Cisco ASA5510 Remote VPN - no client traffic through VPN

Posted on 2010-09-09
Medium Priority
Last Modified: 2012-05-10
Hi Experts,
We have a Cisco ASA5510 which is currently just setup to allow a Citrix CAG through the firewall.. but would like to expand and allow remote VPN users to connect (using the Cisco vpn client).

I have followed the config provided by lrmoore from a similar question on EE here: http://www.experts-exchange.com/Security/Firewalls/Q_21960471.html and have gotten the VPN up and running to a point -  I am unable to ping/tracert or browse to any clients (using IP address, not worried about dns name) on the 192.168.110.x network.

I am a relative Cisco newbie so please be gentle. Also any tips for troubleshooting this would be helpful. Current run config provided below.

On a side note I tried to access the ASDM but it refuses to bring up the software when I log into it. I would prefer to go through CLI if possible anyhow.

Thank you.
: Saved
ASA Version 7.0(8)
hostname C_ASA
domain-name C_ASA.co.uk
enable password xxxxx encrypted
passwd xxxxx encrypted
name 195.xxx.xxx.148 CAG_outside
name CAG_inside
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 195.xxx.xxx.146
interface Ethernet0/1
 nameif cag
 security-level 100
 ip address
interface Ethernet0/2
 nameif inside
 security-level 100
 ip address
interface Ethernet0/3
 no nameif
 no security-level
 no ip address
interface Management0/0
 nameif management
 security-level 100
 no ip address
ftp mode passive
object-group network VPNPOOL
access-list acl_outside extended permit tcp any host CAG_outside eq https
access-list acl_outside extended permit tcp any host CAG_outside eq www
access-list DRXDRX_splitTunnelAcl extended permit ip any
access-list inside_nat0_outbound extended permit ip
access-list outside_cryptomap extended permit ip any
access-list outside_cryptomap_20.20 extended permit ip any object-group VPNPOOL
pager lines 24
logging enable
logging buffered debugging
logging trap debugging
logging asdm informational
mtu outside 1500
mtu cag 1500
mtu inside 1500
mtu management 1500
ip local pool vpnpool
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1 195.xxx.xxx.147
nat (cag) 1
nat (inside) 0 access-list inside_nat0_outbound
static (cag,outside) CAG_outside CAG_inside netmask
access-group acl_outside in interface outside
route outside 195.xxx.xxx.145 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

group-policy DRXDRX internal
group-policy DRXDRX attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DRXDRX_splitTunnelAcl
username admin password xxxxx encrypted privilege 15
username vpnuser password xxxxx encrypted
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_20.20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp nat-traversal  20
tunnel-group DRXDRX type ipsec-ra
tunnel-group DRXDRX general-attributes
 address-pool VPNPOOL
 default-group-policy DRXDRX
tunnel-group DRXDRX ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh inside
ssh timeout 5
console timeout 0
management-access inside
class-map inspection_default
 match default-inspection-traffic
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
service-policy global_policy global
: end

Open in new window

Question by:fieryfredo
  • 2
  • 2
LVL 57

Expert Comment

by:Pete Long
ID: 33635500

Author Comment

ID: 33635746
Hi PeteLong - Thank you for the article, I read through it but my config seems to be of a similar config to the one in the article.. there is two small differences in the tunnel-group IPSEC-VPN-GROUP general-attributes - I don't have authentication-server-group PNL-KERBEROS or default-group-policy IPSEC-VPN-POLICY ... should I put those in or are they irrelevant?
LVL 57

Expert Comment

by:Pete Long
ID: 33639330
no they are just my AAA groups :^)

Accepted Solution

kuoh earned 2000 total points
ID: 33678922
I don't see the "sysopt connection permit-ipsec" command in your config.  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#solution11

As for the ASDM issue, which network are you trying to access it from?  You need to add "http inside" if you want to access it from that network.  Aside from that, the PC also needs to have a JRE installed.

Author Closing Comment

ID: 33681022
The sysopt connection permit-ipsec got the VPN running.

Got ADSM working - needed older version of JRE - 6 update 7 otherwise it wouldn't work.

Many thanks for your help.

Featured Post


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For a while, I have wanted to connect my HTC Incredible to my corporate network to take advantage of the phone's powerful capabilities. I searched online and came up with varied answers from "it won't work" to super complicated statements that I did…
How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question