I have configured a Cisco ASA 5510 via the ASDM for a remote access VPN tunnel. It is configured to do pre-share authentication and then pass user authentication to an IAS server to query against AD.
It seems like all is well I am able to authenticate however in the final step which is Negotiating Security Policies it does not ever finish and the client hangs here forever. I can not even disconnect without restarting the machine. What seems to be happening is I never get an IP address assigned from the pool specified on the ASA which I think is hanging up the IPSEC portion of the connection.
If I do a show crypto isakmp sa I do have an entry while the client is still saying Negotiating Security Policies . However if I do a show crypto ipsec sa I do not have any entries leading me to my last conclusion that I am failing on the IPSEC portion of the connection.
I have run and verified that the AAA portion of the configuration is working by running the test command. I do get a response of INFO: Authentication Successful.
Below is my current VPN configuration from the ASA.
Version for reference:
ASA: 8.0(3)
ASDM: 6.0(3)
VPN Client: 5.0.02.0090
Thank you for your time.
access-list PDX-Remote_splitTunnelAcl standard permit any
access-list inside_nat0_outbound extended permit ip any 192.168.201.0 255.255.255.0
ip local pool VPN 192.168.201.2-192.168.201.
254 mask 255.255.255.0
dynamic-access-policy-reco
rd DfltAccessPolicy
aaa-server RADIUS protocol radius
reactivation-mode timed
aaa-server RADIUS host PDX-DC1
key **************
acl-netmask-convert auto-detect
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console RADIUS LOCAL
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec transform-set TRANS_ESP_AES-128_SHA esp-aes esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_AES-128_SHA mode transport
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128
-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256
-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
vpn-addr-assign local reuse-delay 10
group-policy DfltGrpPolicy attributes
ip-comp enable
group-policy PDX-Remote internal
group-policy PDX-Remote attributes
dns-server value 10.1.1.50 10.1.1.128
vpn-idle-timeout 30
vpn-session-timeout 600
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value PDX-Remote_splitTunnelAcl
default-domain value columbia-dist.com
tunnel-group PDX-Remote type remote-access
tunnel-group PDX-Remote general-attributes
address-pool VPN
authentication-server-grou
p RADIUS
default-group-policy PDX-Remote
tunnel-group PDX-Remote ipsec-attributes
pre-shared-key *
!
Start Free Trial
