Troubleshoot VPN traffic to a paricular IP and port

I'm having issues where the VPN users try to hit a particular server on a specific port. When it is connected to the local network, they can connect without problems, but not via the VPN. However, via the VPN they can PING the device and the RDP to it. I checked the ACL on the ASA 5510 and it seems that the ports are open. Any ideas how can I capture or trace that blocks them to hit this IP and port?

for the sake of argument, let's say 10.1.1.1 is the IP address of the device and the port is 211

When it is connected through the VPN, they get an address 172.16.x.x.

Any help will be greatly appreciated

http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

This link has the time ASDM and CLI guides

HTH. Please rate the answer if it solves your problem. Thank you

Tags: Cisco Network

Similar Questions

VPN site to Site with NAT and Port forwarding on a 871

Hello

Could someone please look at the config 871 router attached and tell me where I'm wrong!

VPNs all work, work, BUT anyone trying to connect to a port that is sent through the VPN port forwarding fails.

In the config attached Port 3389 (RDP) is sent to an internal server, if you connect to the external interface Internet connection is made and it works well, but if someone tries to connect to the IP address internal to that same server through VPN, it does not.

We've added commands to stop working on the lines VPN NAT, but these do not seem to work.

What Miss me?

Thank you in advance and I will adjudicate all useful responses.

It is a common problem. Yes you added controls to prevent NAT to work above the tunnel, but your static nat port to port 3389 takes precedence over the generic nat command, and there not all orders top to prevent it is nat would be above the tunnel.

I wrote an example configuration for this some time, see here for more details:

http://www.Cisco.com/en/us/Tech/tk583/TK372/technologies_configuration_example09186a0080094634.shtml

If all goes well, he explains everything. Note that it is for a general order static host, not a static port that you have, but the concept is exactly the same. Just add a statement roadmap on the end of your static command of the port, and this route map - will reference an ACL that denies are used when going up above the tunnel.

7.2 ASA5520 - filters VPN traffic

Hi all,

I would like to know how can I filter out VPN traffic with a list of access, by using the source address and port of destination as filters.

I tried with "no sysopt permit vpn connection" but it is to filter the traffic through the VPN tunnel and I want to filter the host which can establish the VPN tunnel.

I did it in a router with this access list:

Note access-list 101 VPN

access-list 101 permit ahp host x.x.x.x everything

access-list 101 permit esp host x.x.x.x any newspaper

access-list 101 permit host x.x.x.x esp all

access-list 101 permit udp host x.x.x.x any eq isakmp

access-list 101 permit udp host x.x.x.x any eq non500-isakmp

But I tried the same thing in the ASA and does not work, I think it's because the ASA does not apply the access list for VPN traffic.

Sincerely, Fernando.

Fernando

You can disable it with "no crypto isakmp are outside", but then even if you apply an acl to the outside which allows all IP, ESP, AH it still does not allow an IPSEC connection.

So for the moment I see no way to do this without using an acl on your router upstream.

I'll do a reading just in case I missed something.

Jon

VPN-filer configuration on the VPN traffic

Hello world

We set up a site to ipsec with the seller.

For security reasons we do not want to allow all traffic through the tunnel.

ASA has 2 interfaces both inside and outside.

We refuse any one on the external interface ip.

I have config vpn run ACL to allow traffic on port ssh, icmp through the tunnel.

Then I applied it under the group policy.

name of VPN-filter value.

Need to confirm that I must also allow ipec protocols as esp etc under VPN filter ACL?

Concerning

MAhesh

The vpn-filter is applied to the traffic flowing through the tunnel. You don't need to allow all traffic that 'built' like IKE and IPsec VPN.

On the SAA, you must also add this traffic to your external ACL is it necessary on IOS routers.

For the vpn-filter, be aware that the syntax is not
```
permit/deny PROTOCOL SOURCE DESTINATION
```
It's
```
permit/deny PROTOCOL REMOTE LOCAL
```
This is relevant when you want to filter traffic from your network to the network of peers.

Capture packets for VPN traffic

Hi team,

Please help me to set the ACL and capture for remote access VPN traffic.

To see the amount of traffic flows from this IP Source address.

Source: Remote VPN IP (syringe) 10.10.10.10 access

Destination: any

That's what I've done does not

extended VPN permit tcp host 10.10.10.10 access list all

interface captures CAP_VPN VPN access to OUTSIDE gross-list data type

Hello

If you have configured capture with this access list, you filter all TCP traffic, so you will not be able to see the UDP or ICMP traffic too, I would recommend using the ACL, although only with intellectual property:

list of allowed extended VPN ip host 10.10.10.10 access everything

Capture interface outside access, VPN CAP_VPN-list

Then with:

See the capture of CAP_VPN

You will be able to see the packet capture on the SAA, you can export the capture of a sniffer of packages as follows:

https:// /capture//pcap capname--> CAP

For more details of capture you can find it on this link

Let me know if you could get the information that you were trying to achieve.

Please Don t forget to rate and score as correct the helpful post!

David Castro,

Kind regards

Darkness of 8.4 (1) vpn L2L filter ASA when you specify the Protocol and port

Hi all - I've spent many hours trying to diagnose this and have read several discussions and the Cisco docs unsuccessfully...

Situation: two sites running Cisco ASA 5520 on 8.4 (1) with L2L IPsec on the public internet between each of them. The configuration of IPsec and associated routing works as it should and we are able to pass traffic between networks private behind each device as expected. The problem occurs when you try to block sessions using a vpn-filter group policy configuration.

Each site has 3 private subnets that are able to communicate correctly without the vpn-filter configuration. We want to restrict access to specific protocols, hosts, and ports between each network.

SITE A: 10.10.0.0/18, 10.10.64.0/18, 10.10.128.0/18

SITE B: 10.20.0.0/18, 10.20.64.0/18, 10.20.128.0/18

When we apply a filter-vpn configuration which restricted access only two guests, as follows...

