try VPN remote ping inside the network

Similar Questions

• ASA 5512 Anyconnect VPN cannot connect inside the network 9.1 x

  Hello

  I'm new to ASA, can I please help with this. I managed to connect to the vpn through the mobility cisco anyconnect client, but I am unable to connect to the Internet. the allocated ip address was 172.16.1.60 and it seems OK, I thought my acl and nat is configured to allow and translate the given vpn ip pool but I'm not able to ping anything on the inside.

  If anyone can share some light... There's got to be something escapes me...

  Here's my sh run

  Thank you

  Raul

  -------------------------------------------------------------------------------

  DLSYD - ASA # sh run

  : Saved
  :
  ASA 9.1 Version 2
  !
  hostname DLSYD - ASA
  domain delo.local
  activate the encrypted password of UszxwHyGcg.e6o4z
  names of
  mask 172.16.1.60 - 172.16.1.70 255.255.255.0 IP local pool DLVPN_Pool
  !
  interface GigabitEthernet0/0
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/1
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/2
  Post description
  10 speed
  full duplex
  nameif Ext
  security-level 0
  IP 125.255.160.54 255.255.255.252
  !
  interface GigabitEthernet0/3
  Description Int
  10 speed
  full duplex
  nameif Int
  security-level 100
  IP 192.168.255.2 255.255.255.252
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  boot system Disk0: / asa912-smp - k8.bin
  passive FTP mode
  clock timezone IS 10
  clock daylight saving time EDT recurring last Sun Oct 02:00 last Sun Mar 03:00
  DNS lookup field inside
  DNS domain-lookup Int
  DNS server-group DefaultDNS
  192.168.1.90 server name
  192.168.1.202 server name
  domain delo.local
  permit same-security-traffic intra-interface
  network dlau40 object
  Home 192.168.1.209
  network dlausyd02 object
  host 192.168.1.202
  network of the object 192.168.1.42
  host 192.168.1.42
  dlau-utm network object
  host 192.168.1.50
  network dlauxa6 object
  Home 192.168.1.62
  network of the 192.168.1.93 object
  host 192.168.1.93
  network dlau-ftp01 object
  Home 192.168.1.112
  dlau-dlau-ftp01 network object
  network dlvpn_network object
  subnet 172.16.1.0 255.255.255.0
  the object-group Good-ICMP ICMP-type
  echo ICMP-object
  response to echo ICMP-object
  ICMP-object has exceeded the time
  Object-ICMP traceroute
  ICMP-unreachable object
  DLVPN_STAcl list standard access allowed 192.168.0.0 255.255.0.0
  Standard access list DLVPN_STAcl allow 196.1.1.0 255.255.255.0
  DLVPN_STAcl list standard access allowed 126.0.0.0 255.255.0.0
  Ext_access_in access list extended icmp permitted any object-group Good-ICMP
  Ext_access_in list extended access permitted tcp dlau-ftp01 eq ftp objects
  Ext_access_in list extended access permit tcp any object dlausyd02 eq https
  Ext_access_in list extended access permit tcp any object dlau-utm eq smtp
  Ext_access_in list extended access permit tcp any object dlauxa6 eq 444
  Ext_access_in access-list extended permitted ip object annete-home everything
  pager lines 24
  Enable logging
  asdm of logging of information
  MTU 1500 Ext
  MTU 1500 Int
  management of MTU 1500
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 713.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT (Int, Ext) static source any any destination static dlvpn_network dlvpn_network non-proxy-arp
  !
  network dlausyd02 object
  NAT (Int, Ext) interface static tcp https https service
  dlau-utm network object
  NAT (Int, Ext) interface static tcp smtp smtp service
  network dlauxa6 object
  NAT (Int, Ext) interface static tcp 444 444 service
  network dlau-ftp01 object
  NAT (Int, Ext) interface static tcp ftp ftp service
  Access-group Ext_access_in in Ext interface
  Route Ext 0.0.0.0 0.0.0.0 125.255.160.53 1
  Route Int 192.168.0.0 255.255.0.0 192.168.255.1 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  AAA authentication enable LOCAL console
  AAA authentication LOCAL telnet console
  AAA authentication http LOCAL console
  LOCAL AAA authentication serial console
  the ssh LOCAL console AAA authentication
  http server enable 44310
  http server idle-timeout 30
  http 192.168.0.0 255.255.0.0 Int
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec pmtu aging infinite - the security association
  trustpool crypto ca policy
  Telnet 192.168.1.0 255.255.255.0 management
  Telnet timeout 30
  SSH 192.168.0.0 255.255.0.0 Int
  SSH timeout 30
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  No ipv6-vpn-addr-assign aaa
  no local ipv6-vpn-addr-assign
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  NTP server 61.8.0.89 prefer external source
  SSL encryption rc4-aes128-sha1 aes256-3des-sha1 sha1 sha1
  WebVPN
  port 44320
  allow outside
  Select Ext
  AnyConnect essentials
  AnyConnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 1
  AnyConnect enable
  tunnel-group-list activate
  internal GroupPolicy_DLVPN group strategy
  attributes of Group Policy GroupPolicy_DLVPN
  WINS server no
  value of server DNS 192.168.1.90 192.168.1.202
  client ssl-VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list DLVPN_STAcl
  delonghi.local value by default-field
  WebVPN
  AnyConnect Dungeon-Installer installed
  time to generate a new key 30 AnyConnect ssl
  AnyConnect ssl generate a new method ssl key
  AnyConnect ask flawless anyconnect
  encrypted vendor_ipfx pb6/6ZHhaPgDKSHn password username
  vendor_pacnet mIHuYi1jcf9OqVN9 encrypted password username
  username admin password encrypted tFU2y7Uo15ahFyt4
  type tunnel-group DLVPN remote access
  attributes global-tunnel-group DLVPN
  address pool DLVPN_Pool
  Group Policy - by default-GroupPolicy_DLVPN
  tunnel-group DLVPN webvpn-attributes
  enable DLVPN group-alias
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the netbios
  Review the ip options
  inspect the ftp
  inspect the tftp
  !
  global service-policy global_policy
  SMTPS
  Server 192.168.1.50
  Group Policy - by default-DfltGrpPolicy
  context of prompt hostname
  no remote anonymous reporting call
  Cryptochecksum:67aa840d5cfff989bc045172b2d06212
  : end
  DLSYD - ASA #.

