Question on connecting a client VPN ASA

Hi Guys,
i have a question about VPN Tunneling. I have one ASA 5505 with static PPPoE Adress outside and local 192.168.202.0/24 Network, acting as an EasyVPN Server. On the other side is another ASA 5505 without dynamic PPPoE outside interface acting as EasyVPN Client in client ode. Inside network is 192.168.1.0/24
This works pretty well! But now i have created another user that uses an software EasyVPN client to connect the EasyVPN Server. This works as well.
But how am i able to connect the client network 192.168.1.0/24 over the ASA connections?
Please give me some hint.

"But how am i able to connect the client network 192.168.1.0/24 over the ASA connections?"
Yes, if you set the split-tunnel ACL correctly you should be able connect to remote-client ASA.
Please follow the split-tunnel configuration method from Cisco doc, from below link.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml
Please rate helpful post.
Thanks
Rizwan Rafeek

Similar Messages

Cisco ASA 5505 IPsec client VPN - Cannot connect to local hosts

I have created a Cisco IPsec vpn on my ASA using the VPN creation wizard. I am able to successfully connect to the vpn and seemingly join the network, but after I connect I am unable to connect to or ping any of the hosts on the network.
Checking the ASA I can see that a VPN session is open and my client reports that it is connected. If I attempt to ping the client from the ASA all packets are dropped.
I suspect it may be an issue with my firewall, but I am not really sure where to begin.
Here is a copy of my config, any pointers or tips are aprpeciated:
hostname mcfw
enable password Pt8fQ27yMZplioYq encrypted
passwd 2qaO2Gd6IBRkrRFm encrypted
names
interface Ethernet0/0
switchport access vlan 400
interface Ethernet0/1
switchport access vlan 400
interface Ethernet0/2
switchport access vlan 420
interface Ethernet0/3
switchport access vlan 420
interface Ethernet0/4
switchport access vlan 450
interface Ethernet0/5
switchport access vlan 450
interface Ethernet0/6
switchport access vlan 500
interface Ethernet0/7
switchport access vlan 500
interface Vlan400
nameif outside
security-level 0
ip address 58.13.254.10 255.255.255.248
interface Vlan420
nameif public
security-level 20
ip address 192.168.20.1 255.255.255.0
interface Vlan450
nameif dmz
security-level 50
ip address 192.168.10.1 255.255.255.0
interface Vlan500
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
ftp mode passive
clock timezone JST 9
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network DM_INLINE_NETWORK_1
network-object host 58.13.254.11
network-object host 58.13.254.13
object-group service ssh_2220 tcp
port-object eq 2220
object-group service ssh_2251 tcp
port-object eq 2251
object-group service ssh_2229 tcp
port-object eq 2229
object-group service ssh_2210 tcp
port-object eq 2210
object-group service DM_INLINE_TCP_1 tcp
group-object ssh_2210
group-object ssh_2220
object-group service zabbix tcp
port-object range 10050 10051
object-group service DM_INLINE_TCP_2 tcp
port-object eq www
group-object zabbix
port-object eq 9000
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service http_8029 tcp
port-object eq 8029
object-group network DM_INLINE_NETWORK_2
network-object host 192.168.20.10
network-object host 192.168.20.30
network-object host 192.168.20.60
object-group service imaps_993 tcp
description Secure IMAP
port-object eq 993
object-group service public_wifi_group
description Service allowed on the Public Wifi Group. Allows Web and Email.
service-object tcp-udp eq domain
service-object tcp-udp eq www
service-object tcp eq https
service-object tcp-udp eq 993
service-object tcp eq imap4
service-object tcp eq 587
service-object tcp eq pop3
service-object tcp eq smtp
access-list outside_access_in remark http traffic from outside
access-list outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_1 eq www
access-list outside_access_in remark ssh from outside to web1
access-list outside_access_in extended permit tcp any host 58.13.254.11 object-group ssh_2251
access-list outside_access_in remark ssh from outside to penguin
access-list outside_access_in extended permit tcp any host 58.13.254.10 object-group ssh_2229
access-list outside_access_in remark http from outside to penguin
access-list outside_access_in extended permit tcp any host 58.13.254.10 object-group http_8029
access-list outside_access_in remark ssh from outside to hub & studio
access-list outside_access_in extended permit tcp any host 58.13.254.13 object-group DM_INLINE_TCP_1
access-list outside_access_in remark dns service to hub
