Solved

VPN access through Cisco ASA 5505, can not see internal network (ping, RDP, server shares)

Posted on 2008-10-24
15
1,789 Views
Last Modified: 2012-05-05
Having some trouble accessing my internal network when using the Cisco VPN client (ver 5xxxx) through a ASA 5505. Stats on the client (XP SP2) say there are no packets sent or received, same goes for the crypto section. VPN connects ok, I can login but cannot see anything on the network.

I have tried using a different IP range, starting from scratch, removing all crypto info and re-entering it, and restarting the ASA (sh xlate). Something in the client logs was saying Rout IP or no Route 0.0.0.0

One thing though - last week I was reported on a black list, so I denied all traffic out on port 25 except for the mail server. As a matter of fact, I have denied all outgoing IP traffic, except for relevant  ports (HTTP,  HTTPS, sqlnet, etc.) But I don't think that would have affected my VPN settings.

What am I missing?

I think it's a route issue on the ASA, but I'm not sure.

Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name domain.org
enable password ulzaQiFnKVzDwUmW encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
 ospf cost 10
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 216.x.x.2 255.255.255.240
 ospf cost 10
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
 domain-name audiology.org
same-security-traffic permit inter-interface
access-list inside_access_in extended permit tcp host 192.168.0.62 any eq smtp
access-list inside_access_in extended deny tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in extended permit tcp any any eq www
access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 any eq 1433
access-list inside_access_in extended permit tcp any any eq sqlnet
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit tcp any any eq 667
access-list inside_access_in extended permit tcp any any eq 3389
access-list inside_access_in extended permit ip any any inactive
access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list outside_access_in remark RDP for Sandy
access-list outside_access_in extended permit tcp any host 216.x.x.7 eq 3389
access-list outside_access_in remark RDP for Bkana
access-list outside_access_in extended permit tcp any host 216.x.x.12 eq 3389
access-list outside_access_in remark AAADC2
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq smtp
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq ftp
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq www
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq https
access-list outside_access_in remark RDP for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq 3389
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq www
access-list outside_access_in remark HTTP access for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq https
access-list outside_access_in remark RDP for WebPortal Svr
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq 3389 inactive
access-list outside_access_in remark RDP for Erin
access-list outside_access_in extended permit tcp any host 216.x.x.11 eq 3389
access-list outside_access_in remark RDP for ACCTSVR
access-list outside_access_in extended permit tcp any host 216.x.x.6 eq 3389
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging trap debugging
logging asdm debugging
logging queue 150
mtu inside 1500
mtu outside 1500
ip local pool VPNPOOL 192.168.2.1-192.168.2.20 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 216.x.x.3-216.x.x.12 netmask 255.255.255.240
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 216.x.x.4 192.168.0.4 netmask 255.255.255.255

access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 216.x.x.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server NTWRKSVRS protocol ldap
aaa-server NTWRKSVRS host 192.168.0.62
 timeout 5
 ldap-scope onelevel
group-policy AAATunnel internal
group-policy AAATunnel attributes
 banner value Welcome to the Audiology network. This network is for authorized users only!
 dns-server value 192.168.0.8 192.168.0.62
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value AAATunnel_splitTunnelAcl
 default-domain value audiology
username sbishop password Eeg.fmr26DELXEKw encrypted privilege 5
username sbishop attributes
 vpn-group-policy AAATunnel
username cgallow password cxuXh2CnVa2e5tEm encrypted privilege 5
username cgallow attributes
 vpn-group-policy AAATunnel
username equinn password 6VoiwzYVXm5cbE/8 encrypted privilege 5
username equinn attributes
 vpn-group-policy AAATunnel
username skelley password fLQvCBmxMLbGw02J encrypted privilege 5
username skelley attributes
 vpn-group-policy AAATunnel
username bkana password 7nGPp4eh4G.KZH7p encrypted privilege 15
username bkana attributes
 vpn-group-policy AAATunnel
aaa authorization command LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
crypto isakmp am-disable
tunnel-group AAATunnel type ipsec-ra
tunnel-group AAATunnel general-attributes
 address-pool VPNPOOL
 default-group-policy AAATunnel
tunnel-group AAATunnel ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside vpnclient-wins-override
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
client-update enable
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege


0
Comment
Question by:bkana
  • 9
  • 4
  • 2
15 Comments
 
LVL 4

Expert Comment

by:yurisk
ID: 22795680
When connected what do you see in Routes Tab of the VPn client Statistics ?
ROutes that client gets once connected are defined by
access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
Can you make this ACL an extended one, listing both source and destination ?

access-list AAATunnel_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0  192.168.2.0 255.255.255.0

The second part of the question regarding the ACL that may block the IPsec traffic, 1st ACL applied is
only for traffic coming inbound from outside, and as long as you can connect successfully shouldn't
be a problem. To make sure you can always try (config) sysopt permit ipsec To circumvent any ACL
for IPsec raffic only. But seems more like route issue.
0
 

Author Comment

by:bkana
ID: 22795825
Thanks for replying yurisk.