  Hello

  Add just to be sure, the following configurations related to ICMP traffic

  Policy-map global_policy
  class inspection_default
  inspect the icmp
  inspect the icmp error

  Your NAT0 configurations for traffic between LAN and VPN users seem to. Your Split Tunnel ACL seems fine too because it has included 192.168.0.0/16. I don't know what are the other.

  I wonder if this is a test installation since you don't seem to have a dynamic PAT configured for your local network at all. Just a few static PAT and the NAT0 for VPN configurations. If it is a test configuration yet then confirmed that the device behind the ASA in the internal network has a default route pointing to the ASAs interface and if so is it properly configured?

  Can you same ICMP the directly behind the ASA which is the gateway to LANs?

  If you want to try ICMP interface internal to the VPN ASA then you can add this command and then try ICMP to the internal interface of the ASA

  Int Management-access

  As the post is a little confusing in the sense that the subject talk on the traffic doesn't work not internal to the network, while the message mentions the traffic to the Internet? I guess you meant only traffic to the local network because you use Split Tunnel VPN, which means that Internet traffic should use the VPN local Internet users while traffic to the networks specified in the ACL Tunnel Split list should be sent to the VPN.

  -Jouni

• PIX501 customer VPN - cannot access inside the network with VPN Session

  What follows is based on the config on the attached link:

  http://www.Cisco.com/en/us/Partner/Tech/tk583/TK372/technologies_configuration_example09186a008009442e.shtml

  PIX Ver 6.2 (3) - VPN Client 3.3.6(A) - Windows XP Client PC

  We can establish the VPN to the PIX501 session, but we cannot access the network private behind the pix.

  Here is the config - I can't determine why it does not work, we are desperate to get there as soon as POSSIBLE!

  We have the same problem with the customer 4.0.3(c)

  Thanks in advance for any help!

  =======================================

  AKCPIX00 # sh run

  : Saved

  :

  6.2 (3) version PIX

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  hostname AKCPIX00

  domain.com domain name

  fixup protocol ftp 21

  fixup protocol http 80

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol they 389

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol sip 5060

  fixup protocol 2000 skinny

  fixup protocol sip udp 5060

  names of

  access-list 101 permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

  pager lines 24

  interface ethernet0 10baset

  interface ethernet1 10full

  Outside 1500 MTU

  Within 1500 MTU

  external IP address #. #. #. # 255.255.240.0

  IP address inside 192.168.1.5 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP local pool akcpool 10.0.0.1 - 10.0.0.10

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  (Inside) NAT 0-list of access 101

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Route outside 0.0.0.0 0.0.0.0 #. #. #. # 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  the ssh LOCAL console AAA authentication

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  No sysopt route dnat

  Crypto ipsec transform-set esp - esp-md5-hmac RIGHT

  Crypto-map dynamic dynmap 10 transform-set RIGHT

  map mymap 10-isakmp ipsec crypto dynamic dynmap

  mymap outside crypto map interface

  ISAKMP allows outside

  part of pre authentication ISAKMP policy 10

  encryption of ISAKMP policy 10

  ISAKMP policy 10 md5 hash

  10 2 ISAKMP policy group

  ISAKMP life duration strategy 10 86400

  vpngroup address akcpool pool akcgroup

  vpngroup dns 192.168.1.10 Server akcgroup

  vpngroup akcgroup by default-domain domain.com

  vpngroup split tunnel 101 akcgroup

  vpngroup idle 1800 akcgroup-time

  vpngroup password akcgroup *.

  vpngroup idle 1800 akc-time

  Telnet timeout 5

  SSH #. #. #. # 255.255.255.255 outside

  SSH timeout 15

  dhcpd address 192.168.1.100 - 192.168.1.130 inside

  dhcpd dns 192.168.1.10

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd allow inside

  Terminal width 80

  Cryptochecksum:XXXXX

  : end

  AKCPIX00 #.

  Config looks good - just as domestic mine to my local network. The only thing I can think is that you may have entered commands in the wrong order - which means, you could have isakmp or encryption before the config map was complete. Write memory, then reloading the pix is a way to reset everything. If you do not want downtime:

  mymap outside crypto map interface

  ISAKMP allows outside

  Enter these two commands should be enough to reset the ipsec and isakmp.

• Client VPN cannot get inside the network

  The VPN client connects to the 2600 on the serial interface, should be able to get to the 10.10.0.0 network beyond 192.168.1.14. The customer ping responds failure of external serial interface address.

  If you still have problems... can you check that there is a static route BOF 192.168.100.0/24 on router 192.168.1.14 and initiate a tracert to a host on the network of 10.10.x.x at 192.168.100.7 and see where it goes... your tests show that the VPN client knows how to get to this subnet, but it seems that there is a problem of routing between 10.X.X.X going 192.168.100.0

  I hope that helps!

