Cisco ASA5510 Remote VPN - no client traffic through VPN

Posted on 2010-09-09
Last Modified: 2012-05-10
Hi Experts,
We have a Cisco ASA5510 which is currently just setup to allow a Citrix CAG through the firewall.. but would like to expand and allow remote VPN users to connect (using the Cisco vpn client).

I have followed the config provided by lrmoore from a similar question on EE here: and have gotten the VPN up and running to a point -  I am unable to ping/tracert or browse to any clients (using IP address, not worried about dns name) on the 192.168.110.x network.

I am a relative Cisco newbie so please be gentle. Also any tips for troubleshooting this would be helpful. Current run config provided below.

On a side note I tried to access the ASDM but it refuses to bring up the software when I log into it. I would prefer to go through CLI if possible anyhow.

Thank you.
: Saved
ASA Version 7.0(8)
hostname C_ASA
enable password xxxxx encrypted
passwd xxxxx encrypted
name CAG_outside
name CAG_inside
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address
interface Ethernet0/1
 nameif cag
 security-level 100
 ip address
interface Ethernet0/2
 nameif inside
 security-level 100
 ip address
interface Ethernet0/3
 no nameif
 no security-level
 no ip address
interface Management0/0
 nameif management
 security-level 100
 no ip address
ftp mode passive
object-group network VPNPOOL
access-list acl_outside extended permit tcp any host CAG_outside eq https
access-list acl_outside extended permit tcp any host CAG_outside eq www
access-list DRXDRX_splitTunnelAcl extended permit ip any
access-list inside_nat0_outbound extended permit ip
access-list outside_cryptomap extended permit ip any
access-list outside_cryptomap_20.20 extended permit ip any object-group VPNPOOL
pager lines 24
logging enable
logging buffered debugging
logging trap debugging
logging asdm informational
mtu outside 1500
mtu cag 1500
mtu inside 1500
mtu management 1500
ip local pool vpnpool
no failover
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1
nat (cag) 1
nat (inside) 0 access-list inside_nat0_outbound
static (cag,outside) CAG_outside CAG_inside netmask
access-group acl_outside in interface outside
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute

group-policy DRXDRX internal
group-policy DRXDRX attributes
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DRXDRX_splitTunnelAcl
username admin password xxxxx encrypted privilege 15
username vpnuser password xxxxx encrypted
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_20.20
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
isakmp nat-traversal  20
tunnel-group DRXDRX type ipsec-ra
tunnel-group DRXDRX general-attributes
 address-pool VPNPOOL
 default-group-policy DRXDRX
tunnel-group DRXDRX ipsec-attributes
 pre-shared-key *
telnet timeout 5
ssh inside
ssh timeout 5
console timeout 0
management-access inside
class-map inspection_default
 match default-inspection-traffic
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
service-policy global_policy global
: end

Open in new window

Question by:fieryfredo
  • 2
  • 2
LVL 57

Expert Comment

by:Pete Long
ID: 33635500

Author Comment

ID: 33635746
Hi PeteLong - Thank you for the article, I read through it but my config seems to be of a similar config to the one in the article.. there is two small differences in the tunnel-group IPSEC-VPN-GROUP general-attributes - I don't have authentication-server-group PNL-KERBEROS or default-group-policy IPSEC-VPN-POLICY ... should I put those in or are they irrelevant?
LVL 57

Expert Comment

by:Pete Long
ID: 33639330
no they are just my AAA groups :^)

Accepted Solution

kuoh earned 500 total points
ID: 33678922
I don't see the "sysopt connection permit-ipsec" command in your config.

As for the ASDM issue, which network are you trying to access it from?  You need to add "http inside" if you want to access it from that network.  Aside from that, the PC also needs to have a JRE installed.

Author Closing Comment

ID: 33681022
The sysopt connection permit-ipsec got the VPN running.

Got ADSM working - needed older version of JRE - 6 update 7 otherwise it wouldn't work.

Many thanks for your help.

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Using Windows 2008 RRAS, I was able to successfully VPN into the network, but I was having problems restricting my test user from accessing certain things on the network.  I used Google in order to try to find out how to stop people from accessing c…
Overview Often, we set up VPN appliances where the connected clients are on a separate subnet and the company will have alternate internet connections and do not use this particular device as the gateway for certain servers or clients. In this case…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question