The route tables show nothing on the Local Lan side (left), and 192.168.0.0 255.255.255.0 on the right, which is my internal network.

I thought my: access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 took care of that.

I will make the access-list AAATunnelACL an extended one. Do I have to use the word "extended" when using the CLI - I noticed your example says "standard" but you mentioned making it "extended"

I have used the sysopt command in previous attempts, but it didn't solve anything. I will add it to my current config though.
0
 
LVL 4

Expert Comment

by:yurisk
ID: 22799909
REgarding ACL -  you should not use extended/standard when typing the command itself - my mistake , 'standard' should not be there.
But anyway, if you see you LAN in the righthand pane in Routes than route gets installed ok, no need to change the ACL AAATunnelACL
 
Can you check output of route print on the command line of the PC that is connected
by VPN client ? The idea is that no other overlapping networks of the same range as LAN behind ASA should be there.
IF you do trace from PC to LAN IP through VPN tunnel - where does it stop ?
IF you issue on ASA debug icmp trace and then do pings from PC - do you see something ?
0
 

Author Comment

by:bkana
ID: 22800709
I'll do as you suggested and get back with you. Thanks for all your help.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22811573
Try allowing vpn over tcp
crypto isakmp ipsec-over-tcp port 10000

Set the transport on the client to match
0
 

Author Comment

by:bkana
ID: 22811760
Thanks for replying lrmoore.

I will do as you suggested and get back with you. I have tried every possible config with this ASA, and nothing seems to work. If what you suggest does not work - I think I'm going to remove all the VPN settings and start over and then add the lines (via CLI) that I need , post the config and follow the advice of you or someone else on this board with Cisco/firewall experience.

The funy thing is - is that this worked flawlessly for months, and nothing on my network has changed. The only thing I did was add some outbound rules to block port 25, as I was being blacklisted. I also went ahead and blocked everything else going out except for HTTP, HTTPS, UDP, SQLnet, and a few other ports needed by some 3rd party apps within the network - and I don't think these changes would have affected VPN access.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22812441
You have not blocked anything because the access-list that you created is not even applied to the inside interface.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:bkana
ID: 22812689
Damn, could have swore that I applied it. I thought all of my inside_access_in access lists were just that.
If not, then what is the command to apply them?
0
 

Author Comment

by:bkana
ID: 22815043
How about now, below is the current config. I have made a few adjustments:

Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(2)
!
hostname ciscoasa
domain-name audiology.org
enable password ulzaQiFnKVzDwUmW encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
 ospf cost 10
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 216.x.x.2 255.255.255.240
 ospf cost 10
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
 domain-name audiology.org
same-security-traffic permit inter-interface
access-list inside_access_in extended permit tcp host 192.168.0.62 any eq smtp
access-list inside_access_in extended deny tcp any any eq smtp
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in extended permit tcp any any eq www
access-list inside_access_in extended permit tcp 192.168.0.0 255.255.255.0 any eq 1433
access-list inside_access_in extended permit tcp any any eq sqlnet
access-list inside_access_in extended permit udp any any
access-list inside_access_in extended permit tcp any any eq 667
access-list inside_access_in extended permit tcp any any eq 3389
access-list inside_access_in extended permit ip any any inactive
access-list Audiology_VPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list outside_access_in remark RDP for Sandy
access-list outside_access_in extended permit tcp any host 216.x.x.7 eq 3389
access-list outside_access_in remark RDP for Bkana
access-list outside_access_in extended permit tcp any host 216.x.x.12 eq 3389
access-list outside_access_in remark AAADC2
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq smtp
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq ftp
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq www
access-list outside_access_in remark Web Portal/AAAMBR02
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq https
access-list outside_access_in remark RDP for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq 3389
access-list outside_access_in extended permit tcp any host 216.x.x.10 eq www
access-list outside_access_in remark HTTP access for CRM
access-list outside_access_in extended permit tcp any host 216.x.x.8 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq https
access-list outside_access_in extended permit tcp any host 216.x.x.5 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq www
access-list outside_access_in extended permit tcp any host 216.x.x.9 eq https
access-list outside_access_in remark RDP for WebPortal Svr
access-list outside_access_in extended permit tcp any host 216.x.x.4 eq 3389 inactive
access-list outside_access_in remark RDP for Erin
access-list outside_access_in extended permit tcp any host 216.x.x.11 eq 3389
access-list outside_access_in remark RDP for ACCTSVR
access-list outside_access_in extended permit tcp any host 216.x.x.6 eq 3389
access-list inside_nat0_outbound extended permit ip any 192.168.0.160 255.255.255.240
pager lines 24
logging enable
logging trap debugging
logging asdm debugging
logging queue 150
mtu inside 1500
mtu outside 1500
ip local pool AAAIPPOOL 192.168.0.160-192.168.0.180 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
no asdm history enable
arp timeout 14400
global (outside) 1 216.x.x.3-216.x.x.12 netmask 255.255.255.240
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) 216.x.x.4 192.168.0.4 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 216.64.78.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server NTWRKSVRS protocol ldap
aaa-server NTWRKSVRS host 192.168.0.62
 timeout 5
 ldap-scope onelevel
group-policy DfltGrpPolicy attributes
 banner none
 wins-server none
 dns-server none
 dhcp-network-scope none
 vpn-access-hours none
 vpn-simultaneous-logins 10
 vpn-idle-timeout 30
 vpn-session-timeout none
 vpn-filter none
 vpn-tunnel-protocol IPSec l2tp-ipsec
 password-storage disable
 ip-comp disable
 re-xauth disable
 group-lock none
 pfs disable
 ipsec-udp enable
 ipsec-udp-port 10000
 split-tunnel-policy tunnelall
 split-tunnel-network-list none
 default-domain none
 split-dns none
 intercept-dhcp 255.255.255.255 disable
 secure-unit-authentication disable
 user-authentication disable
 user-authentication-idle-timeout 30
 ip-phone-bypass disable
 leap-bypass disable
 nem disable
 backup-servers keep-client-config
 msie-proxy server none
 msie-proxy method no-modify
 msie-proxy except-list none
 msie-proxy local-bypass disable
 nac disable
 nac-sq-period 300
 nac-reval-period 36000
 nac-default-acl none
 address-pools none
 client-firewall none
 client-access-rule none
 webvpn
  functions url-entry
  html-content-filter none
  homepage none
  keep-alive-ignore 4
  http-comp gzip
  filter none
  url-list none
  customization value DfltCustomization
  port-forward none
  port-forward-name value Application Access
  sso-server none
  deny-message value Login was successful, but because certain criteria have not been met or due to some