• Not able to ping inside the interface from outside

  Hello

  I'm trying to stimulate a new network like the diagram of the topology below:

  Topology

  However, I have a problem:

  ASA:

  I can ping to:

  192.168.200.1 (Site_RTR IP, int fa0/1)

  192.168.200.2 (ASA vlan interface IP, outside interface)

  10.133.95.12 (DC_RTR, int fa0/1)

  10.133.200.1 (ASA vlan interface IP, inside the interface)

  10.133.200.23 (machine)

  The RTR website, I can do a ping to:

  10.133.95.12

  192.168.200.1

  192.168.200.2

  10.133.200.23 (machine)

  but not

  10.133.200.1 (ASA vlan interface IP, inside the interface)

  Question 1:

  It is possible to access / ping back to this address within the IP Interface from outside?

  Question 2:

  As all subnets 10.0.0.0/8 will go through the interface on the outside, however for the internet traffic, out thru interfacera outside 2.

  I haven't set up any nat, is correct to nat all out for outside2?

  NAT (inside outside2) source Dynamics one interface

  Configuration

  Thanks for the help.

  JJ

  Hi JJ,

  If you plan doing a ping within the IP address of the interface, while the traffic is coming from any interface other than inside, you won't able to ping inside the IP address of the interface.

  This is by design, and you cannot change it by any ACL or other settings.

  Thank you
  Ishan
  Please do not forget to select a correct answer and rate useful posts

• ASA 5540 - cannot ping inside the interface

  Hi all. We have recently upgraded PIX to ASA5540 and we saw a strange thing going. In a Word, we can ping the inside interface of the ASA from any beach on our 6500 network (which is connected directly behind the ASA on the inside), but one where our monitoring tools are placed. Inside there is an ACL that allows all of our core networks, but it does not help that the interface is really strange.

  In the ASDM, I see messages like this:

  ID ICMP echo request: 2004 x.x.x.x y.y.y.y on the inside interface to. I don't think that's the problem, but I could be wrong.

  This is also the configuration of the interface VLAN VIRTUAL local area network from which we cannot ping inside the interface we can ping to and since this VLAN and machines without problem. The only problem is ping the inside interface of the ASA.

  interface Vlanx

  IP x.x.x.x 255.255.255.0

  IP broadcast directed to 199

  IP accounting output-packets

  IP pim sparse - dense mode

  route IP cache flow

  load-interval 30

  Has anyone experiences the problem like this before? Thanks in advance for any help.

  Can you post the output of the following on the ASA:-

  display the route

  And the output of your base layer diverter: -.

  show ip route<>

  HTH >

• Cisco ASA 8.4 (3) remote access VPN - client connects but cannot access inside the network

  I have problems to access the resources within the network when connecting with the Cisco VPN client for a version of 8.4 (3) operation of the IOS Cisco ASA 5510. I tried all new NAT 8.4 orders but cannot access the network interior. I can see traffic in newspapers when ping. I can only assume I have NAT evil or it's because the inside interface of the ASA is on the 24th of the same subnet as the network interior? Please see config below, any suggestion would be appreciated. I configured a VPN site to another in this same 5510 and it works well

  Thank you

  interface Ethernet0/0

  Speed 100

  full duplex

  nameif outside

  security-level 0

  IP x.x.x.x 255.255.255.240

  !

  interface Ethernet0/1

  Speed 100

  full duplex

  nameif inside

  security-level 100

  IP 10.88.10.254 255.255.255.0

  !

  interface Management0/0

  Shutdown

  nameif management

  security-level 0

  no ip address

  !

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  network of the PAT_to_Outside_ClassA object

  10.88.0.0 subnet 255.255.0.0

  network of the PAT_to_Outside_ClassB object

  subnet 172.16.0.0 255.240.0.0

  network of the PAT_to_Outside_ClassC object

  Subnet 192.168.0.0 255.255.240.0

  network of the LocalNetwork object

  10.88.0.0 subnet 255.255.0.0

  network of the RemoteNetwork1 object

  Subnet 192.168.0.0 255.255.0.0

  network of the RemoteNetwork2 object

  172.16.10.0 subnet 255.255.255.0

  network of the RemoteNetwork3 object

  10.86.0.0 subnet 255.255.0.0

  network of the RemoteNetwork4 object

  10.250.1.0 subnet 255.255.255.0

  network of the NatExempt object

  10.88.10.0 subnet 255.255.255.0

  the Site_to_SiteVPN1 object-group network

  object-network 192.168.4.0 255.255.254.0

  object-network 172.16.10.0 255.255.255.0

  object-network 10.0.0.0 255.0.0.0

  outside_access_in deny ip extended access list a whole

  inside_access_in of access allowed any ip an extended list

  11 extended access-list allow ip 10.250.1.0 255.255.255.0 any

  outside_1_cryptomap to access extended list ip 10.88.0.0 255.255.0.0 allow object-group Site_to_SiteVPN1

  mask 10.250.1.1 - 10.250.1.254 255.255.255.0 IP local pool Admin_Pool

  NAT static NatExempt NatExempt of the source (indoor, outdoor)

  NAT (inside, outside) static source any any static destination RemoteNetwork4 RemoteNetwork4-route search

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork1 RemoteNetwork1

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork2 RemoteNetwork2

  NAT static LocalNetwork LocalNetwork destination (indoor, outdoor) static source RemoteNetwork3 RemoteNetwork3