SITE A: vpn_acl_x_x_x_x list extended access permit ip host 10.20.0.1 host 10.10.0.1

SITE b: the ip host 10.10.0.1 allowed extended access list vpn_acl_x_x_x_x host 10.20.0.1

... the configuration works correctly. However, when we try to lock the configuration more far and specify the protocols and ports, as follows...

SITE A: vpn_acl_x_x_x_x list extended access permit tcp host 10.20.0.1 host 10.10.0.1 eq 22

SITE b: vpn_acl_x_x_x_x to the list of access permit tcp host 10.10.0.1 host 10.20.0.1 eq 22

... and then try to establish a SSH connection between 10.10.0.1 and 10.20.0.1 or vice versa, the package is stopped on the side of the SOURCE. ..

Mar 22 11:58:01 x.x.x.x 22 March 2011 14:34:56: % ASA-4-106103: vpn_acl_x_x_x_x of the access list refused tcp to the user "" inside-data/10.10.0.1(59112)-> outside-iptrans/10.20.0.1(22) hit - cnt 1 first success [0xd8d1c1b4, 0 x 0]

I would really appreciate it if someone could shed some light on what is wrong with this Setup.

SOLUTION

The ACE must be implemented on the source and the end of the tunnel destination to facilitate this configuration.

EXAMPLE 1: allow SSH two-way communication between hosts on each network (SITE A can connect to SITE B, SITE B can connect to SITE A)...
```
SITE A:
access-list vpn_acl_x_x_x_x extended permit tcp host 10.20.0.1 host 10.10.0.1 eq 22
access-list vpn_acl_x_x_x_x extended permit tcp host 10.20.0.1 eq 22 host 10.10.0.1
SITE B:
access-list vpn_acl_x_x_x_x extended permit tcp host 10.10.0.1 host 10.20.0.1 eq 22
access-list vpn_acl_x_x_x_x extended permit tcp host 10.10.0.1 eq 22 host 10.20.0.1
```
EXAMPLE 2: allow communication one-way SSH between hosts on each network (SITE A can connect to SITE B, SITE B is unable to connect to SITE A)...
```
SITE A:
access-list vpn_acl_x_x_x_x extended permit tcp host 10.20.0.1 eq 22 host 10.10.0.1
SITE B:
access-list vpn_acl_x_x_x_x extended permit tcp host 10.10.0.1 host 10.20.0.1 eq 22
```
Very good and thank you for this post. Please kindly marks the message as answered while others may learn from your post. I think that you have started a very good discussion on vpn-filter for tunnel L2L.

IOS VPN on 7200 12.3.1 and access-list problem

I'm in IOS 12.3 (1) a 7200 and have configured it for VPN access. I use the Cisco VPN client. Wonder if someone has encountered the following problem, and if there is a fix.

The external interface has the access-list standard applied that blocks incoming traffic. One of the rules is to block the IPs private, not routable, such as the 10.0.0.0 concern, for example.

When I set my VPN connection, none of my packets get routed and I noticed that outside access list interface blocks the traffic. When I connect to the router through VPN, the router attributes to the client an IP address from a pool of the VPN as 10.1.1.0/24. But normal outside the access list denies this traffic as it should. But as soon as I have established a VPN connect, it seems that my encrypted VPN traffic must ignore the external interface access list.

If I change my external access list to allow traffic from source address 10.1.1.0/24 my VPN traffic goes through correctly, but this goes against the application to have an outdoor access list that denies such traffic and have a VPN.

Anyone else seen this problem or can recommend a software patch or version of IOS which works correctly?

Thank you

R

That's how IOS has always worked, no way around it.

The reasoning is to do with the internal routing on the router. Basically an encrypted packet inherits from the interface and initially past control of ACL as an encrypted packet. Then expelled the crypto engine and decrypted, so we now have this sitting pouch in the cryptographic engine part of the router. What do we with her now, keeping in mind users may want political route she is also, might want to exercise, qos, etc. etc. For this reason, the package is basically delivered on the external interface and running through everything, once again, this time as a decrypted packet. If the package hits the ACL twice, once encrypted and clear once.

Your external ACL shall include the non encrypted and encrypted form of the package.

Now, if you're afraid that people can then simply spoof packets to come from 10.1.1.0 and they will be allowed through your router, bzzzt, wrong. The first thing that the router checks when it receives a packet on an interface with a card encryption applied is that if the package needs to be encrypted, it is from his crypto ACL and its IP pools. If he receives a decrypted packet when it knows that it must have been encrypted, it will drop the package immediately and a flag a syslog something as "received the decrypted packet when it should have been."

You can check on the old bug on this here:

http://www.Cisco.com/cgi-bin/support/Bugtool/onebug.pl?BugID=CSCdz54626&submit=search

and take note of the section of the security implications, you may need to slightly modify your configuration.

NAT on the VPN traffic

Hello everyone, I need help in a vpn configuration, this is the problem that I need nat all vpn traffic because I net to put into place a vpn but I already have another vpn with the same network, so that overlap with the new one, then how I can nat overlaps all traffic to another network in order to avoid the network?.

Please I really need help

Thank you

You say that the 192.168.1.100 is able to go through the tunnel and the internet now?

Try to add another...

IP nat inside source static 192.168.1.101 10.10.44.101 map route VPN

for example.

Federico.

VPN traffic through incoming port

On my ASA 5510 I want for the VPN clients can connect on the outer harbour and have their internet traffic directed back on that same port, with the internal traffic inside port. Is this possible? If so, how does do this?

Will be transmitted traffic VPN based on the routing table after out of the tunnel.

If you do not want to let Internet traffic to turn on the external interface, you must add

-permit same-security-traffic intra-interface

-make the Association NAT change such as

Global interface 4 (external)

NAT (outside) 4

ASA encrypt interesting VPN traffic

Hello everybody out there using ASA.

I had a few IPSEC VPN tunnels between the company's central site and remote sites.

Two dsl lines were connected to the ASA, one for VPN traffic and the other for the internet.

The default gateway has been configured online internet, some static while insured roads as traffic to the sites of the company was sent through the other line.

