Solved

Cisco ASA5510 Remote VPN - no client traffic through VPN

Posted on 2010-09-09
5
546 Views
Last Modified: 2012-05-10
Hi Experts,
We have a Cisco ASA5510 which is currently just setup to allow a Citrix CAG through the firewall.. but would like to expand and allow remote VPN users to connect (using the Cisco vpn client).

I have followed the config provided by lrmoore from a similar question on EE here: http://www.experts-exchange.com/Security/Firewalls/Q_21960471.html and have gotten the VPN up and running to a point -  I am unable to ping/tracert or browse to any clients (using IP address, not worried about dns name) on the 192.168.110.x network.

I am a relative Cisco newbie so please be gentle. Also any tips for troubleshooting this would be helpful. Current run config provided below.

On a side note I tried to access the ASDM but it refuses to bring up the software when I log into it. I would prefer to go through CLI if possible anyhow.

Thank you.
: Saved
:
ASA Version 7.0(8)
!
hostname C_ASA
domain-name C_ASA.co.uk
enable password xxxxx encrypted
passwd xxxxx encrypted
names
name 195.xxx.xxx.148 CAG_outside
name 192.168.1.2 CAG_inside
dns-guard
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address 195.xxx.xxx.146 255.255.255.240
!
interface Ethernet0/1
 nameif cag
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
 nameif inside
 security-level 100
 ip address 192.168.110.253 255.255.255.0
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 nameif management
 security-level 100
 no ip address
 management-only
!
ftp mode passive
object-group network VPNPOOL
 network-object 172.30.100.0 255.255.255.224
access-list acl_outside extended permit tcp any host CAG_outside eq https
access-list acl_outside extended permit tcp any host CAG_outside eq www
access-list DRXDRX_splitTunnelAcl extended permit ip 192.168.110.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.110.0 255.255.255.0 172.30.100.0 255.255.255.224
access-list outside_cryptomap extended permit ip any 172.30.100.0 255.255.255.224
access-list outside_cryptomap_20.20 extended permit ip any object-group VPNPOOL
pager lines 24
logging enable
logging buffered debugging
logging trap debugging
logging asdm informational
mtu outside 1500
mtu cag 1500
mtu inside 1500
mtu management 1500
ip local pool vpnpool 172.30.100.1-172.30.100.30
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1 195.xxx.xxx.147
nat (cag) 1 192.168.1.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
static (cag,outside) CAG_outside CAG_inside netmask 255.255.255.255
access-group acl_outside in interface outside
route outside 0.0.0.0 0.0.0.0 195.xxx.xxx.145 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

group-policy DRXDRX internal
group-policy DRXDRX attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DRXDRX_splitTunnelAcl
 webvpn
username admin password xxxxx encrypted privilege 15
username vpnuser password xxxxx encrypted
http server enable
http 192.168.110.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_20.20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp nat-traversal  20
tunnel-group DRXDRX type ipsec-ra
tunnel-group DRXDRX general-attributes
 address-pool VPNPOOL
 default-group-policy DRXDRX
tunnel-group DRXDRX ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh 192.168.110.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
management-access inside
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
: end

Open in new window

0
Comment
Question by:fieryfredo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 57

Expert Comment

by:Pete Long
ID: 33635500
0
 

Author Comment

by:fieryfredo
ID: 33635746
Hi PeteLong - Thank you for the article, I read through it but my config seems to be of a similar config to the one in the article.. there is two small differences in the tunnel-group IPSEC-VPN-GROUP general-attributes - I don't have authentication-server-group PNL-KERBEROS or default-group-policy IPSEC-VPN-POLICY ... should I put those in or are they irrelevant?
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 33639330
no they are just my AAA groups :^)
0
 
LVL 6

Accepted Solution

by:
kuoh earned 500 total points
ID: 33678922
I don't see the "sysopt connection permit-ipsec" command in your config.  http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#solution11

As for the ASDM issue, which network are you trying to access it from?  You need to add "http 192.168.1.0 255.255.255.0 inside" if you want to access it from that network.  Aside from that, the PC also needs to have a JRE installed.
0
 

Author Closing Comment

by:fieryfredo
ID: 33681022
The sysopt connection permit-ipsec got the VPN running.

Got ADSM working - needed older version of JRE - 6 update 7 otherwise it wouldn't work.

Many thanks for your help.
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Overview Often, we set up VPN appliances where the connected clients are on a separate subnet and the company will have alternate internet connections and do not use this particular device as the gateway for certain servers or clients. In this case…
Do you have a windows based Checkpoint SmartCenter for centralized Checkpoint management?  Have you ever backed up the firewall policy residing on the SmartCenter?  If you have then you know the hassles of connecting to the server, doing an upgrade_…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question