This will help others find your solution more quickly.
-
ASA ASA from Site to Site VPN IPSec Tunnel
Any help would be greatly appreciated...
I have two devices Cisco ASA with a Site for the configuration of the tunnel VPN IPSec Site as follows: -.
Site #1 - Cisco ASA running version 8.2 (1) with an internal range of 10.0.0.x/24
Site #2 - Cisco ASA running version 8.2 (1) with an internal range of 10.1.1.x/24
Site #1 is simple and has a dynamic NAT rule which translates all of the inside and the outside (public IP) of the SAA.
Internet access works very well in all workstations of this site. A static route is configured to redirect all traffic to a public router upstream.
Site #2 is slightly more complicated; the Cisco ASA is configured with 10.1.1.254/24 as its interior IP address and 10.1.2.254/24 as its external IP address. A dynamic NAT rule is configured to translate everything inside as the 10.1.2.254 (outside) address of the ASA. A default static route is then configured to redirect all traffic to a Draytek device on 10.1.2.253. This device then performs its own private Public NAT. Again the Internet works fine all hosts inside the Cisco ASA (10.1.1.x)
The IPSec tunnel is created with the networks local and remote endpoint as above (10.0.0.x/24) and (10.1.1.x/24). The Draytek at the Site #2 device is configured with a form of DMZ that allows essentially ALL traffic toward the front directly on the external interface of the ASA (10.1.2.254). The Phase 1 and Phase 2 negotiation of the tunnel ends correctly, and the tunnel is formed without any problem. However, all traffic passing on networks ICMP does not end and the Syslog reports the following-
Site #1-
6 January 19, 2011 15:27:21 302020 ZEFF-SB-01_LAN 1 10.1.1.51 0 Built of outbound ICMP connection for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1 6 January 19, 2011 15:27:23 302021 10.1.1.51 0 ZEFF-SB-01_LAN 1 Connection of ICMP disassembly for faddr 10.1.1.51/0 gaddr ZEFF-SB-01_LAN/1 laddr ZEFF-SB-01_LAN/1 Site #2-
6 January 19, 2011 15:24:47 302020 10.1.1.51 0 10.0.0.30 1 Built of outbound ICMP connection for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1 6 January 19, 2011 15:24:49 302021 10.0.0.30 1 10.1.1.51 0 Connection of disassembly for faddr gaddr laddr 10.1.1.51/0 10.1.1.51/0 10.0.0.30/1 ICMP It's the same for any form of traffic passing over the tunnel. The ACL is configured to allow segments of LAN out to any destination. At this point, I left scratching my head, as my original theory was to blame the Draytek, but after reading the documentation given to the DMZ host configuration, it appears this parameter is configured all traffic is simply forwarded to the IP address (in this case, the Cisco ASA interface outside).
Anyone can shed light on a possible cause of this problem?
Thank you
Nick
did you bypass the vpn traffic between 10.0.0 and 10.1.1 to be NAT - ed on the two ASA?
Please provide the following information
-set up the tunnel
-show the isa cry his
-show the ipsec cry his
-ping of the site 1 site 2 via tunnel
-capture "crypto ipsec to show his" once again
-ping from site 2 to 1 by the tunnel of the site
-capture "crypto ipsec to show his" once again
-two ASA configuration.
-
SA520W VPN from Site to Site with several VLANs
Hello
I have a customer here with several VLANS in their places who wants to set up a VPN from Site to site between 2 devices SA520W. Unfortunately I can not find a way to set it up. In the VPN policy, I can choose between everything (which is not what I want, I want only traffict between subnets the routed via VPN), IP address unique, a beach (in a subnet) and a subnet itself - but only one. I don't find a way to configure several subnets in the selection of local traffic and remotely. Adding another IKE policy between the 2 sites does not either (which is good normally).
Any ideas? Anything I'm doing wrong?
Thank you for your help.
Best regards
Thomas
I know that if you have an ASA or a router, you can define as VLANS to pass through the tunnel.
Do not have access to a SA520W to test...
A recommendation might be to post the question on the SMB community where they answered questions related to this product, just to check what other people did.
Federico.
-
VPN clients hairpining through a tunnel from site to site
I have a 8.2 (5) ASA 5510 in Site1 and a 8.2 (1) ASA 5505 Site2 they are configured with a tunnel from site to site.
Each site has VPN clients that connect and I would like to allow customers to access on both sides across the site-to-site tunnel servers.
I enabled same-security-traffic permit intra-interface I also added the remote networks to access list who made the split tunneling.
I think I'm doing something wrong with nat, but I don't know, any help would be greatly appreciated.