access-list outside_access_in extended permit object-group TCPUDP any host 58.13.254.13 eq domain
access-list dmz_access_in extended permit ip 192.168.10.0 255.255.255.0 any
access-list dmz_access_in extended permit tcp any host 192.168.10.251 object-group DM_INLINE_TCP_2
access-list public_access_in remark Web access to DMZ websites (mediastudio/civicrm)
access-list public_access_in extended permit object-group TCPUDP any object-group DM_INLINE_NETWORK_2 eq www
access-list public_access_in remark General web access. (HTTP, DNS & ICMP and Email)
access-list public_access_in extended permit object-group public_wifi_group any any
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.20.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.0.80 255.255.255.240
access-list inside_nat0_outbound extended permit ip any 192.168.0.64 255.255.255.192
pager lines 24
logging enable
logging timestamp
logging buffered notifications
logging trap notifications
logging asdm debugging
logging from-address [email protected]
logging recipient-address [email protected] level warnings
logging host dmz 192.168.10.90 format emblem
logging permit-hostdown
mtu outside 1500
mtu public 1500
mtu dmz 1500
mtu inside 1500
ip local pool OfficePool 192.168.0.80-192.168.0.90 mask 255.255.255.0
ip local pool VPN_Pool 192.168.0.91-192.168.0.99 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 60
global (outside) 1 interface
global (dmz) 2 interface
nat (public) 1 0.0.0.0 0.0.0.0
nat (dmz) 1 0.0.0.0 0.0.0.0
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 2229 192.168.0.29 2229 netmask 255.255.255.255
static (inside,outside) tcp interface 8029 192.168.0.29 www netmask 255.255.255.255
static (dmz,outside) 58.13.254.13 192.168.10.10 netmask 255.255.255.255 dns
static (dmz,outside) 58.13.254.11 192.168.10.30 netmask 255.255.255.255 dns
static (inside,dmz) 192.168.10.0 192.168.0.0 netmask 255.255.255.0 dns
static (dmz,inside) 192.168.0.251 192.168.10.251 netmask 255.255.255.255
static (dmz,public) 192.168.20.30 192.168.10.30 netmask 255.255.255.255 dns
static (dmz,public) 192.168.20.10 192.168.10.10 netmask 255.255.255.255 dns
access-group outside_access_in in interface outside
access-group public_access_in in interface public
access-group dmz_access_in in interface dmz
route outside 0.0.0.0 0.0.0.0 58.13.254.9 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.0.0 255.255.255.0 inside
http 59.159.40.188 255.255.255.255 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt noproxyarp dmz
sysopt noproxyarp inside
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map public_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map public_map interface public
crypto isakmp enable outside
crypto isakmp enable public
crypto isakmp enable inside
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 59.159.40.188 255.255.255.255 outside
ssh 192.168.0.0 255.255.255.0 inside
ssh timeout 20
console timeout 0
dhcpd dns 61.122.112.97 61.122.112.1
dhcpd auto_config outside
dhcpd address 192.168.20.200-192.168.20.254 public
dhcpd enable public
dhcpd address 192.168.10.190-192.168.10.195 dmz
dhcpd enable dmz
dhcpd address 192.168.0.200-192.168.0.254 inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics host number-of-rate 2
no threat-detection statistics tcp-intercept
ntp server 130.54.208.201 source public
webvpn
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 61.122.112.97 61.122.112.1
vpn-tunnel-protocol l2tp-ipsec
group-policy CiscoASA internal
group-policy CiscoASA attributes
dns-server value 61.122.112.97 61.122.112.1
vpn-tunnel-protocol IPSec
username mcit password 4alT9CZ8ayD8O8Xg encrypted privilege 15
tunnel-group DefaultRAGroup general-attributes
address-pool VPN_Pool
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *****
tunnel-group ocmc type remote-access
tunnel-group ocmc general-attributes
address-pool OfficePool
tunnel-group ocmc ipsec-attributes
pre-shared-key *****
tunnel-group CiscoASA type remote-access
tunnel-group CiscoASA general-attributes
address-pool VPN_Pool
default-group-policy CiscoASA
tunnel-group CiscoASA ipsec-attributes
pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
smtp-server 192.168.10.10
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email [email protected]
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:222d6dcb583b5f5abc51a2251026f7f2
: end
asdm location 192.168.10.10 255.255.255.255 inside
asdm location 192.168.0.29 255.255.255.255 inside
asdm location 58.13.254.10 255.255.255.255 inside
no asdm history enable

Hi Conor,
What is your local net ? I see only one default route for outside network. Dont you need a route inside for your local network.
Regards,
Umair

