Question

VPN access through Cisco ASA 5505, can not see internal network (ping, RDP, server shares)

Asked by: bkana

Having some trouble accessing my internal network when using the Cisco VPN client (ver 5xxxx) through a ASA 5505. Stats on the client (XP SP2) say there are no packets sent or received, same goes for the crypto section. VPN connects ok, I can login but cannot see anything on the network.

I have tried using a different IP range, starting from scratch, removing all crypto info and re-entering it, and restarting the ASA (sh xlate). Something in the client logs was saying Rout IP or no Route 0.0.0.0

One thing though - last week I was reported on a black list, so I denied all traffic out on port 25 except for the mail server. As a matter of fact, I have denied all outgoing IP traffic, except for relevant ports (HTTP, HTTPS, sqlnet, etc.) But I don't think that would have affected my VPN settings.

What am I missing?

I think it's a route issue on the ASA, but I'm not sure.

Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name domain.org
enable password ulzaQiFnKVzDwUmW encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
ospf cost 10
!
interface Vlan2
nameif outside
security-level 0
ip address 216.x.x.2 255.255.255.240
ospf cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name audiology.org
same-security-traffic permit inter-interface
access-list inside_access_in extended permit tcp host 192.168.0.62 any eq smtp
access-list inside_access_in extended deny tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in extended permit tcp any any eq www
access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 any eq 1433
access-list inside_access_in extended permit tcp any any eq sqlnet
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit tcp any any eq 667
access-list inside_access_in extended permit tcp any any eq 3389
access-list inside_access_in extended permit ip any any inactive
access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list outside_access_in remark RDP for Sandy
access-list outside_access_in extended permit tcp any host 216.x.x.7 eq 3389
access-list outside_access_in remark RDP for Bkana
access-list outside_access_in extended permit tcp any host 216.x.x.12 eq 3389
access-list outside_access_in remark AAADC2
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq smtp
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq ftp
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq www
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq https
access-list outside_access_in remark RDP for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq 3389
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq www
access-list outside_access_in remark HTTP access for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq https
access-list outside_access_in remark RDP for WebPortal Svr
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq 3389 inactive
access-list outside_access_in remark RDP for Erin
access-list outside_access_in extended permit tcp any host 216.x.x.11 eq 3389
access-list outside_access_in remark RDP for ACCTSVR
access-list outside_access_in extended permit tcp any host 216.x.x.6 eq 3389
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging trap debugging
logging asdm debugging
logging queue 150
mtu inside 1500
mtu outside 1500
ip local pool VPNPOOL 192.168.2.1-192.168.2.20 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 216.x.x.3-216.x.x.12 netmask 255.255.255.240
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 216.x.x.4 192.168.0.4 netmask 255.255.255.255

access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 216.x.x.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server NTWRKSVRS protocol ldap
aaa-server NTWRKSVRS host 192.168.0.62
timeout 5
ldap-scope onelevel
group-policy AAATunnel internal
group-policy AAATunnel attributes
banner value Welcome to the Audiology network. This network is for authorized users only!
dns-server value 192.168.0.8 192.168.0.62
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value AAATunnel_splitTunnelAcl
default-domain value audiology
username sbishop password Eeg.fmr26DELXEKw encrypted privilege 5
username sbishop attributes
vpn-group-policy AAATunnel
username cgallow password cxuXh2CnVa2e5tEm encrypted privilege 5
username cgallow attributes
vpn-group-policy AAATunnel
username equinn password 6VoiwzYVXm5cbE/8 encrypted privilege 5
username equinn attributes
vpn-group-policy AAATunnel
username skelley password fLQvCBmxMLbGw02J encrypted privilege 5
username skelley attributes
vpn-group-policy AAATunnel
username bkana password 7nGPp4eh4G.KZH7p encrypted privilege 15
username bkana attributes
vpn-group-policy AAATunnel
aaa authorization command LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
crypto isakmp am-disable
tunnel-group AAATunnel type ipsec-ra
tunnel-group AAATunnel general-attributes
address-pool VPNPOOL
default-group-policy AAATunnel
tunnel-group AAATunnel ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside vpnclient-wins-override
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
client-update enable
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2008-10-24 at 04:05:40ID23844107
Tags: cisco
,; ASA 5505
,; Remote access VPN
Topics: Virtual Private Networking (VPN)
,; Cisco PIX Firewall
,; Networking Hardware Firewalls
Participating Experts: 2
Points: 0
Comments: 15

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: yuriskPosted on 2008-10-24 at 05:55:23ID: 22795680

When connected what do you see in Routes Tab of the VPn client Statistics ?
ROutes that client gets once connected are defined by
access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
Can you make this ACL an extended one, listing both source and destination ?

access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0

The second part of the question regarding the ACL that may block the IPsec traffic, 1st ACL applied is
only for traffic coming inbound from outside, and as long as you can connect successfully shouldn't
be a problem. To make sure you can always try (config) sysopt permit ipsec To circumvent any ACL
for IPsec raffic only. But seems more like route issue.

by: bkanaPosted on 2008-10-24 at 06:14:56ID: 22795825

Thanks for replying yurisk.

