Remote access VPN-unable to connect inside-URGENT

Hi,
I have configured Remote access VPN in cisco ASA 5520.Whenever I am trying to connect from outside it's connecting fine.It aslo getting IP from pool but prob is i am unable to connect/ping inside nw.
Pls help me...how to resolve this issue.

I had the same problem on an IOS router (871). My solution was one of two things. I downloaded the most up-to-date version of the VPN client (5.0.02.90) as opposed to the version I had or it was a software firewall (Norton 360). I have two different computers. One works just fine...the other connects but no traffic passes through. Here is what I have:
Computer 1 (working)- VPN Client v5.0.02.0090 and Network Associates Enterprise VirusScan.
Computer 2 (not working) - VPN Client v5.0.00.0340 and Norton 360.
I highly doubt it is the VPN Client, but sometimes you never know. Check your software firewall and try disabling it. Let me know how this works.

Similar Messages

  • Remote Access VPN - Unable to Access LAN / Inside Network

    Hi,
    I am facing a problem with Cisco ASA remote access VPN, the remote client is connected to VPN and receiving IP address but the client is not able to ping or telnet any internal network.
    I have attached running configuration for your reference. Please let me know I miss any configuartion.
    FW : ASA5510
    Version : 8.0
    Note : Site to Site VPN is working without any issues
    Thanks
    Jamal

    Hi,
    Very nice network diagram
    Are you saying that originally the VPN Client user is behind the Jeddah ASA?
    If this is true wouldnt it be wiser to just use the already existing L2L VPN between these sites?
    In real situation I think the VPN Client would only be needed when you are outside either Head Quarter or Jeddah Network. And since you tested it infront of the ASA and it worked there shouldnt be any problem.
    Now to the reason why the VPN Client isnt working from behind the Jeddah ASA.
    Can you check that the following configuration is found on the Jeddah ASA (Depending on the software level of the ASA the format of the command might change. I'm not 100% sure)
    isakmp nat-traversal To enable NAT traversal globally, check that ISAKMP is enabled (you can enable it with the isakmp enable command) in global configuration mode and then use the isakmp nat-traversal command. If you have enabled NAT traversal, you can disable it with the no form of this command.
    isakmp nat-traversal natkeepalive
    no isakmp nat-traversal natkeepalive
    Syntax Description
    natkeepalive
    Sets the NAT keep alive interval, from 10 to 3600 seconds. The default is 20 seconds.
    Defaults
    By default, NAT traversal (isakmp nat-traversal) is disabled.
    Command Modes
    The following table shows the modes in which you can enter the command:
    Command Mode
    Firewall Mode
    Security Context
    Routed
    Transparent
    Single
    Multiple
    Context
    System
    Global configuration
    Command History
    Release
    Modification
    Preexisting
    This command was preexisting.
    7.2(1)
    This command was deprecated. The crypto isakmp nat-traversal command replaces it.
    Usage Guidelines Network Address Translation (NAT), including Port Address Translation  (PAT), is used in many networks where IPSec is also used, but there are a  number of incompatibilities that prevent IPSec packets from  successfully traversing NAT devices. NAT traversal enables ESP packets  to pass through one or more NAT devices.
    The security appliance supports NAT traversal as described by Version 2  and Version 3 of the IETF "UDP Encapsulation of IPsec Packets" draft,  available at http://www.ietf.org/html.charters/ipsec-charter.html, and NAT traversal is supported for both dynamic and static crypto maps.
    This command enables NAT-T globally on the security appliance. To disable in a crypto-map entry, use the crypto map set nat-t-disable command.
    Examples
    The following example, entered in global configuration mode, enables  ISAKMP and then enables NAT traversal with an interval of 30 seconds:
    hostname(config)# isakmp enable
    hostname(config)# isakmp nat-traversal 30
    - Jouni

  • Remote access VPN client gets connected fails on hosts in LAN

    Hi,
    VPN client gets connected fine, I have a inter VLAN routing happening on the switch in the LAN so all the LAN hosts have gateway IP on the switch, I have the defult route pointing to ASA inside interface on the switch, the switch I can reach after Remote Access VPN is connected how ever I cannot ping/connect to other hosts in the LAN and if I make the gateway point to the ASA then that host is accessible, any suggestions? I really want to have gateway to be the Switch as I have other networks reachable through the Switch (Intranet routing)

    Hi Mashal,
    Thanks for your time,
    VPN Pool(Client) 192.168.100.0/24
    Internal Subnets 192.9.200.0/24(VLAN 4000) and 192.168.2.0/24 (VLAN 1000)
    =============
    On the Switch
    =============
    Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route
    Gateway of last resort is 192.168.2.5 to network 0.0.0.0
         172.32.0.0/24 is subnetted, 1 subnets
    C       172.32.0.0 is directly connected, Vlan101
    C    192.168.200.0/24 is directly connected, Vlan2000
    C    192.9.200.0/24 is directly connected, Vlan4000
    S    192.168.250.0/24 [1/0] via 192.9.200.125
    S    192.168.1.0/24 [1/0] via 192.9.200.125
    C    192.168.2.0/24 is directly connected, Vlan1000
    S    192.168.252.0/24 [1/0] via 192.9.200.125
    S*   0.0.0.0/0 [1/0] via 192.168.2.5
    ===============
    On ASA
    ===============
    Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
           i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
           * - candidate default, U - per-user static route, o - ODR
           P - periodic downloaded static route
    Gateway of last resort is 172.32.0.2 to network 0.0.0.0
    C    172.32.0.0 255.255.255.0 is directly connected, outside
    C    192.9.200.0 255.255.255.0 is directly connected, inside
    C    192.168.168.0 255.255.255.0 is directly connected, failover
    C    192.168.2.0 255.255.255.0 is directly connected, MGMT
    S    192.168.100.2 255.255.255.255 [1/0] via 172.32.0.2, outside
    S    192.168.100.3 255.255.255.255 [1/0] via 172.32.0.2, outside
    S*   0.0.0.0 0.0.0.0 [1/0] via 172.32.0.2, outside
    We don't need route print on the PC for now as I can explain what is happening I can get complete access to the 192.168.2.0/24 (VLAN 1000) but for 192.9.200.0/24 (VLAN 4000) above from the switch I can only ping IP's on the switches/pair but cannot have any tcp connections, which explains the default route being pointed on the switch is on VLAN 1000, now my issue is How do I get access to VLAN 4000 as you can see these two are on different Interfaces/zones on the ASA and please note with default gateway pointing to ASA I will have access to both the VLAN's it is only when I move the gateway pointing to Switch I loose tcp connections to one VLAN depending on the default route  on the being pointing to on the switch.
    So we are left to do with how to on the switch with default route.

