Solved

ASA 5505 issues, routing I guess..

Posted on 2007-11-29
4
1,884 Views
Last Modified: 2013-11-16
I have these really annoying issues with an ASA5505..
When I connect using the cisco VP client I can access internal network and Lan2Lan networks but not the internet.
When I connect to WebVPN I can not access any sites.
I found that the problems must be routing related and that theory is somewhat proved if I add a default tunneling route WebVPN access will work but the route will break the VPN clients Lan2Lan network access. Sure this could be solved by using another box as a router but wy would I buy a firewall/gateway/vpn thing if it can't route..
So is there a magic setting somewhere in ASDM that says don't route packets going to either local och lan2lan networks (I do have exempt rules for these networks).
If I try to ping one of the lan2lan networks from the ASDM ping util it will fail and a route error is logged, can not find next hop, but the host on the LAN have no problem accessing the remote network so it does work the ASA box just don't know how to reach it..
Except the route error the debug logs shows nothing except build and teardown connections
0
Comment
Question by:maho01
  • 3
4 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 500 total points
ID: 20374969
>>When I connect using the cisco VP client I can access internal network and Lan2Lan networks but not the internet.

You will need to either:

1) Implement split tunneling so that you specifically define the traffic you want sent down the tunnel and then everything else goes straight out your local network connection.  In other words, if you're internal network behind the ASA is 192.168.10.0/24, for example, then you would set up your VPN configuration to send only traffic destined for 192.168.10.x down the tunnel.  Here is a URL on how to do that for PIX/ASA:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702999.shtml

2) Implement hairpin traffic flows such that you are allowed to send traffic down the tunnel and then when the ASA realizes that the destination exists on the Internet, it will perform a hairpin turn on that traffic and send it back out to the Internet on the ASA's outside interface.  Here is how to allow "intra interface" traffic on the ASA:

http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/vpnsysop.html#wp1042114

You don't necessarily need a tunnel default gateway to get the WebVPN to work, but you will need to put in some static routes so that the ASA knows how to get to all the internal subnets that you have on your corporate network.  Basically, any host that you have configured for access from the WebVPN page you will need to have a route for.  For example, if you reference 5 hosts in your WebVPN page such as:

192.168.2.16
192.168.3.5
192.168.14.5
192.168.12.33
192.168.10.123

You will need route statements for all of these subnets that points to the next hop gateway (router) on your internal network.  So if you have a core router at 192.168.1.254 (your ASA's inside interface needs to be on the same subnet as the interface you use for your route statements), then you might have something like this for your static routes:

route inside 192.168.0.0 255.255.0.0 192.168.1.254

This would cover all of the 192.168.x.x networks.  The traffic for any host on the 192.168.1.x segment in this example would be handled via ARP since the ASA's inside interface is directly connected to this network...
0
 
LVL 1

Author Comment

by:maho01
ID: 20401902
The internet access for connecting VPN clients had a quite embarrassing solution, it works better if you enable NAT for the IP range used by connecting clients..

Just resetted the configuration so I have not tried webvpn yet, however I don't really understand how to set the routes, my ASA is the only local router and the webvpn targets are located at another site. The ASA does not have any routes to these sites since it by some magic knows that traffic to hosts in other sites should be tunneled, however noone seems to tell webvpn to tunnel that traffic. So how do I make wpnvpn understand that it should send traffic through the tunnels?
0
 
LVL 1

Author Comment

by:maho01
ID: 20426221
Just to let anyone that might care know, there is an enhancment request for this called,  CSCsc51918, with the title "Allow Clientless WebVPN to U-turn for service access through a L2L".

So WebVPN currently does not allow connections to web sites hosted on another site connected through lan2lan.
0
 
LVL 1

Author Comment

by:maho01
ID: 20426229
And what I forgot in my last post, to make webvpn access web site in remote location, add a router on the lan where the webvpn lives and just set routes to that router which has the ASA as default route and WebVPN should be able to access the website.
0

Featured Post

Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
IPSec via iOS 9.3 through FortiGate 200D 4 104
Do I need a hardware firewall? 12 78
Windows Firewall Rules for WMI and multiple subnets 4 83
Palo Alto Networks Global Protect 2 120
If you are like regular user of computer nowadays, a good bet that your home computer is on right now, all exposed to world of Internet to be exploited by somebody you do not know and you never will. Internet security issues has been getting worse d…
The DROP (Spamhaus Don't Route Or Peer List) is a small list of IP address ranges that have been stolen or hijacked from their rightful owners. The DROP list is not a DNS based list.  It is designed to be downloaded as a file, with primary intention…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question