Cannot get return traffic over VPN on ASA

Here is the Config

!
SA Version 7.2(4)
!
hostname yandp-asa
domain-name yandp.local
enable password ************** encrypted
passwd ************** encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 111.111.111.111 255.255.255.248
!
interface Vlan3
 shutdown
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name yandp.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remoteusers 192.168.10.50-192.168.10.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 4899 192.168.0.2 4899 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 81.143.148.110 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 83.138.39.32 255.255.255.255 outside
http 192.168.0.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet 83.138.39.32 255.255.255.255 outside
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 8.8.8.8 4.2.2.2
!
dhcpd address 192.168.0.50-192.168.0.81 inside
dhcpd dns 8.8.8.8 4.2.2.2 interface inside
dhcpd enable inside
!

group-policy remoteusers internal
group-policy remoteusers attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value remoteusers_splitTunnelAcl
username username1 password LeSqCSjuytOzamUE encrypted privilege 0
username username1 attributes
 vpn-group-policy remoteusers
username username2 password Nkoa85648oq5Tc6PS encrypted privilege 0
username username2 attributes
 vpn-group-policy remoteusers
tunnel-group remoteusers type ipsec-ra
tunnel-group remoteusers general-attributes
 address-pool remoteusers
 default-group-policy remoteusers
tunnel-group remoteusers ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:866b6bbe2ee07ad7d272f6a80d7eed3e
: end

http://www.petenetlive.com/KB/Article/0000193.htm ?

That is not the issue, I cannot access network drives either

are you able to ping those devices through the vpn?

Change this line from
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

to
access-list remoteusers_splitTunnelAcl extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0

Hey Ronnie,

Every thing looks on the up and up, the only thing I think I would change is this:

Remove:
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0

It doesn't appear necessary and I think it might be confusing the NAT because it is hitting the rule first. I don't think what mpickreign suggest will hurt any but I don't see it being necessary as well.

The other change I would make would be to upgrade the code on your asa for a flavor of 8.X but not 8.3 as that will just confuse the issue. There were alot of bugs in the 7 code.

Regards,

3nerds

None of those solutions worked and I cant update the software because we don't have a smartnet agreement

I cannot ping any devices when connected to the VPN

your config looks fine.. check routes in your internal network if router or layer 3 switch is there... they should route traffic to your vpn pool

There is no layer 3 switch, the devices plug directly into the switch on the ASA

Ronnie,

That line appears in the origonal config you posted. If changes get made to the config make sure an update gets posted it will make helping you and getting you answers happen in a more timely manner.

Glad to see it worked out.

Regards,

3nerds