  • Remote access VPN client gets connected no access to LAN

    : Saved
    ASA Version 8.6(1)2
    hostname COL-ASA-01
    domain-name dr.test.net
    enable password i/RAo1iZPOnp/BK7 encrypted
    passwd i/RAo1iZPOnp/BK7 encrypted
    names
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address 172.32.0.11 255.255.255.0
    interface GigabitEthernet0/1
    nameif inside
    security-level 100
    ip address 192.9.200.126 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    nameif failover
    security-level 0
    ip address 192.168.168.1 255.255.255.0 standby 192.168.168.2
    interface Management0/0
    nameif management
    security-level 0
    ip address 192.168.2.11 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dr.test.net
    object network RAVPN
    subnet 192.168.0.0 255.255.255.0
    object network NETWORK_OBJ_192.168.200.0_24
    subnet 192.168.200.0 255.255.255.0
    object network NETWORK_OBJ_192.9.200.0_24
    subnet 192.9.200.0 255.255.255.0
    object-group network inside_network
    network-object 192.9.200.0 255.255.255.0
    object-group network Outside
    network-object host 172.32.0.25
    access-list RAVPN_splitTunnelAcl standard permit 192.9.200.0 255.255.255.0
    access-list test123 extended permit ip host 192.168.200.1 host 192.9.200.190
    access-list test123 extended permit ip host 192.9.200.190 host 192.168.200.1
    access-list test123 extended permit ip object NETWORK_OBJ_192.168.200.0_24 192.9.200.0 255.255.255.0
    access-list test123 extended permit ip 192.9.200.0 255.255.255.0 object NETWORK_OBJ_192.9.200.0_24
    pager lines 24
    mtu management 1500
    mtu outside 1500
    mtu inside 1500
    mtu failover 1500
    ip local pool RAVPN 192.168.200.1-192.168.200.254 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-66114.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic any interface
    nat (any,inside) source static NETWORK_OBJ_192.168.200.0_24 NETWORK_OBJ_192.168.200.0_24 destination static NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24
    route outside 0.0.0.0 0.0.0.0 172.32.0.2 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 0.0.0.0 0.0.0.0 outside
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    subject-name CN=KWI-COL-ASA-01.dr.test.net,O=KWI,C=US
    crl configure
    crypto ikev1 enable outside
    crypto ikev1 policy 10
    authentication crack
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 20
    authentication rsa-sig
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 30
    authentication pre-share
    encryption aes-256
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 40
    authentication crack
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 50
    authentication rsa-sig
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 60
    authentication pre-share
    encryption aes-192
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 70
    authentication crack
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 80
    authentication rsa-sig
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 90
    authentication pre-share
    encryption aes
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 100
    authentication crack
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 110
    authentication rsa-sig
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 120
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 130
    authentication crack
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 140
    authentication rsa-sig
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 150
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    crypto ikev1 policy 65535
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    telnet 192.9.200.0 255.255.255.0 inside
    telnet timeout 30
    ssh 0.0.0.0 0.0.0.0 management
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 66.35.45.128 255.255.255.192 outside
    ssh 0.0.0.0 0.0.0.0 inside
    ssh timeout 30
    ssh version 2
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    group-policy RAVPN internal
    group-policy RAVPN attributes
    wins-server value 192.9.200.164
    dns-server value 66.35.46.84 66.35.47.12
    vpn-filter value test123
    vpn-tunnel-protocol ikev1
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value test123
    default-domain value dr.kligerweiss.net
    username test password xxxxxxx encrypted
    username admin password aaaaaaaaaaaa encrypted privilege 15
    username vpntest password ddddddddddd encrypted
    tunnel-group RAVPN type remote-access
    tunnel-group RAVPN general-attributes
    address-pool RAVPN
    default-group-policy RAVPN
    tunnel-group RAVPN ipsec-attributes
    ikev1 pre-shared-key *****
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly 2
      subscribe-to-alert-group configuration periodic monthly 2
      subscribe-to-alert-group telemetry periodic daily
    password encryption aes
    Cryptochecksum:b001e526a239af2c73fa56f3ca7667ea
    : end
    COL-ASA-01#
    Here is some capture done on the inside interface which may help too, I tried pointing the gateway to inside interface on the target device but I think this was a switch without ip route available on it I believe that is still sending packet back to Cisco inside interface
    COL-ASA-01# sho cap test | in 192.168.200
    25: 23:45:55.570618 192.168.200.1 > 192.9.200.190: icmp: echo request
      29: 23:45:56.582794 192.168.200.1.137 > 192.9.200.164.137:  udp 68
      38: 23:45:58.081050 192.168.200.1.137 > 192.9.200.164.137:  udp 68
      56: 23:45:59.583176 192.168.200.1.137 > 192.9.200.164.137:  udp 68
      69: 23:46:00.573517 192.168.200.1 > 192.9.200.190: icmp: echo request
      98: 23:46:05.578110 192.168.200.1 > 192.9.200.190: icmp: echo request
      99: 23:46:05.590057 192.168.200.1.137 > 192.9.200.164.137:  udp 68
    108: 23:46:07.092310 192.168.200.1.137 > 192.9.200.164.137:  udp 68
    115: 23:46:08.592468 192.168.200.1.137 > 192.9.200.164.137:  udp 68
    116: 23:46:10.580795 192.168.200.1 > 192.9.200.190: icmp: echo request
    COL-ASA-01#
    Any help or pointers greatly appreciated, I am doing this config after a long gap on Cisco last time I was working it was all PIX so just need some expert eyes to let me know if I am missing something.
    And Yes I do not have a Host in Inside network to test against, all I have is a switch which cannot route and ip default gateway is not helping too...

    Hi,
    The first thing you should do to avoid problems is to change the VPN Pool to something else than the current LAN network as they are not really directly connected in the same network segment.
    You could try the following changes
    tunnel-group RAVPN general-attributes
      no address-pool RAVPN
    no ip local pool RAVPN 192.168.200.1-192.168.200.254 mask 255.255.255.0
    ip local pool RAVPN 192.168.201.1-192.168.201.254 mask 255.255.255.0
    tunnel-group RAVPN general-attributes
      address-pool RAVPN
    no nat  (any,inside) source static NETWORK_OBJ_192.168.200.0_24  NETWORK_OBJ_192.168.200.0_24 destination static  NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24
    In the above you first remove the VPN Pool from the "tunnel-group" and then remove and recreate the VPN Pool with another network and then insert it back to the same "tunnel-group". Nex you remove the current NAT configuration.
    object network LAN
    subnet 192.168.200.0 255.255.255.0
    object network VPN-POOL
    subnet 192.168.201.0 255.255.255.0
    nat (inside,outside) 1 source static LAN LAN destination static VPN-POOL VPN-POOL
    The above NAT configurations adds the correct NAT0 configuration for the changed VPN Pool. It also inserts the NAT rule to the very top before the Dynamic PAT rule you currently have. It is also one of the problems with the configurations as it will override your current NAT configurations.
    You have your Dynamic PAT rule at the very top of your NAT rules currently which is not a good idea. If you wish to change it to something else that wont override the other NAT configurations in the future you can do the following change.
    no nat (inside,outside) source dynamic any interface
    nat (inside,outside) after-auto source dynamic any interface
    NOTICE! Changing the above Dynamic PAT configuration will temporarily terminate all connections for users from the LAN as you reconfigure the Dynamic PAT rule. So if you do this change make sure that its ok to cause still small cut in the current connections of internal users
    Hope this helps
    Let me know if it works for you
    - Jouni

  • Remote access VPN to server from outside and server reach internet on the same time

    Dear,
    I have problem in my ASA 5515-X , when i make Remote access VPN to servers in inside zone the internet connection disconnected in the servers, or when i have internet in servers, the remote access cant reach servers.
    the configuration for server as static NAT for each server, and the connection of VPN is to another public IP but in the same subnet of NAT ip.
    server1 : 10.10.10.2 nat to 5.6.7.8
    server2: 10.10.10.3 nat to 5.6.7.9
    server3: 10.10.10.4 nat to 5.6.7.10
    VPN connection to 5.6.7.12
    is there any solution for this senario, remote vpn to servers and the same time the servers have internet readability for download updates .. etc

    Hi,
    So it seems that the problem is with lacking a NAT0 configuration
    You could modify the below configuration to match your networks/IP addresses used. In the below configuration I presume that you have interfaces "inside" and "outside".
    object network SERVER-NETWORK
     subnet <server network address> <network mask>
    object network VPN-POOL
     subnet <vpn pool network address> <network mask>
    nat (inside,outside) 1 source static SERVER-NETWORK SERVER-NETWORK destination static VPN-POOL VPN-POOL
    Just insert the correct address related information and change the "object" and interface names if required.
    This configuration will tell the ASA that no NAT will be performed for traffic between the VPN-POOL and SERVER-NETWORK. The NAT configuration is bidirectional. With this configuration the Static NAT configurations will continue to work for the servers Internet traffic and this NAT0 configuration will be applied only to the VPN Client traffic.
    Hope this helps :)
    - Jouni

  • Remote access vpn issues

    Hi all, I have been having issues with my remote access vpn, I can connect but cannot ping anywhere, I have enabled ipsec over nat-t, but still does not work, I noticed that when I did an ipconfig on my machine, I get the ip address assigned by my asa, 10.120.50.2 /32
    but the default gateway is showing as 10.112.50.3, is this correct, I thought it should be the same as the interface address ?

    Hi Carl,
    Can you make sure you have the following in your config:
    isakmp nat-traversal
    Can you also ensure your internal network has routing in place to cover your VPN client pool.