Site1 Clients1 (172.17.2.0/24) (10.0.254.0/24)
ASA Version 8.2 (5)
!
hostname site1
names of
DNS-guard
!
interface Ethernet0/0
nameif outside
security-level 0
IP address site1 255.255.255.240
!
interface Ethernet0/1
nameif inside
security-level 100
IP 172.17.2.1 255.255.255.0
!
interface Ethernet0/2
Shutdown
nameif DMZ
security-level 0
IP 10.10.10.1 255.255.255.0
!
interface Ethernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
nameif management
security-level 0
IP 192.168.1.1 255.255.255.0
management only
!
passive FTP mode
permit same-security-traffic intra-interface
VPN - UK wide ip 172.17.2.0 access list allow 255.255.255.0 172.18.2.0 255.255.255.0
access extensive list ip 172.17.2.0 inside_nat0_outbound allow 255.255.255.0 192.168.123.0 255.255.255.0
access extensive list ip 172.17.2.0 inside_nat0_outbound allow 255.255.255.0 172.18.2.0 255.255.255.0
access extensive list ip 172.17.2.0 inside_nat0_outbound allow 255.255.255.0 10.0.254.0 255.255.255.0
Notice of inside_nat0_outbound access-list us Client Server UK
access extensive list ip 10.0.254.0 inside_nat0_outbound allow 255.255.255.0 172.18.2.0 255.255.255.0
access extensive list ip 192.168.123.0 inside_nat0_outbound allow 255.255.255.0 10.0.254.0 255.255.255.0
access extensive list ip 172.18.2.0 inside_nat0_outbound allow 255.255.255.0 10.0.254.0 255.255.255.0
Standard access list Split_Tunnel_List allow 172.17.2.0 255.255.255.0
Standard access list Split_Tunnel_List allow 172.18.2.0 255.255.255.0
Split_Tunnel_List list standard access allowed 192.168.123.0 255.255.255.0
Split_Tunnel_List of access note list UK VPN Client pool
Standard access list Split_Tunnel_List allow 172.255.2.0 255.255.255.0
outside-2 extended access list permit tcp any any eq smtp
outside-2 extended access list permit tcp any any eq 82
outside-2 extended access list permit tcp any any eq 81
outside-2 extended access list permit tcp everything any https eq
outside-2 extended access list permit tcp any any eq imap4
outside-2 extended access list permit tcp any any eq ldaps
outside-2 extended access list permit tcp any any eq pop3
outside-2 extended access list permit tcp any any eq www
outside-2 extended access list permit tcp any any eq 5963
outside-2 extended access list permit tcp any any eq ftp
outside-2 allowed extended access list tcp any any eq ftp - data
outside-2 extended access list permit tcp any any eq 3389
list of access outside-2 extended tcp refuse any any newspaper
2-outside access list extended deny ip any any newspaper
outside-2 extended access list deny udp any any newspaper
allow VPN CLIENTS to access extended list ip 172.17.2.0 255.255.255.0 10.0.254.0 255.255.255.0
allow VPN CLIENTS to access extended list ip 172.18.2.0 255.255.255.0 10.0.254.0 255.255.255.0
allow VPN CLIENTS to access extended list 192.168.123.0 ip 255.255.255.0 10.0.254.0 255.255.255.0
Standard access list VPNClient_splittunnel allow 172.17.2.0 255.255.255.0
Standard access list VPNClient_splittunnel allow 172.18.2.0 255.255.255.0
VPNClient_splittunnel list standard access allowed 192.168.123.0 255.255.255.0
VPNClient_splittunnel of access note list UK VPN Client pool
Standard access list VPNClient_splittunnel allow 172.255.2.0 255.255.255.0
VPN-Northwoods extended ip 172.17.2.0 access list allow 255.255.255.0 192.168.123.0 255.255.255.0
Note to outside_nat0_outbound to access list AD 01/05/13
access extensive list ip 10.0.254.0 outside_nat0_outbound allow 255.255.255.0 172.18.2.0 255.255.255.0
pager lines 24
Enable logging
debug logging in buffered memory
asdm of logging of information
Outside 1500 MTU
Within 1500 MTU
MTU 1500 DMZ
management of MTU 1500
mask 10.0.254.25 - 10.0.254.45 255.255.255.0 IP local pool VPNUserPool
ICMP unreachable rate-limit 1 burst-size 1
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (outside) 0-list of access outside_nat0_outbound
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 172.17.2.0 255.255.255.0
public static tcp (indoor, outdoor) interface smtp 172.17.2.200 smtp netmask 255.255.255.255
public static tcp (indoor, outdoor) interface 82 172.17.2.253 82 netmask 255.255.255.255
public static tcp (indoor, outdoor) interface 81 192.168.123.253 81 netmask 255.255.255.255
public static tcp (indoor, outdoor) interface https 172.17.2.10 https netmask 255.255.255.255
public static tcp (indoor, outdoor) interface 172.17.2.10 imap4 imap4 netmask 255.255.255.255
public static tcp (indoor, outdoor) interface ldaps 172.17.2.10 ldaps netmask 255.255.255.255
public static tcp (indoor, outdoor) interface 172.17.2.10 pop3 pop3 netmask 255.255.255.255
public static tcp (indoor, outdoor) interface www 172.17.2.19 www netmask 255.255.255.255
public static tcp (indoor, outdoor) interface 5963 172.17.2.108 5963 netmask 255.255.255.255
public static tcp (indoor, outdoor) interface ftp 172.17.2.7 ftp netmask 255.255.255.255
public static tcp (indoor, outdoor) interface ftp - data 172.17.2.7 ftp - data netmask 255.255.255.255
static (inside, outside) tcp 3389 172.17.2.29 interface 3389 netmask 255.255.255.255
Access-group 2-outside-inside in external interface
Route outside 0.0.0.0 0.0.0.0 74.213.51.129 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
RADIUS protocol AAA-server DCSI_Auth
AAA-server host 172.17.2.29 DCSI_Auth (inside)
key *.
