VPN logon Access prompt

Hello we are in the process of setting up password changes every 45 days on doma in our network. I have many users who VPN into the Network to a do their work. Is there any way the VPN Concentrator will prompt my user to change their password. Here is the software I am currently running:
vpn3005-4.7.2.F-k9.bin Please help!

This can be done with the help of Password Expiration feature. Take a look here
http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00800946b9.shtml#maintask1

Similar Messages

VPN Remote Access on ASA5510 version 7.1(2)

Hi folks,
I have surprising thing when firstly configure IPsec_ra on asa 5510 with asa version 7.1(2). I usually configure this on PIX platform and never failed.
I use standard VPN remote access configuration with using provided default tunnel group.
Bellow is the configuration:
username xxx password xxx
ip local pool VPN_POOL 192.168.21.1-192.168.21.100 mask 255.255.255.0
isakmp enable Outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map dyn1 1 set transform-set ESP-3DES-MD5
crypto map vpnmap 1 ipsec-isakmp dynamic dyn1
crypto map vpnmap interface Outside
tunnel-group DefaultRAGroup general-attributes
address-pool VPN_POOL
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key xxx
I have enable command "sysopt connection permit-vpn", here i didn't find "permit-ipsec". Are those the same thing?
I have issued debug crypto ipsec and isakmp but does not give me enough information for configuartion error.
Aug 13 11:07:33 [IKEv1]: Group = DefaultRAGroup, IP = **.**.**.**, Removing peer from peer table failed, no match!
Aug 13 11:07:33 [IKEv1]: Group = DefaultRAGroup, IP = **.**.**.**, Error: Unable to remove PeerTblEntry
What is missing here? Please advice...
fyi: I use cisco vpn client v4.8.

Dear All ,
Since last 8 days i am also facing the same problem while configuring Remote Access VPN on ASA 5510
Error Message from ASA syslog while client making requset to connect :-
Group = AUTOMATION_TG, IP = 210.212.172.91, Error: Unable to remove PeerTblEntry
Group = AUTOMATION_TG, IP = 210.212.172.91, Removing peer from peer table failed, no match!
================This is the show run of my running configuration =======================
: Saved
PIX Version 7.2(2)
hostname ciscoasa
domain-name default.domain.invalid
names
interface Ethernet0
nameif Inside
security-level 100
ip address 10.210.3.254 255.255.255.0
interface Ethernet1
nameif Outside
security-level 0
ip address 210.212.172.94 255.255.255.0
interface Ethernet2
shutdown
no nameif
no security-level
no ip address
boot system flash:/asa722-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list Inside_nat0_outbound extended permit ip 10.210.3.0 255.255.255.0 172.16.1.0 255.255.255.240
access-list AUTOMATION_TG_splitTunnelAcl standard permit 10.210.3.0 255.255.255.0
pager lines 24
mtu Inside 1500
mtu Outside 1500
ip local pool VPN_POOL 172.16.1.1-172.16.1.10 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image flash:/asdm-522.bin
no asdm history enable
arp timeout 14400
nat (Inside) 0 access-list Inside_nat0_outbound
route Outside 0.0.0.0 0.0.0.0 210.212.172.95 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
group-policy AUTOMATION_TG internal
group-policy AUTOMATION_TG attributes
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value AUTOMATION_TG_splitTunnelAcl
username automation1 password auto1 privilege 0
username automation1 attributes
vpn-group-policy AUTOMATION_TG
username cisco password cisco
http server enable
http 10.15.1.0 255.255.255.0 Outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map Outside_dyn_map 20 set pfs
crypto dynamic-map Outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map Outside_dyn_map 40 set pfs
crypto dynamic-map Outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto map Outside_map 65535 ipsec-isakmp dynamic Outside_dyn_map
crypto map Outside_map interface Outside
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
tunnel-group AUTOMATION_TG type ipsec-ra
tunnel-group AUTOMATION_TG general-attributes
address-pool VPN_POOL
default-group-policy AUTOMATION_TG
tunnel-group AUTOMATION_TG ipsec-attributes
pre-shared-key automation
tunnel-group-map default-group AUTOMATION_TG
telnet timeout 5
ssh timeout 5
console timeout 0
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
service-policy global_policy global
prompt hostname context
Rergards
Sandeep Kadam
Network Specialist

RV042 VPN Client Access not able to connect two users at same time

I have a RV042 and have set it up for VPN Client access using the QuickVPN client to connect my remote users. I discovered today that I cannot have two users connect in at the same time. Both users are in the same remote office. They can connect individually with no problem but if one is connected and the other tries connect also the second user gets a message the gateway is not responding. They are both running WinXPPRo SP3. Any help is greatly appreciated.