  • Remote Access VPN Users with CX Active Authentication.

    I have ASA 5515 with CX for webfiltering , also have enabled remote access vpn . All my inside users are able to get active and passive authentication correctly . But for remote access VPN users , they are redirected to ASA external ip and CX authentication port 9000 but a blank page comes in and there is no prompt for authentication. I wasnt doing split tunneling , but now i have excluded ASA WAN ip from the tunnel and still have the same issue.
    The CX version we have is 9.3.1.1

    Have you excluded the VPN traffic from being NATed when traffic is going between clients?
    Please post a full sanitised configuration of the router so we can check it for configuration issues.
    Please remember to select a correct answer and rate helpful posts

  • Can you create a Remote Access VPN connection to tunnel DMZ LAN and Inside Networks simultaneously?

    I have a customer that has a ASA 5510 version 8.3 with IPSEC Client Access that includes some of their networks on the Inside interface.   The issue they are having is when their mobile users connect with the vpn client (which is using split tunneling), they can no longer access their web server applications that are running in the DMZ.   Without the client connected, they access the web servers via the external public IP.  Once they are connected via vpn, their default dns server becomes the internal AD DNS server, which resolves the DNS of the web servers to the private DMZ ip address. 
    Can a Remote Access VPN client connection be allowed to connect to both the DMZ interface and the Inside Interface? I had always only setup RA VPN clients to connect to networks on the Inside Interface.  
    I tried adding the DMZ network to the Split Tunnel list, but I could not access anything it while connected to vpn using the private IP addresses.

    Yes, you should be able to access DMZ subnets as well if they are added to the split tunnel ACL. You could check the NAT exemption configuration for the DMZ and also check if the ASA is forwarding the packet through DMZ interface by configuring captures on the DMZ interface. 
    Share the configuration if you want help with the NAT exemption part.

  • Inside lan is not reachable even after cisco Remote access vpn client connected to router C1841 But can ping to the router inside interface and loop back interface but not able to ping even to the directly connected inside device..??

    Hii frnds,
    here is the configuration in my router C1841..for the cisco ipsec remote access vpn..i was able to establish a vpn session properly...but there after i can only reach up to the inside interfaces of the router..but not to the lan devices...
    Below is the out put from the router
    r1#sh run
    Building configuration...
    Current configuration : 3488 bytes
    ! Last configuration change at 20:07:20 UTC Tue Apr 23 2013 by ramana
    ! NVRAM config last updated at 11:53:16 UTC Sun Apr 21 2013 by ramana
    version 15.1
    service config
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname r1
    boot-start-marker
    boot-end-marker
    enable secret 5 $1$6RzF$L6.zOaswedwOESNpkY0Gb.
    aaa new-model
    aaa authentication login local-console local
    aaa authentication login userauth local
    aaa authorization network groupauth local
    aaa session-id common
    dot11 syslog
    ip source-route
    ip cef
    ip domain name r1.com
    multilink bundle-name authenticated
    license udi pid CISCO1841 sn FHK145171DM
    username ramana privilege 15 secret 5 $1$UE7J$u9nuCPGaAasL/k7CxtNMj.
    username giet privilege 15 secret 5 $1$esE5$FD9vbBwTgHERdRSRod7oD.
    redundancy
    crypto isakmp policy 10
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group ra-vpn
    key xxxxxx
    domain r1.com
    pool vpn-pool
    acl 150
    save-password
      include-local-lan
    max-users 10
    crypto ipsec transform-set my-vpn esp-3des esp-md5-hmac
    crypto dynamic-map RA 1
    set transform-set my-vpn
    reverse-route
    crypto map ra-vpn client authentication list userauth
    crypto map ra-vpn isakmp authorization list groupauth
    crypto map ra-vpn client configuration address respond
    crypto map ra-vpn 1 ipsec-isakmp dynamic RA
    interface Loopback0
    ip address 10.2.2.2 255.255.255.255
    interface FastEthernet0/0
    bandwidth 8000000
    ip address 117.239.xx.xx 255.255.255.240
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip nat outside
    ip virtual-reassembly
    duplex auto
    speed auto
    crypto map ra-vpn
    interface FastEthernet0/1
    description $ES_LAN$
    ip address 192.168.10.252 255.255.255.0 secondary
    ip address 10.10.10.1 255.255.252.0 secondary
    ip address 172.16.0.1 255.255.252.0 secondary
    ip address 10.10.7.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    duplex auto
    speed auto
    ip local pool vpn-pool 172.18.1.1   172.18.1.100
    ip forward-protocol nd
    ip http server
    ip http authentication local
    no ip http secure-server
    ip dns server
    ip nat pool INTERNETPOOL 117.239.xx.xx 117.239.xx.xx netmask 255.255.255.240
    ip nat inside source list 100 pool INTERNETPOOL overload
    ip route 0.0.0.0 0.0.0.0 117.239.xx.xx
    access-list 100 permit ip 10.10.7.0 0.0.0.255 any
    access-list 100 permit ip 10.10.10.0 0.0.1.255 any
    access-list 100 permit ip 172.16.0.0 0.0.3.255 any
    access-list 100 permit ip 192.168.10.0 0.0.0.255 any
    access-list 150 permit ip 10.10.7.0 0.0.0.255 172.18.0.0 0.0.255.255
    access-list 150 permit ip host 10.2.2.2 172.18.1.0 0.0.0.255
    access-list 150 permit ip 192.168.10.0 0.0.0.255 172.18.1.0 0.0.0.255
    control-plane
    line con 0
    login authentication local-console
    line aux 0
    line vty 0 4
    login authentication local-console
    transport input telnet ssh
    scheduler allocate 20000 1000
    end
    r1>sh ip route
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, + - replicated route
    Gateway of last resort is 117.239.xx.xx to network 0.0.0.0
    S*    0.0.0.0/0 [1/0] via 117.239.xx.xx
          10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks
    C        10.2.2.2/32 is directly connected, Loopback0
    C        10.10.7.0/24 is directly connected, FastEthernet0/1
    L        10.10.7.1/32 is directly connected, FastEthernet0/1
    C        10.10.8.0/22 is directly connected, FastEthernet0/1
    L        10.10.10.1/32 is directly connected, FastEthernet0/1
          117.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
    C        117.239.xx.xx/28 is directly connected, FastEthernet0/0
    L        117.239.xx.xx/32 is directly connected, FastEthernet0/0
          172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
    C        172.16.0.0/22 is directly connected, FastEthernet0/1
    L        172.16.0.1/32 is directly connected, FastEthernet0/1
          172.18.0.0/32 is subnetted, 1 subnets
    S        172.18.1.39 [1/0] via 49.206.59.86, FastEthernet0/0
          192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks
    C        192.168.10.0/24 is directly connected, FastEthernet0/1
    L        192.168.10.252/32 is directly connected, FastEthernet0/1
    r1#sh crypto isakmp sa
    IPv4 Crypto ISAKMP SA
    dst             src             state          conn-id status
    117.239.xx.xx   49.206.59.86    QM_IDLE           1043 ACTIVE
    IPv6 Crypto ISAKMP SA
    r1 #sh crypto ipsec sa
    interface: FastEthernet0/0
        Crypto map tag: giet-vpn, local addr 117.239.xx.xx
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
       remote ident (addr/mask/prot/port): (172.18.1.39/255.255.255.255/0/0)
       current_peer 49.206.59.86 port 50083
         PERMIT, flags={}
        #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
        #pkts decaps: 2, #pkts decrypt: 2, #pkts verify: 2
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
         local crypto endpt.: 117.239.xx.xx, remote crypto endpt.: 49.206.xx.xx
         path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0
         current outbound spi: 0x550E70F9(1427009785)
         PFS (Y/N): N, DH group: none
         inbound esp sas:
          spi: 0x5668C75(90606709)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            conn id: 2089, flow_id: FPGA:89, sibling_flags 80000046, crypto map: ra-vpn
            sa timing: remaining key lifetime (k/sec): (4550169/3437)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE
         inbound ah sas:
         inbound pcp sas:
         outbound esp sas:
          spi: 0x550E70F9(1427009785)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel UDP-Encaps, }
            conn id: 2090, flow_id: FPGA:90, sibling_flags 80000046, crypto map: ra-vpn
            sa timing: remaining key lifetime (k/sec): (4550170/3437)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE
         outbound ah sas:
         outbound pcp sas:

    hi  Maximilian Schojohann..
    First i would like to Thank you for showing  interest in solving my issue...After some research i found that desabling the " IP CEF" will solve the issue...when i desable i was able to communicate success fully with the router lan..But when i desable " IP CEF "  Router cpu processer goes to 99% and hangs...
    In the output of " sh process cpu" it shows 65% of utilization from "IP INPUT"
    so plz give me an alternate solution ....thanks in advance....

