Link to home
Start Free TrialLog in
Avatar of fieryfredo
fieryfredoFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Cisco ASA5510 Remote VPN - no client traffic through VPN

Hi Experts,
We have a Cisco ASA5510 which is currently just setup to allow a Citrix CAG through the firewall.. but would like to expand and allow remote VPN users to connect (using the Cisco vpn client).

I have followed the config provided by lrmoore from a similar question on EE here: and have gotten the VPN up and running to a point -  I am unable to ping/tracert or browse to any clients (using IP address, not worried about dns name) on the 192.168.110.x network.

I am a relative Cisco newbie so please be gentle. Also any tips for troubleshooting this would be helpful. Current run config provided below.

On a side note I tried to access the ASDM but it refuses to bring up the software when I log into it. I would prefer to go through CLI if possible anyhow.

Thank you.
: Saved
ASA Version 7.0(8)
hostname C_ASA
enable password xxxxx encrypted
passwd xxxxx encrypted
name CAG_outside
name CAG_inside
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address
interface Ethernet0/1
 nameif cag
 security-level 100
 ip address
interface Ethernet0/2
 nameif inside
 security-level 100
 ip address
interface Ethernet0/3
 no nameif
 no security-level
 no ip address
interface Management0/0
 nameif management
 security-level 100
 no ip address
ftp mode passive
object-group network VPNPOOL
access-list acl_outside extended permit tcp any host CAG_outside eq https
access-list acl_outside extended permit tcp any host CAG_outside eq www
access-list DRXDRX_splitTunnelAcl extended permit ip any
access-list inside_nat0_outbound extended permit ip
access-list outside_cryptomap extended permit ip any
access-list outside_cryptomap_20.20 extended permit ip any object-group VPNPOOL
pager lines 24
logging enable
logging buffered debugging
logging trap debugging
logging asdm informational
mtu outside 1500
mtu cag 1500
mtu inside 1500
mtu management 1500
ip local pool vpnpool
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1
nat (cag) 1
nat (inside) 0 access-list inside_nat0_outbound
static (cag,outside) CAG_outside CAG_inside netmask
access-group acl_outside in interface outside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

group-policy DRXDRX internal
group-policy DRXDRX attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DRXDRX_splitTunnelAcl
username admin password xxxxx encrypted privilege 15
username vpnuser password xxxxx encrypted
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_20.20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp nat-traversal  20
tunnel-group DRXDRX type ipsec-ra
tunnel-group DRXDRX general-attributes
 address-pool VPNPOOL
 default-group-policy DRXDRX
tunnel-group DRXDRX ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh inside
ssh timeout 5
console timeout 0
management-access inside
class-map inspection_default
 match default-inspection-traffic
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
service-policy global_policy global
: end

Open in new window

Avatar of Pete Long
Pete Long
Flag of United Kingdom of Great Britain and Northern Ireland image

Avatar of fieryfredo


Hi PeteLong - Thank you for the article, I read through it but my config seems to be of a similar config to the one in the article.. there is two small differences in the tunnel-group IPSEC-VPN-GROUP general-attributes - I don't have authentication-server-group PNL-KERBEROS or default-group-policy IPSEC-VPN-POLICY ... should I put those in or are they irrelevant?
no they are just my AAA groups :^)
Avatar of kuoh
Flag of United States of America image

Link to home
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
The sysopt connection permit-ipsec got the VPN running.

Got ADSM working - needed older version of JRE - 6 update 7 otherwise it wouldn't work.

Many thanks for your help.