ASA 5505 site-to-site VPN tunnel and client VPN sessions

Hello all
I have several years of general networking experience, but I have not yet had to set up an ASA from the ground up, so please bear with me.
I have a client who needs to establish a VPN tunnel from his satellite office (Site A) to his corporate office (Site Z). His satellite office will have a single PC sitting behind the ASA. In addition, he needs to be able to VPN from his home (Site H) to Site A to access his PC.
The first question I have is about the ASA 5505 and the various licensing options. I want to ensure that an ASA5505-BUN-K9 will be able to establish the site-to-site tunnel as well as allow him to use either the IPsec or SSL VPN client to connect from Site H to Site A. Would someone please confirm or deny that for me?
Secondly, I would like to verify that no special routing or configuration would need to take place in order to allow traffic not destined for Site Z (i.e., general web browsing or other traffic to any resource that is not part of the Site Z network) to go out his outside interface without specifically traversing the VPN tunnel (split tunneling?)
Finally, if the client were to establish a VPN session from Site H to Site A, would that allow for him to connect directly into resources at Site Z without any special firewall security rules? Since the VPN session would come in on the outside interface, and the tunnel back to Site Z goes out on the same interface, would this constitute a split horizon scenario that would call for a more complex config, or will the ASA handle that automatically without issue?
I don't yet have the equipment in-hand, so I can't provide any sample configs for you to look over, but I will certainly do so once I've got it.
Thanks in advance for any assistance provided!

First question:
Yes, 5505 will be able to establish site-to-site tunnel, and he can use IPSec vpn client, and SSL VPN (it comes with 2 default SSL VPN license).
Second question:
Yes, you are right. No special routing is required. All you need to configure is site-to-site VPN between Site A and Site Z LAN, and the internet traffic will be routed via Site A internet. Assuming you have all the NAT statement configured for that.
Last question:
This needs to be configured, it wouldn't automatically allow access to Site Z when he VPNs in to Site A.
Here is what needs to be configured:
1) Split tunnel ACL for VPN Client should include both Site Z and Site A LAN subnets.
2) On site A configures: same-security-traffic permit intra-interface
3) Crypto ACL for the site-to-site tunnel between Site Z and Site A needs to include the VPN Client pool subnet as follows:
On Site Z:
access-list permit ip
On Site A:
access-list permit ip
4) NAT exemption on site Z needs to include vpn client pool subnet as well.
Hope that helps.
Message was edited by: Jennifer Halim

