Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 455
  • Last Modified:

Remote Access VPN - Odd Routing Issue

I have a single user having an issue connecting from their house via the Cisco VPN Client to our corporate network which has an ASA 5510 head end.

Her local subnet is 192.168.1.0/24 and she connects fine and obtains an IP address in the address block reserved for remote access clients, however there is no communication over the link though TX and RX show data moving.

If I do a traceroute from her computer to the corporate network, I see real oddities (attached). I also attached her routing table which looks good.

The only gotcha I can think of, though it shouldn't make a difference to my knowledge, is that we also have a site-to-site VPN tunnel that connects to a 192.168.1.0/24 subnet, but since remote access clients grab from their own DHCP pool, I don't think this should matter?

Any ideas on this?
traceroute.PNG
routing-table.PNG
0
Tercestisi
Asked:
Tercestisi
  • 5
  • 2
2 Solutions
 
QlemoC++ DeveloperCommented:
Is the 172.30.11.x network the one used for 192.168.1.0 in the site-2-site connection? And what is 10.141.78.1?
0
 
djcanterCommented:
First hop should be 10.1.201.1 not 192.168.1.1.  Can you adjust the metric for the routed vpn networks to be less than the default route?
0
 
TercestisiAuthor Commented:
That's what I'm wondering Qlemo... none of those networks are used anywhere within our corporate network that does span about 50 subnets. Very odd...

Good idea djcanter, though the routing table shows which hop to contact for that route... that should take precedence over a metic.
0
Identify and Prevent Potential Cyber-threats

Become the white hat who helps safeguard our interconnected world. Transform your career future by earning your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

 
djcanterCommented:
Your traffic egressing the 192.168.1.1 gateway is hopping on the ISPs private routed network. Clearly they shouldnt allow this....
0
 
djcanterCommented:
Routing table should look like below with tunnel routes lower metric than default gateway:
Other sites have reported enabling NAT-T may resolve this

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0     192.168.1.10    192.168.1.10       20
     192.168.1.10  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255     192.168.1.10    192.168.1.10       20
        224.0.0.0        240.0.0.0     192.168.1.10    192.168.1.10       20
  255.255.255.255  255.255.255.255     192.168.1.10    192.168.1.10       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:


Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10       20
         10.1.0.0    255.255.255.0     172.20.10.62    172.20.10.62       1
         10.2.0.0    255.255.255.0     172.20.10.62    172.20.10.62       1
     65.216.9.229  255.255.255.255      192.168.1.1    192.168.1.10       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      172.20.10.0    255.255.255.0     172.20.10.62    172.20.10.62       1
     172.20.10.62  255.255.255.255        127.0.0.1       127.0.0.1       20
      172.20.11.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.21.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.31.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.50.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.51.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.60.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.61.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.70.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.71.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.81.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.91.0    255.255.255.0     172.20.10.62    172.20.10.62       1
   172.20.255.255  255.255.255.255     172.20.10.62    172.20.10.62       20
      192.168.1.0    255.255.255.0     192.168.1.10    192.168.1.10       20
      192.168.1.1  255.255.255.255     192.168.1.10    192.168.1.10       1
     192.168.1.10  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255     192.168.1.10    192.168.1.10       20
        224.0.0.0        240.0.0.0     172.20.10.62    172.20.10.62       20
        224.0.0.0        240.0.0.0     192.168.1.10    192.168.1.10       20
  255.255.255.255  255.255.255.255     172.20.10.62    172.20.10.62       1
  255.255.255.255  255.255.255.255     192.168.1.10    192.168.1.10       1
Default Gateway:       192.168.1.1
0
 
djcanterCommented:
Try this:
https://supportforums.cisco.com/thread/2084929

Workaround 2, changing metric of wired/wireless adapter not vpn client.
0
 
djcanterCommented:
Were you able to get issue resolved by adjusting route metric ?
If so, please close question as answered and award points.
0
 
TercestisiAuthor Commented:
Issue not resolved as I didn't hear back from user, and don't expect to unless the next big snow storm when they need to work from home again; awarded points anyhow.
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now