AAA-server protocol nt AD
AAA-server AD (inside) host 172.16.1.211
AAA-server AD (inside) host 172.17.2.29
the ssh LOCAL console AAA authentication
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp - esp-sha-hmac trans_set
Crypto ipsec transform-set VPN-Client-esp-3des esp-sha-hmac
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto dynamic-map DYN_MAP 20 the value reverse-road
Crypto-map dynamic outside_dyn_map 20 game of transformation-VPN-Client
address for correspondence outside_map 20 card crypto VPN - UK
card crypto outside_map 20 peers set site2
card crypto outside_map 20 transform-set trans_set
address for correspondence outside_map 30 card crypto VPN-Northwoods
card crypto outside_map 30 peers set othersite
trans_set outside_map 30 transform-set card crypto
map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
outside_map interface card crypto outside
Crypto ca trustpoint _SmartCallHome_ServerCA
Configure CRL
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
the Encryption
sha hash
Group 2
lifetime 28800
crypto ISAKMP policy 20
preshared authentication
the Encryption
md5 hash
Group 2
lifetime 28800
Telnet timeout 5
SSH timeout 60
Console timeout 0
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
WebVPN
internal Clients_vpn group strategy
attributes of strategy of group Clients_vpn
value of server DNS 10.0.1.30
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list VPNClient_splittunnel
domain.local value by default-field
the authentication of the user activation
tunnel-group VPNclient type remote access
tunnel-group VPNclient-global attributes
address pool VPNUserPool
authentication-server-group DCSI_Auth
strategy - by default-group Clients_vpn
tunnel-group VPNclient ipsec-attributes
pre-shared key *.
tunnel-group othersite type ipsec-l2l
othersite group tunnel ipsec-attributes
pre-shared key *.
tunnel-group site2 type ipsec-l2l
tunnel-group ipsec-attributes site2
pre-shared key *.
!
class-map inspection_default
match default-inspection-traffic
class-map imblock
match any
class-map p2p
game port tcp eq www
class-map P2P
game port tcp eq www
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
type of policy-map inspect im bine
parameters
msn - im yahoo im Protocol game
drop connection
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the pptp
type of policy-card inspect http P2P_HTTP
parameters
matches the query uri regex _default_gator
Journal of the drop connection
football match request uri regex _default_x-kazaa-network
Journal of the drop connection
Policy-map IM_P2P
class imblock
inspect the im bine
class P2P
inspect the http P2P_HTTP
!
global service-policy global_policy
IM_P2P service-policy inside interface
context of prompt hostname
no remote anonymous reporting call
Cryptochecksum:7717a11f5f2dce11af0f35cee7b4c893
: end
Site2 Clients1 (172.18.2.0/24) (172.255.2.0/24)
ASA Version 8.2 (1)
!
names of
name 172.18.2.2 UKserver
!
interface Vlan1
nameif inside
security-level 100
IP 172.18.2.1 255.255.255.0
!
interface Vlan2
nameif GuestWiFi
security-level 0
IP 192.168.2.1 255.255.255.0
!
interface Vlan3
nameif outside
security-level 0
IP address site2 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 3
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport trunk allowed vlan 1-2
switchport vlan trunk native 2
switchport mode trunk
Speed 100
full duplex
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
permit same-security-traffic intra-interface
Access extensive list ip 172.18.2.0 USER_VPN allow 255.255.255.0 172.255.2.0 255.255.255.0
Access extensive list ip 172.17.2.0 USER_VPN allow 255.255.255.0 172.255.2.0 255.255.255.0
Standard access list VPNClient_splittunnel allow 172.18.2.0 255.255.255.0
Standard access list VPNClient_splittunnel allow 172.17.2.0 255.255.255.0
Standard access list VPNClient_splittunnel allow 172.255.2.0 255.255.255.0
Outside_2_Inside list extended access permit tcp any host otherhost eq smtp
Outside_2_Inside list extended access permit tcp any host otherhost eq pop3
Outside_2_Inside list extended access permit tcp any host otherhost eq imap4
Outside_2_Inside list extended access permit tcp any host otherhost eq www
Outside_2_Inside list extended access permit tcp any host otherhost eq https
Outside_2_Inside list extended access permit tcp any host otherhost eq ldap
Outside_2_Inside list extended access permit tcp any host otherhost eq ldaps
Outside_2_Inside list extended access permit tcp any host otherhost eq nntp
Outside_2_Inside list extended access permit tcp any host otherhost eq 135
Outside_2_Inside list extended access permit tcp any host otherhost eq 102
Outside_2_Inside list extended access permit tcp any host otherhost eq 390
Outside_2_Inside list extended access permit tcp any host otherhost eq 3268
Outside_2_Inside list extended access permit tcp any host otherhost eq 3269
Outside_2_Inside list extended access permit tcp any host otherhost eq 993
Outside_2_Inside list extended access permit tcp any host otherhost eq 995
Outside_2_Inside list extended access permit tcp any host otherhost eq 563
Outside_2_Inside list extended access permit tcp any host otherhost eq 465
Outside_2_Inside list extended access permit tcp any host otherhost eq 691
Outside_2_Inside list extended access permit tcp any host otherhost eq 6667
Outside_2_Inside list extended access permit tcp any host otherhost eq 994
Outside_2_Inside access list extended icmp permitted an echo
Outside_2_Inside list extended access permit icmp any any echo response
Outside_2_Inside list extended access permit tcp any host site2 eq smtp
Outside_2_Inside list extended access permit tcp any host site2 eq pop3
Outside_2_Inside list extended access permit tcp any host site2 eq imap4