  NAT (inside, outside) static source LocalNetwork LocalNetwork static destination RemoteNetwork4 RemoteNetwork4-route search

  !

  network of the PAT_to_Outside_ClassA object

  NAT dynamic interface (indoor, outdoor)

  network of the PAT_to_Outside_ClassB object

  NAT dynamic interface (indoor, outdoor)

  network of the PAT_to_Outside_ClassC object

  NAT dynamic interface (indoor, outdoor)

  Access-group outside_access_in in interface outside

  inside_access_in access to the interface inside group

  Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

  dynamic-access-policy-registration DfltAccessPolicy

  Sysopt connection timewait

  Service resetoutside

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec transform-set esp-ikev1 esp-md5-hmac bh-series

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto-map dynamic dynmap 10 set pfs

  Crypto-map dynamic dynmap 10 set transform-set bh - set ikev1

  life together - the association of security crypto dynamic-map dynmap 10 28800 seconds

  Crypto-map dynamic dynmap 10 kilobytes of life together - the association of safety 4608000

  Crypto-map dynamic dynmap 10 the value reverse-road

  card crypto mymap 1 match address outside_1_cryptomap

  card crypto mymap 1 set counterpart x.x.x.x

  card crypto mymap 1 set transform-set ESP-AES-256-SHA ikev1

  card crypto mymap 86400 seconds, 1 lifetime of security association set

  map mymap 1 set security-association life crypto kilobytes 4608000

  map mymap 100-isakmp ipsec crypto dynamic dynmap

  mymap outside crypto map interface

  crypto isakmp identity address

  Crypto isakmp nat-traversal 30

  Crypto ikev1 allow outside

  IKEv1 crypto ipsec-over-tcp port 10000

  IKEv1 crypto policy 5

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 1

  life 86400

  IKEv1 crypto policy 50

  preshared authentication

  the Encryption

  md5 hash

  Group 2

  life 86400

  IKEv1 crypto policy 60

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 70

  preshared authentication

  aes-256 encryption

  sha hash

  Group 1

  life 86400

  IKEv1 crypto policy 90

  preshared authentication

  aes encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  Console timeout 0

  management-access inside

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal BACKDOORVPN group policy

  BACKDOORVPN group policy attributes

  value of VPN-filter 11

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelall

  BH.UK value by default-field

  type tunnel-group BACKDOORVPN remote access

  attributes global-tunnel-group BACKDOORVPN

  address pool Admin_Pool

  Group Policy - by default-BACKDOORVPN

  IPSec-attributes tunnel-group BACKDOORVPN

  IKEv1 pre-shared-key *.

  tunnel-group x.x.x.x type ipsec-l2l

  tunnel-group ipsec-attributes x.x.x.x

  IKEv1 pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  Excellent.

  Evaluate the useful ticket.

  Thank you

  Rizwan James

• ASA 5505 9.1 Unable to ping inside the IPSec VPN network

  To give some background that the asa has been reloaded and upgranded from 8.2 to 9.1.  I am able to connect to vpn, but unable to reach anything inside, including of the asa.  I didn't unfortunately not much experience with 8.3 +, but I thought that I had nat made appropriately.  Nothing else is currently configured for the asa, as it's just an asa test currently, so I could of just missed something odvious.

  ASA Version 9.1 (3)

  !

  hostname testasa

  activate the encrypted password of Ry5/Pmodu2QL1Xe3

  volatile xlate deny tcp any4 any4

  volatile xlate deny tcp any4 any6

  volatile xlate deny tcp any6 any4

  volatile xlate deny tcp any6 any6

  volatile xlate deny udp any4 any4 eq field

  volatile xlate deny udp any4 any6 eq field

  volatile xlate deny udp any6 any4 eq field

  volatile xlate deny udp any6 any6 eq field

  names of

  mask 192.168.3.1 - 192.168.3.200 255.255.255.0 IP local pool VPNPool

  !

  interface Ethernet0/0

  !

  interface Ethernet0/1

  switchport access vlan 2

  !

  interface Ethernet0/2

  switchport access vlan 2

  !

  interface Ethernet0/3

  switchport access vlan 2

  !

  interface Ethernet0/4

  switchport access vlan 2

  !

  interface Ethernet0/5

  switchport access vlan 2

  !

  interface Ethernet0/6

  switchport access vlan 2

  !

  interface Ethernet0/7

  switchport access vlan 2

  !

  interface Vlan1

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  interface Vlan2

  nameif inside

  security-level 100

  IP 192.168.2.252 255.255.255.0

  !

  passive FTP mode

  network of the NETWORK_OBJ_192.168.2.0_24 object

  Subnet 192.168.2.0 255.255.255.0

  network of the NETWORK_OBJ_192.168.3.0_24 object

  subnet 192.168.3.0 255.255.255.0

  network of object obj-Interior

  Subnet 192.168.2.0 255.255.255.0

  object obj - vpn network

  subnet 192.168.3.0 255.255.255.0

  VPNGroup_splitTunnelAcl list standard access allowed 192.168.2.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Outside 1500 MTU

  Within 1500 MTU

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (inside, outside) static source inside obj obj-indoor destination static obj - vpn obj - vpn

  !

