?
Solved

ASA5505 Client VPN

Posted on 2009-07-03
10
Medium Priority
?
537 Views
Last Modified: 2012-05-07
Hi Guys
I attached my config for Cisco ASA 5505 I did configure the Remote access vpn for users I am testing it at our office I need to ship it the client in 2 days. every time I try the vpn from another outside network I get error: secure vpn connection terminated by peer reason 433!
also on ASDAM realtime log:  Group=WestaimGroup ip x.x.x.x error: Unable to remove PeerTbIEntery
Group=WestaimGroup ip x.x.x.x Removing peer from peer table failed no match

Any help please
Run-Config.txt
0
Comment
Question by:modathir
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
10 Comments
 
LVL 5

Author Comment

by:modathir
ID: 24775722
also Group=WestaimGroup user xxx ip x.x.x.x  Cannot obtain IP address for remote peer
0
 
LVL 57

Accepted Solution

by:
Pete Long earned 2000 total points
ID: 24776242
Lets discount NAT as the problem add the following
crypto isakmp nat-traversal  20
Then if theres still no joy start from scratch http://www.petenetlive.com/Tech/Firewalls/Cisco/c2svpn.htm
 
0
 
LVL 5

Author Comment

by:modathir
ID: 24777847
Hi PeteLong:
I followed your instructions and started over  what I did is reset to factory-default and reconfigured from scratch. the VPN is working I can connect but, I have one host connected to the local network with IP 172.17.66.30 I cannot ping it from the VPN client computer! my new config is here:

ASA Version 7.2(4)
!
hostname WESTAIM-ASA5505
domain-name default.domain.invalid
enable password iWVY0RB2EOEs8wDO encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 172.17.66.3 WESTAIMSBS description Westaim SBS Server
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.17.66.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
banner exec #######################################################
banner exec #######################################################
banner exec ####                                               ####
banner exec ####        UNAUTHORIZED ACCESS IS PROHIBITED      ####
banner exec ####             All Activity is being Logged.     ####
banner exec #######################################################
banner exec #######################################################
banner login ##################################################################
banner login ##################################################################
banner login ###                          You have been Authenticated       ###
banner login ###  You are responsible for all activity during this session  ###
banner login ##################################################################
banner login ##################################################################
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
access-list inside_access_in extended permit tcp any any eq https
access-list inside_access_in remark Allow Exchange server to send e-mail
access-list inside_access_in remark Allow DNS server to query DNS servers on the                                                                              Internet
access-list inside_access_in extended permit tcp host WESTAIMSBS any eq smtp
access-list inside_access_in extended permit tcp host WESTAIMSBS eq smtp any
access-list inside_access_in extended permit udp host WESTAIMSBS any eq domain
access-list remotevpn_splitTunnelAcl standard permit 172.17.66.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.17.66.0 255.255.255.0 17                                                                             2.17.56.0 255.255.255.192
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool reomtevpnpool 172.17.56.30-172.17.56.50 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 205.206.116.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 172.17.66.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
telnet timeout 5
ssh 172.17.66.0 255.255.255.255 inside
ssh 172.17.66.30 255.255.255.255 inside
ssh WESTAIMSBS 255.255.255.255 inside
ssh timeout 60
console timeout 0
dhcpd auto_config outside
!
dhcpd address 172.17.66.30-172.17.66.50 inside
dhcpd enable inside
!
ntp server WESTAIMSBS
group-policy remotevpn internal
group-policy remotevpn attributes
 wins-server value 172.17.66.3
 dns-server value 172.17.66.3
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value remotevpn_splitTunnelAcl
 default-domain value westaimc.local
username xxxxxxxxxx password xxxxxxxxx encrypted privilege 0
username westaim attributes
 vpn-group-policy remotevpn
username xxxxxx password xxxxxxxxxxx encrypted
tunnel-group remotevpn type ipsec-ra
tunnel-group remotevpn general-attributes
 address-pool reomtevpnpool
 default-group-policy remotevpn
tunnel-group remotevpn ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
smtp-server 172.17.66.3
prompt hostname context
Cryptochecksum:16504a01e99b95dee4978a0d633bfe20
: end
WESTAIM-ASA5505#
0
The Ideal Solution for Multi-Display Applications

Check out ATEN’s VS1912 12-Port DP Video Wall Media Player at InfoComm 2017. Kerri describes how easy it is to design creative video walls in asymmetric layouts and schedule detailed playlists ahead of time with its advanced scheduling feature.

 
LVL 57

Expert Comment

by:Pete Long
ID: 24780115
The VPN connects? you say you cannot ping this client?  does other traffic work? if a VPN client can connect and no traffic passes usually the problem is NAT related.
0
 
LVL 5

Author Comment

by:modathir
ID: 24780653
Thanks PeteLong
Do you see any NAT  issue in this configration? I cannot ping anything on 172.17.66.0/24 from the VPN client or the otherway around  ping 172.17.56.0/24 from local network, so the connection is established but there is no trafic going through!
Thanks again.    
0
 
LVL 5

Author Comment

by:modathir
ID: 24780679
Also I notice that the VPN client doesn't have a gateway IP if that help!
0
 
LVL 5

Author Comment

by:modathir
ID: 24781660
Thanks PeteLong
Now it is working I just had to disable windows firewall on both machines, I can ping the remote and local computers. The full points are going toward you man you been very helpful! But I have more questions for you:
1-      I need to configure Radius server to authenticate VPN users, I need to keep the local as well. So, the command lines  for that  please, my RADIUS server would be 172.17.66.4
2-     I have  SBS server  2008 on 172.17.66.3  I need  to allow SMTP exchange server in and out, remote web workplace on SBS. Do I need to configure static NAT for that?
 
Thanks again
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 24785664
1- See my website here - http://www.petenetlive.com/Tech/Firewalls/Cisco/c2svpnRADIUS.htm
2- No you just need to forward the RWW Ports to the SBS Server see my website here http://www.petenetlive.com/Tech/Firewalls/Cisco/portforward.htm
Note for RWW you need TCP 443 and TCP 4125 :)
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 24785671
To swap from Local to RADIUS simply locate the group policy in the ADSM and change fromLOCAL to RADIUS (see my link above)
0
 
LVL 5

Author Comment

by:modathir
ID: 24788266
Thank you so much!
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question