Outside_2_Inside list extended access permit tcp any host site2 eq www
Outside_2_Inside list extended access permit tcp any host site2 eq https
Outside_2_Inside list extended access permit tcp any host site2 eq ldap
Outside_2_Inside list extended access permit tcp any host site2 eq ldaps
Outside_2_Inside list extended access permit tcp any host site2 eq nntp
Outside_2_Inside list extended access permit tcp any host site2 eq 135
Outside_2_Inside list extended access permit tcp any host site2 eq 102
Outside_2_Inside list extended access permit tcp any host site2 eq 390
Outside_2_Inside list extended access permit tcp any host site2 eq 3268
Outside_2_Inside list extended access permit tcp any host site2 eq 3269
Outside_2_Inside list extended access permit tcp any host site2 eq 993
Outside_2_Inside list extended access permit tcp any host site2 eq 995
Outside_2_Inside list extended access permit tcp any host site2 eq 563
Outside_2_Inside list extended access permit tcp any host site2 eq 465
Outside_2_Inside list extended access permit tcp any host site2 eq 691
Outside_2_Inside list extended access permit tcp any host site2 eq 6667
Outside_2_Inside list extended access permit tcp any host site2 eq 994
Outside_2_Inside list extended access permit tcp any SIP EQ host site2
Outside_2_Inside list extended access permit tcp any range of 8000-8005 host site2
Outside_2_Inside list extended access permit udp any range of 8000-8005 host site2
Outside_2_Inside list extended access udp allowed any SIP EQ host site2
Outside_2_Inside tcp extended access list deny any any newspaper
Outside_2_Inside list extended access deny udp any any newspaper
VPN - USA 172.255.2.0 ip extended access list allow 255.255.255.0 172.17.2.0 255.255.255.0
access extensive list ip 172.18.2.0 inside_nat0_outbound allow 255.255.255.0 172.17.2.0 255.255.255.0
access extensive list ip 172.18.2.0 inside_nat0_outbound allow 255.255.255.0 172.255.2.0 255.255.255.0
access extensive list ip 172.255.2.0 inside_nat0_outbound allow 255.255.255.0 172.17.2.0 255.255.255.0
Comment by Split_Tunnel_List-list of access networks to allow via VPN
Standard access list Split_Tunnel_List allow 172.18.2.0 255.255.255.0
Standard access list Split_Tunnel_List allow 172.17.2.0 255.255.255.0
Standard access list Split_Tunnel_List allow 172.255.2.0 255.255.255.0
Standard access list Split_Tunnel_List allow 10.0.254.0 255.255.255.0
pager lines 20
Enable logging
monitor debug logging
debug logging in buffered memory
asdm of logging of information
Debugging trace record
Within 1500 MTU
MTU 1500 GuestWiFi
Outside 1500 MTU
IP pool local ClientVPN 172.255.2.100 - 172.255.2.124
no failover
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 621.bin
don't allow no asdm history
ARP timeout 14400
NAT-control
Global 1 interface (outside)
NAT (inside) 0-list of access inside_nat0_outbound
NAT (inside) 1 172.18.2.0 255.255.255.0
NAT (GuestWiFi) 2 192.168.2.0 255.255.255.0
public static tcp (indoor, outdoor) interface smtp smtp UKserver netmask 255.255.255.255
public static tcp (indoor, outdoor) UKserver netmask 255.255.255.255 pop3 pop3 interface
public static tcp (indoor, outdoor) interface imap4 imap4 netmask 255.255.255.255 UKserver
public static tcp (indoor, outdoor) interface www UKserver www netmask 255.255.255.255
public static tcp (indoor, outdoor) https UKserver netmask 255.255.255.255 https interface
public static tcp (indoor, outdoor) interface ldap UKserver ldap netmask 255.255.255.255
public static tcp (indoor, outdoor) interface ldaps ldaps netmask 255.255.255.255 UKserver
public static tcp (indoor, outdoor) interface nntp nntp netmask 255.255.255.255 UKserver
public static 135 135 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 102 102 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 390 390 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 3268 3268 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 3269 3269 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static UKserver netmask 255.255.255.255 993 993 interface tcp (indoor, outdoor)
public static UKserver 995 netmask 255.255.255.255 995 interface tcp (indoor, outdoor)
public static 563 563 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 465 465 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 691 691 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 6667 UKserver 6667 netmask 255.255.255.255 interface tcp (indoor, outdoor)
public static 994 994 UKserver netmask 255.255.255.255 interface tcp (indoor, outdoor)
Access-group Outside_2_Inside in interface outside
Route outside 0.0.0.0 0.0.0.0 87.224.93.53 1
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Ray of AAA-server vpn Protocol
AAA-server vpn (inside) host UKserver
key DCSI_vpn_Key07
the ssh LOCAL console AAA authentication
Enable http server
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set esp - esp-sha-hmac trans_set
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto-map dynamic outside_dyn_map 20 transform-set trans_set
Crypto dynamic-map DYN_MAP 20 the value reverse-road
address for correspondence outside_map 20 card crypto VPN - USA
card crypto outside_map 20 peers set othersite2 site1
card crypto outside_map 20 transform-set trans_set
map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map
outside_map interface card crypto outside
crypto isakmp identity address
crypto ISAKMP allow outside
crypto ISAKMP policy 10
preshared authentication
the Encryption
sha hash
Group 2
lifetime 28800
crypto ISAKMP policy 20
preshared authentication
the Encryption
md5 hash
Group 2
lifetime 28800
Telnet timeout 5
SSH timeout 25
Console timeout 0
dhcpd dns 8.8.8.8 UKserver
!