Were your QuickVPN clients behind a firewall router of some sort? For multiple QuickVPN clients to be able to connect to the remote RV042 at the same time, the local firewall router must have VPN Passthrough correctly implemented. You could try using a RV042 as the firewall router for your QuickVPN clients and you should be able to maintain 2 tunnels at the same time to the remote RV042.

Cisco ASA disable command line interface (CLI) vor VPN Remote Access users

Hi,
I have local database for a couple of VPN Remote Access users on our Cisco ASA 5510 firewall. When adding users i asigned them the privilege leve 0. Is it possible to completly disable CLI for theses users as they will only be using VPN Remote Access and do not need to access the appliance cli.
Thanks in advance.
Kind Regards,
Marco

Hi,
We will need to use the vpn-filter or the ssh command to block ssh from the vpn pool.
Regards,
Vivek

Allow remote Cisco VPN ASDM Access

Hi,
I am trying to setup asdm access for remote vpn user. Our ASA is running verion 9.1(1). ASDM is running version 7.1(1)52
I have outside interface, inside interface enabled for vpn tunnel and I use 3rd interface(asdm_inf) dedicated for this purpose.
In the asdm, I have enabled management interface for asdm_inf. In the ASDM/HTTPS/Telnet/SSH section, I also add ASDM/HTTPS(port 444) for asdm_inf, ip_address 0.0.0.0, mask 0.0.0.0.
However, when I connect to vpn client and trying https://asdm_inf:444, the connection is failed with timeout.
Where could I go wrong? Any help would be appreciated.
Thanks
Jin

Yes. I configured management-access asdm_inf
Now I made some changes to try to use internal interface for remote VPN asdm access. Here are some of my running-config:
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 12.10.10.250 255.255.255.0
interface GigabitEthernet0/1
nameif inside
security-level 1
no ip address
interface GigabitEthernet0/1.100
vlan 307
nameif BFD
security-level 100
ip address 192.168.244.152 255.255.255.0
interface Management0/0
management-only
nameif management
security-level 10
ip address 192.55.194.112 255.255.255.0
object network vpn_pool
subnet 10.50.16.0 255.255.240.0
object network NETWORK_OBJ_10.50.16.0_20
subnet 10.50.16.0 255.255.240.0
object network NETWORK_OBJ_192.168.244.0_24
subnet 192.168.244.0 255.255.255.0
object-group network All_vpn_networks
description This is used for split tunnel network list
network-object 172.16.66.0 255.255.255.0
access-list testacl standard permit 172.16.66.0 255.255.255.0
nat (BFD,outside) source static NETWORK_OBJ_192.168.244.0_24 NETWORK_OBJ_192.168.244.0_24 destination static NETWORK_OBJ_10.50.16.0_20 NETWORK_OBJ_10.50.16.0_20 no-proxy-arp route-lookup
http server enable 444
http 192.55.194.0 255.255.255.0 management
http 10.50.16.0 255.255.240.0 BFD
ssh scopy enable
ssh 10.50.16.0 255.255.240.0 BFD
ssh 192.55.194.0 255.255.255.0 management
ssh timeout 60
console timeout 0
management-access BFD
As you could read, vpn tunnel the traffic to 172.16.66.x network and our vpn address pool is 10.50.16.x, vlan BFD(under inside interface) has management access and vpn address pool is allowed to access.
Please advise what I can do.
Thanks
Jin

