Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Cisco VPN no traffic received

Posted on 2009-06-30
7
592 Views
Last Modified: 2012-05-07
Hello experts

I have an ASA 5510 that I am having difficulties with. I can get a VPN client to connect but cannot get it to communicate with anything beyond itself. Clients connected locally can browse fine, just VPN having the problem. I need the 192.168.20.x clients to be able to talk to 10.0.33.x, I'm sure I am missing something simple but am having brain freeze. Any help is appreciated. Config is attached
asdm image disk0:/asdm-507.bin
asdm location 10.0.33.0 255.255.255.0 Inside
asdm location 192.168.20.0 255.255.255.0 Outside
no asdm history enable
: Saved
:
ASA Version 7.0(7) 
!
hostname ciscoasa
domain-name default.domain.invalid
enable password Wr.NW4mrJ2tQV7ku encrypted
names
dns-guard
!
interface Ethernet0/0
 nameif Outside
 security-level 0
 ip address x.x.x.x 255.255.255.240 
!
interface Ethernet0/1
 nameif Inside
 security-level 50
 ip address 10.0.1.97 255.255.255.0 
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
 management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
same-security-traffic permit intra-interface
access-list Outside_access_in extended permit ip 192.168.20.0 255.255.255.0 10.0.33.0 255.255.255.0 
access-list Outside_access_in extended permit ip 192.168.20.0 255.255.255.0 10.0.1.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 10.0.33.0 255.255.255.0 192.168.20.0 255.255.255.224 
access-list Inside_nat0_outbound extended permit ip 10.0.1.0 255.255.255.0 192.168.20.0 255.255.255.224 
access-list ACCT_splitTunnelAcl standard permit 10.0.1.0 255.255.255.0 
access-list Inside_access_in extended permit ip 10.0.33.0 255.255.255.0 192.168.20.0 255.255.255.0 
access-list Inside_access_in extended permit ip 10.0.1.0 255.255.255.0 192.168.20.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 10.0.33.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.0.0 192.168.20.0 255.255.255.0 
access-list VPN_ACL standard permit 192.168.20.0 255.255.255.0 
access-list VPN_ACL standard permit 10.0.33.0 255.255.255.0 
access-list VPN_ACL standard permit 10.0.1.0 255.255.255.0 
pager lines 24
logging enable
logging asdm informational
mtu management 1500
mtu Inside 1500
mtu Outside 1500
ip local pool acctpool 192.168.20.10-192.168.20.20 mask 255.255.255.0
asdm image disk0:/asdm-507.bin
no asdm history enable
arp timeout 14400
global (Outside) 10 interface
nat (management) 10 0.0.0.0 0.0.0.0
nat (Inside) 0 access-list Inside_nat0_outbound
access-group Inside_access_in in interface Inside
access-group Outside_access_in in interface Outside
route Inside 10.0.0.0 255.255.255.0 10.0.1.1 1
route Outside 0.0.0.0 0.0.0.0 63.127.200.241 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy ACCT internal
group-policy ACCT attributes
 dns-server value 10.0.1.52 10.0.1.10
 split-tunnel-policy tunnelall
 split-tunnel-network-list value VPN_ACL
 webvpn
username kmann password WJqThhYg1G4Yh2cm encrypted privilege 15
username kmann attributes
 vpn-group-policy ACCT
 webvpn
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.0.1.200 255.255.255.255 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
crypto map Outside_map interface Outside
isakmp identity auto 
isakmp enable Outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
tunnel-group ACCT type ipsec-ra
tunnel-group ACCT general-attributes
 address-pool acctpool
 default-group-policy ACCT
tunnel-group ACCT ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
Cryptochecksum:bf3af0d5f793903e5d8d0b720ac919e1
: end

Open in new window

0
Comment
Question by:kvmann
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 24750288
Well, does your network route 192.168.20.x traffic to the ASA?
0
 
LVL 6

Assisted Solution

by:djcapone
djcapone earned 50 total points
ID: 24750991
I do not see where the 33.0 network is configured on your ASA.

I am assuming that there is other routing devices in your network.

Can you post your network topology?
0
 

Author Comment

by:kvmann
ID: 24751044
asavener: Yes, we have a 6513 that has the route for 192.168.20.x

djcapone: There is / was a route for the 33.0 network on the ASA but it did not help. Yes we have other routing devices. a 6513 at main office controlling access to 7 remote sites. However, I only need the ASA to be able to accept VPN traffic from the outside and talk to the 33.0 network.

