Cisco ASA5510 Remote VPN - no client traffic through VPN

Posted on 2010-09-09
Last Modified: 2012-05-10
Hi Experts,
We have a Cisco ASA5510 which is currently just setup to allow a Citrix CAG through the firewall.. but would like to expand and allow remote VPN users to connect (using the Cisco vpn client).

I have followed the config provided by lrmoore from a similar question on EE here: and have gotten the VPN up and running to a point -  I am unable to ping/tracert or browse to any clients (using IP address, not worried about dns name) on the 192.168.110.x network.

I am a relative Cisco newbie so please be gentle. Also any tips for troubleshooting this would be helpful. Current run config provided below.

On a side note I tried to access the ASDM but it refuses to bring up the software when I log into it. I would prefer to go through CLI if possible anyhow.

Thank you.
: Saved


ASA Version 7.0(8)


hostname C_ASA


enable password xxxxx encrypted

passwd xxxxx encrypted


name CAG_outside

name CAG_inside



interface Ethernet0/0

 nameif outside

 security-level 0

 ip address


interface Ethernet0/1

 nameif cag

 security-level 100

 ip address


interface Ethernet0/2

 nameif inside

 security-level 100

 ip address


interface Ethernet0/3


 no nameif

 no security-level

 no ip address


interface Management0/0


 nameif management

 security-level 100

 no ip address



ftp mode passive

object-group network VPNPOOL


access-list acl_outside extended permit tcp any host CAG_outside eq https

access-list acl_outside extended permit tcp any host CAG_outside eq www

access-list DRXDRX_splitTunnelAcl extended permit ip any

access-list inside_nat0_outbound extended permit ip

access-list outside_cryptomap extended permit ip any

access-list outside_cryptomap_20.20 extended permit ip any object-group VPNPOOL

pager lines 24

logging enable

logging buffered debugging

logging trap debugging

logging asdm informational

mtu outside 1500

mtu cag 1500

mtu inside 1500

mtu management 1500

ip local pool vpnpool

no failover

asdm image disk0:/asdm-508.bin

no asdm history enable

arp timeout 14400

global (outside) 1

nat (cag) 1

nat (inside) 0 access-list inside_nat0_outbound

static (cag,outside) CAG_outside CAG_inside netmask

access-group acl_outside in interface outside

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

group-policy DRXDRX internal

group-policy DRXDRX attributes

 vpn-tunnel-protocol IPSec

 split-tunnel-policy tunnelspecified

 split-tunnel-network-list value DRXDRX_splitTunnelAcl


username admin password xxxxx encrypted privilege 15

username vpnuser password xxxxx encrypted

http server enable

http inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map outside_dyn_map 20 match address outside_cryptomap_20.20

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800

crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000

crypto dynamic-map outside_dyn_map 20 set reverse-route

crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

isakmp enable outside

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash sha

isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

isakmp nat-traversal  20

tunnel-group DRXDRX type ipsec-ra

tunnel-group DRXDRX general-attributes

 address-pool VPNPOOL

 default-group-policy DRXDRX

tunnel-group DRXDRX ipsec-attributes

 pre-shared-key *

telnet timeout 5

ssh inside

ssh timeout 5

console timeout 0

management-access inside


class-map inspection_default

 match default-inspection-traffic



policy-map global_policy

 class inspection_default

  inspect dns maximum-length 512

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp


service-policy global_policy global

: end

Open in new window

Question by:fieryfredo
  • 2
  • 2
LVL 57

Expert Comment

by:Pete Long
ID: 33635500

Author Comment

ID: 33635746
Hi PeteLong - Thank you for the article, I read through it but my config seems to be of a similar config to the one in the article.. there is two small differences in the tunnel-group IPSEC-VPN-GROUP general-attributes - I don't have authentication-server-group PNL-KERBEROS or default-group-policy IPSEC-VPN-POLICY ... should I put those in or are they irrelevant?
LVL 57

Expert Comment

by:Pete Long
ID: 33639330
no they are just my AAA groups :^)

Accepted Solution

kuoh earned 500 total points
ID: 33678922
I don't see the "sysopt connection permit-ipsec" command in your config.

As for the ASDM issue, which network are you trying to access it from?  You need to add "http inside" if you want to access it from that network.  Aside from that, the PC also needs to have a JRE installed.

Author Closing Comment

ID: 33681022
The sysopt connection permit-ipsec got the VPN running.

Got ADSM working - needed older version of JRE - 6 update 7 otherwise it wouldn't work.

Many thanks for your help.

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Using Windows 2008 RRAS, I was able to successfully VPN into the network, but I was having problems restricting my test user from accessing certain things on the network.  I used Google in order to try to find out how to stop people from accessing c…
This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now