Solved

Cisco asa 5505 8.3 client ipsec vpn not working.

Posted on 2011-02-17
7
1,532 Views
Last Modified: 2012-05-11
Hi,

Well this week havent been the most excelent one.....Having another Cisco vpn client problem and the new 8.3 "language" is confusing me. I'm running the vpn wizard for ipsec, and it's not working as it should. My vpn clients (192.168.2.0) cannot contact anything on the lan (192.168.1.0). What is missing?

Tia

Lasse

ASA Version 8.3(1)
!
hostname Pix-Brende
enable password 2ODpSdIp.eAP3ZQS encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address x.x.207.130 255.255.255.252
!
interface Vlan5
 shutdown
 no nameif
 security-level 50
 ip address dhcp
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network OBJ_local_pool
 subnet 192.168.2.0 255.255.255.0
object network OBJ_Internal_Lan
 subnet 192.168.1.0 255.255.255.0
object network NETWORK_OBJ_192.168.2.0_25
 subnet 192.168.2.0 255.255.255.128
access-list no_nat extended permit ip object OBJ_Internal_Lan 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpnadr 192.168.2.1-192.168.2.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static OBJ_Internal_Lan OBJ_Internal_Lan destination static OBJ_local_pool OBJ_local_pool
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
!
object network obj_any
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 x.x.207.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
 network-acl no_nat
http server enable
http 192.168.1.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.40-192.168.1.80 inside
dhcpd dns 194.239.134.83 193.162.153.164 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 svc image disk0:/anyconnect-macosx-i386-2.4.1012-k9.pkg 1
 svc enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy ciscovpn internal
group-policy ciscovpn attributes
 wins-server value 192.168.1.100
 dns-server value 192.168.1.100
 vpn-tunnel-protocol IPSec l2tp-ipsec
username xxxxx password ANCZiCN68aFz2EKz encrypted privilege 0
username xxxxx attributes
 vpn-group-policy ciscovpn
username xxxxx password R4lCnDBBkBefk/Rq encrypted
username xxxxx attributes
 vpn-group-policy ciscovpn
tunnel-group vpnudefra type remote-access
tunnel-group vpnudefra general-attributes
 address-pool vpnadr
tunnel-group ciscovpn type remote-access
tunnel-group ciscovpn general-attributes
 address-pool vpnadr
 default-group-policy ciscovpn
tunnel-group ciscovpn ipsec-attributes
 pre-shared-key *****
!
!
prompt hostname context
Cryptochecksum:01688224f42ba489f2bafeb9b5adbbe5
: end
[OK]
0
Comment
Question by:melfarit
  • 3
  • 3
7 Comments
 
LVL 79

Expert Comment

by:lrmoore
ID: 34916515
>nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.2.0_25 NETWORK_OBJ_192.168.2.0_25
That looks right. It is the "new" way of doing "nat 0 w/access-list"

0
 

Author Comment

by:melfarit
ID: 34923911
Hi,

Well I still cant connect to any of the inside clients, any ideas ?

0
 
LVL 1

Accepted Solution

by:
alex_firewall_guy earned 125 total points
ID: 34925865
from my experience here and based upon the config snippet you have shown, you would either need to add the following command

sysopt connection permit-vpn

or you would need to have ACLs applied to the interfaces that allowed for your vpn pool addresses to access your internal hosts.

Maybe you already have one or the other of these present in your config, but I didn't see either in the snippet you posted.

Hope this helps.
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 1

Expert Comment

by:alex_firewall_guy
ID: 34951317
any luck yet?  
0
 

Assisted Solution

by:melfarit
melfarit earned 0 total points
ID: 34994992
Hi,

Sorry for the late answer, I've been sick.

I got it to work. I did a reset and ran the vpn wizard again. And then it worked. Strange.

0
 
LVL 1

Expert Comment

by:alex_firewall_guy
ID: 35061372
Did you try comparing the config after the reset and vpn wizard to the config from before all that to see what the difference was?  Just curious.
0
 

Author Closing Comment

by:melfarit
ID: 35115337
Resetting the device, was the only thing that worked. I never found the error
0

Featured Post

Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

OpenVPN is a great open source VPN server that is capable of providing quick and easy VPN access to your network on the cheap.  By default the software is configured to allow open access to your network.  But what if you want to restrict users to on…
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question