  • Remote Access VPN Clients Cannot Access inside LAN

    I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable.
    : Saved
    ASA Version 8.2(1)
    hostname ASA5505
    domain-name default.domain.invalid
    enable password eelnBRz68aYSzHyz encrypted
    passwd eelnBRz68aYSzHyz encrypted
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 192.168.100.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    pppoe client vpdn group dataDSL
    ip address 76.244.75.57 255.255.255.255 pppoe
    interface Vlan3
    nameif dmz
    security-level 50
    ip address 192.168.9.1 255.255.255.0
    interface Vlan10
    nameif outside_cable
    security-level 0
    ip address 50.84.96.178 255.255.255.240
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    switchport access vlan 10
    interface Ethernet0/2
    switchport access vlan 3
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    ftp mode passive
    clock timezone CST -6
    clock summer-time CDT recurring
    dns server-group DefaultDNS
    domain-name default.domain.invalid
    same-security-traffic permit intra-interface
    object-group service Netbios udp
    port-object eq 139
    port-object eq 445
    port-object eq netbios-ns
    object-group service Netbios_TCP tcp
    port-object eq 445
    port-object eq netbios-ssn
    object-group network DM_INLINE_NETWORK_1
    network-object host 192.168.100.177
    network-object host 192.168.100.249
    object-group service Web_Services tcp
    port-object eq ftp
    port-object eq ftp-data
    port-object eq www
    port-object eq https
    object-group network DM_INLINE_NETWORK_10
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_11
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_2
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_3
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_4
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_5
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_6
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_7
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_8
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network DM_INLINE_NETWORK_9
    network-object host 192.168.9.10
    network-object host 192.168.9.4
    object-group network VPN
    network-object 192.168.255.0 255.255.255.0
    access-list outside_access_in extended permit icmp any host 76.244.75.61
    access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp
    access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp-data
    access-list outside_access_in extended permit tcp any host 76.244.75.62 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.62 eq https
    access-list outside_access_in extended permit tcp any host 76.244.75.59 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.59 eq https
    access-list outside_access_in extended permit tcp any host 76.244.75.60 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.60 eq https
    access-list outside_access_in extended permit tcp any host 76.244.75.58 eq www
    access-list outside_access_in extended permit tcp any host 76.244.75.58 eq https
    access-list dmz_access_in remark Quickbooks
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_6 host 192.168.100.5 eq 56719
    access-list dmz_access_in remark Quickbooks range
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_7 host 192.168.100.5 range 55333 55337
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_8 host 192.168.100.5 eq 1434
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_9 host 192.168.100.5 eq 49398
    access-list dmz_access_in remark QB
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_10 host 192.168.100.5 eq 8019
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_2 host 192.168.100.5 eq 2638
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_11 host 192.168.100.5 object-group Netbios
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_3 host 192.168.100.5 object-group Netbios_TCP
    access-list dmz_access_in extended deny ip host 192.168.9.4 host 192.168.100.5 inactive
    access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_4 any
    access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_5 any
    access-list dmz_access_in remark Printer
    access-list dmz_access_in extended permit ip 192.168.9.0 255.255.255.0 object-group DM_INLINE_NETWORK_1
    access-list dmz_access_in extended permit tcp 192.168.9.0 255.255.255.0 any object-group Web_Services
    access-list dmz_access_in extended permit udp 192.168.9.0 255.255.255.0 any eq domain
    access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.255.0 255.255.255.0 echo-reply
    access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.100.0 255.255.255.0 echo-reply log disable
    access-list dmz_access_in remark QB probably does not need any udp
    access-list dmz_access_in extended permit udp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive
    access-list dmz_access_in remark QB included in other rule range
    access-list dmz_access_in extended permit tcp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive
    access-list dmz_access_in remark May be required for Quickbooks
    access-list dmz_access_in extended permit icmp host 192.168.9.4 host 192.168.100.5
    access-list CAD_capture extended permit ip host 192.168.9.4 host 192.168.100.5
    access-list CAD_capture extended permit ip host 192.168.100.5 host 192.168.9.4
    access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 172.16.10.0 255.255.255.240
    access-list inside_nat0_outbound extended permit ip any 172.16.20.0 255.255.255.240
    access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
    access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.9.0 255.255.255.0
    access-list dmz_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0
    access-list outside_cable_access_in extended permit icmp any host 50.84.96.182
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp-data
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq https
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq https
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq https
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq www
    access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq https
    access-list Local_LAN_Access standard permit host 0.0.0.0
    access-list vpnusers_spitTunnelACL extended permit ip 192.168.100.0 255.255.255.0 any
    access-list nonat-in extended permit ip 192.168.100.0 255.255.255.0 172.16.20.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffered informational
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500 
    mtu outside_cable 1500
    ip local pool VPN_IP_range 192.168.255.1-192.168.255.10 mask 255.255.255.0
    ip local pool VPN_Phone 172.16.20.1-172.16.20.10 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 10 interface
    global (outside_cable) 10 interface
    nat (inside) 0 access-list nonat-in
    nat (inside) 10 0.0.0.0 0.0.0.0
    nat (dmz) 0 access-list dmz_nat0_outbound
    nat (dmz) 10 0.0.0.0 0.0.0.0
    static (inside,outside) 76.244.75.62 192.168.100.25 netmask 255.255.255.255 dns
    static (dmz,outside) 76.244.75.61 192.168.9.123 netmask 255.255.255.255 dns
    static (dmz,outside) 76.244.75.59 192.168.9.124 netmask 255.255.255.255 dns
    static (dmz,outside) 76.244.75.58 192.168.9.4 netmask 255.255.255.255 dns
    static (inside,dmz) 192.168.100.0 192.168.100.0 netmask 255.255.255.0
    static (dmz,outside) 76.244.75.60 192.168.9.10 netmask 255.255.255.255 dns
    static (inside,outside_cable) 50.84.96.183 192.168.100.25 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.182 192.168.9.123 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.180 192.168.9.124 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.179 192.168.9.4 netmask 255.255.255.255 dns
    static (dmz,outside_cable) 50.84.96.181 192.168.9.10 netmask 255.255.255.255 dns
    access-group outside_access_in in interface outside
    access-group dmz_access_in in interface dmz
    access-group outside_cable_access_in in interface outside_cable
    route outside_cable 0.0.0.0 0.0.0.0 50.84.96.177 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 192.168.100.0 255.255.255.0 inside
    http 204.107.173.0 255.255.255.0 outside
    http 204.107.173.0 255.255.255.0 outside_cable
    http 0.0.0.0 0.0.0.0 outside_cable
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_cable_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_cable_map interface outside_cable
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto isakmp enable inside
    crypto isakmp enable outside
    crypto isakmp enable outside_cable
    crypto isakmp policy 10
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 30
    authentication pre-share
    encryption 3des
    hash md5
    group 2
    lifetime 86400
    telnet 192.168.100.0 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.100.0 255.255.255.0 inside
    ssh 204.107.173.0 255.255.255.0 outside
    ssh 204.107.173.0 255.255.255.0 outside_cable
    ssh 0.0.0.0 0.0.0.0 outside_cable
    ssh timeout 15
    console timeout 0
    vpdn group dataDSL request dialout pppoe
    vpdn group dataDSL localname [email protected]
    vpdn group dataDSL ppp authentication pap
    vpdn username [email protected] password *********
    dhcpd address 192.168.100.30-192.168.100.99 inside
    dhcpd dns 192.168.100.5 68.94.156.1 interface inside
    threat-detection basic-threat
    threat-detection statistics port
    threat-detection statistics protocol
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    webvpn
    group-policy DefaultRAGroup internal
    group-policy DefaultRAGroup attributes
    dns-server value 192.168.100.5
    vpn-tunnel-protocol IPSec l2tp-ipsec
    group-policy cad_supplies_RAVPN internal
    group-policy cad_supplies_RAVPN attributes
    vpn-tunnel-protocol IPSec
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value cad_supplies_RAVPN_splitTunnelAcl
    group-policy VPNPHONE internal
    group-policy VPNPHONE attributes
    dns-server value 192.168.100.5
    vpn-tunnel-protocol IPSec
    split-tunnel-policy excludespecified
    split-tunnel-network-list value Local_LAN_Access
    client-firewall none
    client-access-rule none
    username swinc password BlhBNWfh7XoeHcQC encrypted
    username swinc attributes
    vpn-group-policy cad_supplies_RAVPN
    username meredithp password L3lRjzwb7TnwOyZ1 encrypted
    username meredithp attributes
    vpn-group-policy cad_supplies_RAVPN
    service-type remote-access
    username ipphone1 password LOjpmeIOshVdCSOU encrypted privilege 0
    username ipphone1 attributes
    vpn-group-policy VPNPHONE
    username ipphone2 password LOjpmeIOshVdCSOU encrypted privilege 0
    username ipphone2 attributes
    vpn-group-policy VPNPHONE
    username ipphone3 password LOjpmeIOshVdCSOU encrypted privilege 0
    username ipphone3 attributes
    vpn-group-policy VPNPHONE
    username oethera password WKJxJq7L6wmktFNt encrypted
    username oethera attributes
    vpn-group-policy cad_supplies_RAVPN
    service-type remote-access
    username markh password nqH+bk6vj0fR83ai0SAxkg== nt-encrypted
    username markh attributes
    vpn-group-policy cad_supplies_RAVPN
    tunnel-group DefaultRAGroup general-attributes
    default-group-policy DefaultRAGroup
    tunnel-group DefaultRAGroup ipsec-attributes
    pre-shared-key *
    tunnel-group DefaultRAGroup ppp-attributes
    authentication ms-chap-v2
    tunnel-group cad_supplies_RAVPN type remote-access
    tunnel-group cad_supplies_RAVPN general-attributes
    address-pool VPN_IP_range
    default-group-policy cad_supplies_RAVPN
    tunnel-group cad_supplies_RAVPN ipsec-attributes
    pre-shared-key *
    tunnel-group VPNPHONE type remote-access
    tunnel-group VPNPHONE general-attributes
    address-pool VPN_Phone
    default-group-policy VPNPHONE
    tunnel-group VPNPHONE ipsec-attributes
    pre-shared-key *
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum 1500
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
    service-policy global_policy global
    prompt hostname context
    Cryptochecksum:8b25ecc61861a2baa6d2556a3679cc7c
    : end