The route tables show nothing on the Local Lan side (left), and 192.168.0.0 255.255.255.0 on the right, which is my internal network.

I thought my: access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 took care of that.

I will make the access-list AAATunnelACL an extended one. Do I have to use the word "extended" when using the CLI - I noticed your example says "standard" but you mentioned making it "extended"

I have used the sysopt command in previous attempts, but it didn't solve anything. I will add it to my current config though.

by: yuriskPosted on 2008-10-24 at 13:40:22ID: 22799909

REgarding ACL - you should not use extended/standard when typing the command itself - my mistake , 'standard' should not be there.

But anyway, if you see you LAN in the righthand pane in Routes than route gets installed ok, no need to change the ACL AAATunnelACL

Can you check output of route print on the command line of the PC that is connected

by VPN client ? The idea is that no other overlapping networks of the same range as LAN behind ASA should be there.

IF you do trace from PC to LAN IP through VPN tunnel - where does it stop ?

IF you issue on ASA debug icmp trace and then do pings from PC - do you see something ?

by: bkanaPosted on 2008-10-24 at 15:49:50ID: 22800709

I'll do as you suggested and get back with you. Thanks for all your help.

by: lrmoorePosted on 2008-10-27 at 04:46:56ID: 22811573

Try allowing vpn over tcp
crypto isakmp ipsec-over-tcp port 10000

Set the transport on the client to match

by: bkanaPosted on 2008-10-27 at 05:12:44ID: 22811760

Thanks for replying lrmoore.

I will do as you suggested and get back with you. I have tried every possible config with this ASA, and nothing seems to work. If what you suggest does not work - I think I'm going to remove all the VPN settings and start over and then add the lines (via CLI) that I need , post the config and follow the advice of you or someone else on this board with Cisco/firewall experience.

The funy thing is - is that this worked flawlessly for months, and nothing on my network has changed. The only thing I did was add some outbound rules to block port 25, as I was being blacklisted. I also went ahead and blocked everything else going out except for HTTP, HTTPS, UDP, SQLnet, and a few other ports needed by some 3rd party apps within the network - and I don't think these changes would have affected VPN access.

by: lrmoorePosted on 2008-10-27 at 06:34:50ID: 22812441

You have not blocked anything because the access-list that you created is not even applied to the inside interface.

by: bkanaPosted on 2008-10-27 at 06:59:56ID: 22812689

Damn, could have swore that I applied it. I thought all of my inside_access_in access lists were just that.
If not, then what is the command to apply them?

by: bkanaPosted on 2008-10-27 at 11:03:46ID: 22815043

How about now, below is the current config. I have made a few adjustments:

Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name audiology.org
enable password ulzaQiFnKVzDwUmW encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
ospf cost 10
!
interface Vlan2
nameif outside
security-level 0
ip address 216.x.x.2 255.255.255.240
ospf cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name audiology.org
same-security-traffic permit inter-interface
access-list inside_access_in extended permit tcp host 192.168.0.62 any eq smtp
access-list inside_access_in extended deny tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in extended permit tcp any any eq www
access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 any eq 1433
access-list inside_access_in extended permit tcp any any eq sqlnet
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit tcp any any eq 667
access-list inside_access_in extended permit tcp any any eq 3389
access-list inside_access_in extended permit ip any any inactive
access-list Audiology_VPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list outside_access_in remark RDP for Sandy
access-list outside_access_in extended permit tcp any host 216.x.x.7 eq 3389
access-list outside_access_in remark RDP for Bkana
access-list outside_access_in extended permit tcp any host 216.x.x.12 eq 3389
access-list outside_access_in remark AAADC2
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq smtp
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq ftp
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq www
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq https
access-list outside_access_in remark RDP for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq 3389
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq www
access-list outside_access_in remark HTTP access for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq https
access-list outside_access_in remark RDP for WebPortal Svr
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq 3389 inactive
access-list outside_access_in remark RDP for Erin
access-list outside_access_in extended permit tcp any host 216.x.x.11 eq 3389
access-list outside_access_in remark RDP for ACCTSVR
access-list outside_access_in extended permit tcp any host 216.x.x.6 eq 3389
access-list inside_nat0_outbound extended permit ip any 192.168.0.160 255.255.255.240
pager lines 24
logging enable
logging trap debugging
logging asdm debugging
logging queue 150
mtu inside 1500
mtu outside 1500
ip local pool AAAIPPOOL 192.168.0.160-192.168.0.180 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 216.x.x.3-216.x.x.12 netmask 255.255.255.240
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 216.x.x.4 192.168.0.4 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 216.64.78.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server NTWRKSVRS protocol ldap
aaa-server NTWRKSVRS host 192.168.0.62
timeout 5
ldap-scope onelevel
group-policy DfltGrpPolicy attributes
banner none
wins-server none
dns-server none
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 10
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec l2tp-ipsec
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp enable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain none
split-dns none
intercept-dhcp 255.255.255.255 disable
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
msie-proxy server none
msie-proxy method no-modify
msie-proxy except-list none
msie-proxy local-bypass disable
nac disable
nac-sq-period 300
nac-reval-period 36000
nac-default-acl none
address-pools none
client-firewall none
client-access-rule none
webvpn
functions url-entry
html-content-filter none
homepage none
keep-alive-ignore 4
http-comp gzip
filter none
url-list none
customization value DfltCustomization
port-forward none
port-forward-name value Application Access
sso-server none
deny-message value Login was successful, but because certain criteria have not been met or due to some