Vpn-asa 5505 - connects fine, can't use resources

Using Remote Client VPN to access internal Lan behind an ASA 5505 device. The connection is working fine. But once I connect, I can't access any computer shared folders etc.   The only thing I can do is access the ASA 5505 through the ASDM 7.1    I can only ping the device 10.0.0.1 but nothing else.    The funny thing is that this was working fine, then in an attempt to speed up the VPN ACCESS (it is pretty slow), I went into the ASDM configuration software to look around.   Didn't think I changed anything, but now, it's not working.   Here is a copy of the backup cpg.
Any ideas.   Please respond with ASDM COMMANDS.. I'm a novice at the command line stuff.
Thanks.
-brett
config:
: Saved
: Written by enable_15 at 09:19:26.379 UTC Sat Feb 15 2014
ASA Version 9.1(4)
hostname ciscoasa
domain-name hnedu.com
enable password mnpTCRVkk1.ZjiWJ encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd 2KFQnbNIdI.2KYOU encrypted
names
ip local pool VPNUsers 10.0.0.80-10.0.0.99 mask 255.255.0.0
interface Ethernet0/0
switchport access vlan 2
speed 100
duplex full
interface Ethernet0/1
speed 100
duplex full
interface Ethernet0/2
speed 100
duplex full
interface Ethernet0/3
speed 100
duplex full
interface Ethernet0/4
speed 100
duplex full
interface Ethernet0/5
speed 100
duplex full
interface Ethernet0/6
speed 100
duplex full
interface Ethernet0/7
speed 100
duplex full
interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.1 255.255.0.0
interface Vlan2
description External Connection
no forward interface Vlan1
nameif outside
security-level 0
ip address 209.117.123.226 255.255.255.224
boot system disk0:/asa914-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 10.0.0.2
name-server 10.0.0.4
domain-name hnedu.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-10.0.0.0
subnet 10.0.0.0 255.255.0.0
object network obj-10.0.0.64
subnet 10.0.0.64 255.255.255.192
object network obj-10.0.0.6
host 10.0.0.6
object network obj-10.0.3.48
host 10.0.3.48
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_10.0.0.64_26
subnet 10.0.0.64 255.255.255.192
object-group network RDP_static
object-group service RemoteDesktop tcp-udp
description Windows Remote Desktop Access
port-object eq 3389
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list inside_access_in extended permit ip any4 any4
access-list Napoleons_splitTunnelAcl standard permit 10.0.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.0.0 10.0.0.64 255.255.255.192
access-list outside_access_in extended permit tcp any4 host 10.0.0.6 eq www
access-list outside_access_in remark remote desktop to cproom desktop
access-list outside_access_in extended permit object-group TCPUDP any4 host 10.0.3.48 eq 3389
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-715-100.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,any) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.0.0.64 obj-10.0.0.64 no-proxy-arp route-lookup
object network obj-10.0.0.6
nat (inside,outside) static 209.117.123.227
object network obj-10.0.3.48
nat (inside,outside) static 209.117.123.228
object network obj_any
nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside control-plane
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 209.117.123.225 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 10.0.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map inside_map interface inside
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca 6ecc7aa5a7032009b8cebcf4e952d491
    308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130
    0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117
    30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b
    13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504
    0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72
    20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56
    65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043
    65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31
    30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b
    30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20
    496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65
    74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420
    68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329
    3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365
    63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7
    0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597
    a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10
    9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc
    7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b
    15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845
    63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8
    18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced
    4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f
    81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201
    db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868
    7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101
    ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8
    45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777
    2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a
    1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406
    03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973
    69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403
    02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969
    6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b
    c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973
    69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30
    1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603
    551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355
    1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609
    2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80
    4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e
    b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a
    6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc
    481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16
    b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0
    5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8
    6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28
    6c2527b9 deb78458 c61f381e a4c4cb66
quit
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev1 enable inside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside
vpn-addr-assign local reuse-delay 5
vpn-sessiondb max-other-vpn-limit 10
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 2
dhcp-client update dns server none
dhcpd dns 10.0.0.2 10.0.0.4
dhcpd wins 10.0.0.2 10.0.0.4
dhcpd domain hnedu.com
dhcpd option 5 ip 10.0.0.2 10.0.0.4 interface inside
dhcpd option 6 ip 10.0.0.2 10.0.0.2 interface inside
dhcprelay server 10.0.0.2 inside
dhcprelay server 10.0.0.4 inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
group-policy Napoleons internal
group-policy Napoleons attributes
wins-server value 10.0.0.2 10.0.0.4
dns-server value 10.0.0.2 10.0.0.4
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Napoleons_splitTunnelAcl
default-domain value hnedu.com
group-policy Napoleon internal
group-policy Napoleon attributes
wins-server value 10.0.0.2 10.0.0.4
dns-server value 10.0.0.2 10.0.0.4
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Napoleons_splitTunnelAcl
default-domain value hnedu.com
username bpenza password LTg/b/c3kPWfC8KM encrypted privilege 0
username bpenza attributes
vpn-group-policy Napoleons
username baudette password nPZIRfshkE7WcaDQ encrypted
username baudette attributes
vpn-group-policy Napoleons
tunnel-group Napoleons type remote-access
tunnel-group Napoleons general-attributes
address-pool VPNUsers
default-group-policy Napoleons
tunnel-group Napoleons ipsec-attributes
ikev1 pre-shared-key Holyname12
tunnel-group Napoleon type remote-access
tunnel-group Napoleon general-attributes
address-pool VPNUsers
default-group-policy Napoleon
tunnel-group Napoleon ipsec-attributes
ikev1 pre-shared-key Holyname12
policy-map global-policy
class class-default
user-statistics accounting
service-policy global-policy global
prompt hostname context
call-home reporting anonymous
Cryptochecksum:eb9d34735b125eb61d8f7d93247ad9b7
: end

You need to discuss this issue with your network administrator. I suspect the network ports that allow VPN access to the system you want to use may be closed.
You also need to confirm that the VPN software you are using is compatible with the network you are trying to access. Where I work, the VPN software that comes with Mac OS X is not
compatible with the network so I have to use VPN software that was provided by my employer. You might be in the same situation.

How can I configure Lion server to accept inbound VPN (L2TP) connections while connected as client to another vpn service?

