Link to home
Start Free TrialLog in
Avatar of melfarit
melfaritFlag for Faroe Islands

asked on

Cisco asa 5505 8.3 client ipsec vpn not working.

Hi,

Well this week havent been the most excelent one.....Having another Cisco vpn client problem and the new 8.3 "language" is confusing me. I'm running the vpn wizard for ipsec, and it's not working as it should. My vpn clients (192.168.2.0) cannot contact anything on the lan (192.168.1.0). What is missing?

Tia

Lasse

ASA Version 8.3(1)
!
hostname Pix-Brende
enable password 2ODpSdIp.eAP3ZQS encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address x.x.207.130 255.255.255.252
!
interface Vlan5
 shutdown
 no nameif
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network OBJ_local_pool
 subnet 192.168.2.0 255.255.255.0
object network OBJ_Internal_Lan
 subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_25
 subnet 192.168.2.0 255.255.255.128
access-list no_nat extended permit ip object OBJ_Internal_Lan 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpnadr 192.168.2.1-192.168.2.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static OBJ_Internal_Lan OBJ_Internal_Lan destination static OBJ_local_pool OBJ_local_pool
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
!
object network obj_any
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.207.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
 network-acl no_nat
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.40-192.168.1.80 inside
dhcpd dns 194.239.134.83 193.162.153.164 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 1
 svc enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy ciscovpn internal
group-policy ciscovpn attributes
 wins-server value 192.168.1.100
 dns-server value 192.168.1.100
 vpn-tunnel-protocol IPSec l2tp-ipsec
username xxxxx password ANCZiCN68aFz2EKz encrypted privilege 0
username xxxxx attributes
 vpn-group-policy ciscovpn
username xxxxx password R4lCnDBBkBefk/Rq encrypted
username xxxxx attributes
 vpn-group-policy ciscovpn
tunnel-group vpnudefra type remote-access
tunnel-group vpnudefra general-attributes
 address-pool vpnadr
tunnel-group ciscovpn type remote-access
tunnel-group ciscovpn general-attributes
 address-pool vpnadr
 default-group-policy ciscovpn
tunnel-group ciscovpn ipsec-attributes
 pre-shared-key *****
!
!
prompt hostname context
Cryptochecksum:01688224f42ba489f2bafeb9b5adbbe5
: end
[OK]
Avatar of Les Moore
Les Moore
Flag of United States of America image

>nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
That looks right. It is the "new" way of doing "nat 0 w/access-list"

Avatar of melfarit

ASKER

Hi,

Well I still cant connect to any of the inside clients, any ideas ?

ASKER CERTIFIED SOLUTION
Avatar of alex_firewall_guy
alex_firewall_guy

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of alex_firewall_guy
alex_firewall_guy

any luck yet?  
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Did you try comparing the config after the reset and vpn wizard to the config from before all that to see what the difference was?  Just curious.
Resetting the device, was the only thing that worked. I never found the error