A few days ago we changed the configuration of ASA to use only a single dsl connection, then the line serving the internet has been cut, while the other will become the gateway default and static routes have been removed.

The VPN connections instant stopped working and trying to send packets to the remote lan, it seems that ASA will not recognize that the traffic is encrypted. Obviousely we checked cryptomap, acl, ecc, but we find no problem... do you have any suggestions?

Thanks in advance,

Matt

-----------------------------------------------------------------------------------------------------------------------------------------------------------------

XNetwork object network
10.10.0.0 subnet 255.255.255.0

network of the YNetwork object
172.0.1.0 subnet 255.255.255.0

card crypto RB1ITSHDSL001_map2 1 corresponds to the address RB1ITSHDSL001_1_cryptomap
card crypto RB1ITSHDSL001_map2 1 set peer a.b.c.186
RB1ITSHDSL001_map2 1 transform-set ESP-3DES-SHA crypto card game

RB1ITSHDSL001_1_cryptomap list extended access permitted ip XNetwork object YNetwork

-------------------------------------------------------------------------------------------------------------------------------------------------------------------

Hello

Your exit the ASA must be encrypting the traffic between XNetwork and YNetwork.

If the ASA does not encrypt this traffic, it could be because there is a problem with the NAT configuration.

When the ASA receives a packet, it must first check if there are ACLs that allows traffic, passes through the inspection engine and check that the associated NAT. For example, if the package is coordinated, then the private IP encryption will never take place.

Could ensure you that packets from the XNetwork are really reach the ASA, the NAT rule is correct and you may be looking for "debugging cry isa 127" and "scream ips 127" debug to check for errors of incompatibility.

In addition, what is the condition of the tunnel trying to communicate: "sh cry isa his"

Federico.

Is it still possible? Customer VPN traffic through a PIX for an another VPN?

Hi, I just want to know if the following is actually technically possible? I'm starting to think I'm trying to implement a solution that is simply not possible.

I have the following:

VPN<->CiscoPix506e<->Cisco3000 Clients

VPN clients running an IPSEC VPN for the 506th Cisco PIX and can access its "internal network" very well.

The Cisco pix is running a VPN to another company where all network traffic is nat'ed to a single address IP RFC1918 before coming out of the tunnel (requirement of the other company to avoid the problems of overlap)

and everyone on the "internal network" can access this great VPN.

I want that people who use the VPN client to be able to access the other site-to-site VPN. I think that NAT forced to the external company VPN is a problem.

All of the examples for VPN VPN cross-I see specify NAT should be disabled on the entire path. I can't do it in this situation. Is it possible to make this work?

I guess with a good statement of ACL that all my problems will be solved.

If you just get the users connect to the cisco 3000 rather than transversing my network. I don't have for the following reasons. I have no access to the cisco 3000 vpn concentrator and a very limited amount of the tunnels that they can open for my business. I was instructed to implement a solution to facilitate the life of employees (so that they only run a VPN tunnel at a time to do their work). For the moment, they need access to the systems within our corporate network and external society through the site to site VPN (it's actually a web application). They can do this at the office but obviously not home if they attempt to use remote access.

I have attached a diagram of the network example PDF explaining the situation.

Networks of each address is the following (change of the actual address of the innocents :))):

CLIENTS_VPN

192.168.10.0/24

Internal network

192.168.1.0/24

External VPN end point

192.168.20.0/24

Address used for NAT on the VPN

172.16.1.1/32

the IOS config

local IP pool - 192.168.10.1 VPN CLIENTS - 192.168.10.254

inside ip access list allow a whole

access-list allowed SHEEP ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0

access list permits EXTERNAL-ACL-VPN ip 172.16.1.1 host 192.168.20.0 255.255.255.0

EXTERNAL-ACL-NAT of the list of permitted access ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0

IP address outside a.b.c.d 255.255.255.0

IP address inside 192.168.10.1 255.255.255.0

Global interface 2 (external)

Global (outside) 1 172.16.1.1

NAT (inside) 0 access-list SHEEP

NAT (inside) - EXTERNAL-ACL-1 NAT access list 0 0

NAT (inside) 2 0.0.0.0 0.0.0.0 0 0

outside access-group in external interface

Route outside 0.0.0.0 0.0.0.0 a.b.c.d 1

Thank you

Jason.

I understand from your description of the scenario, you try to route traffic on the same interface on which it was received on the PIX. This is called pinning hair in traffic and is not currently supported in PIX (6.3).

Configuration of the router to allow VPN traffic through

I would like to ask for assistance with a specific configuration to allow VPN traffic through a router from 1721.

The network configuration is the following:

Internet - Cisco 1721 - Cisco PIX 506th - LAN

Remote clients connect from the internet by using the Cisco VPN client. The 1721 should just pass the packets through to the PIX, which is 192.168.0.2. Inside of the interface of the router is 192.168.0.1.

The pix was originally configured with a public ip address and has been tested to work well to authenticate VPN connections and passing traffic in the local network. Then, the external ip address was changed to 192.168.0.2 and the router behind.

The 1721 is configured with an ADSL connection, with fall-over automatic for an asynchronous connection. This configuration does not work well, and in the local network, users have normal internet access. I added lists of access for udp, esp and the traffic of the ahp.

Cisco VPN clients receive an error indicating that the remote control is not responding.

I have attached the router for reference, and any help would be greatly apreciated.

Manual.

Brian

For VPN clients reach the PIX to complete their VPN the PIX needs to an address that is accessible from the outside where the customers are. When the PIX was a public address was obviously easy for guests to reach the PIX. When you give the PIX one address private, then he must make a translation. And this becomes a problem if the translation is dynamic.

You have provided a static translation that is what is needed. But you have restricted the TCP 3389. I don't know why you restricted it in this way. What is supposed to happen for ISAKMP and ESP, AHP traffic? How is it to be translated?

If there is not a static translation for ISAKMP traffic, ESP and AHP so clients don't know how to reach the server. Which brings me to the question of what the address is configured in the client to the server?

