Having some trouble accessing my internal network when using the Cisco VPN client (ver 5xxxx) through a ASA 5505. Stats on the client (XP SP2) say there are no packets sent or received, same goes for the crypto section. VPN connects ok, I can login but cannot see anything on the network.
I have tried using a different IP range, starting from scratch, removing all crypto info and re-entering it, and restarting the ASA (sh xlate). Something in the client logs was saying Rout IP or no Route 0.0.0.0
One thing though - last week I was reported on a black list, so I denied all traffic out on port 25 except for the mail server. As a matter of fact, I have denied all outgoing IP traffic, except for relevant ports (HTTP, HTTPS, sqlnet, etc.) But I don't think that would have affected my VPN settings.
What am I missing?
I think it's a route issue on the ASA, but I'm not sure.
Result of the command: "show running-config"
: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name domain.org
enable password ulzaQiFnKVzDwUmW encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
ospf cost 10
!
interface Vlan2
nameif outside
security-level 0
ip address 216.x.x.2 255.255.255.240
ospf cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name audiology.org
same-security-traffic permit inter-interface
access-list inside_access_in extended permit tcp host 192.168.0.62 any eq smtp
access-list inside_access_in extended deny tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in extended permit tcp any any eq www
access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 any eq 1433
access-list inside_access_in extended permit tcp any any eq sqlnet
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit tcp any any eq 667
access-list inside_access_in extended permit tcp any any eq 3389
access-list inside_access_in extended permit ip any any inactive
access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list outside_access_in remark RDP for Sandy
access-list outside_access_in extended permit tcp any host 216.x.x.7 eq 3389
access-list outside_access_in remark RDP for Bkana
access-list outside_access_in extended permit tcp any host 216.x.x.12 eq 3389
access-list outside_access_in remark AAADC2
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq smtp
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq ftp
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq www
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq https
access-list outside_access_in remark RDP for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq 3389
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq www
access-list outside_access_in remark HTTP access for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq https
access-list outside_access_in remark RDP for WebPortal Svr
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq 3389 inactive
access-list outside_access_in remark RDP for Erin
access-list outside_access_in extended permit tcp any host 216.x.x.11 eq 3389
access-list outside_access_in remark RDP for ACCTSVR
access-list outside_access_in extended permit tcp any host 216.x.x.6 eq 3389
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging trap debugging
logging asdm debugging
logging queue 150
mtu inside 1500
mtu outside 1500
ip local pool VPNPOOL 192.168.2.1-192.168.2.20 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 216.x.x.3-216.x.x.12 netmask 255.255.255.240
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 216.x.x.4 192.168.0.4 netmask 255.255.255.255
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 216.x.x.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server NTWRKSVRS protocol ldap
aaa-server NTWRKSVRS host 192.168.0.62
timeout 5
ldap-scope onelevel
group-policy AAATunnel internal
group-policy AAATunnel attributes
banner value Welcome to the Audiology network. This network is for authorized users only!
dns-server value 192.168.0.8 192.168.0.62
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value AAATunnel_splitTunnelAcl
default-domain value audiology
username sbishop password Eeg.fmr26DELXEKw encrypted privilege 5
username sbishop attributes
vpn-group-policy AAATunnel
username cgallow password cxuXh2CnVa2e5tEm encrypted privilege 5
username cgallow attributes
vpn-group-policy AAATunnel
username equinn password 6VoiwzYVXm5cbE/8 encrypted privilege 5
username equinn attributes
vpn-group-policy AAATunnel
username skelley password fLQvCBmxMLbGw02J encrypted privilege 5
username skelley attributes
vpn-group-policy AAATunnel
username bkana password 7nGPp4eh4G.KZH7p encrypted privilege 15
username bkana attributes
vpn-group-policy AAATunnel
aaa authorization command LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 20
crypto isakmp am-disable
tunnel-group AAATunnel type ipsec-ra
tunnel-group AAATunnel general-attributes
address-pool VPNPOOL
default-group-policy AAATunnel
tunnel-group AAATunnel ipsec-attributes
pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside vpnclient-wins-override
!
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
service-policy global_policy global
client-update enable
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
