Solved

Cisco ASA5510 Remote VPN - no client traffic through VPN

Posted on 2010-09-09
5
533 Views
Last Modified: 2012-05-10
Hi Experts,
We have a Cisco ASA5510 which is currently just setup to allow a Citrix CAG through the firewall.. but would like to expand and allow remote VPN users to connect (using the Cisco vpn client).

I have followed the config provided by lrmoore from a similar question on EE here: http://www.experts-exchange.com/Security/Firewalls/Q_21960471.html and have gotten the VPN up and running to a point -  I am unable to ping/tracert or browse to any clients (using IP address, not worried about dns name) on the 192.168.110.x network.

I am a relative Cisco newbie so please be gentle. Also any tips for troubleshooting this would be helpful. Current run config provided below.

On a side note I tried to access the ASDM but it refuses to bring up the software when I log into it. I would prefer to go through CLI if possible anyhow.

Thank you.
: Saved

:

ASA Version 7.0(8)

!

hostname C_ASA

domain-name C_ASA.co.uk

enable password xxxxx encrypted

passwd xxxxx encrypted

names

name 195.xxx.xxx.148 CAG_outside

name 192.168.1.2 CAG_inside

dns-guard

!

interface Ethernet0/0

 nameif outside

 security-level 0

 ip address 195.xxx.xxx.146 255.255.255.240

!

interface Ethernet0/1

 nameif cag

 security-level 100

 ip address 192.168.1.1 255.255.255.0

!

interface Ethernet0/2

 nameif inside

 security-level 100

 ip address 192.168.110.253 255.255.255.0

!

interface Ethernet0/3

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Management0/0

 shutdown

 nameif management

 security-level 100

 no ip address

 management-only

!

ftp mode passive

object-group network VPNPOOL

 network-object 172.30.100.0 255.255.255.224

access-list acl_outside extended permit tcp any host CAG_outside eq https

access-list acl_outside extended permit tcp any host CAG_outside eq www

access-list DRXDRX_splitTunnelAcl extended permit ip 192.168.110.0 255.255.255.0 any

access-list inside_nat0_outbound extended permit ip 192.168.110.0 255.255.255.0 172.30.100.0 255.255.255.224

access-list outside_cryptomap extended permit ip any 172.30.100.0 255.255.255.224

access-list outside_cryptomap_20.20 extended permit ip any object-group VPNPOOL

pager lines 24

logging enable

logging buffered debugging

logging trap debugging

logging asdm informational

mtu outside 1500

mtu cag 1500

mtu inside 1500

mtu management 1500

ip local pool vpnpool 172.30.100.1-172.30.100.30

no failover

asdm image disk0:/asdm-508.bin

no asdm history enable

arp timeout 14400

global (outside) 1 195.xxx.xxx.147

nat (cag) 1 192.168.1.0 255.255.255.0

nat (inside) 0 access-list inside_nat0_outbound

static (cag,outside) CAG_outside CAG_inside netmask 255.255.255.255

access-group acl_outside in interface outside

route outside 0.0.0.0 0.0.0.0 195.xxx.xxx.145 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute



group-policy DRXDRX internal

group-policy DRXDRX attributes

 vpn-tunnel-protocol IPSec

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value DRXDRX_splitTunnelAcl

 webvpn

username admin password xxxxx encrypted privilege 15

username vpnuser password xxxxx encrypted

http server enable

http 192.168.110.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_20.20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800

crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000

crypto dynamic-map outside_dyn_map 20 set reverse-route

crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

isakmp enable outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

isakmp nat-traversal  20

tunnel-group DRXDRX type ipsec-ra

tunnel-group DRXDRX general-attributes

 address-pool VPNPOOL

 default-group-policy DRXDRX

tunnel-group DRXDRX ipsec-attributes

 pre-shared-key *

telnet timeout 5

ssh 192.168.110.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

management-access inside

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map global_policy

 class inspection_default

  inspect dns maximum-length 512

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

: end

Open in new window

0
Comment
Question by:fieryfredo
  • 2
  • 2
5 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 33635500
0
 

Author Comment

by:fieryfredo
ID: 33635746
Hi PeteLong - Thank you for the article, I read through it but my config seems to be of a similar config to the one in the article.. there is two small differences in the tunnel-group IPSEC-VPN-GROUP general-attributes - I don't have authentication-server-group PNL-KERBEROS or default-group-policy IPSEC-VPN-POLICY ... should I put those in or are they irrelevant?
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 33639330
no they are just my AAA groups :^)
0
 
LVL 6

Accepted Solution

by:
kuoh earned 500 total points
ID: 33678922
I don't see the "sysopt connection permit-ipsec" command in your config.  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#solution11

As for the ASDM issue, which network are you trying to access it from?  You need to add "http 192.168.1.0 255.255.255.0 inside" if you want to access it from that network.  Aside from that, the PC also needs to have a JRE installed.
0
 

Author Closing Comment

by:fieryfredo
ID: 33681022
The sysopt connection permit-ipsec got the VPN running.

Got ADSM working - needed older version of JRE - 6 update 7 otherwise it wouldn't work.

Many thanks for your help.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now