I have setup SSL VPN on our ASA5520 and can successfully establish a VPN connection, but I am unable to pass traffic to/from the VPN client and the internal network. Below is a copy of my config and the error message I receive when viewing the debugging log.
Error:
Through-the-device packet to/from management-only network is denied: udp src management:10.1.4.6/161 dst Outside:10.1.200.1/1032
ASA Version 8.0(2)
!
hostname WH-MC-FW-A002
enable password ftagm5OkITOQh/L. encrypted
names
dns-guard
!
interface GigabitEthernet0/0
nameif Outside
security-level 0
ip address 67.x.x.x 255.255.255.x
!
interface GigabitEthernet0/1
nameif DMZ
security-level 50
ip address 172.20.100.1 255.255.252.0
!
interface GigabitEthernet0/2
nameif Inside
security-level 100
ip address 10.1.3.1 255.255.0.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 75
ip address 172.20.16.1 255.255.252.0
management-only
!
passwd ftagm5OkITOQh/L. encrypted
boot system disk0:/asa802-k8.bin
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup Outside
dns domain-lookup DMZ
dns domain-lookup Inside
dns server-group DefaultDNS
name-server 10.1.30.91
domain-name x.com
access-list nonat extended permit ip any 10.1.0.0 255.255.0.0
access-list VPN webtype permit tcp any log default
pager lines 24
logging enable
logging asdm informational
mtu Outside 1500
mtu DMZ 1500
mtu Inside 1500
mtu management 1500
ip local pool SSL_VPN_Users 10.1.200.1-10.1.200.10 mask 255.255.0.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
global (Outside) 200 interface
global (DMZ) 200 172.20.100.100-172.20.100.
150 netmask 255.255.252.0
nat (Inside) 0 access-list nonat
nat (Inside) 200 10.1.0.0 255.255.0.0
route Outside 0.0.0.0 0.0.0.0 67.134.28.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-reco
rd DfltAccessPolicy
webvpn
svc ask none default svc
aaa-server Woodharbor_AAA protocol radius
aaa-server Woodharbor_AAA host 10.1.30.24
timeout 5
key <REMOVED>
radius-common-pw <REMOVED>
nac-policy DfltGrpPolicy-nac-framewor
k-create nac-framework
reval-period 36000
sq-period 300
http server enable
http 172.20.16.0 255.255.252.0 management
http 10.1.0.0 255.255.0.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ca trustpoint ASDM_TrustPoint0
enrollment terminal
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment url
http://maple:80/certsrv/ fqdn WH-MC-FW-A002
subject-name CN=WH-MC-FW-A002
keypair key1
no client-types
crl configure
crypto ca certificate chain ASDM_TrustPoint0
<REMOVED>
quit
no crypto isakmp nat-traversal
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
telnet 10.1.0.0 255.255.0.0 Inside
telnet timeout 5
ssh 10.1.0.0 255.255.0.0 Inside
ssh timeout 5
console timeout 0
management-access management
dhcprelay server 10.1.30.91 Inside
threat-detection basic-threat
threat-detection statistics
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
webvpn
enable Outside
svc image disk0:/sslclient-win-1.1.0
.154.pkg 1
svc enable
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
webvpn
svc ask none default svc
group-policy GroupAdmins internal
group-policy GroupAdmins attributes
vpn-tunnel-protocol webvpn
webvpn
url-list value GroupAdminBookmarks
username X password X encrypted privilege 15
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool (Inside) SSL_VPN_Users
address-pool SSL_VPN_Users
authorization-server-group
Woodharbor_AAA
accounting-server-group Woodharbor_AAA
tunnel-group DefaultWEBVPNGroup webvpn-attributes
nbns-server 10.1.30.91 master timeout 2 retry 2
tunnel-group DefaultWEBVPNGroup ppp-attributes
authentication ms-chap-v2
tunnel-group Clientless-VPN type remote-access
tunnel-group Clientless-VPN general-attributes
authentication-server-grou
p Woodharbor_AAA
default-group-policy GroupAdmins
tunnel-group SSL_VPN type remote-access
tunnel-group SSL_VPN general-attributes
address-pool SSL_VPN_Users
authentication-server-grou
p Woodharbor_AAA
prompt hostname context
Cryptochecksum:5474706cc5f
ace7892da7
87a5ca6d2a
9
: end
Start Free Trial