Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 561
  • Last Modified:

Cannot get return traffic over VPN on ASA


I have an ASA 5505 with VPN set up, I can connect to the VPN fine but I cannot remote desktop to any client machines, or connect to network drives etc.

I can Remote desktop and connect to the network drives internally

I have posted the config, with ext IP's and passwords masked out

The Network is Peer to Peer workgroup so we are using Google DNS servers, I'm not sure if this will make any difference.

However I am trying to connect to the Remote Desktop and Network drives via IP address.

I believe the issue is with the remote MAchine not receiving traffic back from the ASA
0
ronnie_urbanit
Asked:
ronnie_urbanit
  • 6
  • 2
  • 2
  • +2
1 Solution
 
ronnie_urbanitAuthor Commented:
Here is the Config

!
SA Version 7.2(4)
!
hostname yandp-asa
domain-name yandp.local
enable password ************** encrypted
passwd ************** encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 111.111.111.111 255.255.255.248
!
interface Vlan3
 shutdown
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name yandp.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remoteusers 192.168.10.50-192.168.10.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 4899 192.168.0.2 4899 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 81.143.148.110 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 83.138.39.32 255.255.255.255 outside
http 192.168.0.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet 83.138.39.32 255.255.255.255 outside
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 8.8.8.8 4.2.2.2
!
dhcpd address 192.168.0.50-192.168.0.81 inside
dhcpd dns 8.8.8.8 4.2.2.2 interface inside
dhcpd enable inside
!

group-policy remoteusers internal
group-policy remoteusers attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value remoteusers_splitTunnelAcl
username username1 password LeSqCSjuytOzamUE encrypted privilege 0
username username1 attributes
 vpn-group-policy remoteusers
username username2 password Nkoa85648oq5Tc6PS encrypted privilege 0
username username2 attributes
 vpn-group-policy remoteusers
tunnel-group remoteusers type ipsec-ra
tunnel-group remoteusers general-attributes
 address-pool remoteusers
 default-group-policy remoteusers
tunnel-group remoteusers ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:866b6bbe2ee07ad7d272f6a80d7eed3e
: end
0
 
Pete LongConsultantCommented:
0
 
ronnie_urbanitAuthor Commented:
That is not the issue, I cannot access network drives either
0
 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

 
ullas_unniCommented:
are you able to ping those devices through the vpn?
0
 
mpickreignCommented:
Change this line from
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

to
access-list remoteusers_splitTunnelAcl extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
0
 
3nerdsCommented:
Hey Ronnie,

Every thing looks on the up and up, the only thing I think I would change is this:

Remove:
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0

It doesn't appear necessary and I think it might be confusing the NAT because it is hitting the rule first. I don't think what mpickreign suggest will hurt any but I don't see it being necessary as well.

The other change I would make would be to upgrade the code on your asa for a flavor of 8.X but not 8.3 as that will just confuse the issue. There were alot of bugs in the 7 code.

Regards,

3nerds
0
 
ronnie_urbanitAuthor Commented:
None of those solutions worked and I cant update the software because we don't have a smartnet agreement
0
 
ronnie_urbanitAuthor Commented:
I cannot ping any devices when connected to the VPN
0
 
ullas_unniCommented:
your config looks fine.. check routes in your internal network if router or layer 3 switch is there... they should route traffic to your vpn pool
0
 
ronnie_urbanitAuthor Commented:
There is no layer 3 switch, the devices plug directly into the switch on the ASA
0
 
ronnie_urbanitAuthor Commented:
This line was missing from the config

nat (inside) 0 access-list inside_nat0_outbound

I have added this line and it now working correctly
0
 
3nerdsCommented:
Ronnie,

That line appears in the origonal config you posted. If changes get made to the config make sure an update gets posted it will make helping you and getting you answers happen in a more timely manner.

Glad to see it worked out.

Regards,

3nerds

0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

  • 6
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now