Solved

Cisco VPN no traffic received

Posted on 2009-06-30
7
584 Views
Last Modified: 2012-05-07
Hello experts

I have an ASA 5510 that I am having difficulties with. I can get a VPN client to connect but cannot get it to communicate with anything beyond itself. Clients connected locally can browse fine, just VPN having the problem. I need the 192.168.20.x clients to be able to talk to 10.0.33.x, I'm sure I am missing something simple but am having brain freeze. Any help is appreciated. Config is attached
asdm image disk0:/asdm-507.bin

asdm location 10.0.33.0 255.255.255.0 Inside

asdm location 192.168.20.0 255.255.255.0 Outside

no asdm history enable

: Saved

:

ASA Version 7.0(7) 

!

hostname ciscoasa

domain-name default.domain.invalid

enable password Wr.NW4mrJ2tQV7ku encrypted

names

dns-guard

!

interface Ethernet0/0

 nameif Outside

 security-level 0

 ip address x.x.x.x 255.255.255.240 

!

interface Ethernet0/1

 nameif Inside

 security-level 50

 ip address 10.0.1.97 255.255.255.0 

!

interface Ethernet0/2

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Management0/0

 nameif management

 security-level 100

 ip address 192.168.1.1 255.255.255.0 

 management-only

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

same-security-traffic permit intra-interface

access-list Outside_access_in extended permit ip 192.168.20.0 255.255.255.0 10.0.33.0 255.255.255.0 

access-list Outside_access_in extended permit ip 192.168.20.0 255.255.255.0 10.0.1.0 255.255.255.0 

access-list Inside_nat0_outbound extended permit ip 10.0.33.0 255.255.255.0 192.168.20.0 255.255.255.224 

access-list Inside_nat0_outbound extended permit ip 10.0.1.0 255.255.255.0 192.168.20.0 255.255.255.224 

access-list ACCT_splitTunnelAcl standard permit 10.0.1.0 255.255.255.0 

access-list Inside_access_in extended permit ip 10.0.33.0 255.255.255.0 192.168.20.0 255.255.255.0 

access-list Inside_access_in extended permit ip 10.0.1.0 255.255.255.0 192.168.20.0 255.255.255.0 

access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 10.0.33.0 255.255.255.0 

access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.0.0 192.168.20.0 255.255.255.0 

access-list VPN_ACL standard permit 192.168.20.0 255.255.255.0 

access-list VPN_ACL standard permit 10.0.33.0 255.255.255.0 

access-list VPN_ACL standard permit 10.0.1.0 255.255.255.0 

pager lines 24

logging enable

logging asdm informational

mtu management 1500

mtu Inside 1500

mtu Outside 1500

ip local pool acctpool 192.168.20.10-192.168.20.20 mask 255.255.255.0

asdm image disk0:/asdm-507.bin

no asdm history enable

arp timeout 14400

global (Outside) 10 interface

nat (management) 10 0.0.0.0 0.0.0.0

nat (Inside) 0 access-list Inside_nat0_outbound

access-group Inside_access_in in interface Inside

access-group Outside_access_in in interface Outside

route Inside 10.0.0.0 255.255.255.0 10.0.1.1 1

route Outside 0.0.0.0 0.0.0.0 63.127.200.241 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

group-policy ACCT internal

group-policy ACCT attributes

 dns-server value 10.0.1.52 10.0.1.10

 split-tunnel-policy tunnelall

 split-tunnel-network-list value VPN_ACL

 webvpn

username kmann password WJqThhYg1G4Yh2cm encrypted privilege 15

username kmann attributes

 vpn-group-policy ACCT

 webvpn

http server enable

http 192.168.1.0 255.255.255.0 management

http 10.0.1.200 255.255.255.255 Inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 

crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map

crypto map Outside_map interface Outside

isakmp identity auto 

isakmp enable Outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

tunnel-group ACCT type ipsec-ra

tunnel-group ACCT general-attributes

 address-pool acctpool

 default-group-policy ACCT

tunnel-group ACCT ipsec-attributes

 pre-shared-key *

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd lease 3600

dhcpd ping_timeout 50

dhcpd enable management

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map global_policy

 class inspection_default

  inspect dns maximum-length 512 

  inspect ftp 

  inspect h323 h225 

  inspect h323 ras 

  inspect rsh 

  inspect rtsp 

  inspect esmtp 

  inspect sqlnet 

  inspect skinny 

  inspect sunrpc 

  inspect xdmcp 

  inspect sip 

  inspect netbios 

  inspect tftp 

!

service-policy global_policy global

Cryptochecksum:bf3af0d5f793903e5d8d0b720ac919e1

: end

Open in new window

0
Comment
Question by:kvmann
  • 2
  • 2
  • 2
  • +1
7 Comments
 
LVL 28

Expert Comment

by:asavener
ID: 24750288
Well, does your network route 192.168.20.x traffic to the ASA?
0
 
LVL 6

Assisted Solution

by:djcapone
djcapone earned 50 total points
ID: 24750991
I do not see where the 33.0 network is configured on your ASA.

I am assuming that there is other routing devices in your network.

Can you post your network topology?
0
 

Author Comment

by:kvmann
ID: 24751044
asavener: Yes, we have a 6513 that has the route for 192.168.20.x

djcapone: There is / was a route for the 33.0 network on the ASA but it did not help. Yes we have other routing devices. a 6513 at main office controlling access to 7 remote sites. However, I only need the ASA to be able to accept VPN traffic from the outside and talk to the 33.0 network.