HTH

Rick

VPN site to Site btw Pix535 and 2811 router, can't get to work

Hi, everyone, I spent a few days doing a VPN site-to site between PIX535 and 2811 router but returned empty-handed, I followed the instructions here:

http://www.Cisco.com/en/us/products/ps9422/products_configuration_example09186a0080b4ae61.shtml

#1: config PIX:

: Saved

: Written by enable_15 to the 18:05:33.678 EDT Saturday, October 20, 2012

!

8.0 (4) version PIX

!

hostname pix535

!

interface GigabitEthernet0

Description to cable-modem

nameif outside

security-level 0

address IP X.X.138.132 255.255.255.0

OSPF cost 10

!

interface GigabitEthernet1

Description inside 10/16

nameif inside

security-level 100

IP 10.1.1.254 255.255.0.0

OSPF cost 10

!

outside_access_in of access allowed any ip an extended list

access extensive list ip 10.1.0.0 inside_nat0_outbound allow 255.255.0.0 10.20.0.0 255.255.0.0

inside_nat0_outbound list of allowed ip extended access all 10.1.1.192 255.255.255.248

outside_cryptomap_dyn_60 list of allowed ip extended access all 10.1.1.192 255.255.255.248

access extensive list ip 10.1.0.0 outside_1_cryptomap allow 255.255.0.0 10.20.0.0 255.255.0.0

pager lines 24

cnf-8-ip 10.1.1.192 mask - 10.1.1.199 IP local pool 255.255.0.0

Global interface 10 (external)

15 1.2.4.5 (outside) global

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 15 10.1.0.0 255.255.0.0

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 X.X.138.1 1

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA MD5-ESP-3DES ESP-DES-MD5

life together - the association of security crypto dynamic-map outside_dyn_map 20 28800 seconds

Crypto-map dynamic outside_dyn_map 20 kilobytes of life together - the association of safety 4608000

Crypto-map dynamic outside_dyn_map 40 value transform-set ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA

life together - the association of security crypto dynamic-map outside_dyn_map 40 28800 seconds

Crypto-map dynamic outside_dyn_map 40 kilobytes of life together - the association of safety 4608000

Dynamic crypto map outside_dyn_map 60 match address outside_cryptomap_dyn_60

Crypto-map dynamic outside_dyn_map 60 value transform-set ESP-3DES-MD5 ESP-3DES-SHA ESP-DES-MD5 ESP-DES-SHA

life together - the association of security crypto dynamic-map outside_dyn_map 60 28800 seconds

Crypto-map dynamic outside_dyn_map 60 kilobytes of life together - the association of safety 4608000

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-SHA-3DES ESP-MD5-3DES ESP-DES-SHA ESP-DES-MD5

Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define security association lifetime 28800 seconds

cryptographic kilobytes 4608000 life of the set - the association of security of the 65535 SYSTEM_DEFAULT_CRYPTO_MAP of the dynamic-map

card crypto outside_map 1 match address outside_1_cryptomap

outside_map game 1 card crypto peer X.X.21.29

card crypto outside_map 1 set of transformation-ESP-DES-SHA

outside_map map 1 lifetime of security association set seconds 28800 crypto

card crypto outside_map 1 set security-association life kilobytes 4608000

outside_map card crypto 65534 isakmp ipsec dynamic SYSTEM_DEFAULT_CRYPTO_MAP

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

ISAKMP crypto identity hostname

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

the Encryption

sha hash

Group 1

life 86400

crypto ISAKMP policy 20

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 65535

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Crypto isakmp nat-traversal 3600

internal GroupPolicy1 group strategy

cnf-vpn-cls group policy internal

attributes of cnf-vpn-cls-group policy

value of 10.1.1.7 WINS server

value of 10.1.1.7 DNS server 10.1.1.205

Protocol-tunnel-VPN IPSec l2tp ipsec

field default value x.com

sean U/h5bFVjXlIDx8BtqPFrQw password user name is nt encrypted

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key secret1

RADIUS-sdi-xauth

tunnel-group DefaultRAGroup ppp-attributes

ms-chap-v2 authentication

tunnel-group cnf-vpn-cls type remote access

tunnel-group global cnf-vpn-cls-attributes

cnf-8-ip address pool

Group Policy - by default-cnf-vpn-cls

tunnel-group cnf-CC-vpn-ipsec-attributes

pre-shared-key secret2

ISAKMP ikev1-user authentication no

tunnel-group cnf-vpn-cls ppp-attributes

ms-chap-v2 authentication

tunnel-group X.X.21.29 type ipsec-l2l

IPSec-attributes tunnel-Group X.X.21.29

Pre-shared key SECRET

!

class-map inspection_default

match default-inspection-traffic

!

!

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:9780edb09bc7debe147db1e7d52ec39c

: end

#2: 2811 router config:

!

! Last configuration change to 09:15:32 PST Friday, October 19, 2012 by cnfla

! NVRAM config update at 13:45:03 PST Tuesday, October 16, 2012

!

version 12.4

horodateurs service debug datetime msec

Log service timestamps datetime msec

no password encryption service

!

hostname THE-2800

!

!

Crypto pki trustpoint TP-self-signed-1411740556

enrollment selfsigned

name of the object cn = IOS - Self - signed - certificate - 1411740556

revocation checking no

rsakeypair TP-self-signed-1411740556

!

!