  NAT source auto after (indoor, outdoor) dynamic one interface

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  Enable http server

  http 192.168.2.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  Crypto ipsec pmtu aging infinite - the security association

  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  trustpool crypto ca policy

  Crypto ikev1 allow outside

  IKEv1 crypto policy 10

  authentication crack

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 20

  authentication rsa - sig

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 30

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 40

  authentication crack

  aes-192 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 50

  authentication rsa - sig

  aes-192 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 60

  preshared authentication

  aes-192 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 70

  authentication crack

  aes encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 80

  authentication rsa - sig

  aes encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 90

  preshared authentication

  aes encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 100

  authentication crack

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 110

  authentication rsa - sig

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 120

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 130

  authentication crack

  the Encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 140

  authentication rsa - sig

  the Encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 150

  preshared authentication

  the Encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH timeout 5

  SSH group dh-Group1-sha1 key exchange

  Console timeout 0

  interface ID client DHCP-client to the outside

  dhcpd address 192.168.2.50 - 192.168.2.100 inside

  dhcpd dns 208.67.222.222 198.153.192.40 interface inside

  dhcpd allow inside

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  AnyConnect essentials

  internal VPNGroup group strategy

  Group Policy attributes VPNGroup

  value of server DNS 208.67.222.222 198.153.192.40

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPNGroup_splitTunnelAcl

  disable the split-tunnel-all dns

  no method of MSIE-proxy-proxy

  VLAN no

  NAC settings no

  test I9znLlryc6yq.BN4 encrypted privilege 15 password username

  tunnel-group VPNGroup type remote access

  attributes global-tunnel-group VPNGroup

  address pool VPNPool

  Group Policy - by default-VPNGroup

  IPSec-attributes tunnel-group VPNGroup

  IKEv1 pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  Review the ip options

  inspect the netbios

  inspect the rsh

  inspect the rtsp

  inspect the skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect the tftp

  inspect the sip

  inspect xdmcp

  inspect the icmp

  inspect the icmp error

  !

  global service-policy global_policy

  context of prompt hostname

  Hello

  To be honest, I can't see anything in the configuration that should be a problem.

  Your NAT settings seem to be correct.

  You have the global setting of "sysopt connection permit - vpn" who does not appear in this form in the CLI configuration. This configuration means essentially that the SAA would allow traffic from a VPN connection to work around interface ACL of the interface when the VPN connection is completed (outside)

  Your ACL Split Tunnel is also correct.

  You might connect with VPN Client and run a continuous ICMP to a host of LAN and provide an output of the following command after a the ICMP has run a few seconds

  Crypto ipsec to show his

  Should see the counters of VPN.

  You can also try adding

  management-access inside

  This should allowed you to the 'internal' to the ASA IP ICMP and also manage ASA through the VPN connection by using the 'internal' the IP address provided you have enabled it. But for this you need to change the configuration of "nat" in this

  NAT (inside, outside) static source inside obj obj-indoor destination static obj - vpn vpn-obj-research route

  Hope this helps

  -Jouni

• Remote access VPN client to connect but cannot ping inside the host, after that split tunnel is activated (config-joint)

  Hello

  I don't know what could be held, vpn users can ping to the outside and inside of the Cisco ASA interface but can not connect to servers or servers within the LAN ping.

  is hell config please kindly and I would like to know what might happen.

  hostname horse

  domain evergreen.com

  activate 2KFQnbNIdI.2KYOU encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  ins-guard

  !

  interface GigabitEthernet0/0

  LAN description

  nameif inside

  security-level 100

  192.168.200.1 IP address 255.255.255.0

  !

  interface GigabitEthernet0/1

  Description CONNECTION_TO_FREEMAN

  nameif outside

  security-level 0

  IP 196.1.1.1 255.255.255.248

  !

  interface GigabitEthernet0/2

  Description CONNECTION_TO_TIGHTMAN

  nameif backup

  security-level 0

  IP 197.1.1.1 255.255.255.248

  !

  interface GigabitEthernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  Shutdown

  No nameif

  no level of security

  no ip address

  management only

  !

  boot system Disk0: / asa844-1 - k8.bin

  boot system Disk0: / asa707 - k8.bin

  passive FTP mode

  clock timezone WAT 1

  DNS server-group DefaultDNS

  domain green.com

  network of the NETWORK_OBJ_192.168.2.0_25 object

  Subnet 192.168.2.0 255.255.255.128

  network of the NETWORK_OBJ_192.168.202.0_24 object

  192.168.202.0 subnet 255.255.255.0

  network obj_any object

  subnet 0.0.0.0 0.0.0.0

  the DM_INLINE_NETWORK_1 object-group network

  object-network 192.168.200.0 255.255.255.0

  object-network 192.168.202.0 255.255.255.0

  the DM_INLINE_NETWORK_2 object-group network

  object-network 192.168.200.0 255.255.255.0

  object-network 192.168.202.0 255.255.255.0

  access-list extended INSIDE_OUT allow ip 192.168.202.0 255.255.255.0 any

  access-list extended INSIDE_OUT allow ip 192.168.200.0 255.255.255.0 any

  Access extensive list permits all ip a OUTSIDE_IN

  gbnlvpntunnel_splitTunnelAcl standard access list allow 192.168.200.0 255.255.255.0

  standard access list gbnlvpntunnel_splitTunnelAcl allow 192.168.202.0 255.255.255.0

  gbnlvpntunnell_splitTunnelAcl standard access list allow 192.168.200.0 255.255.255.0

  standard access list gbnlvpntunnell_splitTunnelAcl allow 192.168.202.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  backup of MTU 1500

  mask of local pool VPNPOOL 192.168.2.0 - 192.168.2.100 IP 255.255.255.0

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm-645 - 206.bin

  don't allow no asdm history

  ARP timeout 14400

  NAT (inside, outside) static source NETWORK_OBJ_192.168.202.0_24 NETWORK_OBJ_192.168.202.0_24 NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25 non-proxy-arp-search of route static destination