Thanks
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 28

Accepted Solution

by:
asavener earned 150 total points
ID: 24753884
You'll definitely need a route statement to the 33.0 network; it can't work until that's in place.
0
 
LVL 7

Assisted Solution

by:Boilermaker85
Boilermaker85 earned 50 total points
ID: 24757079
I think the route statement you have has the wrong mask. You have:
    route Inside 10.0.0.0 255.255.255.0 10.0.1.1 1
and I think you wanted this:
    route Inside 10.0.0.0 255.0.0.0 10.0.1.1 1  Which says all 10. networks are inside and are reached via the next hop router of 10.0.1.1.
0
 

Author Comment

by:kvmann
ID: 24868650
sorry for the delay, was out of town. turns there was in fact a missing route but not on this device. Points awarded. However the problem has morphed a bit. We have a wireless network we use for testing (it is not connected to our local network), can establish a VPN connection and pass all appropriate traffic but......when attempting the same connection from another wireless (at home) I can connect but am NOT able to pass any traffic again.

Any ideas?
asdm image disk0:/asdm-507.bin

asdm location 192.168.20.0 255.255.255.0 Outside

no asdm history enable

: Saved

:

ASA Version 7.0(7) 

!

hostname ciscoasa

domain-name default.domain.invalid

enable password Wr.NW4mrJ2tQV7ku encrypted

names

dns-guard

!

interface Ethernet0/0

 nameif Outside

 security-level 0

 ip address x.x.x.x 255.255.255.240 

!

interface Ethernet0/1

 nameif Inside

 security-level 100

 ip address 10.0.1.97 255.255.255.0 

!

interface Ethernet0/2

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Management0/0

 nameif management

 security-level 100

 ip address 192.168.1.1 255.255.255.0 

 management-only

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

access-list Inside_nat0_outbound extended permit ip 10.0.33.0 255.255.255.0 192.168.20.0 255.255.255.224 

access-list Inside_nat0_outbound extended permit ip 10.0.1.0 255.255.255.0 192.168.20.0 255.255.255.224 

access-list Inside_nat0_outbound extended permit ip 10.0.33.0 255.255.255.0 10.0.6.0 255.255.255.0 

access-list ACCT_splitTunnelAcl standard permit 10.0.33.0 255.255.255.0 

access-list ACCT_splitTunnelAcl standard permit 10.0.1.0 255.255.255.0 

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu management 1500

ip local pool acct_pool 192.168.20.10-192.168.20.20 mask 255.255.255.0

icmp permit any Inside

asdm image disk0:/asdm-507.bin

no asdm history enable

arp timeout 14400

global (Outside) 10 interface

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 10 0.0.0.0 0.0.0.0

route Outside 0.0.0.0 0.0.0.0 63.127.200.241 1

route Inside 10.0.33.0 255.255.255.0 10.0.1.11 1

route Inside 10.0.6.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.44.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.39.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.12.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.11.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.10.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.9.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.8.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.7.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.4.0 255.255.255.0 10.0.1.1 1

route Inside 10.0.2.0 255.255.255.0 10.0.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

group-policy ACCT internal

group-policy ACCT attributes

 dns-server value 10.0.1.52 10.0.1.10

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value ACCT_splitTunnelAcl

 webvpn

username rscarlavai password xbYGHid4YWBJH3FT encrypted privilege 0

username rscarlavai attributes

 vpn-group-policy ACCT

 webvpn

username kmann password WJqThhYg1G4Yh2cm encrypted privilege 0

username kmann attributes

 vpn-group-policy ACCT

 webvpn

username cdeignan password ICwqPs5Nd457inf9 encrypted privilege 0

username cdeignan attributes

 vpn-group-policy ACCT

 webvpn

username krottman password R/RJhVcvU0SGjanq encrypted privilege 0

username krottman attributes

 vpn-group-policy ACCT

 webvpn

http server enable

http 10.0.1.200 255.255.255.255 Inside

http 192.168.1.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 

crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map

crypto map Outside_map interface Outside

isakmp enable Outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

tunnel-group ACCT type ipsec-ra

tunnel-group ACCT general-attributes

 address-pool acct_pool

 default-group-policy ACCT

tunnel-group ACCT ipsec-attributes

 pre-shared-key *

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd lease 3600

dhcpd ping_timeout 50

dhcpd enable management

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map global_policy

 class inspection_default

  inspect dns maximum-length 512 

  inspect ftp 

  inspect h323 h225 

  inspect h323 ras 

  inspect rsh 

  inspect rtsp 

  inspect esmtp 

  inspect sqlnet 

  inspect skinny 

  inspect sunrpc 

  inspect xdmcp 

  inspect sip 

  inspect netbios 

  inspect tftp 

!

service-policy global_policy global

Cryptochecksum:3ed323fe466b52c5033584c9cfdd54ee

: end

Open in new window

0
 
LVL 7

Expert Comment

by:Boilermaker85
ID: 24868923
The simple answer is that the wireless network firewall that you use at home is not set up to pass the VPN packets through. Is your home router capable of IPSEC passthrough? If not, you may still be able to create a custom rule. Or maybe there is a checkbox for NAT traversal. But there are a lot of variables. You haven't given much info about the two remote connection environments.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now