TP-self-signed-1411740556 crypto pki certificate chain

certificate self-signed 01

308201A 8 A0030201 02020101 3082023F 300 D 0609 2A 864886 F70D0101 04050030

2 060355 04031326 494F532D 53656 C 66 2 AND 536967 6E65642D 43657274 31312F30

69666963 31343131 37343035 6174652D 3536301E 170 3132 31303136 32303435

30335A 17 0D 323030 31303130 30303030 305A 3031 06035504 03132649 312F302D

4F532D53 5369676E 656C662D 43 65727469 66696361 74652 31 34313137 65642D

34303535 3630819F 300 D 0609 2A 864886 01050003, 818, 0030, 81890281 F70D0101

8100F75F F1BDAD9B DE9381FD 7EAF9685 CF15A317 165B 5188 1 B 424825 9C66AA28

C990B2D3 D69A2F0F D745DB0E 2BB4995D 73415AC4 F01B2019 C4BCF9E0 84373199

E599B86C 17DBDCE6 47EBE0E3 8DBC90B2 9B4E217A 87F04BF7 A182501E 24381019

A61D2C05 5404DE88 DA2A1ADC A81B7F65 C318B697 7ED69DF1 2769E4C8 F3449B33

010001A 3 67306530 1 130101 FF040530 030101FF 30120603 0F060355 35AF0203

1104 B 0 300982 074C412D 32383030 551D 551 2304 18301680 14B56EEB 301F0603

88054CCA BB8CF8E8 F44BFE2C B77954E1 52301 D 06 04160414 B56EEB88 03551D0E

054CCABB 8CF8E8F4 4BFE2CB7 7954E152 300 D 0609 2A 864886 F70D0101 04050003

81810056 58755 56 331294F8 BEC4FEBC 54879FF5 0FCC73D4 B964BA7A 07D 20452

E7F40F42 8B 355015 77156C9F AAA45F9F 59CDD27F 89FE7560 F08D953B FC19FD2D

310DA96E A5F3E83B 52D515F8 7B4C99CF 4CECC3F7 1A0D4909 BD08C373 50BB53CC

659 4246 2CB7B79F 43D94D96 586F9103 9B4659B6 5C8DDE4F 7CC5FC68 C4AD197A 4EC322 C

quit smoking

!

!

!

crypto ISAKMP policy 1

preshared authentication

ISAKMP crypto key address SECRET X.X.138.132 No.-xauth

!

!

Crypto ipsec transform-set the-2800-trans-set esp - esp-sha-hmac

!

map 1 la-2800-ipsec policy ipsec-isakmp crypto

ipsec vpn Description policy

defined by peer X.X.138.132

the transform-set the-2800-trans-set value

match address 101

!

!

!

!

!

!

interface FastEthernet0/0

Description WAN side

address IP X.X.216.29 255.255.255.248

NAT outside IP

IP virtual-reassembly

automatic duplex

automatic speed

No cdp enable

No mop enabled

card crypto 2800-ipsec-policy

!

interface FastEthernet0/1

Description side LAN

IP 10.20.1.1 255.255.255.0

IP nat inside

IP virtual-reassembly

full duplex

automatic speed

No mop enabled

!

IP nat inside source map route sheep interface FastEthernet0/0 overload

access-list 10 permit X.X.138.132

access-list 99 allow 64.236.96.53

access-list 99 allow 98.82.1.202

access list 101 remark vpn tunnerl acl

Note access-list 101 category SDM_ACL = 4

policy of access list 101 remark tunnel

access-list 101 permit ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255

access-list 110 deny ip 10.20.0.0 0.0.0.255 10.1.0.0 0.0.255.255

access-list 110 permit ip 10.20.0.0 0.0.0.255 any

public RO SNMP-server community

!

!

!

sheep allowed 10 route map

corresponds to the IP 110

!

!

!

!

WebVPN gateway gateway_1

IP address X.X.216.29 port 443

SSL trustpoint TP-self-signed-1411740556

development

!

WebVPN install svc flash:/webvpn/svc.pkg

!

WebVPN gateway-1 context

title 'b '.

secondary-color white

color of the title #CCCC66

text-color black

SSL authentication check all

!

!

policy_1 political group

functions compatible svc

SVC-pool of addresses "WebVPN-Pool."

SVC Dungeon-client-installed

SVC split include 10.20.0.0 255.255.0.0

Group Policy - by default-policy_1

Gateway gateway_1

development

!

!

end

#3: test Pix to the router:

ITS enabled: 1

Generate a new key SA: 0 (a tunnel report Active 1 and 1 to generate a new key during the generate a new key)

Total SA IKE: 1

1 peer IKE: X.X.21.29

Type: user role: initiator

Generate a new key: no State: MM_WAIT_MSG2

> DEBUG:

12:07:14 pix535:Oct 22 Oct 22 12:20:28 EDT: % PIX-vpn-3-713902: IP = X.X.21.29, Removing peer to peer table has not, no match
!
22 Oct 12:07:14 pix535: 22 Oct 12:20:28 EDT: % PIX-vpn-4-713903: IP = X.X.21.29, error: cannot delete PeerTblEntry

#4: test the router to pix:

LA - 2800 #sh crypto isakmp his

IPv4 Crypto ISAKMP Security Association

status of DST CBC State conn-id slot

X.X.138.132 X.X.216.29 MM_KEY_EXCH 1017 ASSETS 0

> debug

LA - 2800 #ping 10.1.1.7 source 10.20.1.1

Type to abort escape sequence.

Send 5, echoes ICMP 100 bytes to 10.1.1.7, time-out is 2 seconds:

Packet sent with a source address of 10.20.1.1

Oct 22 16:24:33.945: ISAKMP: (0): profile of THE request is (NULL)

22 Oct 16:24:33.945: ISAKMP: created a struct peer X.X.138.132, peer port 500

22 Oct 16:24:33.945: ISAKMP: new created position = 0x488B25C8 peer_handle = 0 x 80000013

22 Oct 16:24:33.945: ISAKMP: lock struct 0x488B25C8, refcount 1 to peer isakmp_initiator

22 Oct 16:24:33.945: ISAKMP: 500 local port, remote port 500

22 Oct 16:24:33.945: ISAKMP: set new node 0 to QM_IDLE

22 Oct 16:24:33.945: ISAKMP: find a dup her to the tree during the isadb_insert his 487720 A 0 = call BVA

22 Oct 16:24:33.945: ISAKMP: (0): cannot start aggressive mode, try the main mode.

22 Oct 16:24:33.945: ISAKMP: (0): pair found pre-shared key matching 70.169.138.132

Oct 22 16:24:33.945: ISAKMP: (0): built of NAT - T of the seller-rfc3947 ID

Oct 22 16:24:33.945: ISAKMP: (0): built the seller-07 ID NAT - t

Oct 22 16:24:33.945: ISAKMP: (0): built of NAT - T of the seller-03 ID

Oct 22 16:24:33.945: ISAKMP: (0): built the seller-02 ID NAT - t

22 Oct 16:24:33.945: ISAKMP: (0): entry = IKE_MESG_FROM_IPSEC, IKE_SA_REQ_MM

22 Oct 16:24:33.945: ISAKMP: (0): former State = new State IKE_READY = IKE_I_MM1

Oct 22 16:24:33.945: ISAKMP: (0): Beginner Main Mode Exchange

Oct 22 16:24:33.945: ISAKMP: (0): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_NO_STATE