    Hi,
    You have your "group-policy" set so that you have excluding some networks from being tunneled.
    In this access-list named Local_LAN_Access you specify "0.0.0.0"
    Doesnt this mean you are excluding all networks from being tunneled? In other words no traffic goes to your tunnel.
    This access-list should only contain your local LAN network from where you are connecting with the VPN Client. If you dont need to access anything on your local LAN while having the VPN on, you don't even need this setting on. You could just tunnel all traffic instead of excluding some networks.
    - Jouni

  • Remote Access VPN connecting but not passing traffic

    I have a remote access VPN configured on a device here. I'm able to connect a device and it assigns me an IP address out of the pool, and injects the routes to its local network, but I'm not able to pass any traffic through the VPN and none of the IPSec SA counters increment for the dial-in connection. I've compared the config here to the samples from documentation and I don't know what I'm missing. Config is below.
    3118-FWL001(config)# sho run
    : Saved
    ASA Version 7.2(3)
    hostname 3118-FWL001
    domain-name rr-rentals.com
    enable password hEgvNHfNHV8zypPu encrypted
    names
    interface Vlan1
     nameif inside
     security-level 100
     ip address 192.168.10.1 255.255.255.0
    interface Vlan2
     nameif outside
     security-level 0
     ip address 199.X.X.162 255.255.255.248
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    passwd 2KFQnbNIdI.2KYOU encrypted
    banner exec
    banner exec
    banner exec
    banner exec Any attempted or unauthorized access, use, or modification is prohibited.
    banner exec Unauthorized users may face criminal and/or civil penalties.
    banner exec The use of this system may be monitored and recorded.
    banner exec If the monitoring reveals possible evidence of criminal activity, Adhost can
    banner exec provide the records to law enforcement.
    banner exec Be safe!  Do not share your access information with anyone!
    banner exec
    banner exec
    banner exec
    banner asdm
    banner asdm
    banner asdm
    banner asdm Any attempted or unauthorized access, use, or modification is prohibited.
    banner asdm Unauthorized users may face criminal and/or civil penalties.
    banner asdm The use of this system may be monitored and recorded.
    banner asdm If the monitoring reveals possible evidence of criminal activity, Adhost can
    banner asdm provide the records to law enforcement.
    banner asdm Be safe!  Do not share your access information with anyone!
    banner asdm
    banner asdm
    banner asdm
    ftp mode passive
    dns server-group DefaultDNS
     domain-name rr-rentals.com
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    access-list outside_acl extended permit ip any host 199.X.X.163
    access-list outside_acl extended permit icmp any any echo
    access-list outside_acl extended permit icmp any any echo-reply
    access-list outside_acl extended permit tcp 216.X.X.64 255.255.255.192 any
    access-list outside_acl extended permit tcp host 76.X.X.166 any eq 3389
    access-list outside_acl extended permit tcp 67.X.X.192 255.255.255.224 any eq 3389
    access-list outside_acl extended permit tcp any any eq ftp
    access-list outside_acl extended permit tcp any any eq ftp-data
    access-list outside_acl extended permit tcp host 72.X.X.71 any eq 3389
    access-list outside_acl extended permit tcp host 26.X.X.155 any eq 3389
    access-list outside_acl extended permit tcp host 24.X.X.155 any eq 3389
    access-list outside_acl extended permit icmp any any unreachable
    access-list outside_acl extended permit icmp any any time-exceeded
    access-list outside_acl extended permit tcp host 71.X.X.170 any eq 3389
    access-list outside_acl extended permit tcp host 24.X.X.200 any eq 3389
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.20.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 192.168.20.0 255.255.255.0 192.168.10.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_1_cryptomap extended permit ip 192.168.20.0 255.255.255.0 192.168.1.0 255.255.255.0
    access-list outside_2_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
    access-list outside_4_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
    access-list outside_3_cryptomap extended permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
    access-list rr-vpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0
    access-list rr-vpn_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging buffer-size 1048576
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool vpnpool 192.168.20.1-192.168.20.254 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-523.bin
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 1 0.0.0.0 0.0.0.0
    static (inside,outside) 199.X.X.163 192.168.10.2 netmask 255.255.255.255
    access-group outside_acl in interface outside
    route outside 0.0.0.0 0.0.0.0 199.X.X.161 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout uauth 0:05:00 absolute
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authentication enable console LOCAL
    aaa authentication serial console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 216.X.X.64 255.255.255.192 outside
    http 0.0.0.0 0.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    sysopt connection tcpmss 1200
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map outside_dyn_map 20 set pfs
    crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
    crypto map outside_map 1 match address outside_1_cryptomap
    crypto map outside_map 1 set pfs
    crypto map outside_map 1 set peer 50.X.X.58
    crypto map outside_map 1 set transform-set ESP-AES-128-SHA
    crypto map outside_map 2 match address outside_2_cryptomap
    crypto map outside_map 2 set pfs
    crypto map outside_map 2 set peer 75.X.X.253
    crypto map outside_map 2 set transform-set ESP-AES-128-SHA
    crypto map outside_map 3 match address outside_3_cryptomap
    crypto map outside_map 3 set pfs
    crypto map outside_map 3 set peer 173.X.X.69
    crypto map outside_map 3 set transform-set ESP-AES-128-SHA
    crypto map outside_map 4 match address outside_4_cryptomap
    crypto map outside_map 4 set pfs
    crypto map outside_map 4 set peer 70.X.X.194
    crypto map outside_map 4 set transform-set ESP-AES-128-SHA
    crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption aes
     hash sha
     group 5
     lifetime 86400
    crypto isakmp policy 30
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet timeout 5
    ssh 192.168.10.2 255.255.255.255 inside
    ssh 192.168.0.0 255.255.0.0 inside
    ssh 216.X.X.64 255.255.255.192 outside
    ssh 50.X.X.58 255.255.255.255 outside
    ssh timeout 60
    ssh version 2
    console timeout 0
    management-access inside
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    tftp-server outside 216.X.X.116 3118-FWL001.config
    group-policy rr-vpn internal
    group-policy rr-vpn attributes
     dns-server value 216.X.X.12 66.X.X.11
     vpn-tunnel-protocol IPSec
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value rr-vpn_splitTunnelAcl
    username rrlee password B6rKS8LmKC50oIXK encrypted privilege 0
    username rrlee attributes
     vpn-group-policy rr-vpn
    username cschirado password QYICGrOFAZ9iPWpp encrypted privilege 0
    username cschirado attributes
     vpn-group-policy rr-vpn
    username daniel password SZsXZCSuVXcFn9NB encrypted privilege 15
    username adhostadm password 7P2Y2Ow1o0.VSjvh encrypted privilege 15
    username troy password amZKsxVU.8N9kKPb encrypted privilege 0
    username troy attributes
     vpn-group-policy rr-vpn
    username troyr password Hek9zbMrM6wEDSfi encrypted privilege 15
    username druiz password 33oau7XOcvhJ3DMv encrypted privilege 0
    username druiz attributes
     vpn-group-policy rr-vpn
    username theresa password qWsPnR.vfjXzlunC encrypted privilege 0
    username theresa attributes
     vpn-group-policy rr-vpn
    username kevin password R5DPfUVhzGCEg6pu encrypted privilege 0
    username kevin attributes
     vpn-group-policy rr-vpn
    username andrea password MyhIPdH6UJQDon77 encrypted privilege 0
    username andrea attributes
     vpn-group-policy rr-vpn
    tunnel-group 50.X.X.58 type ipsec-l2l
    tunnel-group 50.X.X.58 ipsec-attributes
     pre-shared-key *
    tunnel-group 75.X.X.253 type ipsec-l2l
    tunnel-group 75.X.X.253 ipsec-attributes
     pre-shared-key *
    tunnel-group 72.X.X.71 type ipsec-l2l
    tunnel-group 72.X.X.71 ipsec-attributes
     pre-shared-key *
    tunnel-group 173.X.X.69 type ipsec-l2l
    tunnel-group 173.X.X.69 ipsec-attributes
     pre-shared-key *
    tunnel-group rr-vpn type ipsec-ra
    tunnel-group rr-vpn general-attributes
     address-pool vpnpool
     default-group-policy rr-vpn
    tunnel-group rr-vpn ipsec-attributes
     pre-shared-key *
    tunnel-group 70.X.X.194 type ipsec-l2l
    tunnel-group 70.X.X.194 ipsec-attributes
     pre-shared-key *
    prompt hostname context