I have what I believe to be a unique need;
I have a MacPro (1,1) running Lion with Server app.
I require that this particular machine be connected as a client to a VPN server, while at the same time acting as a VPN server for my network.
The PPTP connection configuration is such that "Send all traffic over VPN connection" is checked.
If PPTP client is NOT connected, I can connect to Lion as VPN server. As soon as I make the connection from Lion as a client, I can no longer
connect to Lion VPN server.
I understand this is because I am forcing all traffic out the virtual interface (tun0) and eth0 is no longer listening on the local network.
1. Is it possible to bind the VPN client (on Lion Server) to a particular interface? If I could tell the PPTP client to only use eth1 as the interface of choice, my assumption would be that eth0 would then be free to accept incoming connections.
2. Is it possible to bind the VPN service (on Lion Server) to a particular interface? if I could tell the vpn serviec to only listen on eth1, and in turn tell the PPTP client to NOT communicate on eth1 but only eth0 then perhaps I could separate the communications?
In my head, it seems as though both of the above options would be required in order to use Lion as both a VPN server and VPN client
Any and all help appreciated.

This is a standard facet of most VPNs - the problem lies in your NAT router since both clients appear to come from the same IP address as far as the VPN server is concerned, and the router can't separate out the traffic.
There are a couple of solutions.
First, the built-in VPN server supports L2TP and PPTP protocols. You should be able to connect one system under each protocol, so that gets your two machines connected.
Second, you can replace your NAT router with one that supports multiple VPN clients (often termed 'VPN passthrough').
Third, setup a site-to-site tunnel so that your entire LAN is connected to the VPN (this saves you from having to run a separate VPN client on each machine, but is typically only worth it when you have more machines).

Can't connect to Easy VPN Server using Windows 7 inbuilt VPN client

Hi Everyone,
I would like your help to resolve a vpn issue I am having with my Windows 7 inbuilt vpn client. I am trying to connect to an Easy vpn server on a Cisco 2951 ISR G2. Well, I can connect using Cisco vpn client v5.07 but I can't connect using Windows 7 inbuilt vpn client. Is there any configuration that I am missing so that I can connect using Windows 7 inbuilt vpn client to connect to the vpn server?
Thank you.

Hi MindaugasKa,
Base on your description, your case must is the NPS client can’t pass the NPS policy.
The NPS client can’t connect the network may have many reason, such as the Network Access Protection Agent service not started successful, the certificate not issued properly,
please offer us information when your Windows 7 client denied, such as event id, original error information, screenshot.
More information:
Extensible Authentication Protocol (EAP) Settings for Network Access
http://technet.microsoft.com/en-us/library/hh945104.aspx
Network Access Protection in NPS
http://msdn.microsoft.com/en-us/library/cc754378.aspx
Appendix A: NAP Requirements
http://technet.microsoft.com/en-us/library/dd125301(v=ws.10).aspx
802.1X Authenticated Wireless Access Overview
http://technet.microsoft.com/en-us/library/hh994700.aspx
Connecting to Wireless Networks with Windows 7
http://technet.microsoft.com/library/ff802404.aspx
The related thread:
NPS 2012 rejects windows 7 clients after upgrade from 2008 R2. Requested EAP methods not available
http://social.technet.microsoft.com/Forums/windowsserver/en-US/44af171f-6155-4f2e-b6c7-f89a2d755908/nps-2012-rejects-windows-7-clients-after-upgrade-from-2008-r2-requested-eap-methods-not-available?forum=winserverNAP
I’m glad to be of help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Mapped drives do not open after connecting via Cisco VPN Client

I have an issue when I initially connect to my remote network, I cannot get to any mapped drive unless I wait a few minutes for the VPN connect to mature. To explain further, I have to wait 2-4 minutes after connecting to the VPN for me to actually connect to those drives.
The error that pops up is:
"An error occurred while reconnecting to DriveLetter: to \\Server\sharedDrive\ Microsoft WIndows Network: The network path was not found. This connection has not been restored.
Now, immediately after I connect, I am able to successfully ping the server that hosts those folder locations but for some reason I cannot get to the server via UNC/shared drives until I wait a few minutes after connecting.
Below is the list of error logs I get when attempting to connect to the mapped drives during those first few minutes of connectivity:
1 15:26:39.804 10/06/14 Sev=Warning/3 IKE/0xA300005F
Firewall, Sygate Security Agent, is not running, the client will not send firewall information to concentrator.
2 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
3 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
4 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
5 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
6 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
7 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
8 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
9 15:28:10.614 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
10 15:28:17.188 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
11 15:28:17.188 10/06/14 Sev=Warning/2 IPSEC/0xE3700003
Function CniInjectSend() failed with an error code of 0xE4510023 (IPSecDrvCB:856)
12 15:33:50.642 10/06/14 Sev=Warning/2 CVPND/0xA3400015
Error with call to IpHlpApi.DLL: CheckUpVASettings: Found IPADDR entry addr=192.168.11.120, error 0
13 15:33:51.656 10/06/14 Sev=Warning/2 CVPND/0xA3400015
Error with call to IpHlpApi.DLL: CleanUpVASettings: Was able to delete all VA settings after all, error 0
14 15:35:16.855 10/06/14 Sev=Warning/3 IKE/0xA300005F
Firewall, Sygate Security Agent, is not running, the client will not send firewall information to concentrator.
Any ideas on what it could be?