22 Oct 16:24:33.945: ISAKMP: (0): sending a packet IPv4 IKE.

22 Oct 16:24:34.049: ISAKMP (0:0): packet received dport 500 sport Global 500 (I) MM_NO_STATE X.X.138.132

22 Oct 16:24:34.049: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

22 Oct 16:24:34.049: ISAKMP: (0): former State = new State IKE_I_MM1 = IKE_I_MM2

Oct 22 16:24:34.049: ISAKMP: (0): treatment ITS payload. Message ID = 0

Oct 22 16:24:34.049: ISAKMP: (0): load useful vendor id of treatment

Oct 22 16:24:34.049: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123

Oct 22 16:24:34.049: ISAKMP: (0): provider ID is NAT - T v2

Oct 22 16:24:34.049: ISAKMP: (0): load useful vendor id of treatment

Oct 22 16:24:34.049: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194

22 Oct 16:24:34.053: ISAKMP: (0): pair found pre-shared key matching 70.169.138.132

Oct 22 16:24:34.053: ISAKMP: (0): pre-shared key local found

22 Oct 16:24:34.053: ISAKMP: analysis of the profiles for xauth...

22 Oct 16:24:34.053: ISAKMP: (0): audit ISAKMP transform 1 against the policy of priority 1

22 Oct 16:24:34.053: ISAKMP: DES-CBC encryption

22 Oct 16:24:34.053: ISAKMP: SHA hash

22 Oct 16:24:34.053: ISAKMP: default group 1

22 Oct 16:24:34.053: ISAKMP: pre-shared key auth

22 Oct 16:24:34.053: ISAKMP: type of life in seconds

22 Oct 16:24:34.053: ISAKMP: life (IPV) 0 x 0 0 x 1 0 x 51 0x80

22 Oct 16:24:34.053: ISAKMP: (0): atts are acceptable
. Next payload is 0
22 Oct 16:24:34.053: ISAKMP: (0): Acceptable atts: real life: 0

22 Oct 16:24:34.053: ISAKMP: (0): Acceptable atts:life: 0

22 Oct 16:24:34.053: ISAKMP: (0): fill atts in his vpi_length:4

22 Oct 16:24:34.053: ISAKMP: (0): fill atts in his life_in_seconds:86400

22 Oct 16:24:34.053: ISAKMP: (0): return real life: 86400

22 Oct 16:24:34.053: ISAKMP: (0): timer life Started: 86400.

Oct 22 16:24:34.053: ISAKMP: (0): load useful vendor id of treatment

Oct 22 16:24:34.053: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 123

Oct 22 16:24:34.053: ISAKMP: (0): provider ID is NAT - T v2

Oct 22 16:24:34.053: ISAKMP: (0): load useful vendor id of treatment

Oct 22 16:24:34.053: ISAKMP: (0): provider ID seems the unit/DPD but major incompatibility of 194

22 Oct 16:24:34.053: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

22 Oct 16:24:34.053: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM2

Oct 22 16:24:34.057: ISAKMP: (0): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_SA_SETUP

22 Oct 16:24:34.057: ISAKMP: (0): sending a packet IPv4 IKE.

22 Oct 16:24:34.057: ISAKMP: (0): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

22 Oct 16:24:34.057: ISAKMP: (0): former State = new State IKE_I_MM2 = IKE_I_MM3

22 Oct 16:24:34.181: ISAKMP (0:0): packet received dport 500 sport Global 500 (I) MM_SA_SETUP X.X.138.132

22 Oct 16:24:34.181: ISAKMP: (0): entry = IKE_MESG_FROM_PEER, IKE_MM_EXCH

22 Oct 16:24:34.181: ISAKMP: (0): former State = new State IKE_I_MM3 = IKE_I_MM4

Oct 22 16:24:34.181: ISAKMP: (0): processing KE payload. Message ID = 0

Oct 22 16:24:34.217: ISAKMP: (0): processing NONCE payload. Message ID = 0

22 Oct 16:24:34.217: ISAKMP: (0): pre-shared key found peer corresponding to X.X.138.132

Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment

Oct 22 16:24:34.217: ISAKMP: (1018): provider ID is the unit

Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment

Oct 22 16:24:34.217: ISAKMP: (1018): provider ID seems the unit/DPD but major incompatibility of 55

Oct 22 16:24:34.217: ISAKMP: (1018): provider ID is XAUTH

Oct 22 16:24:34.217: ISAKMP: (1018): load useful vendor id of treatment

Oct 22 16:24:34.217: ISAKMP: (1018): addressing another box of IOS
!
Oct 22 16:24:34.221: ISAKMP: (1018): load useful vendor id of treatment

22 Oct 16:24:34.221: ISAKMP: (1018): vendor ID seems the unit/DPD but hash mismatch

22 Oct 16:24:34.221: ISAKMP: receives the payload type 20

22 Oct 16:24:34.221: ISAKMP: receives the payload type 20

22 Oct 16:24:34.221: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE

22 Oct 16:24:34.221: ISAKMP: (1018): former State = new State IKE_I_MM4 = IKE_I_MM4

22 Oct 16:24:34.221: ISAKMP: (1018): send initial contact

22 Oct 16:24:34.221: ISAKMP: (1018): ITS been pre-shared key, using id ID_IPV4_ADDR type authentication

22 Oct 16:24:34.221: ISAKMP (0:1018): payload ID

next payload: 8

type: 1

address: X.X.216.29

Protocol: 17

Port: 500

Length: 12

22 Oct 16:24:34.221: ISAKMP: (1018): the total payload length: 12

Oct 22 16:24:34.221: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH

22 Oct 16:24:34.221: ISAKMP: (1018): sending a packet IPv4 IKE.

22 Oct 16:24:34.225: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE

22 Oct 16:24:34.225: ISAKMP: (1018): former State = new State IKE_I_MM4 = IKE_I_MM5

...