Thanks
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 28

Accepted Solution

by:
asavener earned 150 total points
ID: 24753884
You'll definitely need a route statement to the 33.0 network; it can't work until that's in place.
0
 
LVL 7

Assisted Solution

by:Boilermaker85
Boilermaker85 earned 50 total points
ID: 24757079
I think the route statement you have has the wrong mask. You have:
    route Inside 10.0.0.0 255.255.255.0 10.0.1.1 1
and I think you wanted this:
    route Inside 10.0.0.0 255.0.0.0 10.0.1.1 1  Which says all 10. networks are inside and are reached via the next hop router of 10.0.1.1.
0
 

Author Comment

by:kvmann
ID: 24868650
sorry for the delay, was out of town. turns there was in fact a missing route but not on this device. Points awarded. However the problem has morphed a bit. We have a wireless network we use for testing (it is not connected to our local network), can establish a VPN connection and pass all appropriate traffic but......when attempting the same connection from another wireless (at home) I can connect but am NOT able to pass any traffic again.

Any ideas?
asdm image disk0:/asdm-507.bin
asdm location 192.168.20.0 255.255.255.0 Outside
no asdm history enable
: Saved
:
ASA Version 7.0(7) 
!
hostname ciscoasa
domain-name default.domain.invalid
enable password Wr.NW4mrJ2tQV7ku encrypted
names
dns-guard
!
interface Ethernet0/0
 nameif Outside
 security-level 0
 ip address x.x.x.x 255.255.255.240 
!
interface Ethernet0/1
 nameif Inside
 security-level 100
 ip address 10.0.1.97 255.255.255.0 
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
 management-only
!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
access-list Inside_nat0_outbound extended permit ip 10.0.33.0 255.255.255.0 192.168.20.0 255.255.255.224 
access-list Inside_nat0_outbound extended permit ip 10.0.1.0 255.255.255.0 192.168.20.0 255.255.255.224 
access-list Inside_nat0_outbound extended permit ip 10.0.33.0 255.255.255.0 10.0.6.0 255.255.255.0 
access-list ACCT_splitTunnelAcl standard permit 10.0.33.0 255.255.255.0 
access-list ACCT_splitTunnelAcl standard permit 10.0.1.0 255.255.255.0 
pager lines 24
logging enable
logging asdm informational
mtu Outside 1500
mtu Inside 1500
mtu management 1500
ip local pool acct_pool 192.168.20.10-192.168.20.20 mask 255.255.255.0
icmp permit any Inside
asdm image disk0:/asdm-507.bin
no asdm history enable
arp timeout 14400
global (Outside) 10 interface
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 10 0.0.0.0 0.0.0.0
route Outside 0.0.0.0 0.0.0.0 63.127.200.241 1
route Inside 10.0.33.0 255.255.255.0 10.0.1.11 1
route Inside 10.0.6.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.44.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.39.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.12.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.11.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.10.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.9.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.8.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.7.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.4.0 255.255.255.0 10.0.1.1 1
route Inside 10.0.2.0 255.255.255.0 10.0.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy ACCT internal
group-policy ACCT attributes
 dns-server value 10.0.1.52 10.0.1.10
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ACCT_splitTunnelAcl
 webvpn
username rscarlavai password xbYGHid4YWBJH3FT encrypted privilege 0
username rscarlavai attributes
 vpn-group-policy ACCT
 webvpn
username kmann password WJqThhYg1G4Yh2cm encrypted privilege 0
username kmann attributes
 vpn-group-policy ACCT
 webvpn
username cdeignan password ICwqPs5Nd457inf9 encrypted privilege 0
username cdeignan attributes
 vpn-group-policy ACCT
 webvpn
username krottman password R/RJhVcvU0SGjanq encrypted privilege 0
username krottman attributes
 vpn-group-policy ACCT
 webvpn
http server enable
http 10.0.1.200 255.255.255.255 Inside
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-MD5
crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
crypto map Outside_map interface Outside
isakmp enable Outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
tunnel-group ACCT type ipsec-ra
tunnel-group ACCT general-attributes
 address-pool acct_pool
 default-group-policy ACCT
tunnel-group ACCT ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
Cryptochecksum:3ed323fe466b52c5033584c9cfdd54ee
: end

Open in new window

0
 
LVL 7

Expert Comment

by:Boilermaker85
ID: 24868923
The simple answer is that the wireless network firewall that you use at home is not set up to pass the VPN packets through. Is your home router capable of IPSEC passthrough? If not, you may still be able to create a custom rule. Or maybe there is a checkbox for NAT traversal. But there are a lot of variables. You haven't given much info about the two remote connection environments.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
Let’s list some of the technologies that enable smooth teleworking. 
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question