    Here are the results of the commands you requested. I'm not able to ping either direction.
    Thanks,
    James
    3118-FWL001# sho cry isa sa
       Active SA: 5
        Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
    Total IKE SA: 5
    1   IKE Peer: 50.34.254.58
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    2   IKE Peer: 173.10.71.69
        Type    : L2L             Role    : responder
        Rekey   : no              State   : MM_ACTIVE
    3   IKE Peer: 75.151.109.253
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    4   IKE Peer: 70.99.88.194
        Type    : L2L             Role    : initiator
        Rekey   : no              State   : MM_ACTIVE
    5   IKE Peer: 216.211.143.85
        Type    : user            Role    : responder
        Rekey   : no              State   : AM_ACTIVE
    3118-FWL001# sho cry ips sa
    interface: outside
        Crypto map tag: outside_dyn_map, seq num: 20, local addr: 199.21.66.162
          local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.20.2/255.255.255.255/0/0)
          current_peer: 216.211.143.85, username: kevin
          dynamic allocated peer ip: 192.168.20.2
          #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
          #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 216.211.143.85
          path mtu 1500, ipsec overhead 58, media mtu 1500
          current outbound spi: CBF94621
        inbound esp sas:
          spi: 0x8D8279CA (2374138314)
             transform: esp-3des esp-sha-hmac none
             in use settings ={RA, Tunnel, }
             slot: 0, conn_id: 200, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 28715
             IV size: 8 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0xCBF94621 (3422111265)
             transform: esp-3des esp-sha-hmac none
             in use settings ={RA, Tunnel, }
             slot: 0, conn_id: 200, crypto-map: outside_dyn_map
             sa timing: remaining key lifetime (sec): 28715
             IV size: 8 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 1, local addr: 199.21.66.162
          access-list outside_1_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.1.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
          current_peer: 50.34.254.58
          #pkts encaps: 15356573, #pkts encrypt: 15356573, #pkts digest: 15356573
          #pkts decaps: 9021115, #pkts decrypt: 9021114, #pkts verify: 9021114
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 15356573, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 50.34.254.58
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: FE16571B
        inbound esp sas:
          spi: 0x78BD7E4F (2025684559)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 86, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4263158/5788)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0xFE16571B (4262876955)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 86, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4064653/5788)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 4, local addr: 199.21.66.162
          access-list outside_4_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.4.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.4.0/255.255.255.0/0/0)
          current_peer: 70.99.88.194
          #pkts encaps: 491814, #pkts encrypt: 491814, #pkts digest: 491814
          #pkts decaps: 416810, #pkts decrypt: 416810, #pkts verify: 416810
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 491814, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 70.99.88.194
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 533F55E1
        inbound esp sas:
          spi: 0xE2F461AD (3807666605)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 194, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4273818/27167)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x533F55E1 (1396659681)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 194, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4266133/27167)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 2, local addr: 199.21.66.162
          access-list outside_2_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.2.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)
          current_peer: 75.151.109.253
          #pkts encaps: 207718, #pkts encrypt: 207718, #pkts digest: 207718
          #pkts decaps: 142739, #pkts decrypt: 142739, #pkts verify: 142739
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 207722, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 75.151.109.253
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 8D74AC18
        inbound esp sas:
          spi: 0x0CF7F70B (217577227)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 195, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4274490/23242)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x8D74AC18 (2373233688)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 195, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4270718/23242)
             IV size: 16 bytes
             replay detection support: Y
        Crypto map tag: outside_map, seq num: 3, local addr: 199.21.66.162
          access-list outside_3_cryptomap permit ip 192.168.10.0 255.255.255.0 192.168.3.0 255.255.255.0
          local ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
          remote ident (addr/mask/prot/port): (192.168.3.0/255.255.255.0/0/0)
          current_peer: 173.10.71.69
          #pkts encaps: 3427935, #pkts encrypt: 3427935, #pkts digest: 3427935
          #pkts decaps: 2006044, #pkts decrypt: 2006044, #pkts verify: 2006044
          #pkts compressed: 0, #pkts decompressed: 0
          #pkts not compressed: 3427935, #pkts comp failed: 0, #pkts decomp failed: 0
          #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
          #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
          #send errors: 0, #recv errors: 0
          local crypto endpt.: 199.21.66.162, remote crypto endpt.: 173.10.71.69
          path mtu 1500, ipsec overhead 74, media mtu 1500
          current outbound spi: 2E8A6147
        inbound esp sas:
          spi: 0x467968AB (1182361771)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 154, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4270213/18597)
             IV size: 16 bytes
             replay detection support: Y
        outbound esp sas:
          spi: 0x2E8A6147 (780820807)
             transform: esp-aes esp-sha-hmac none
             in use settings ={L2L, Tunnel, PFS Group 2, }
             slot: 0, conn_id: 154, crypto-map: outside_map
             sa timing: remaining key lifetime (kB/sec): (4162093/18597)
             IV size: 16 bytes
             replay detection support: Y
    3118-FWL001# sho run route
    route outside 0.0.0.0 0.0.0.0 199.21.66.161 1

