Solved

vpn tunnel only works for 1 of 2 workstations

Posted on 2014-02-26
4
251 Views
Last Modified: 2014-03-25
Server 2008
VPN tunnel with a Cisco ASA 5500 on each end

At the remote location there are two workstations, each of them plugged into the Cisco ASA 5500. Workstation1 works fine. Workstation2 can't see the server or anything on the  other side of the tunnel. Workstation2 can't ping the server or websites on the internet. Workstation 2 can, however, ping itself and Workstation1. Workstation2 CAN browse the internet.

Thanks for any help.
0
Comment
Question by:carlosab
  • 2
4 Comments
 
LVL 51

Expert Comment

by:Netman66
ID: 39890935
Is workstation 2 in the vpn network object in that site?

In order to be allowed through an ASA, you need to be included in access lists and/or policies (service or global) to be able to do anything.

I'm just guessing, but you should check the firewall policies to ensure that workstation 2 is in all the same groups as workstation 1.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 500 total points
ID: 39890940
Oh, you may also need to check that the physical port that workstation 2 is connected to is configured the same as the port workstation 1 is attached to.

You can even prevent access by ports as well as users or IP addresses.

ASA is very granular and because of this it's easy to misconfigure it.
0
 
LVL 9

Expert Comment

by:ffleisma
ID: 39891026
based from your information both workstations are directly connected to the firewall, is the correct assumption?

if you could provide the current configuration for both sites, we might be able to drill down the exact configuration you need to apply.

also, just a question, why are the two workstation directly connected to the firewall? (if this assumption is correct) if possible it might be better to have host connected to a switch which then connects to the firewall
0
 

Author Closing Comment

by:carlosab
ID: 39954899
Yes - changing the port that workstation 2 was connected to fixed the problem. Thank you.
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now