I have a client that is showing a similar issue.. Windows 7 computer using Cisco IPSec client terminating on a Cisco 881 Router. I can ping the server by IP, Name and even access the drive from the start menu option, but not the mapped drive. Currently I am looking into this from a offline file issue in windows, but ran across this post and was wondering if you had figured this out? I am going to try the following and will post back if that resolves it.
Doing some research I found that Windows 7 and Vista both have what’s called “slow link mode”. The behavior is that if the latency of the network connection exceeds 80 milliseconds (ms), the system will transition the files to “offline mode”. The 80 ms value is configurable using a local group policy edit.
Open Group policy (start -> run -> gpedit.msc)
Expand “Computer Configuration”
Expand “Administrative Templates”
Expand “Network”
Click on “Offline Files”
Locate “Configure slow-link mode”
This policy can either be disabled or set to a higher value for slower connections.
https://www.conetrix.com/Blog/post/Fixing-Problem-With-Windows-7-Shared-Files-and-Mapped-Drives-Unavailable-Over-VPN.aspx

Certificates for IPSEC vpn clients in ASA 8.0

Hello!
I have configured MS CA and i setup vpn client and ASA 7.0 to make tunnel with certificates.
Same configuration does not work with ASA 8.0 I get error
CRYPTO_PKI: Checking to see if an identical cert is
already in the database...
CRYPTO_PKI: looking for cert in handle=d4bb2888, digest=
b8 e5 74 97 f3 bf 25 1c 2e e5 21 3e d1 93 d6 15 | ..t...%...!>....
CRYPTO_PKI: Cert record not found, returning E_NOT_FOUND
CRYPTO_PKI: Cert not found in database.
CRYPTO_PKI: Looking for suitable trustpoints...
CRYPTO_PKI: Found a suitable authenticated trustpoint CA1.
CRYPTO_PKI(make trustedCerts list)CRYPTO_PKI:check_key_usage: Incorrect KeyUsage
(40)
CRYPTO_PKI: Certificate validation: Failed, status: 1873. Attempting to retrieve
revocation status if necessary
ERROR: Certificate validation failed. Peer certificate key usage is invalid, ser
ial number: 250F3ECE0000000009AF, subject name: cn=xxxxx,ou=xxxx,o=xxxxx,c=
xx
CRYPTO_PKI: Certificate not validated
Why the key usage is invalid? What certificate template must be used in MS CA in order to get a regular key usage?
The CA enrollement is terminal.
THANKS!

The cert needs to have the Digital Signature key usage set.
Not sure what templates are available on MS CA, but it should be something like "Ipsec user" I suppose.
To make ASA 8 behave the same as ASA 7 (i.e. disable th check on the cert's key usage), configure:
crypto ca trustpoint
ignore-ipsec-keyusage

Configurate cisco ipsec vpn client at asa 5505 version 8.4

Hi dear. I want to configurate cisco ipsec vpn client at asa 5505. At my asa the software version is 8.4.
please provide me a link or some material to config ipsec vpn client at asa 5505 version 8.4
thank you.

are you looking for vpn client .pcf file or the configuration on ASA (ASDM) ?
what version of vpn client ?