22 Oct 16:24:38.849: ISAKMP: (1017): purge the node 198554740

22 Oct 16:24:38.849: ISAKMP: (1017): purge the node 812380002

22 Oct 16:24:38.849: ISAKMP: (1017): purge node 773209335...

Success rate is 0% (0/5)

# THE-2800

Oct 22 16:24:44.221: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...

22 Oct 16:24:44.221: ISAKMP (0:1018): increment the count of errors on his, try 1 5: retransmit the phase 1

Oct 22 16:24:44.221: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH

Oct 22 16:24:44.221: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH

22 Oct 16:24:44.221: ISAKMP: (1018): sending a packet IPv4 IKE.

22 Oct 16:24:44.317: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132

Oct 22 16:24:44.317: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.

Oct 22 16:24:44.321: ISAKMP: (1018): retransmission jumped to the stage 1 (time elapsed since the last transmission 96)

22 Oct 16:24:48.849: ISAKMP: (1017): serving SA., his is 469BAD60, delme is 469BAD60

22 Oct 16:24:52.313: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132

Oct 22 16:24:52.313: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.

Oct 22 16:24:52.313: ISAKMP: (1018): retransmission due to phase 1 of retransmission

Oct 22 16:24:52.813: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...

22 Oct 16:24:52.813: ISAKMP (0:1018): increment the count of errors on his, try 2 of 5: retransmit the phase 1

Oct 22 16:24:52.813: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH

Oct 22 16:24:52.813: ISAKMP: (1018): package X.X138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH

22 Oct 16:24:52.813: ISAKMP: (1018): sending a packet IPv4 IKE.

Oct 22 16:24:52.913: ISAKMP: (1018): package of phase 1 is a duplicate of a previous package.

Oct 22 16:24:52.913: ISAKMP: (1018): retransmission jumped to the stage 1 (time elapsed since the last transmission of 100)

22 Oct 16:25:00.905: ISAKMP (0:1018): packet received dport 500 sport Global 500 (I) MM_KEY_EXCH X.X.138.132

22 Oct 16:25:00.905: ISAKMP: node set 422447177 to QM_IDLE

....

22 Oct 16:25:03.941: ISAKMP: (1018): SA is still budding. New application of ipsec in the annex
. (local 1 X. X.216.29, remote X.X.138.132)
22 Oct 16:25:03.941: ISAKMP: error during the processing of HIS application: failed to initialize SA

22 Oct 16:25:03.941: ISAKMP: error while processing message KMI 0, error 2.

Oct 22 16:25:12.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...

22 Oct 16:25:12.814: ISAKMP (0:1018): increment the count of errors on his, try 4 out 5: retransmit the phase 1

Oct 22 16:25:12.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH

Oct 22 16:25:12.814: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH

22 Oct 16:25:12.814: ISAKMP: (1018): sending a packet IPv4 IKE.

Oct 22 16:25:22.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...

22 Oct 16:25:22.814: ISAKMP (0:1018): increment the count of errors on his, try 5 of 5: retransmit the phase 1

Oct 22 16:25:22.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH

Oct 22 16:25:22.814: ISAKMP: (1018): package X.X.138.132 my_port 500 peer_port 500 (I) sending MM_KEY_EXCH

22 Oct 16:25:22.814: ISAKMP: (1018): sending a packet IPv4 IKE.

Oct 22 16:25:32.814: ISAKMP: (1018): transmit phase 1 MM_KEY_EXCH...

22 Oct 16:25:32.814: ISAKMP: (1018): peer does not paranoid KeepAlive.

......

22 Oct 16:25:32.814: ISAKMP: (1018): removal of reason ITS status of 'Death by retransmission P1' (I) MM_KEY_EXCH (post 70.169.138.132)

22 Oct 16:25:32.814: ISAKMP: (1018): removal of reason ITS status of 'Death by retransmission P1' (I) MM_KEY_EXCH (post 70.169.138.132)

22 Oct 16:25:32.814: ISAKMP: Unlocking counterpart struct 0x488B25C8 for isadb_mark_sa_deleted(), count 0

22 Oct 16:25:32.814: ISAKMP: delete peer node by peer_reap for X.X.138.132: 488B25C8

22 Oct 16:25:32.814: ISAKMP: (1018): error suppression node 1112432180 FALSE reason 'IKE deleted.

22 Oct 16:25:32.814: ISAKMP: (1018): error suppression node 422447177 FALSE reason 'IKE deleted.

22 Oct 16:25:32.814: ISAKMP: (1018): node-278980615 error suppression FALSE reason 'IKE deleted.

22 Oct 16:25:32.814: ISAKMP: (1018): entry = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

22 Oct 16:25:32.814: ISAKMP: (1018): former State = new State IKE_I_MM5 = IKE_DEST_SA

22 Oct 16:26:22.816: ISAKMP: (1018): purge the node 1112432180

22 Oct 16:26:22.816: ISAKMP: (1018): purge the node 422447177

22 Oct 16:26:22.816: ISAKMP: (1018): purge the node-278980615

22 Oct 16:26:32.816: ISAKMP: (1018): serving SA., its A 487720, 0 =, delme = A 487720, 0

The PIX is also used VPN client, such as the VPN Cicso 5.0 client access, works very well. Router is used as a server SSL VPN, too much work

I know there are a lot of data here, I hope that these data may be useful for diagnostic purposes.

All suggestions and tips are greatly appreciated.

Sean

Recommended action:

On the PIX:

no card crypto outside_map 1

!