specific group policy, you do not have permission to use any of the VPN features. Contact your IT

administrator for more information
svc none
svc keep-installer installed
svc keepalive none
svc rekey time none
svc rekey method none
svc dpd-interval client none
svc dpd-interval gateway none
svc compression deflate
group-policy Audiology_VPN internal
group-policy Audiology_VPN attributes
banner value Welcome to the AAA Network.
dns-server value 192.168.0.8 192.168.0.62
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Audiology_VPN_splitTunnelAcl
default-domain value audiology.org
username sbishop password Eeg.fmr26DELXEKw encrypted privilege 5
username sbishop attributes
vpn-group-policy Audiology_VPN
username cgallow password cxuXh2CnVa2e5tEm encrypted privilege 5
username cgallow attributes
vpn-group-policy Audiology_VPN
username bkana password 7nGPp4eh4G.KZH7p encrypted privilege 15
username bkana attributes
vpn-group-policy Audiology_VPN
aaa authorization command LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
crypto isakmp am-disable
tunnel-group Audiology_VPN type ipsec-ra
tunnel-group Audiology_VPN general-attributes
address-pool AAAIPPOOL
default-group-policy Audiology_VPN
tunnel-group Audiology_VPN ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside vpnclient-wins-override
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
client-update enable
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
Cryptochecksum:85585170792e27d316f23f061fb21b06
: end

by: lrmoorePosted on 2008-10-27 at 16:26:53ID: 22817847

>access-group inside_access_in in interface inside
This is how you apply the acl..
but, you did not permit local LAN to VPN Pool traffic, nor did you allow UDP/53 for DNS to work

First, just remove the acl from the interface again while troubleshooting.

Next, setup the VPN pool using a different IP subnet instead of a sub-set of the internal network. Something like 192.168.199.1-192.168.199.200
Now the acls make more sense
access-list NONAT permit ip 192.168.0.0 255.255.255.0 192.168.199.0 255.255.255.0
access-list Audiology_VPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

by: bkanaPosted on 2008-10-27 at 18:03:09ID: 22818346

Did as you suggested, but no dice. Now I am getting the 412 error: remote peer is not responding. However, this was happening before I started conversing with you. After I attempted the NAT option over port 10000 is when it started happening. I have tried power cycling the ASA and reloading it.

And there is nothing in the logs on the client when I try to connect.

What is the command to show the route table on the client?

by: bkanaPosted on 2008-10-27 at 18:08:57ID: 22818366

Also, I thought my access-list inside_nat0_outbound statement permits local LAN to VPN Pool traffic.

And what would the command be to allow UDP/53 and DNS to work? Again, doesn't my
access-list inside_access_in extended permit udp any any do this?

by: bkanaPosted on 2008-11-24 at 09:27:07ID: 23029189

Sorry for the late response - have not been in the office. None of the answers provided have solved anything in this case and I have put the project on-hold and have moved to another solution for the time being.

by: lrmoorePosted on 2008-11-25 at 05:49:23ID: 23034482

Thanks for the update. Sorry that we could not have been more help.

by: bkanaPosted on 2008-11-26 at 04:05:05ID: 23041251

Thanks lrmoore! I'm sure you'll hear from me again in the near future - have a happy T-day!

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

VPN access through Cisco ASA 5505, can not see internal network (ping, RDP, server shares)

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

cisco

ASA 5505

Remote access VPN

Virtual Private Networking (VPN)

Cisco PIX Firewall

Networking Hardware Firewalls

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press