Cannot connect to ASDM on ASA 5505 over https

Problem: Cannot connect to ASDM on ASA 5505 when vlan1 network is changed from the factory default.
Hi all. I am just getting started on a new ASA 5505, working it in a test lab environment. I ran thru the initial setup wizard. During that time I specified a name for Vlan1 (changed from 'inside' to 'INTR-NET'), modified the Vlan1 IP address to use DHCP, and then populated the Device Config Access table with entries corresponding to the entire Class B network here on the local intranet. I don't recall if the factory-default network was already populated, but if it wasn't I added it as 192.168.1.0/255.255.255.0
I then saved the config, and verified that the ASA got a dhcp address using the RS-232 console. I then reconfigured the laptop I have plugged into port 0/1 with it's normal address on the intranet and discovered that I couldn't reconnect to ASDM. The ASDM client times out, and a web browser opened to https://(ASA5505's dhcp addr) fails as well.
I then used the console to add another http IP address matching the specific IP address (xxx.240.113.129/255.255.255.255) which the laptop is set for, to the list of permissible admin connections, but saw no difference.
This issue is much the same as was reported in this prior forum posting:
http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=General&topicID=.ee6e1f8&CommCmd=MB%3Fcmd%3Dpass_through%26location%3Doutline%40%5E1%40%40.2cc16cb8/4
EXCEPT that I was already aware the admin IP address(es) needed to be registered to enable access via SSH/Telnet/HTTPS.
And, I did that step, but it is not working. I have tried adding various combinations of network ranges in the device config access list, including the specific subnet that the lab's dhcp server assigned to the ASA 5505 (xxx.240.112.0/255.255.254.0), but there is no difference. I can traceroute to the laptop and ping the Vlan1 interface from the laptop, but the https ASDM (and ssh connections too) are not successful. This is very frustrating.
The device is brand new, I see that upon boot it loads asa724-k8.bin, and the software banner says Cisco Adaptive Security Appliance Software Version 7.2(4)
Note also that, from the RS-232 console, if I reset the IP address to the static, factory default (192.168.1.1) and manually config my laptop on the same subnet, then ASDM makes the connection. Just like out of the box. But when I put it back onto our intranet and verify the DHCP lease, then ASDM is a no go.
Can you think of what I've missed?

Good question. Let me add that info plus related Vlan config details:
ASA5505A# show ip
System IP Addresses:
Interface Name IP address Subnet mask Method
Vlan1 INTR-NET XXX.240.112.92 255.255.254.0 DHCP
Vlan2 VoIP 172.26.99.1 255.255.255.0 manual
Vlan3 dmz-unused 192.168.99.1 255.255.255.0 manual
Current IP Addresses:
Interface Name IP address Subnet mask Method
Vlan1 INTR-NET XXX.240.112.92 255.255.254.0 DHCP
Vlan2 VoIP 172.26.99.1 255.255.255.0 manual
Vlan3 dmz-unused 192.168.99.1 255.255.255.0 manual
ASA5505A# show switch vlan
VLAN Name Status Ports
1 INTR-NET up Et0/1, Et0/2, Et0/3, Et0/4
2 VoIP down Et0/5, Et0/6, Et0/7
3 dmz-unused down Et0/0
ASA5505A#
ASA5505A# config t
ASA5505A(config)# show running-config http
http server enable
http XXX.240.0.0 255.255.0.0 INTR-NET
http 192.168.1.0 255.255.255.0 INTR-NET
http XXX.240.113.129 255.255.255.255 INTR-NET
ASA5505A(config)#
ASA5505A(config)# show running-config ssh
ssh 192.168.1.0 255.255.255.0 INTR-NET
ssh XXX.240.0.0 255.255.0.0 INTR-NET
ssh timeout 5
SECURITY LEVEL IS 100 ON Vlan1 and Vlan2, 50 on Vlan3, and traffic is restricted from Vlan3 to Vlan1 because this is the basic license.

Is it OK to have two SBS Servers with same name, on different subnets but connected over a VPN?

Hi Everyone,
I'm just about to connect up two SBS 2011 Servers with the same server name but on different subnets & domains over a VPN.
So for example both servers will have the name Server01, one would have an ip address of 192.168.85.5, the other 192.168.86.5, they both then would be connected over a VPN.
Can anyone foresee any issues with this configuration, like DNS & DHCP requests, adding new machines to the domain, mapping drives etc.
Many thanks,
Nick

Hi Larry & Strike First,
Thank you for your responses. I understand that this is an unusual situation. Basically I've recently taken over the IT support for this client. The client has just had a new phone system installed
& are asking if they can speak to each office internally, which can easily be done once I setup the VPN.
However I noticed whilst looking at this further that the Server names are the same, hence my question?
Am I right in saying that providing the workstations have a trust relationship with their own domain controllers through their individual domains on separate subnets, that hopefully there shouldn't be any DNS issues between the two domains and Servers?
I could build a new VM if you feel it would be better practice to do so?
Many thanks for your assistance,
Nick