  NAT (inside, backup) static source NETWORK_OBJ_192.168.202.0_24 NETWORK_OBJ_192.168.202.0_24 NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25 non-proxy-arp-search of route static destination

  NAT (inside, outside) static source DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25 non-proxy-arp-search of route static destination

  NAT (inside, backup) static source DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25 non-proxy-arp-search of route static destination

  !

  network obj_any object

  dynamic NAT interface (inside, backup)

  Access-group interface inside INSIDE_OUT

  Access-group OUTSIDE_IN in interface outside

  Route outside 0.0.0.0 0.0.0.0 196.1.1.2 1 track 10

  Route outside 0.0.0.0 0.0.0.0 197.1.1.2 254

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  identity of the user by default-domain LOCAL

  Enable http server

  http 192.168.200.0 255.255.255.0 inside

  http 192.168.202.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  monitor SLA 100

  type echo protocol ipIcmpEcho 212.58.244.71 interface outside

  Timeout 3000

  frequency 5

  monitor als 100 calendar life never start-time now

  Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

  Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

  Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

  Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  outside_map interface card crypto outside

  backup_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

  backup of crypto backup_map interface card

  Crypto ikev1 allow outside

  Crypto ikev1 enable backup

  IKEv1 crypto policy 10

  authentication crack

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 20

  authentication rsa - sig

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 30

  preshared authentication

  aes-256 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 40

  authentication crack

  aes-192 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 50

  authentication rsa - sig

  aes-192 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 60

  preshared authentication

  aes-192 encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 70

  authentication crack

  aes encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 80

  authentication rsa - sig

  aes encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 90

  preshared authentication

  aes encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 100

  authentication crack

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 110

  authentication rsa - sig

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 120

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 130

  authentication crack

  the Encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 140

  authentication rsa - sig

  the Encryption

  sha hash

  Group 2

  life 86400

  IKEv1 crypto policy 150

  preshared authentication

  the Encryption

  sha hash

  Group 2

  life 86400

  !

  track 10 rtr 100 accessibility

  Telnet 192.168.200.0 255.255.255.0 inside

  Telnet 192.168.202.0 255.255.255.0 inside

  Telnet timeout 5

  SSH 192.168.202.0 255.255.255.0 inside

  SSH 192.168.200.0 255.255.255.0 inside

  SSH 0.0.0.0 0.0.0.0 outdoors

  SSH timeout 15

  SSH group dh-Group1-sha1 key exchange

  Console timeout 0

  management-access inside

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  WebVPN

  internal group vpntunnel strategy

  Group vpntunnel policy attributes

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list vpntunnel_splitTunnelAcl

  field default value green.com

  internal vpntunnell group policy

  attributes of the strategy of group vpntunnell

  Ikev1 VPN-tunnel-Protocol

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list gbnlvpntunnell_splitTunnelAcl

  field default value green.com

  Green user name encrypted BoEFKkDtbnX5Uy1Q privilege 15 password

  attributes of user name THE

  VPN-group-policy gbnlvpn

  tunnel-group vpntunnel type remote access

  tunnel-group vpntunnel General attributes

  address VPNPOOL pool

  strategy-group-by default vpntunnel

  tunnel-group vpntunnel ipsec-attributes

  IKEv1 pre-shared-key *.

  type tunnel-group vpntunnell remote access

  tunnel-group vpntunnell General-attributes

  address VPNPOOL2 pool

  Group Policy - by default-vpntunnell

  vpntunnell group of tunnel ipsec-attributes

  IKEv1 pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns migrated_dns_map_1

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the migrated_dns_map_1 dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  call-home

  Profile of CiscoTAC-1

  no active account

  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address

  email address of destination [email protected] / * /

  destination-mode http transport

  Subscribe to alert-group diagnosis

  Subscribe to alert-group environment

  Subscribe to alert-group monthly periodic inventory

  monthly periodicals to subscribe to alert-group configuration

  daily periodic subscribe to alert-group telemetry

  Cryptochecksum:7c1b1373bf2e2c56289b51b8dccaa565

  Hello

  1 - Please run these commands:

  "crypto isakmp nat-traversal 30.

  "crypto than dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 Road opposite value.

  The main issue here is that you have two roads floating and outside it has a better than backup metric, that's why I added the command 'reverse-road '.

  Please let me know.

  Thank you.

• ASA - upgrade to 8.4, impossible to ping inside the interface via IPSec VPN

  We have configured a site 5, site to site VPN scenario.   Last week, we have upgraded 2 devices ASA 5505 to 8.4.2.   Before the upgrade, our monitoring software would ping the inside interface from remote devices to confirm VPN tunnels were established, as well as the addresses of remote devices and the outside of the ASA.   While we were on 8.2, remote equipment successfully ping the inside interface.   After that we went to 8.4.2 we can do a ping to this interface.   We looked at the newspapers and we see the ICMP traffic that is listed in the newspaper, but the remote equipment does not receive back icmp traffic.   We can ping successfully from local hardware interface inside and the external interface of remote devices successfully.  In addition, we can ping material behind the two devices in both directions successfully.

  We are unable to remotely manage the device through the VPN tunnel

  Net is:

  ASA #1 inside 10.168.107.1 (running ASA 8.2)

  ASA #2 inside 10.168.101.1 (running ASA 8,4)

  Server 1 (behind the ASA #1) 10.168.107.34

  Server 2 (behind the ASA #2) 10.168.101.14

  Can ping server 1 Server 2

  Can ping server 1 to 1 of the SAA

  Can ping server 2-ASA 2

  Can ping server 2 to server 1

  Can ping server 2 ASA 1

  Can ping ASA 2 ASA 1

  can not ping ASA 1 and 2 of the ASA

  can not ping server 1 and 2 of the ASA

  cannot access the ASA 2 https for management interface, nor can the ASDM software

  Here is the config on ASA (attached) 2.