  • ASA Remote Access VPN: internal LAN cannot connect to connected VPN clients

    Hi community,
    I configured IPSec remote Access VPN in ASA, and remote client use Cisco VPN client to connect to the HQ. The VPN is working now, VPN clients can connect to Servers inside and IT's subnet, but from my PC or Servers inside LAN cannot ping or initial a RDP to connected VPN clients. Below is my configuration:
    object-group network RemoteVPN_LocalNet
     network-object 172.29.168.0 255.255.255.0
     network-object 172.29.169.0 255.255.255.0
     network-object 172.29.173.0 255.255.255.128
     network-object 172.29.172.0 255.255.255.0
    access-list Split_Tunnel remark The Corporation network behind ASA
    access-list Split_Tunnel extended permit ip object-group RemoteVPN_LocalNet 10.88.61.0 255.255.255.0
    ip local pool remotevpnpool 10.88.61.10-10.88.61.15 mask 255.255.255.0
    nat (inside,outside) source static Allow_Go_Internet Allow_Go_Internet destination static remotevpnpool remotevpnpool
    crypto ipsec ikev1 transform-set myset esp-aes esp-sha-hmac
    crypto dynamic-map dyn1 1 set ikev1 transform-set myset
    crypto map mymap 65000 ipsec-isakmp dynamic dyn1
    crypto map mymap interface outside
    tunnel-group remotevpngroup type remote-access
    tunnel-group remotevpngroup general-attributes
     address-pool remotevpnpool
     authentication-server-group MS_LDAP LOCAL
     default-group-policy Split_Tunnel_Policy
    I don't know what I miss in order to have internal LANs initial connection to connected vpn clients. Please guide me.
    Thanks in advanced.

    Hi tranminhc,
    Step 1: Create an object.
    object network vpn_clients
     subnet 10.88.61.0 mask 255.255.255.0
    Step 2: Create a standard ACL.
    access-list my-split standard permit ip object RemoteVPN_LocalNet
    Step 3: Remove this line, because I am not sure what "Allow_Go_Internet" included for nat-exemption.
    no nat (inside,outside) source static Allow_Go_Internet Allow_Go_Internet destination static remotevpnpool remotevpnpool
    Step 4: Create new nat exemption.
    nat (inside,outside) source static RemoteVPN_LocalNet RemoteVPN_LocalNet destination static vpn_clients vpn_clients
    Step 5: Apply ACL on the tunnel.
    group-policy Split_Tunnel_Policy attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value my-split
    Step 6:
    I assume you have a default route on your inside L3 switch point back to ASA's inside address.  If you don't have one.
    Please add a default or add static route as shown below.
    route 10.88.61.0 mask 255.255.255.0 xxx.xxx.xxx.xxx 
    xxx.xxx.xxx.xxx = equal to ASA's inside interface address.
    Hope this helps.
    Thanks
    Rizwan Rafeek

  • Remote Access VPN and NAT inside interface

    Hi everyone,
    I have configured Remote VPN access.
    Inside interface and vpn pool is 10.0.0.0 subnet.
    ASA inside interface has NAT exempt as per config below
    nat (inside,outside) source static NETWORK_OBJ_10.0.0.0_24 NETWORK_OBJ_10.0.0.0_24 destination static NETWORK_OBJ_10.0.0.0_25 NETWORK_OBJ_10.0.0.0_25 no-proxy-arp route-lookup
    object network NETWORK_OBJ_10.0.0.0_24
    subnet 10.0.0.0 255.255.255.0
    object network NETWORK_OBJ_10.0.0.0_25
    subnet 10.0.0.0 255.255.255.128
    Also i have ASA inside interface connected to R1 as below
    R1 ---10.0.0.2------------inside int  IP 10.0.0.1--------ASA
    R1 has loopback int 192.168.50.1 and ASA has static route to it.
    When i connect to remote access vpn i can ping the IP 192.168.50.1 from My pc which is connected to outside interface of ASA.
    This ping works fine.
    Mar 04 2014 21:58:27: %ASA-6-302020: Built inbound ICMP connection for faddr 10.0.0.52/1(LOCAL\ipsec-user) gaddr 192.168.50.1/0 laddr 192.168.50.1/0 (ipsec-user                                                                                        )
    Mar 04 2014 21:58:28: %ASA-6-302021: Teardown ICMP connection for faddr 10.0.0.52/1(LOCAL\ipsec-user) gaddr 192.168.50.1/0 laddr 192.168.50.1/0 (ipsec-user) Mar 04 2014 21:58:27:
    Need to understand how this ping works without exempting 192.168.50.0 from natiing
    or
    how does nat work for above ping from 10.0.0.52 VPN user PC IP to loopback interface of R1 in regards to NATing?
    Regards
    Mahesh

    Hi Jouni,
    IP address to PC is 10.0.0.52 ---------Assigned to Client PC.
    Leting you  know that i have removed the NAT below config from inside to outside interface 
    ASA inside interface has NAT exempt as per config below
    nat (inside,outside) source static NETWORK_OBJ_10.0.0.0_24 NETWORK_OBJ_10.0.0.0_24 destination static NETWORK_OBJ_10.0.0.0_25 NETWORK_OBJ_10.0.0.0_25 no-proxy-arp route-lookup
    object network NETWORK_OBJ_10.0.0.0_24
    subnet 10.0.0.0 255.255.255.0
    object network NETWORK_OBJ_10.0.0.0_25
    subnet 10.0.0.0 255.255.255.128
    Still ping works fine from VPN client PC to IP 192.168.50.1
    Packet tracer output
    ASA1# packet-tracer input outside  icmp 10.0.0.52 8 0 192.168.50.1
    Phase: 1
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   192.168.50.1    255.255.255.255 inside
    Phase: 2
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group outside_access_in in interface outside
    access-list outside_access_in extended permit ip any host 192.168.50.1 log
    access-list outside_access_in remark Allow Ping to Loopback IP of R1 Which is inside Network of ASA1
    Additional Information:
    Phase: 3
    Type: NAT
    Subtype: per-session
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 4
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 5
    Type: CP-PUNT
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 6
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 7
    Type: VPN
    Subtype: ipsec-tunnel-flow
    Result: DROP
    Config:
    Additional Information:
    Result:
    input-interface: outside
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    I can ping from PC command prompt to IP 192.168.50.1 fine.
    Here is second packet tracer
    ASA1# packet-tracer input inside icmp 192.168.50.1 8 0 8.8.8.8
    Phase: 1
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   0.0.0.0         0.0.0.0         outside
    Phase: 2
    Type: ACCESS-LIST
    Subtype: log
    Result: ALLOW
    Config:
    access-group inside_access_in in interface inside
    access-list inside_access_in extended permit ip any any
    Additional Information:
    Phase: 3
    Type: NAT
    Subtype: per-session
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 4
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 5
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 6
    Type: INSPECT
    Subtype: np-inspect
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 7
    Type: DEBUG-ICMP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 8
    Type: DEBUG-ICMP
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 9
    Type: NAT
    Subtype: per-session
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 10
    Type: IP-OPTIONS
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    Phase: 11
    Type: FLOW-CREATION
    Subtype:
    Result: ALLOW
    Config:
    Additional Information:
    New flow created with id 18033, packet dispatched to next module
    Result:
    input-interface: inside
    input-status: up
    input-line-status: up
    output-interface: outside
    output-status: up
    output-line-status: up
    Action: allow
    So question is how ping from outside is working without nat exempt from inside to outside?
    So does second packet tracer proves that i have no NAT config from loopback to outside and ping works because i have NO NAT configured?
    Regards
    Mahesh
    Message was edited by: mahesh parmar

  • Remote Access VPN users unable to communicate with each other

    Hi,
    We have configured Remote Access VPN on Cisco IOS router. Users are able to access the inside resources but cant communicate to each other. Any suggestions on the issue?
    Regards
    Saif

    Have you excluded the VPN traffic from being NATed when traffic is going between clients?
    Please post a full sanitised configuration of the router so we can check it for configuration issues.
    Please remember to select a correct answer and rate helpful posts