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

life 86400

!

card crypto outside_map 10 correspondence address outside_1_cryptomap

crypto outside_map 10 peer X.X.216.29 card game

outside_map crypto 10 card value transform-set ESP-3DES-SHA

life safety association set card crypto outside_map 10 28800 seconds

card crypto outside_map 10 set security-association life kilobytes 4608000

!

tunnel-group X.X.216.29 type ipsec-l2l

IPSec-attributes tunnel-Group X.X.216.29

Pre-shared key SECRET

!

On the router:

crypto ISAKMP policy 10

preshared authentication

Group 2

3des encryption

!

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

output

!

card 10 la-2800-ipsec policy ipsec-isakmp crypto

ipsec vpn Description policy

defined by peer X.X.138.132

game of transformation-ESP-3DES-SHA

match address 101

!

No crypto card-2800-ipsec-policy 1

Let me know how it goes.

Portu.

Please note all useful posts

Post edited by: Javier Portuguez

VPN needs access to all external internal vpn traffic traffic all in tunnel

Hello

Could someone help me find the problem?

I am ASA configuration as firewall + vpn server, essentially outside of the device's access T1 (there are two VLANS in inside via an iptables, outside of iptables is on the same vlan as insdie of ASA (192.168.5.1 and 192.168.5.2).) VPN users are authenticated via authentication 2 factors (SDI, ip is 192.168.5.5) and get the ACL by local database. pool of VPN is 192.168.6.1 - 192.168.6.15. pool of VPN is coordinated to the external IP address

trying to access a remote host A from the host a is open for the IP and one specific Protocol. all vpn traffic are in the tunnel. the VPN user can connected and ACL vpnuser1_ONLY not working does not as expected.

Here is the part of configuration:

ASA Version 8.2 (2)
...........

Route outside 0.0.0.0 0.0.0.0 xx.10.194.193 1

Route inside companynet1 255.255.255.0 192.168.5.2 1

Route inside companynet2 255.255.255.0 192.168.5.2 1

Route inside companynet3 255.255.255.0 192.168.5.2 1

Route inside companynet4 255.255.255.0 192.168.5.2 1

...............

Route inside companynetn 255.255.255.0 192.168.5.2 1

NAT (inside) 4 vpnpool 255.255.255.0 outside <--------- is="" this="">

Global (outside) 4 xx.10.194.238 netmask 255.255.255.255

Split-tunnel-policy tunnelall

.....................

vpnuser1_ONLY list extended access permitted tcp vpnpool 255.255.255.0 192.168.1.28 host 255.255.255.255 eq ssh connect

vpnuser1_ONLY list extended access permitted tcp vpnpool 255.255.255.0 74.2.23.195 host 255.255.255.255 eq ssh connect

............

enable SVC

tunnel-group-list activate

attributes of Group Policy DfltGrpPolicy

VPN - connections 8

VPN-idle-timeout 10

VPN-session-timeout 60

Protocol-tunnel-VPN l2tp ipsec

WebVPN

SVC Dungeon - install any

time to generate a new key of SVC 8

SVC generate a new method ssl key

SVC request no svc default

internal GroupPolicy1 group strategy

attributes of Group Policy GroupPolicy1

VPN - connections 1

VPN-idle-timeout 9

VPN-session-timeout 45

VPN-tunnel-Protocol svc

Split-tunnel-policy tunnelall

WebVPN

SVC Dungeon - install any

time to generate a new key of SVC 15

SVC generate a new method ssl key

client of dpd-interval SVC 30

dpd-interval SVC 30 bridge

value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. For more information, contact your COMPUTER administrator.

disable the SVC routing-filtering-ignore

username vpnuser1 encrypted password xxxxxxx

username vpnuser1 attributes

VPN-group-policy GroupPolicy1

VPN-idle-timeout 6

VPN-session-timeout 20

VPN-filter value vpnuser1_ONLY

VPN-tunnel-Protocol svc

value of group-lock COMAVPN

type of remote access service

tunnel-group DefaultRAGroup webvpn-attributes

Disable group companyvpn aliases

type tunnel-group COMAVPN remote access

attributes global-tunnel-group COMAVPN

address (inside) vpnpool pool

address vpnpool pool

SDI Group-authentication server

authentication-server-group (inside) SDI

LOCAL authority-server-group

Group Policy - by default-GroupPolicy1

tunnel-group COMAVPN webvpn-attributes

activation of the Group companyremote alias

I did anything wrong / missing?

Thank you

Yijun

First of all, you can set "no nat-control" because once you have relieved of NAT, 'no nat-control' becomes disable anyway. 'No nat-control' is useful if you have no statement of NAT at all on the interface.

Second, if you can't access the outside inside which is because you must configure the NAT exemption. Not sure if you have configured it.

Here's the command:

access-list allowed sheep ip 192.168.1.0 255.255.255.0 192.168.6.0 255.255.255.0

NAT (inside) 0 access-list sheep

You can then add all other subnets that are internal to the ACL sheep if you need VPN access.

Finally, for the error message deny on access-group "OUTSIDE", you would need check if you have configured "sysopt connection VPN-enabled'. If it is disabled, it will also check the "OUTSIDE" interface for VPN traffic.

VPN traffic via a secondary access provider

Hello world

I have been asked by a client to implement this topology:

where:

ISP 1 is used as primary internet connection.

2 ISP will be used to connect remote users by IPsec VPN.

Currently, I'm not looking for the Active/Backup feature, I need to know if I can use both ISP connections (as I've written before) an ISP for the Internet company and the other for the user remote access VPN.

I read some post where, said, it's possible, but I want to be sure.

Kind regards

Jose

ASA must add the static route in the routing table automatically when the VPN client is connected. So, in general, you don't need to do anything. But if not, you can just manually configure who will forward a VPN client IP packet to ISP2.

With respect to NAT, in general, VPN traffic must ignore the NAT. You can use "nat (inside_interface_name) 0-list of access ' with an ACL that define the vpn traffic to do so.

Troubleshoot VPN traffic to a paricular IP and port

Similar Questions

Maybe you are looking for