Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1555
  • Last Modified:

Cisco asa 5505 8.3 client ipsec vpn not working.

Hi,

Well this week havent been the most excelent one.....Having another Cisco vpn client problem and the new 8.3 "language" is confusing me. I'm running the vpn wizard for ipsec, and it's not working as it should. My vpn clients (192.168.2.0) cannot contact anything on the lan (192.168.1.0). What is missing?

Tia

Lasse

ASA Version 8.3(1)
!
hostname Pix-Brende
enable password 2ODpSdIp.eAP3ZQS encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address x.x.207.130 255.255.255.252
!
interface Vlan5
 shutdown
 no nameif
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network OBJ_local_pool
 subnet 192.168.2.0 255.255.255.0
object network OBJ_Internal_Lan
 subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_25
 subnet 192.168.2.0 255.255.255.128
access-list no_nat extended permit ip object OBJ_Internal_Lan 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpnadr 192.168.2.1-192.168.2.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static OBJ_Internal_Lan OBJ_Internal_Lan destination static OBJ_local_pool OBJ_local_pool
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
!
object network obj_any
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.207.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
 network-acl no_nat
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.40-192.168.1.80 inside
dhcpd dns 194.239.134.83 193.162.153.164 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 1
 svc enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy ciscovpn internal
group-policy ciscovpn attributes
 wins-server value 192.168.1.100
 dns-server value 192.168.1.100
 vpn-tunnel-protocol IPSec l2tp-ipsec
username xxxxx password ANCZiCN68aFz2EKz encrypted privilege 0
username xxxxx attributes
 vpn-group-policy ciscovpn
username xxxxx password R4lCnDBBkBefk/Rq encrypted
username xxxxx attributes
 vpn-group-policy ciscovpn
tunnel-group vpnudefra type remote-access
tunnel-group vpnudefra general-attributes
 address-pool vpnadr
tunnel-group ciscovpn type remote-access
tunnel-group ciscovpn general-attributes
 address-pool vpnadr
 default-group-policy ciscovpn
tunnel-group ciscovpn ipsec-attributes
 pre-shared-key *****
!
!
prompt hostname context
Cryptochecksum:01688224f42ba489f2bafeb9b5adbbe5
: end
[OK]
0
melfarit
Asked:
melfarit
  • 3
  • 3
2 Solutions
 
lrmooreCommented:
>nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
That looks right. It is the "new" way of doing "nat 0 w/access-list"

0
 
melfaritAuthor Commented:
Hi,

Well I still cant connect to any of the inside clients, any ideas ?

0
 
alex_firewall_guyCommented:
from my experience here and based upon the config snippet you have shown, you would either need to add the following command

sysopt connection permit-vpn

or you would need to have ACLs applied to the interfaces that allowed for your vpn pool addresses to access your internal hosts.

Maybe you already have one or the other of these present in your config, but I didn't see either in the snippet you posted.

Hope this helps.
0
What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

 
alex_firewall_guyCommented:
any luck yet?  
0
 
melfaritAuthor Commented:
Hi,

Sorry for the late answer, I've been sick.

I got it to work. I did a reset and ran the vpn wizard again. And then it worked. Strange.

0
 
alex_firewall_guyCommented:
Did you try comparing the config after the reset and vpn wizard to the config from before all that to see what the difference was?  Just curious.
0
 
melfaritAuthor Commented:
Resetting the device, was the only thing that worked. I never found the error
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

What Kind of Coding Program is Right for You?

There are many ways to learn to code these days. From coding bootcamps like Flatiron School to online courses to totally free beginner resources. The best way to learn to code depends on many factors, but the most important one is you. See what course is best for you.

  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now