  • Remote Access VPN - add new internal IP

    Hi 
    I have a existing Cisco VPN client configuration into ASA 5510 for remote access.
    Group name : ISETANLOT10
    Group password  : xxxx
    IP pool : lot10ippool, 172.27.17.240 - 172.27.17.245
    enycrption : 3DES
    authentication : SHA
    the connection was successful and i was able to ping to the internal server of 172.47.1.10.
    Now there is request for the same VPN remote access to be able to ping access a new server inside LAN, 172.57.1.10 & 172.57.1.20
    But with the same VPN access, i was unable to ping both new IP.
    How can i add in the both IP to be able to ping using the same remote access VPN config?
    I attached below existing config (edited version)
    ===
    : Saved
    ASA Version 8.0(4) 
    hostname asalot10
    names
    name 172.17.100.22 NAVNew
    name 172.27.17.215 NECUser
    name 172.47.1.10 NarayaServer description Naraya Server
    name 62.80.122.172 NarayaTelco1
    name 62.80.122.178 NarayaTelco2
    name 172.57.1.10 IPVSSvr description IPVSSvr
    name 122.152.181.147 Japan01
    name 122.152.181.0 Japan02
    name 175.139.156.174 Outside_Int
    name 178.248.228.121 NarayaTelco3
    name 172.67.1.0 VCGroup
    name 172.57.1.20 IPVSSvr2
    object-group service NECareService
     description Remote NECareService
     service-object tcp eq https 
     service-object tcp eq ssh 
     service-object icmp echo-reply
    access-list inside_access_in extended deny ip any Japan02 255.255.255.0 
    access-list inside_access_in extended permit ip VCGroup 255.255.255.0 any 
    access-list inside_access_in extended deny tcp object-group PermitInternet any object-group torrent1 
    access-list inside_access_in extended permit ip object-group PermitInternet any log disable 
    access-list inside_access_in extended permit ip host NarayaServer any log disable 
    access-list inside_access_in extended permit ip host IPVSSvr any 
    access-list inside_access_in extended permit ip host NAVNew any log disable 
    access-list inside_access_in extended permit ip host 172.17.100.30 any 
    access-list outside_access_in extended permit object-group NECareService object-group NECare any 
    access-list outside_access_in extended permit ip object-group DM_INLINE_NETWORK_1 host NarayaServer 
    access-list outsidein extended permit tcp any host Outside_Int eq https 
    access-list outsidein extended permit object-group rdp any host Outside_Int log debugging 
    access-list outsidein extended permit tcp object-group DM_INLINE_NETWORK_2 host Outside_Int eq 8080 
    access-list outsidein extended permit ip object-group DM_INLINE_NETWORK_3 host IPVSSvr 
    access-list inside_mpc extended permit object-group TCPUDP any any eq www 
    access-list inside_mpc extended permit tcp any any eq www 
    access-list inside_nat0_outbound extended permit ip any 172.27.17.240 255.255.255.248 
    access-list inside_nat0_outbound extended permit ip host NarayaServer object-group Nry_Png 
    access-list inside_nat0_outbound extended permit ip host IPVSSvr2 172.27.17.240 255.255.255.248 
    access-list outside_cryptomap extended permit ip object-group Naraya_Png object-group Nry_Png 
    global (outside) 10 interface
    nat (inside) 0 access-list inside_nat0_outbound
    nat (inside) 10 0.0.0.0 0.0.0.0
    static (inside,outside) tcp interface 8080 NarayaServer 8080 netmask 255.255.255.255 
    static (inside,outside) tcp interface 3389 NAVNew 3389 netmask 255.255.255.255 
    static (inside,outside) tcp interface ssh IPVSSvr2 ssh netmask 255.255.255.255 
    access-group outsidein in interface outside
    access-group inside_access_in in interface inside
    route outside 0.0.0.0 0.0.0.0 175.139.156.173 1
    route inside 172.17.100.20 255.255.255.255 172.27.17.100 1
    route inside NAVNew 255.255.255.255 172.27.17.100 1
    route inside 172.17.100.30 255.255.255.255 172.27.17.100 1
    route inside NarayaServer 255.255.255.255 172.27.17.100 1
    route inside 172.47.1.11 255.255.255.255 172.27.17.100 1
    route inside VCGroup 255.255.255.0 172.27.17.100 1
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs 
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime seconds 28800
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set security-association lifetime kilobytes 4608000
    crypto map outside_map 1 match address outside_cryptomap
    crypto map outside_map 1 set peer 218.x.x.105 
    crypto map outside_map 1 set transform-set ESP-3DES-SHA
    crypto map outside_map 1 set security-association lifetime seconds 28800
    crypto map outside_map 1 set security-association lifetime kilobytes 4608000
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 10
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto isakmp policy 30
     authentication pre-share
     encryption 3des
     hash md5
     group 2
     lifetime 86400
    group-policy ISETANLOT10 internal
    group-policy ISETANLOT10 attributes
     dns-server value 172.27.17.100
     vpn-tunnel-protocol IPSec l2tp-ipsec 
    username nectier3 password dPFBFnrViJi/LGbT encrypted privilege 0
    username nectier3 attributes
     vpn-group-policy ISETANLOT10
    username necare password BkPn6VQ0VwTy7MY7 encrypted privilege 0
    username necare attributes
     vpn-group-policy ISETANLOT10
    username naraya password pcGKDau9jtKgFWSc encrypted
    username naraya attributes
     vpn-group-policy ISETANLOT10
     service-type nas-prompt
    tunnel-group ISETANLOT10 type remote-access
    tunnel-group ISETANLOT10 general-attributes
     address-pool lot10ippool
     default-group-policy ISETANLOT10
    tunnel-group ISETANLOT10 ipsec-attributes
     pre-shared-key *
    tunnel-group 218.x.x.105 type ipsec-l2l
    tunnel-group 218.x.x.105 ipsec-attributes
     pre-shared-key *
    tunnel-group ivmstunnel type remote-access
    tunnel-group ivmstunnel general-attributes
     address-pool lot10ippool
    tunnel-group ivmstunnel ipsec-attributes
     pre-shared-key *
    !=====

    The remote access VPN should allow the connection but I am guessing your ASA doesn't know how to route to the two new destinations.
    You have a name and static route for the working server at 172.47.1.10:
    name 172.47.1.10 NarayaServer description Naraya Server
    route inside NarayaServer 255.255.255.255 172.27.17.100 1
    ..but no equivalent for the two new hosts. As a result, any traffic from the ASA destined for them will attempt to use the default route (via the outside interface).
    If you add:
    route inside 172.57.1.10 255.255.255.255 172.27.17.100
    route inside 172.57.1.20 255.255.255.255 172.27.17.100
    (assuming that's your correct gateway), it should work.

Maybe you are looking for

  • Restarting after waking from sleep

    I have a mid 2010 macbook pro running Mountain Lion OS X 10.8.3 of which keeps restarting after being left in sleep mode for an hour or two. When waking from sleep mode, the mac functions for about 5 seconds, before restarting by itself. I have tried

  • How to send ENCRYPTED email from 10v2

    Helllo, How to send ENCRYPTED email from 10v2 to end users who will receive their emails from Microsoft Outlook? I created a stored procedure to change user passwords. I need to email the users their passwords but the email message has to be encrypte

  • Itunes/Match downconverting purchases on my Iphone

    I am getting incredibly ****** off and at my wits end....First off, I do NOT have the "downconvert" option selected in itunes when my iphone is clicked. In the last month i have downloaded ~100 songs via itunes, i purchase then on a computer and then

  • Aggregate Audio bug in Tiger?

    I tried to create an Aggregate Audio device using Tiger's Audio MIDI Setup under /Utilities I wish to use the aggregate device to broadcast iTunes music through my desk speakers and my Griffin RocketFM fm transmitter to my living room stereo speakers

  • Deletion of archivelogs

    hello, my database in archivelog mode....... i am taking hotbackup of datafile,controlfile and archivelogs every day. so what is the best way to remove archivelogs??? i am not taking cold backups thanks in advance