dhcpd address 172.18.2.100 - 172.18.2.149 inside
dhcpd allow inside
!
dhcpd address 192.168.2.50 - 192.168.2.74 GuestWiFi
enable GuestWiFi dhcpd
!
no basic threat threat detection
no statistical access list - a threat detection
no statistical threat detection tcp-interception
WebVPN
internal USER_VPN group policy
USER_VPN group policy attributes
Protocol-tunnel-VPN IPSec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list Split_Tunnel_List
the authentication of the user activation
tunnel-group othersite2 type ipsec-l2l
othersite2 group of tunnel ipsec-attributes
pre-shared-key *.
type tunnel-group USER_VPN remote access
attributes global-tunnel-group USER_VPN
address pool ClientVPN
Authentication-server group (external vpn)
Group Policy - by default-USER_VPN
IPSec-attributes tunnel-group USER_VPN
pre-shared-key *.
tunnel-group site1 type ipsec-l2l
tunnel-group ipsec-attributes site1
pre-shared-key *.
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect the rsh
inspect the rtsp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the tftp
!
global service-policy global_policy
context of prompt hostname
Cryptochecksum:d000c75c8864547dfabaf3652d81be71
: end
Hello
The output seems to say that traffic is indeed transmitted to connect VPN L2L
Can you PING from hosts on the network 172.18.2.0/24 to the hosts on the network 172.17.2.0/24?
Have you tried several different target hosts on the network you are trying to ping while might exclude us actual devices are not just meeting the specifications these PINGs?
-Jouni
-
So I'm a few 5510 preconfiguration is before shipment to the site. I have my tunnel VPN from Site to Site and can ping of internal subnets between the sites. However, as soon as I configure NAT on my interface my pings die outside. I checked a guide very full config posted by TAC and I think the answer is to set up two times-NAT, which I believe I did. I don't always get no package in the tunnel.
A hint, I found, is that I get the journaled message when NAT is applied & affecting routing "ASA-6-110003: routing could not locate the next hop for ICMP from Outside:10.56.8.4/512 to Internal:172.16.60.253/0.
Output sh run object / run object-group sh / sh run nat / show the two ASA nat: -.
SITE 1
= sh run object
network obj_any object
subnet 0.0.0.0 0.0.0.0
network of the BH-Asterisk object
host x.x.x.x
BG Hill Asterisk description
network of the BH-Exchange object
host x.x.x.x
BG Hill Exchange Server description
the DH - AV object network
10.56.20.0 subnet 255.255.255.0
Description AV DH
the DH-Asterisk object network
host x.x.x.x
DH Asterisk description
the object-Diffie-Hellman exchange network
Home 10.56.1.253
Description Exchange Diffie-Hellman
the DH-guests object network
10.56.8.0 subnet 255.255.255.0
DH customers description
the object DH ME network
10.56.24.0 subnet 255.255.255.0
DH ME description
the DH-phones object network
10.56.16.0 subnet 255.255.255.0
Description phones DH
network of the DH-security object
10.56.32.0 subnet 255.255.255.0
Description safety DH
DH-internal object network
10.56.1.0 subnet 255.255.255.0
Description internal DH
network object internally-BH
10.60.1.0 subnet 255.255.255.0
Description internal BH
network of the BH-phones object
10.60.16.0 subnet 255.255.255.0
Description BH phones
network of the BH-security object
10.60.32.0 subnet 255.255.255.0
BH Security description
network of the BH - AV object
10.60.20.0 subnet 255.255.255.0
Description AV BH
network of the BH-guests object
10.60.8.0 subnet 255.255.255.0
BH invited description
network of the BH - ASA object
host 1.1.1.1
the DH - ASA object network
host 1.1.1.2
network of the BH-RAS object
10.60.99.0 subnet 255.255.255.0
the DH-RAS object network
10.56.99.0 subnet 255.255.255.0
network of the NETWORK_OBJ_10.56.99.0_26 object
255.255.255.192 subnet 10.56.99.0
network of the BH-UC560 object
Home 172.16.60.253
network of the DH-UC560 object
Home 172.16.56.253= RJ5510-DOHA # sh run object-group
the BGHill object-group network
Description of subnets in BGHill
BH-internal network-object
network-object BH-phones
network-object BH - AV
network-object BH-security
network-object BH-guests
network-object BH-RAS
BH-UC560 network-object
object-group network DH
Description of subnets in DH
network-object DH - AV
network-object DH-guests
network-object DH ME
network-object DH-phones
network-object DH-security
DH-internal network-object
network-object DH-RAS
network object-DH-UC560= RJ5510-DH # sh run nat
NAT (AV, outdoors) static source DH DH static destination BGHill BGHill
NAT (comments, outdoors) static source DH DH static destination BGHill BGHill
NAT (inside, outside) static source DH DH static destination BGHill BGHill
NAT (phones, outdoors) static source DH DH static destination BGHill BGHill
NAT (safety, outdoors) static source DH DH static destination BGHill BGHill
NAT (ME out) static source DH DH static destination BGHill BGHill
!
