Solved

Cannot get return traffic over VPN on ASA

Posted on 2010-09-08
12
552 Views
Last Modified: 2012-05-10

I have an ASA 5505 with VPN set up, I can connect to the VPN fine but I cannot remote desktop to any client machines, or connect to network drives etc.

I can Remote desktop and connect to the network drives internally

I have posted the config, with ext IP's and passwords masked out

The Network is Peer to Peer workgroup so we are using Google DNS servers, I'm not sure if this will make any difference.

However I am trying to connect to the Remote Desktop and Network drives via IP address.

I believe the issue is with the remote MAchine not receiving traffic back from the ASA
0
Comment
Question by:ronnie_urbanit
  • 6
  • 2
  • 2
  • +2
12 Comments
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33634234
Here is the Config

!
SA Version 7.2(4)
!
hostname yandp-asa
domain-name yandp.local
enable password ************** encrypted
passwd ************** encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 111.111.111.111 255.255.255.248
!
interface Vlan3
 shutdown
 no forward interface Vlan1
 nameif dmz
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name yandp.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip local pool remoteusers 192.168.10.50-192.168.10.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 4899 192.168.0.2 4899 netmask 255.255.255.255
route outside 0.0.0.0 0.0.0.0 81.143.148.110 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 83.138.39.32 255.255.255.255 outside
http 192.168.0.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet 83.138.39.32 255.255.255.255 outside
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 8.8.8.8 4.2.2.2
!
dhcpd address 192.168.0.50-192.168.0.81 inside
dhcpd dns 8.8.8.8 4.2.2.2 interface inside
dhcpd enable inside
!

group-policy remoteusers internal
group-policy remoteusers attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value remoteusers_splitTunnelAcl
username username1 password LeSqCSjuytOzamUE encrypted privilege 0
username username1 attributes
 vpn-group-policy remoteusers
username username2 password Nkoa85648oq5Tc6PS encrypted privilege 0
username username2 attributes
 vpn-group-policy remoteusers
tunnel-group remoteusers type ipsec-ra
tunnel-group remoteusers general-attributes
 address-pool remoteusers
 default-group-policy remoteusers
tunnel-group remoteusers ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:866b6bbe2ee07ad7d272f6a80d7eed3e
: end
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 33635519
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33636199
That is not the issue, I cannot access network drives either
0
 
LVL 4

Expert Comment

by:ullas_unni
ID: 33636485
are you able to ping those devices through the vpn?
0
 
LVL 4

Expert Comment

by:mpickreign
ID: 33637286
Change this line from
access-list remoteusers_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0

to
access-list remoteusers_splitTunnelAcl extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
0
 
LVL 13

Expert Comment

by:3nerds
ID: 33640688
Hey Ronnie,

Every thing looks on the up and up, the only thing I think I would change is this:

Remove:
access-list inside_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0

It doesn't appear necessary and I think it might be confusing the NAT because it is hitting the rule first. I don't think what mpickreign suggest will hurt any but I don't see it being necessary as well.

The other change I would make would be to upgrade the code on your asa for a flavor of 8.X but not 8.3 as that will just confuse the issue. There were alot of bugs in the 7 code.

Regards,

3nerds
0
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33641196
None of those solutions worked and I cant update the software because we don't have a smartnet agreement
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33641220
I cannot ping any devices when connected to the VPN
0
 
LVL 4

Expert Comment

by:ullas_unni
ID: 33643081
your config looks fine.. check routes in your internal network if router or layer 3 switch is there... they should route traffic to your vpn pool
0
 
LVL 1

Author Comment

by:ronnie_urbanit
ID: 33659991
There is no layer 3 switch, the devices plug directly into the switch on the ASA
0
 
LVL 1

Accepted Solution

by:
ronnie_urbanit earned 0 total points
ID: 33671930
This line was missing from the config

nat (inside) 0 access-list inside_nat0_outbound

I have added this line and it now working correctly
0
 
LVL 13

Expert Comment

by:3nerds
ID: 33671951
Ronnie,

That line appears in the origonal config you posted. If changes get made to the config make sure an update gets posted it will make helping you and getting you answers happen in a more timely manner.

Glad to see it worked out.

Regards,

3nerds

0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now