Solved

Cannot get return traffic over VPN on ASA

Posted on 2010-09-08
12
557 Views
Last Modified: 2012-05-10

I have an ASA 5505 with VPN set up, I can connect to the VPN fine but I cannot remote desktop to any client machines, or connect to network drives etc.

I can Remote desktop and connect to the network drives internally

I have posted the config, with ext IP's and passwords masked out

The Network is Peer to Peer workgroup so we are using Google DNS servers, I'm not sure if this will make any difference.

However I am trying to connect to the Remote Desktop and Network drives via IP address.

I believe the issue is with the remote MAchine not receiving traffic back from the ASA
0
Comment
Question by:ronnie_urbanit
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 2
  • 2
  • +2
12 Comments
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33634234
Here is the Config

!
SA Version 7.2(4)
!
hostname yandp-asa
domain-name yandp.local
enable password ************** encrypted
passwd ************** encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 111.111.111.111 255.255.255.248
!
interface Vlan3
 shutdown
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name yandp.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remoteusers 192.168.10.50-192.168.10.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 4899 192.168.0.2 4899 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 81.143.148.110 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 83.138.39.32 255.255.255.255 outside
http 192.168.0.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet 83.138.39.32 255.255.255.255 outside
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 8.8.8.8 4.2.2.2
!
dhcpd address 192.168.0.50-192.168.0.81 inside
dhcpd dns 8.8.8.8 4.2.2.2 interface inside
dhcpd enable inside
!

group-policy remoteusers internal
group-policy remoteusers attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value remoteusers_splitTunnelAcl
username username1 password LeSqCSjuytOzamUE encrypted privilege 0
username username1 attributes
 vpn-group-policy remoteusers
username username2 password Nkoa85648oq5Tc6PS encrypted privilege 0
username username2 attributes
 vpn-group-policy remoteusers
tunnel-group remoteusers type ipsec-ra
tunnel-group remoteusers general-attributes
 address-pool remoteusers
 default-group-policy remoteusers
tunnel-group remoteusers ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:866b6bbe2ee07ad7d272f6a80d7eed3e
: end
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 33635519
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33636199
That is not the issue, I cannot access network drives either
0
Webinar June 1st - Attacking Ransomware  

The global cyberattack that corrupted hundreds of thousands of computer systems on May 12th had a face, name, & price tag that we’ve seen all too often in recent years: Ransomware. With the stakes – and costs – of a ransomware attack higher than ever, is your business prepared ?

 
LVL 4

Expert Comment

by:ullas_unni
ID: 33636485
are you able to ping those devices through the vpn?
0
 
LVL 4

Expert Comment

by:mpickreign
ID: 33637286
Change this line from
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

to
access-list remoteusers_splitTunnelAcl extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
0
 
LVL 13

Expert Comment

by:3nerds
ID: 33640688
Hey Ronnie,

Every thing looks on the up and up, the only thing I think I would change is this:

Remove:
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0

It doesn't appear necessary and I think it might be confusing the NAT because it is hitting the rule first. I don't think what mpickreign suggest will hurt any but I don't see it being necessary as well.

The other change I would make would be to upgrade the code on your asa for a flavor of 8.X but not 8.3 as that will just confuse the issue. There were alot of bugs in the 7 code.

Regards,

3nerds
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33641196
None of those solutions worked and I cant update the software because we don't have a smartnet agreement
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33641220
I cannot ping any devices when connected to the VPN
0
 
LVL 4

Expert Comment

by:ullas_unni
ID: 33643081
your config looks fine.. check routes in your internal network if router or layer 3 switch is there... they should route traffic to your vpn pool
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33659991
There is no layer 3 switch, the devices plug directly into the switch on the ASA
0
 
LVL 1

Accepted Solution

by:
ronnie_urbanit earned 0 total points
ID: 33671930
This line was missing from the config

nat (inside) 0 access-list inside_nat0_outbound

I have added this line and it now working correctly
0
 
LVL 13

Expert Comment

by:3nerds
ID: 33671951
Ronnie,

That line appears in the origonal config you posted. If changes get made to the config make sure an update gets posted it will make helping you and getting you answers happen in a more timely manner.

Glad to see it worked out.

Regards,

3nerds

0

Featured Post

Simple, centralized multimedia control

Watch and learn to see how ATEN provided an easy and effective way for three jointly-owned pubs to control the 60 televisions located across their three venues utilizing the ATEN Control System, Modular Matrix Switch and HDBaseT extenders.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question