  Any thoughts would be appreciated.

  Hey Joseph,.

  Most likely, you hit this bug:

  CSCtr16184            Details of bug

  To-the-box traffic switches vpn hosts after upgrade to 8.4.2.

  Symptom: After the upgrade of the ASA to 8.4.2 all management traffic to employment (including the) ICMP/telnet/ssh/ASDM) hosts via the VPN (L2L or remote access VPN) can fail the IP access address to the administration. Conditionsof : 1. the problem occurs if ASA is on 8.4.2. Not been seen on 8.4.1. 2. the user directly logged in the face of internal interfaces no problem with ICMP/telnet/ssh/AMPS in their respective interfaces. Workaround: The problem goes back to a Manual NAT statement that straddles the address IP-access to the administration. The NAT must have both the source areas and destination. Add the keyword "research route" at the end of the statement by NAT solves the problem. Ex: IP address access to the administration Interface of the ASA is 192.168.1.1. ! Statement by NAT overlapping: NAT obj destination - 192.168.1.0 obj - 192.168.1.0 Shared source (indoor, outdoor) VPN-vpn-obj static obj! New declaration: NAT obj destination - 192.168.1.0 obj - 192.168.1.0 Shared source (indoor, outdoor) public static obj - vpn vpn-obj-research route

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtr16184

  HTH,

  Raga

• Cannot ping inside the vpn client hosts. It's a NAT problem

  Hello everyone, I'm running into what seems to be a cause of exclusion with an IOS IPSEC VPN NAT/nat. I can connect to the VPN with cisco IPSEC VPN client, and I am able to authenticate. Once I have authenticate, I'm not able to reach one of the guests inside. Below is my relevant config. Any help would be greatly appreciated.

  AAA new-model

  !

  !

  AAA authentication login default local

  radius of group AAA authentication login userauthen

  AAA authorization exec default local

  AAA authorization groupauthor LAN

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group businessVPN

  key xxxxxx

  DNS 192.168.10.2

  business.local field

  pool vpnpool

  ACL 108

  Crypto isakmp VPNclient profile

  businessVPN group identity match

  client authentication list userauthen

  ISAKMP authorization list groupauthor

  client configuration address respond

  !

  !

  Crypto ipsec transform-set esp-3des esp-sha-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  Define VPNclient isakmp-profile

  market arriere-route

  !

  !

  10 ipsec-isakmp crypto map clientmap Dynamics dynmap

  interface Loopback0

  IP 10.1.10.2 255.255.255.252

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP virtual-reassembly

  !

  Null0 interface

  no ip unreachable

  !

  interface FastEthernet0/0

  IP 111.111.111.138 255.255.255.252

  IP access-group outside_in in

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  NAT outside IP

  inspect the outgoing IP outside

  IP virtual-reassembly

  automatic duplex

  automatic speed

  clientmap card crypto

  !

  the integrated-Service-Engine0/0 interface

  description Locator is initialized with default IMAP group

  IP unnumbered Loopback0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP virtual-reassembly

  ip address of service-module 10.1.10.1 255.255.255.252

  Service-module ip default gateway - 10.1.10.2

  interface BVI1

  IP 192.168.10.1 255.255.255.0

  no ip redirection

  no ip unreachable

  no ip proxy-arp

  IP nat inside

  IP virtual-reassembly

  IP nat inside source static tcp 192.168.10.2 25 interface FastEthernet0/0 25

  IP nat inside source static tcp 192.168.10.2 443 interface FastEthernet0/0 443

  IP nat inside source static tcp 192.168.10.2 3389 interface FastEthernet0/0 3389

  IP nat inside source map route nat interface FastEthernet0/0 overload

  nat extended IP access list

  deny ip 192.168.10.0 0.0.0.255 192.168.109.0 0.0.0.255

  refuse the 10.1.1.0 ip 0.0.0.255 192.168.109.0 0.0.0.255

  ip licensing 10.1.1.0 0.0.0.255 any

  permit ip 192.168.10.0 0.0.0.255 any

  sheep extended IP access list

  permit ip 192.168.10.0 0.0.0.255 192.168.109.0 0.0.0.255

  ip permit 10.1.10.0 0.0.0.255 192.168.109.0 0.0.0.255

  ip licensing 10.1.1.0 0.0.0.255 192.168.109.0 0.0.0.255

  outside_in extended IP access list

  permit tcp object-group Yes_SMTP host 111.111.111.138 eq smtp

  permit any any eq 443 tcp

  permit tcp 20.20.20.96 0.0.0.31 host 111.111.111.138 eq 3389

  permit tcp 20.20.20.96 0.0.0.31 host 111.111.111.138 eq 22

  allow any host 111.111.111.138 esp

  allow any host 111.111.111.138 eq isakmp udp

  allow any host 111.111.111.138 eq non500-isakmp udp

  allow any host 111.111.111.138 ahp

  allow accord any host 111.111.111.138

  access-list 108 allow ip 192.168.109.0 0.0.0.255 192.168.10.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.1.0 0.0.0.255

  access-list 108 allow ip 192.168.109.0 0.0.0.255 10.1.10.0 0.0.0.255

  !

  !

  !

