July 24, 2008 01:47pm pdt

Member Login

Top Experts

Yearly

1batry_boy 585,976
2lrmoore 211,025
3mkielar 102,700
4Voltz-dk 99,420
5MrHusy 90,695
6Cyclops3... 77,840
7PeteLong 71,000
8grblades 40,275
9JFrederic... 37,100
10nodisco 34,925
11raptorjb007 33,000
12from_exp 32,120
13rsivanandan 30,980
142PiFL 25,575
15stuknhaw... 25,425

	[x] Attachment Details

Trouble using Cisco VPN client behind a Cisco ASA 5505

Zones: Cisco PIX Firewall, Virtual Private Networking (VPN), Networking Hardware Firewalls

Tags: Cisco, Cisco ASA 5505, Cisco ASA 5505, Trouble using Cisco VPN client behind a Cisco ASA 5505

In this environment users remote in using the Cisco VPN client (software Ver 5.0) to VPN into the main office (via a PIX). The VPN client works flawlessly (i.e. through Linksys and D-Links routers) except when sitting behind a Cisco ASA 5505. When the user tries to VPN in the tunnel gets created (i.e client gets a valid IP address from the main office) but cannot access any network resources, ping by name or IP address. Below is the running configuration of a Cisco ASA 5505 which is causing this issue.

What am I missing in this running config to get the Cisco VPN client working behind this ASA 5505? If I remember corretly, when the user tries the VPN client, I see syslog 305006 everytime the client tries to acces a network resource (unsuccessfully).

         
           
             1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:

           
           
             ASA Version 7.2(2)
!
hostname ****
domain-name ****.local
enable password aqKH0I8CseFDWGiF encrypted
names
!
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name ****.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service tcp_in tcp
object-group protocol protocol_in
object-group network local_LAN network-object 192.168.1.0 255.255.255.0
access-list outside_access_in extended permit tcp any interface outside object-group tcp_in
access-list inside_nat0_outbound extended permit ip any 192.168.1.0 255.255.255.0
access-list vpn_group_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
pager lines 24s
mtu inside 1500
mtu outside 1500
ip local pool webvpn 192.168.1.50-192.168.1.75 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp deny any outside
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp www_server smtp netmask 255.255.255.255
static (inside,outside) tcp interface https www_server https netmask 255.255.255.255
static (inside,outside) tcp interface www www_server www netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy webvpn internal
group-policy webvpn attributes
 wins-server value 192.168.1.5
 dns-server value 192.168.1.5
 vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value vpn_group_splitTunnelAcl
 default-domain value 192.168.1.5
 address-pools value webvpn
 webvpn
  functions url-entry file-access file-entry file-browsing
  customization none
  port-forward none
  port-forward-name value Application Access
  svc enable
  svc keep-installer none
  svc rekey time 30
  svc rekey method ssl
group-policy vpn_group internal
group-policy vpn_group attributes
 wins-server value 192.168.1.5
 dns-server value 192.168.1.5
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value vpn_group_splitTunnelAcl
 default-domain value jds.local
username ******** password PDT8b1Ijt5BrogRd encrypted privilege 15
username ******** password rbL/d2O90evgDz.W encrypted privilege 15
username ******** password K1NOSRbR.tN8fAdl encrypted privilege 15
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 outside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
tunnel-group DefaultWEBVPNGroup general-attributes
 address-pool webvpn
 default-group-policy webvpn
tunnel-group vpn_group type ipsec-ra
tunnel-group vpn_group general-attributes
 address-pool webvpn
 default-group-policy vpn_group
tunnel-group vpn_group ipsec-attributes
 pre-shared-key *
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 192.168.1.0 255.255.255.0 outside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.33 inside
!
 
priority-queue inside
priority-queue outside
!
class-map vpn_qos
 match tunnel-group vpn_group
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map vpn_qos
 class vpn_qos
  priority
!
service-policy vpn_qos interface inside
service-policy vpn_qos interface outside

           
         

Start your free trial to view this solution

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.2

Question Stats

Zone: Security

Question Asked By: jonske01

Solution Provided By: mkielar

Participating Experts: 1

Solution Grade: A

Translate:

Loading Advertisement...

20080723-EE-VQP-34 / EE_QW_2_20070628