Link to home
Start Free TrialLog in
Avatar of ronnie_urbanit

asked on

Cannot get return traffic over VPN on ASA

I have an ASA 5505 with VPN set up, I can connect to the VPN fine but I cannot remote desktop to any client machines, or connect to network drives etc.

I can Remote desktop and connect to the network drives internally

I have posted the config, with ext IP's and passwords masked out

The Network is Peer to Peer workgroup so we are using Google DNS servers, I'm not sure if this will make any difference.

However I am trying to connect to the Remote Desktop and Network drives via IP address.

I believe the issue is with the remote MAchine not receiving traffic back from the ASA
Avatar of ronnie_urbanit


Here is the Config

SA Version 7.2(4)
hostname yandp-asa
domain-name yandp.local
enable password ************** encrypted
passwd ************** encrypted
interface Vlan1
 nameif inside
 security-level 100
 ip address
interface Vlan2
 nameif outside
 security-level 0
 ip address
interface Vlan3
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
dns server-group DefaultDNS
 domain-name yandp.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list remoteusers_splitTunnelAcl standard permit
access-list inside_nat0_outbound extended permit ip any
access-list inside_nat0_outbound extended permit ip
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remoteusers mask
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1
static (inside,outside) tcp interface 4899 4899 netmask
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http outside
http inside
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet outside
telnet inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns
dhcpd address inside
dhcpd dns interface inside
dhcpd enable inside

group-policy remoteusers internal
group-policy remoteusers attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value remoteusers_splitTunnelAcl
username username1 password LeSqCSjuytOzamUE encrypted privilege 0
username username1 attributes
 vpn-group-policy remoteusers
username username2 password Nkoa85648oq5Tc6PS encrypted privilege 0
username username2 attributes
 vpn-group-policy remoteusers
tunnel-group remoteusers type ipsec-ra
tunnel-group remoteusers general-attributes
 address-pool remoteusers
 default-group-policy remoteusers
tunnel-group remoteusers ipsec-attributes
 pre-shared-key *
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
service-policy global_policy global
prompt hostname context
: end
Avatar of Pete Long
That is not the issue, I cannot access network drives either
are you able to ping those devices through the vpn?
Change this line from
access-list remoteusers_splitTunnelAcl standard permit

access-list remoteusers_splitTunnelAcl extended permit ip
Hey Ronnie,

Every thing looks on the up and up, the only thing I think I would change is this:

access-list inside_nat0_outbound extended permit ip any

It doesn't appear necessary and I think it might be confusing the NAT because it is hitting the rule first. I don't think what mpickreign suggest will hurt any but I don't see it being necessary as well.

The other change I would make would be to upgrade the code on your asa for a flavor of 8.X but not 8.3 as that will just confuse the issue. There were alot of bugs in the 7 code.


None of those solutions worked and I cant update the software because we don't have a smartnet agreement
I cannot ping any devices when connected to the VPN
your config looks fine.. check routes in your internal network if router or layer 3 switch is there... they should route traffic to your vpn pool
There is no layer 3 switch, the devices plug directly into the switch on the ASA
Avatar of ronnie_urbanit

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial

That line appears in the origonal config you posted. If changes get made to the config make sure an update gets posted it will make helping you and getting you answers happen in a more timely manner.

Glad to see it worked out.