  !

  route nat allowed 10 map

  match ip address nat

  1 channel ip bridge

  In my view, the acl applied to customer is back. It must allow traffic from the internal network to the pool of customers.

  To confirm, you can open the Cisco VPN client statistics (after login) then go in the route Details tab. We should see the networks you should be able to reach the customer. Make sure that the good ones are here.

  Kind regards

• ASA 5505 VPN cannot access inside the host

  I have access remote VPN configuration on an ASA 5505, but cannot access the host or the AAS when I connect through the VPN. I can connect with the Cisco VPN client and the VPN is on on the SAA and it shows that I am connected. I have the correct Ip address, but I can't ping or you connect to one of the internal addresses. I can't find what I'm missing. I have the VPN without going through the ACL interface. Because I can connect but not going anywhere I'm sure I missed something.

  framework for configuration below

  interface Vlan1

  nameif inside

  security-level 100

  10.1.1.1 IP address 255.255.255.0

  IP local pool xxxx 10.1.1.50 - 10.1.1.55 mask 255.255.255.0

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto-map dynamic outside_dyn_map 20 set pfs

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  PFS set 40 crypto dynamic-map outside_dyn_map

  Crypto-map dynamic outside_dyn_map 40 value transform-set ESP-3DES-SHA

  Crypto-map dynamic inside_dyn_map 20 set pfs

  Crypto-map dynamic inside_dyn_map 20 the value transform-set ESP-3DES-SHA

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  map inside_map 65535-isakmp ipsec crypto dynamic inside_dyn_map

  inside crypto map inside_map interface

  crypto ISAKMP allow inside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  global service-policy global_policy

  XXXXXXX strategy of Group internal

  attributes of the strategy group xxxxxxx

  banner value xxxxx Site Recovery

  WINS server no

  24.xxx.xxx.xx value of DNS server

  VPN-access-hour no

  VPN - connections 3

  VPN-idle-timeout 30

  VPN-session-timeout no

  VPN-filter no

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelall

  by default no

  disable secure authentication unit

  disable authentication of the user

  user-authentication-idle-timeout no

  disable the IP-phone-bypass

  disable the leap-bypass

  disable the NEM

  disable the NAC

  NAC-sq-period 300

  NAC-reval-period 36000

  NAC-by default-acl no

  the address value xxxxxx pools

  enable Smartcard-Removal-disconnect

  the firewall client no

  WebVPN

  url-entry functions

  Free VPN of CNA no

  No vpn-addr-assign aaa

  No dhcp vpn-addr-assign

  tunnel-group xxxx type ipsec-ra

  tunnel-group xxxx general attributes

  xxxx address pool

  Group Policy - by default-xxxx

  blountdr group of tunnel ipsec-attributes

  pre-shared-key *.

  Missing nat exemption for vpn clients. Add the following and you should be good to go.

  inside_nat0_outbound list of allowed ip extended access any 192.168.10.0 255.255.255.0

  NAT (inside) 0-list of access inside_nat0_outbound

• Remote access to the network when AAA server is out of service help

  Hi all, I have a Cisco ASA 5510. I configured Cisco Anyconnect to authenticate via IAS from Windows. We recently had a server crash and I tried to control it remotely and via anyconnect and couldn't. Once the IAS server came, I could come back in the network.

  Y at - there a command that I'm missing that will allow me to connect to the network, even if my AAA server fell Anyconnect?

  Here is my part of the config AAA command...

  RADIUS protocol AAA-server WindowsIAS

  Max - a attempts failed 5

  AAA-server host 192.168.2.15 WindowsIAS (inside)

  XXXXXXXXXX key

  RADIUS-common-pw xxxxxxxxxx

  Thanks in advance... Dan

  Dan,

  Try to add the LOCAL keyword to your authentication server group statement in your group of tunnel or group policy.

  http://www.Cisco.com/en/us/docs/security/ASA/asa90/command/reference/A3...

  Thank you

  Sent by Cisco Support technique iPad App

• Cannot ping inside the ASA from the inside interface

  Don't know what I did wrong... appreciate any help

  Here is the page layout

  laptop--> cisco 3750 switch--> ASA5505 firewall--> future VPN tunnel

  Laptop, switch interface VLAN and inside the ASA are all in the same subnet

  Switch and ASA have all interfaces local network VIRTUAL 52 (the subnet in question), except for the external interface

  -----------------

  This is the problem

  laptop getting ip addressing and def GW via DHCP from the firewall

  switch and FW can ping each other without problem

  FW can't ping, still gets the DHCP scope.

  Thank you

  Dave

  Hello

  How did you setup?

  The laptop is connected to a port of the 3750 (VLAN 52).

  The connection between the 3750 and the SAA is a chest or a link L3?

  If the 3750 has a SVI belonging to VLAN52, you can ping from the correct PC? As well as the ASA?

  Federico.

• Remote Desktop in the network does not work

  First time VPN newbie. I need to set up the vpn for a small company of friends using RV082 so, as a test, I put up here at home using a very basic configuration. The network topology looks like:

  Cloud-online cable modem => RV082-online-online PC win7 DIR655

  On a remote site, I launch QUICKVPN, enter the necessary data and connect. Setting up the Office remotely and put the IP address of my pc at home and the user name to logon and after a minute or two, he says "unable to connect to the computer" (or words to that effect). My home PC has been configured to allow remote desktop connections and this has happened in the past, but not since the installation of RV082. There is nothing in the logs of the PC, or in the newspapers of the RV082. What should be my line of inquiry?

  These products are processed by the Cisco Small Business support community. (URL: https://supportforums.cisco.com/community/netpro/small-business )