Remote Access VPN - Odd Routing Issue

I have a single user having an issue connecting from their house via the Cisco VPN Client to our corporate network which has an ASA 5510 head end.

Her local subnet is 192.168.1.0/24 and she connects fine and obtains an IP address in the address block reserved for remote access clients, however there is no communication over the link though TX and RX show data moving.

If I do a traceroute from her computer to the corporate network, I see real oddities (attached). I also attached her routing table which looks good.

The only gotcha I can think of, though it shouldn't make a difference to my knowledge, is that we also have a site-to-site VPN tunnel that connects to a 192.168.1.0/24 subnet, but since remote access clients grab from their own DHCP pool, I don't think this should matter?

Any ideas on this?
traceroute.PNG
routing-table.PNG
TercestisiAsked:
Who is Participating?
 
djcanterCommented:
Your traffic egressing the 192.168.1.1 gateway is hopping on the ISPs private routed network. Clearly they shouldnt allow this....
0
 
QlemoBatchelor, Developer and EE Topic AdvisorCommented:
Is the 172.30.11.x network the one used for 192.168.1.0 in the site-2-site connection? And what is 10.141.78.1?
0
 
djcanterCommented:
First hop should be 10.1.201.1 not 192.168.1.1.  Can you adjust the metric for the routed vpn networks to be less than the default route?
0
Live Q & A: Securing Your Wi-Fi for Summer Travel

Traveling this summer? Join us on June 18, 2018 for a live stream to learn about the importance of Wi-Fi security and 3 easy measures you can start taking immediately to protect your private data while using public Wi-Fi. Follow us today to learn more!

Check it out!
 
TercestisiAuthor Commented:
That's what I'm wondering Qlemo... none of those networks are used anywhere within our corporate network that does span about 50 subnets. Very odd...

Good idea djcanter, though the routing table shows which hop to contact for that route... that should take precedence over a metic.
0
 
djcanterCommented:
Routing table should look like below with tunnel routes lower metric than default gateway:
Other sites have reported enabling NAT-T may resolve this

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10       20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      192.168.1.0    255.255.255.0     192.168.1.10    192.168.1.10       20
     192.168.1.10  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255     192.168.1.10    192.168.1.10       20
        224.0.0.0        240.0.0.0     192.168.1.10    192.168.1.10       20
  255.255.255.255  255.255.255.255     192.168.1.10    192.168.1.10       1
Default Gateway:       192.168.1.1
===========================================================================
Persistent Routes:


Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10       20
         10.1.0.0    255.255.255.0     172.20.10.62    172.20.10.62       1
         10.2.0.0    255.255.255.0     172.20.10.62    172.20.10.62       1
     65.216.9.229  255.255.255.255      192.168.1.1    192.168.1.10       1
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      172.20.10.0    255.255.255.0     172.20.10.62    172.20.10.62       1
     172.20.10.62  255.255.255.255        127.0.0.1       127.0.0.1       20
      172.20.11.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.21.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.31.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.50.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.51.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.60.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.61.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.70.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.71.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.81.0    255.255.255.0     172.20.10.62    172.20.10.62       1
      172.20.91.0    255.255.255.0     172.20.10.62    172.20.10.62       1
   172.20.255.255  255.255.255.255     172.20.10.62    172.20.10.62       20
      192.168.1.0    255.255.255.0     192.168.1.10    192.168.1.10       20
      192.168.1.1  255.255.255.255     192.168.1.10    192.168.1.10       1
     192.168.1.10  255.255.255.255        127.0.0.1       127.0.0.1       20
    192.168.1.255  255.255.255.255     192.168.1.10    192.168.1.10       20
        224.0.0.0        240.0.0.0     172.20.10.62    172.20.10.62       20
        224.0.0.0        240.0.0.0     192.168.1.10    192.168.1.10       20
  255.255.255.255  255.255.255.255     172.20.10.62    172.20.10.62       1
  255.255.255.255  255.255.255.255     192.168.1.10    192.168.1.10       1
Default Gateway:       192.168.1.1
0
 
djcanterCommented:
Try this:
https://supportforums.cisco.com/thread/2084929

Workaround 2, changing metric of wired/wireless adapter not vpn client.
0
 
djcanterCommented:
Were you able to get issue resolved by adjusting route metric ?
If so, please close question as answered and award points.
0
 
TercestisiAuthor Commented:
Issue not resolved as I didn't hear back from user, and don't expect to unless the next big snow storm when they need to work from home again; awarded points anyhow.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.

Advertise Here