the DH - AV object network
dynamic NAT interface (AV, outdoors)
the object-Diffie-Hellman exchange network
x.x.x.x static NAT (indoor, outdoor)
the DH-guests object network
dynamic NAT interface (comments, outdoors)
the object DH ME network
dynamic NAT interface (ME, outdoor)
the DH-phones object network
dynamic NAT interface (phones, outdoors)
network of the DH-security object
dynamic NAT interface (safety, outdoors)
DH-internal object network
dynamic NAT interface (indoor, outdoor)= HD-RJ5510 # see nat
Manual NAT policies (Section 1)
1 (f) (outdoor) static source DH DH destination static BGHill BGHill
translate_hits = 0, untranslate_hits = 386
2 (guest) (outdoor) static source DH DH destination static BGHill BGHill
translate_hits = 180, untranslate_hits = 0
3 (inside) (outside) static source DH DH destination static BGHill BGHill
translate_hits = 0, untranslate_hits = 0
4 (phones) (outdoor) static source DH DH destination static BGHill BGHill
translate_hits = 0, untranslate_hits = 0
5 (security) (outdoor) static source DH DH destination static BGHill BGHill
translate_hits = 0, untranslate_hits = 0
6 (ME) (outdoor) static source DH DH destination static BGHill BGHill
translate_hits = 0, untranslate_hits = 0Auto NAT policies (Section 2)
1 (outdoor) source static-Exchange Diffie-Hellman x.x.x.x (internal)
translate_hits = 0, untranslate_hits = 0
2 (internal) interface of DH-internal dynamics of the source (outdoor)
translate_hits = 0, untranslate_hits = 0
3 (comments) interface (outside) dynamic source DH-guests
translate_hits = 2, untranslate_hits = 0
4 (phones) to the dynamic interface of DH-phones of the source (outside)
translate_hits = 0, untranslate_hits = 0
5 (AV) to dynamic source DH - AV interface (outside)
translate_hits = 0, untranslate_hits = 0
6 (I) dynamic source DH-ME interface (outside)
translate_hits = 0, untranslate_hits = 0
7 (security) to DH-security dynamic interface of the source (outside)
translate_hits = 0, untranslate_hits = 0SITE 2: -.
= object # executed sh
network obj_any object
subnet 0.0.0.0 0.0.0.0
network of the BH-Asterisk object
host x.x.x.x
BH Hill Asterisk description
network of the BH-Exchange object
Home 10.60.1.253
BH Hill Exchange Server description
the DH - AV object network
10.56.20.0 subnet 255.255.255.0
Description AV DH
the DH-Asterisk object network
host x.x.x.x
DH Asterisk description
the object-Diffie-Hellman exchange network
host x.x.x.x
Description Exchange Diffie-Hellman
the DH-guests object network
10.56.8.0 subnet 255.255.255.0
DH customers description
the object DH ME network
10.56.24.0 subnet 255.255.255.0
DH ME description
the DH-phones object network
10.56.16.0 subnet 255.255.255.0
Description phones DH
network of the DH-security object
10.56.32.0 subnet 255.255.255.0
Description safety DH
DH-internal object network
10.56.1.0 subnet 255.255.255.0
Description internal DH
network object internally-BH
10.60.1.0 subnet 255.255.255.0
Description internal BH
network of the BH-phones object
10.60.16.0 subnet 255.255.255.0
Description BH phones
network of the BH-security object
10.60.32.0 subnet 255.255.255.0
BH Security description
network of the BH - AV object
10.60.20.0 subnet 255.255.255.0
Description AV BH
network of the BH-guests object
10.60.8.0 subnet 255.255.255.0
BH invited description
network of the BH - ASA object
host 1.1.1.1
the DH - ASA object network
host 1.1.1.2
network of the NETWORK_OBJ_10.60.99.0_26 object
255.255.255.192 subnet 10.60.99.0
network of the BH-RAS object
10.60.99.0 subnet 255.255.255.0
the DH-RAS object network
10.56.99.0 subnet 255.255.255.0
network of the BH-UC560 object
Home 172.16.60.253
network of the DH-UC560 object
Home 172.16.56.253= # sh run object-group
the BHHill object-group network
Description of subnets in BH Hill
BH-internal network-object
network-object BH-phones
network-object BH - AV
network-object BH-security
network-object BH-guests
network-object BH-RAS
BH-UC560 network-object
object-group network DH
Description of subnets in DH
network-object DH - AV
network-object DH-guests
network-object DH ME
network-object DH-phones
network-object DH-security
DH-internal network-object
network-object DH-RAS
network object-DH-UC560= # sh run nat
NAT (inside, outside) static source BHHill BHHill static destination DH DH
NAT (AV, outdoors) static source BHHill BHHill static destination DH DH
NAT (comments, outdoors) static source BHHill BHHill static destination DH DH
NAT (phones, outdoors) static source BHHill BHHill static destination DH DH
NAT (safety, outdoors) static source BHHill BHHill static destination DH DH
!