Help connecting to schools VPN

Hi there,
I am trying to connect to my schools vpn. I have tried tried the Cisco AnyConnect client, network-manager-openconnect and just openconnect.
Running openconnect I do:
openconnect -s /etc/vpnc/vpnc-script vpn.au.dk --user=username --authgroup=group
POST https://vpn.au.dk/
Attempting to connect to server 130.225.0.84:443
SSL negotiation with vpn.au.dk
Connected to HTTPS on vpn.au.dk
XML POST enabled
Please enter your username and password.
POST https://vpn.au.dk/
XML POST enabled
Please enter your username and password.
Password:
POST https://vpn.au.dk/
Got CONNECT response: HTTP/1.1 200 OK
CSTP connected. DPD 30, Keepalive 20
Connected tun0 as 10.11.38.72, using SSL
Established DTLS connection (using GnuTLS). Ciphersuite (DTLS0.9)-(RSA)-(AES-128-CBC)-(SHA1).
Now, when I try to go online (just with firefox) it's lang the connection is hanging. It will not tell me I'm offline, but I can't connect to anything. Pings doesn't answer and so on.
this is my ip addr:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp0s25: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether bc:5f:f4:f7:19:1a brd ff:ff:ff:ff:ff:ff
inet 192.168.1.10/24 brd 192.168.1.255 scope global enp0s25
valid_lft forever preferred_lft forever
inet6 fe80::c6c1:4161:14ca:9e3c/64 scope link
valid_lft forever preferred_lft forever
12: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1406 qdisc fq_codel state UNKNOWN group default qlen 500
link/none
inet 10.11.38.72/32 scope global tun0
valid_lft forever preferred_lft forever
So it seems I have connected, right? The same things happen when I use the Cisco AnyConnect client. It hangs, but will not tell me I'm completely offline.
With the network-manager-openconnect (just using nm-applet and adding my VPN connection) it will let me connect to the VPN and now I can actually go online. But surprise surprise, I'm not actually connected, I'm just using my own connection out to the world.
Can anyone recommend me a course of action? Any places I should look for trouble? It has worked fine before. I'm not even sure what has changed.
Edit: Here is the schools VPN guide: http://medarbejdere.au.dk/en/administra … vpn-linux/ .Seems like I'm doing what the think I should be doing, and I also get the OK message (Connected tun0 as 10.11.38.72, using SSL)
Last edited by madsravn (2015-05-05 22:22:01)

There are a number different VPN applications and protocols so without more info like, we probably can't help you much. (i.e.: Cisco VPN client v4.95. Juniper VPN, Microsoft PPtP, etc.) Additionally, the point of a VPN is security so info like your username and password would not be easily accessible by poking around on the Windows laptop. For example, if the laptop was stolen, it would be a crisis for your company if the bad guy could figure out your name/password by simply looking at the config files. So not to sound snarky, but if you need a name and password, that's something you need to get from your I.T. department.
I'm not saying that it's impossible, just that you either need the knowledge yourself, or the assistance / cooperation of your I.T. department. (I have my Mac connect to my Cisco ASA VPN appliance. But I'm also in the I.T. department, so I have their full cooperation. )

Cisco 2504 WLC client VPN Access

Hi,
I was reading couple of posts related to Cisco WLC + Client VPN passthrough .. and got a query.
https://supportforums.cisco.com/thread/2183687
https://supportforums.cisco.com/thread/2219356
The second link says that "Remote Acces VPN connections through the WLC work out of the box". Is this True? No need to configure Layer 3 VPN-Pass though for the SSID?
They are using WPA2+PSK as Layer 2 Security. Here WPA2-PSK + VPN Passthrough is the right combination for WLAN Layer2 + Layer 3 Security?
Thanks,
Jagan

It works out of the box... you don't need to configure any passthrough.. just connect to the ssid and VPN away.
Thanks,
Scott
Help out other by using the rating system and marking answered questions as "Answered"

Download Anyconnect client inside ASA

Hi,
I currently have a Cisco 5520 ASA which is up and running and the users are able to connect to Anyconnect to VPN into the network.
However, users plugged into the internal network inside the ASA are unable to connect to the vpn address and download the Anyconnect Client. I think this may be to do with reverse NAT missing?
I would appreciate any help.
Thanks in advance.
Nisha

Hi Lee,
I enabled the Anyconnect Client on the inside interface but have had no luck.
The users are trying to browse to a vpn address from which they are prompted to install the Anyconnect software. This comes under Network (Client) Access right?
Thanks in advance.
Nisha

To connect Oracle via VPN.

Like connecting Oracle Via VPN with my Remote Server

It shouldn't be a problem to connect to a remote database from a client machine through VPN.
But is it your question ?
Nicolas.

Question on connecting a client VPN ASA

Similar Messages

Maybe you are looking for