specific group policy, you do not have permission to use any of the VPN features. Contact your IT

administrator for more information
  svc none
  svc keep-installer installed
  svc keepalive none
  svc rekey time none
  svc rekey method none
  svc dpd-interval client none
  svc dpd-interval gateway none
  svc compression deflate
group-policy Audiology_VPN internal
group-policy Audiology_VPN attributes
 banner value Welcome to the AAA Network.
 dns-server value 192.168.0.8 192.168.0.62
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Audiology_VPN_splitTunnelAcl
 default-domain value audiology.org
username sbishop password Eeg.fmr26DELXEKw encrypted privilege 5
username sbishop attributes
 vpn-group-policy Audiology_VPN
username cgallow password cxuXh2CnVa2e5tEm encrypted privilege 5
username cgallow attributes
 vpn-group-policy Audiology_VPN
username bkana password 7nGPp4eh4G.KZH7p encrypted privilege 15
username bkana attributes
 vpn-group-policy Audiology_VPN
aaa authorization command LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
crypto isakmp am-disable
tunnel-group Audiology_VPN type ipsec-ra
tunnel-group Audiology_VPN general-attributes
 address-pool AAAIPPOOL
 default-group-policy Audiology_VPN
tunnel-group Audiology_VPN ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside vpnclient-wins-override
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
client-update enable
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
Cryptochecksum:85585170792e27d316f23f061fb21b06
: end
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 22817847
>access-group inside_access_in in interface inside
This is how you apply the acl..
but, you did not permit local LAN to VPN Pool traffic, nor did you allow UDP/53 for DNS to work

First, just remove the acl from the interface again while troubleshooting.

Next, setup the VPN pool using a different IP subnet instead of a sub-set of the internal network. Something like 192.168.199.1-192.168.199.200
Now the acls make more sense
access-list NONAT permit ip 192.168.0.0 255.255.255.0 192.168.199.0 255.255.255.0
access-list Audiology_VPN_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
0
 

Author Comment

by:bkana
ID: 22818346
Did as you suggested, but no dice. Now I am getting the 412 error: remote peer is not responding. However, this was happening before I started conversing with you. After I attempted the NAT option over port 10000 is when it started happening. I have tried power cycling the ASA and reloading it.

And there is nothing in the logs on the client when I try to connect.

What is the command to show the route table on the client?
0
 

Author Comment

by:bkana
ID: 22818366
Also, I thought my access-list inside_nat0_outbound statement  permits local LAN to VPN Pool traffic.

And what would the command be to allow UDP/53 and DNS to work? Again, doesn't my
access-list inside_access_in extended permit udp any any  do this?

0
 

Accepted Solution

by:
bkana earned 0 total points
ID: 23029189
Sorry for the late response - have not been in the office. None of the answers provided have solved anything in this case and I have put the project on-hold and have moved to another solution for the time being.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 23034482
Thanks for the update. Sorry that we could not have been more help.
0
 

Author Comment

by:bkana
ID: 23041251
Thanks lrmoore! I'm sure you'll hear from me again in the near future - have a happy T-day!
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Suggested Solutions

If you have an ASA5510 then this sort of thing would be better handled with a CSC Module, however on an ASA5505 thats not an option, and if you want to throw in a quick solution to stop your staff going to facebook during work time, then this is the…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now