network of the BH-Exchange object
x.x.x.x static NAT (indoor, outdoor)
network object internally-BH
dynamic NAT interface (indoor, outdoor)
network of the BH-phones object
dynamic NAT interface (phones, outdoors)
network of the BH-security object
dynamic NAT interface (safety, outdoors)
network of the BH - AV object
dynamic NAT interface (AV, outdoors)
network of the BH-guests object
dynamic NAT interface (comments, outdoors)= # sh nat
Manual NAT policies (Section 1)
1 (inside) (outside) static source BHHill BHHill static destination DH DH
translate_hits = 421, untranslate_hits = 178
2 (AV) to (outside) static source BHHill BHHill static destination DH DH
translate_hits = 0, untranslate_hits = 0
3 (guest) (outdoor) static source BHHill BHHill static destination DH DH
translate_hits = 0, untranslate_hits = 0
4 (phones) (outdoor) static source BHHill BHHill static destination DH DH
translate_hits = 0, untranslate_hits = 0
5 (security) (outdoor) static source BHHill BHHill static destination DH DH
translate_hits = 0, untranslate_hits = 0Auto NAT policies (Section 2)
1 (outdoor) static source BH-Exchange x.x.x.x (internal)
translate_hits = 0, untranslate_hits = 0
2 (internal) interface of BH-internal dynamics of the source (outdoor)
translate_hits = 0, untranslate_hits = 0
3 (comments) interface (outside) dynamic source BH-guests
translate_hits = 0, untranslate_hits = 0
4 (phones) to the dynamic interface of BH-phones of the source (outside)
translate_hits = 0, untranslate_hits = 0
5 (AV) to dynamic source BH - AV interface (outside)
translate_hits = 0, untranslate_hits = 0
6 (security) at the interface of BH-security dynamic of the source (outdoor)
translate_hits = 0, untranslate_hits = 0
RJ5510-BH #.I admit that I am scoobied with this one, but I hope that someone will find the capture?
Thank you
In fact, the problem is with the NAT because because you use the same object on different States of NAT attached to different interfaces.
The SAA can go crazy with it...
I must leave now.
As soon as I get back I'll explain this a little further.
Kind regards
Julio
Note all useful posts
-
Tunnel VPN remote Internet and VPN remote VPN from Site to Site traffic?
Hello
We try to remote traffic from our users VPN tunnel through our ASA 5510 as well as to allow the only access for remote user VPN traffic to the other end of the all our VPN site-to-site connected to the same ASA. Basically, we who want to VPN in the network in order to access all of our networks business. We try to get away with this without using split Tunneling.
I can currently get internal traffic from the remote user VPN to reach all other vpn site-to-site tunnels without the internet in tunnel. The problem is when I add the following statement to the NAT:
NAT (outside) 1 10.10.19.0 255.255.255.0 * 10.10.19.0 is the address of the remote VPN Client
Internet traffic to the remote VPN starts to get in the tunnel, but I lose the opportunity to reach one of the other tunnels from site to site by the remote VPN tunnel.
I also begin to receive the following errors in the journal of the ASA
3 July 1, 2009 12:34:18 305005 10.10.19.255 137 no group of translation not found for udp src outside:10.10.19.3/137 dst outside:10.10.19.255/137
Any help with how NAT statements must be defined for this work would be appreciated.
Thank you
Will be
Will,
the link of this post for your scenario of vpn hub & speak reference, you problem may be on exempt nat rules.
Have a second look at your sheep rules.
Be sure to eliminate tunnel rules related to rheumatoid arthritis, as appropriate, to not let him get in the way of splitting.
If always emits discribe topology for l2ls and info logic RA and sanatized hub config asa... but I think if you look at the thread above, you should be able to solve.
Concerning
-
Remote VPN users cannot access tunnel from site to site
Cisco ASA5505.
I have a tunnel of site-to-site set up from our office to our Amazon AWS VPC. I'm not a network engineer and have spent way too much time just to get to this point.
It works very well since within the office, but users remote VPN can not access the tunnel from site to site. All other remote access looks very good.
The current configuration is here: https://gist.github.com/pmac72/f483ea8c7c8c8c254626
Any help or advice would be greatly appreciated. It is probably super simple for someone who knows what they're doing to see the question.
Hi Paul.
Looking at your configuration:
Remote access:
internal RA_GROUP group policy
RA_GROUP group policy attributes
value of server DNS 8.8.8.8 8.8.4.4
Protocol-tunnel-VPN IPSec
value of Split-tunnel-network-list Split_Tunnel_Listpermit same-security-traffic intra-interface
type tunnel-group RA_GROUP remote access
attributes global-tunnel-group RA_GROUP
address RA_VPN_POOL pool
Group Policy - by default-RA_GROUP
IPSec-attributes tunnel-group RA_GROUP
pre-shared key *.
local pool RA_VPN_POOL 10.0.0.10 - 255.255.255.0 IP 10.0.0.50 maskSite to site:
card crypto outside_map 1 match address acl-amzncard crypto outside_map 1 set pfspeer set card crypto outside_map 1 AWS_TUNNEL_1_IP AWS_TUNNEL_2_IPcard crypto outside_map 1 set of transformation transformation-amznI recommend you to use a local IP address pool with a different IP address that deals with the inside interface uses, now you are missing NAT are removed from the IP local pool to the destination of the site to site:NAT_EXEMPT list of ip 10.0.0.0 access allow 255.255.255.0 172.17.0.0 255.255.0.0NAT (outside) 0-list of access NAT_EXEMPTNow, there's a dynamically a NAT exempt allowing traffic to go out and are not translated.I would like to know how it works!Please don't forget to rate and score as correct the helpful post!Kind regardsDavid Castro, -
VPN clients are unable to access sites that are above a link from site to site
could someone please give me some direction, I have a set of vpn clients set up on a pix and I'm trying to give them access to a network that is connected via a link from a site that is set up on the same pix. so, basically, that it receives information from VPN client on the same interface, it built the tunnel from site to site, I've heard that's not possible is that the case. Or it can be fixed, I can provide diagrams and if necessary conf files.
