Solved

Cisco asa 5505 8.3 client ipsec vpn not working.

Posted on 2011-02-17
7
1,535 Views
Last Modified: 2012-05-11
Hi,

Well this week havent been the most excelent one.....Having another Cisco vpn client problem and the new 8.3 "language" is confusing me. I'm running the vpn wizard for ipsec, and it's not working as it should. My vpn clients (192.168.2.0) cannot contact anything on the lan (192.168.1.0). What is missing?

Tia

Lasse

ASA Version 8.3(1)
!
hostname Pix-Brende
enable password 2ODpSdIp.eAP3ZQS encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address x.x.207.130 255.255.255.252
!
interface Vlan5
 shutdown
 no nameif
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network OBJ_local_pool
 subnet 192.168.2.0 255.255.255.0
object network OBJ_Internal_Lan
 subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_25
 subnet 192.168.2.0 255.255.255.128
access-list no_nat extended permit ip object OBJ_Internal_Lan 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpnadr 192.168.2.1-192.168.2.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static OBJ_Internal_Lan OBJ_Internal_Lan destination static OBJ_local_pool OBJ_local_pool
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
!
object network obj_any
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.207.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
 network-acl no_nat
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.40-192.168.1.80 inside
dhcpd dns 194.239.134.83 193.162.153.164 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 1
 svc enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy ciscovpn internal
group-policy ciscovpn attributes
 wins-server value 192.168.1.100
 dns-server value 192.168.1.100
 vpn-tunnel-protocol IPSec l2tp-ipsec
username xxxxx password ANCZiCN68aFz2EKz encrypted privilege 0
username xxxxx attributes
 vpn-group-policy ciscovpn
username xxxxx password R4lCnDBBkBefk/Rq encrypted
username xxxxx attributes
 vpn-group-policy ciscovpn
tunnel-group vpnudefra type remote-access
tunnel-group vpnudefra general-attributes
 address-pool vpnadr
tunnel-group ciscovpn type remote-access
tunnel-group ciscovpn general-attributes
 address-pool vpnadr
 default-group-policy ciscovpn
tunnel-group ciscovpn ipsec-attributes
 pre-shared-key *****
!
!
prompt hostname context
Cryptochecksum:01688224f42ba489f2bafeb9b5adbbe5
: end
[OK]
0
Comment
Question by:melfarit
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 34916515
>nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
That looks right. It is the "new" way of doing "nat 0 w/access-list"

0
 

Author Comment

by:melfarit
ID: 34923911
Hi,

Well I still cant connect to any of the inside clients, any ideas ?

0
 
LVL 1

Accepted Solution

by:
alex_firewall_guy earned 125 total points
ID: 34925865
from my experience here and based upon the config snippet you have shown, you would either need to add the following command

sysopt connection permit-vpn

or you would need to have ACLs applied to the interfaces that allowed for your vpn pool addresses to access your internal hosts.

Maybe you already have one or the other of these present in your config, but I didn't see either in the snippet you posted.

Hope this helps.
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 
LVL 1

Expert Comment

by:alex_firewall_guy
ID: 34951317
any luck yet?  
0
 

Assisted Solution

by:melfarit
melfarit earned 0 total points
ID: 34994992
Hi,

Sorry for the late answer, I've been sick.

I got it to work. I did a reset and ran the vpn wizard again. And then it worked. Strange.

0
 
LVL 1

Expert Comment

by:alex_firewall_guy
ID: 35061372
Did you try comparing the config after the reset and vpn wizard to the config from before all that to see what the difference was?  Just curious.
0
 

Author Closing Comment

by:melfarit
ID: 35115337
Resetting the device, was the only thing that worked. I never found the error
0

Featured Post

Are Your IoT Devices Out to Get You?

IoT business is booming, with manufacturers connecting any and every “thing” to the Internet. But as pressure grows to release new products faster and faster, we’re all left to wonder: is security a priority? Join our webinar on June 29th for the answer.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question