Solved

Cisco asa 5505 8.3 client ipsec vpn not working.

Posted on 2011-02-17
7
1,521 Views
Last Modified: 2012-05-11
Hi,

Well this week havent been the most excelent one.....Having another Cisco vpn client problem and the new 8.3 "language" is confusing me. I'm running the vpn wizard for ipsec, and it's not working as it should. My vpn clients (192.168.2.0) cannot contact anything on the lan (192.168.1.0). What is missing?

Tia

Lasse

ASA Version 8.3(1)
!
hostname Pix-Brende
enable password 2ODpSdIp.eAP3ZQS encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address x.x.207.130 255.255.255.252
!
interface Vlan5
 shutdown
 no nameif
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network OBJ_local_pool
 subnet 192.168.2.0 255.255.255.0
object network OBJ_Internal_Lan
 subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_25
 subnet 192.168.2.0 255.255.255.128
access-list no_nat extended permit ip object OBJ_Internal_Lan 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpnadr 192.168.2.1-192.168.2.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static OBJ_Internal_Lan OBJ_Internal_Lan destination static OBJ_local_pool OBJ_local_pool
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
!
object network obj_any
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.207.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
 network-acl no_nat
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.40-192.168.1.80 inside
dhcpd dns 194.239.134.83 193.162.153.164 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 1
 svc enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy ciscovpn internal
group-policy ciscovpn attributes
 wins-server value 192.168.1.100
 dns-server value 192.168.1.100
 vpn-tunnel-protocol IPSec l2tp-ipsec
username xxxxx password ANCZiCN68aFz2EKz encrypted privilege 0
username xxxxx attributes
 vpn-group-policy ciscovpn
username xxxxx password R4lCnDBBkBefk/Rq encrypted
username xxxxx attributes
 vpn-group-policy ciscovpn
tunnel-group vpnudefra type remote-access
tunnel-group vpnudefra general-attributes
 address-pool vpnadr
tunnel-group ciscovpn type remote-access
tunnel-group ciscovpn general-attributes
 address-pool vpnadr
 default-group-policy ciscovpn
tunnel-group ciscovpn ipsec-attributes
 pre-shared-key *****
!
!
prompt hostname context
Cryptochecksum:01688224f42ba489f2bafeb9b5adbbe5
: end
[OK]
0
Comment
Question by:melfarit
  • 3
  • 3
7 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 34916515
>nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
That looks right. It is the "new" way of doing "nat 0 w/access-list"

0
 

Author Comment

by:melfarit
ID: 34923911
Hi,

Well I still cant connect to any of the inside clients, any ideas ?

0
 
LVL 1

Accepted Solution

by:
alex_firewall_guy earned 125 total points
ID: 34925865
from my experience here and based upon the config snippet you have shown, you would either need to add the following command

sysopt connection permit-vpn

or you would need to have ACLs applied to the interfaces that allowed for your vpn pool addresses to access your internal hosts.

Maybe you already have one or the other of these present in your config, but I didn't see either in the snippet you posted.

Hope this helps.
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 1

Expert Comment

by:alex_firewall_guy
ID: 34951317
any luck yet?  
0
 

Assisted Solution

by:melfarit
melfarit earned 0 total points
ID: 34994992
Hi,

Sorry for the late answer, I've been sick.

I got it to work. I did a reset and ran the vpn wizard again. And then it worked. Strange.

0
 
LVL 1

Expert Comment

by:alex_firewall_guy
ID: 35061372
Did you try comparing the config after the reset and vpn wizard to the config from before all that to see what the difference was?  Just curious.
0
 

Author Closing Comment

by:melfarit
ID: 35115337
Resetting the device, was the only thing that worked. I never found the error
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

This is an article about my experiences with remote access to my clients (so that I may serve them) and eventually to my home office system via Radmin Remote Control. I have been using remote access for over 10 years and have been improving my metho…
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now