You are right. You need a minimum of 7.0 for the feature you're looking for.
Kind regards
Arul
* Please note all useful messages *.
-
How can I block a VPN from site to Site traffic
I configured a VPN from Site to Site, the wizard on a
ASA 5510 and it works.
However, I want to restrict http traffic only.
I tried to change the ACL entry that allows ip traffic to allow only http traffic, but that seems to block all traffic and translates into a journal entry:
Inbound TCP connection doesn't deny x to Y/80 SYN flags on the incoming interface.
I managed to block pings by entering an ACL rule to specifically deny icmp, but I would like to deny all except http.
Any advice on how to achieve this appreciated.
William.
Hello
Guess that's what you're looking for. See the Bidirectional VPN filter configuration section.
-
How to end a vpn connection from site to site on ASA 5510
Hi guys,.
I would like to know if there is a command that I can use to break a connection from site to site and restart it whenever I want.
I don't want to use the close command since I use the specific interface as an exit point on the internet.
In this case, you can configure just one incomplete crypto map entry, for example: just keep 'peers set' not configured until you establish the vpn tunnel, and then add the command "set by the peers.
If you disable the tunnel, just remove the 'set by the peers' command for this particular VPN tunnel.
-
Refuse the remote user VPN to access PC using VPN from Site users to partner Site
Hi Experts,
Installation program:
We have configured IPSEC Site - Site VPN between Cisco ASA 5510 and Sonicwall.
Tunnel is in place and working well, we are able to access the remote workstation to partner and Vis Versa.
Requirment: We want to deny remote VPN users, who are our partners access to the workstation.
Example:
Remote IP address range: 192.168.200.x/2r4
Local IP address range: 192.168.10.x/24
Deny traffic from 192.168.200.x/24 to 192.168.10.x/24
Thanks in advance
Kiran Kumar CH
Hi Kiran,
You want to deny certain IP addresses of the Remote LAN (of the L2L tunnel), to connect to your workstation?
Thus, if the remote network 192.168.200.0/24, want to deny some of these machines to connect to 192.168.10.x?
If this is the case, you can create ACL VPN (VPN filters) on the SAA to restrictive traffic through the tunnel from the IPs.
Please clarify if I have misunderstood.
Federico.
-
IPSEC VPN from Site to Site - NAT problem with address management
Hi all
I have two Cisco ASA 5505 performing of IPSEC Site to Site VPN. All traffic inside each firewall through the VPN tunnel and I have full connectivity. From site A, I can connect to the inside address of the ASA at the site B and launch of the ASDM or SSH, etc.
The problem I have is when I'm logged on the ASA site B management traffic is given the external address. I created this as interesting traffic to get it to go through the VPN but I need to use the inside address of ASA B. The following is possible:
- If I can make the ASA Site B to use inside interface as its address management (I already have management access to the inside Interface)
- I have NAT can address external interfaces to Site B before moving through the VPN tunnel management traffic so that it appears to come from Site B inside the address
- I can NAT VPN traffic as it appears in the Site A for management traffic to Site B on the right address.
The problem is that my PRACTICE Please also come from this address and I need the application before being on an internal address to even if my CA.
Thanks for any help.
Ian
Thanks, I understand what you are trying to achieve now.
However, I think that I don't have good news for you. Unfortunately PEIE request can be initiated of the SAA within the interface, as there is no option to start the query from the inside interface. With other features of management such as AAA, logging, you have an option to specify what ASA desired originally to demand from interface, but CEP doesn't have this option.
Here's how you can configure under the trustpoint crypto, but unfortunately by specifying the interface doesn't not part of option:
http://www.Cisco.com/en/us/docs/security/ASA/asa84/command/reference/C5.html#wp2262210
Maybe you are looking for
-
I recently changed my sign on password (OS X user account) and now I keep getting permission from keychain pop ups that require a password. I discovered that ion to my old password erase them, but when I log in again, they reappear. I tried to update
-
I recently bought Apple TV but the TV I want to hang up to does not have an HDMI input. I bought a converter HDMI cord at Radio Shack, but it did not work. Any suggestions?
-
TCP multiple error of the client
Hello world I have server TCP/IP running on labview and tries to connect simultaneously with two client on two different computers, by using software called Hercules. If it is read or write, labview interacting with a single client that connects firs
-
Z10 Z10 ILA BlackBerry does not display the name of the caller of the stored contacts.
My Z10 does not display the names of the callers stored in contacts with a prefix or area code. For example, an incoming call on contact JOHN SMITH, whose number is stored as + 44 7976 667668 shows not her name but just 07976 667668, but if the numbe
-
Alertify Plugin - how to call via Javascript and not by a dynamic Action
HelloEnvironment: Oracle APEX v4.2.1 | Oracle 11g R2 | IE8 Web browserHoping someone can help, I use the plugin Alertify via a dynamic Action, but my question is, instead of use this via a dynamic Action, I actually want to make the same call I do vi