Cisco ASA 5505 L2TP VPN cannot access internal network

Hi,
I'm trying to configure Cisco L2TP VPN to my office. After successful connection I cannot access to internal network.
Can you jhelp me to find out the issue?
I have Cisco ASA:
inside network - 192.168.1.0
VPN network - 192.168.168.0
I have router 192.168.1.2 and I cannot ping or get access to this router.
Here is my config:
ASA Version 8.4(3)
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 198.X.X.A 255.255.255.248
ftp mode passive
same-security-traffic permit intra-interface
object network net-all
subnet 0.0.0.0 0.0.0.0
object network vpn_local
subnet 192.168.168.0 255.255.255.0
object network inside_nw
subnet 192.168.1.0 255.255.255.0
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended deny ip any any log
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool sales_addresses 192.168.168.1-192.168.168.254
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic net-all interface
nat (inside,outside) source static inside_nw inside_nw destination static vpn_local vpn_local
nat (outside,inside) source static vpn_local vpn_local destination static inside_nw inside_nw route-lookup
object network vpn_local
nat (outside,outside) dynamic interface
object network inside_nw
nat (inside,outside) dynamic interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 198.X.X.B 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set my-transform-set-ikev1 esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set my-transform-set-ikev1 mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set my-transform-set-ikev1
crypto map vpn 20 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto isakmp nat-traversal 3600
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 30
console timeout 0
management-access inside
dhcpd address 192.168.1.5-192.168.1.132 inside
dhcpd dns 75.75.75.75 76.76.76.76 interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy sales_policy internal
group-policy sales_policy attributes
dns-server value 75.75.75.75 76.76.76.76
vpn-tunnel-protocol l2tp-ipsec
username ----------
username ----------
tunnel-group DefaultRAGroup general-attributes
address-pool sales_addresses
default-group-policy sales_policy
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:5d1fc9409c87ecdc1e06f06980de6c13
: end
Thanks for your help.

You have to test it with "real" traffic to 192.168.1.2 and if you use ping, you have to add icmp-inspection:
policy-map global_policy
class inspection_default
inspect icmp
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

IOS Remote Desktop Client Logon Issue Prompts to Logon 3 Times with RDGW

I have an issue when connecting from the Remote Desktop client iOS on multiple iPads/users.
First a little background: We have an RDS Web Access / RDS Gateway (2012 R2) setup and properly configured. We can logon using it just fine from the Mac OS version of the app, Android version of the app, or from a Windows PC. When we try to
connect via the iOS app we get the prompt to logon 3 times. Due to security reasons, we do not want them to store their credentials on the iPads, which is the only method I have found to eliminate the triple password entry. It only prompts once on the Mac
OS version, Android version or from a Windows PC.
The password isn't being entered incorrectly and the servers are not registering any Audit Failures for the logon attempts. Can you assist?
Additionally I would like to recommend the addition of a feature to be able to setup remote resources but prompt for the password on app launch for security reasons. That way they would have to enter it once but then they could access any resources needed.
Thanks,
Nate L

I am not comfortable posting the entire log file but let me give you the high level summary. The settings section for the active connection:
[2014-Jun-17 12:45:23] RDP (0): Final rdp configuration used: {
    activeUsername = "domain\username";
    arcTimeout = 1800;
    configurationVersion = 8;
    console = 0;
    gatewayId = XXXXXXXX;
    host = "InternalServerHostName.domain.local";
    label = "";
    mouseMode = "-1";
    offsetX = 0;
    offsetY = 0;
    peerIp = "ExternalRDSGatewayIP";
    port = 3389;
    previousMouseMode = 1;
    previousUtilityBar = 0;
    screenshotScale = "0.125";
    soundMode = 1;
    swapMouseButtons = 0;
    type = rdp;
    utilityBar = "-1";
    zoomFactor = 1;
    connections =
        ...bunch of addresses...
    host = "ExternalRDSGatewayHostName";
    id = XXXXXX;
    port = 443;
    temporary = 1;
    type = rdp;
    kCFProxyTypeKey = kCFProxyTypeNone;
It then attempts to connect to the InternalServerHostName.domain.local.
[2014-Jun-19 09:40:01] RDP (0): Resolved 'InternalServerHostName.domain.local' to 'ERROR: Unable to connect to remote PC. Please provide the fully-qualified name or the IP address of the remote PC, and then try again.' using NameResolveMethod_Unknown(0)
[2014-Jun-19 09:40:01] RDP (0): Error message: Unable to connect to remote PC. Please provide the fully-qualified name or the IP address of the remote PC, and then try again.(phase: 0, type: 0, reason: 0, systemCode: 0, systemMessage: )
[2014-Jun-19 09:40:01] RDP (0): Protocol state changed to: ProtocolDisconnected(8)
[2014-Jun-19 09:40:02] RDP (0): Showing credentials dialog
It then displays the same settings again with the exception of an additional line after the gatewayId line:
gwAutodetectState = kConnectionGwAutodectedForceGW;
Then it goes through the interface list, not using any proxy, correlation id, then resolves name:
[2014-Jun-19 09:40:10] RDP (0): Resolved 'ExternalRDSGatewayHostName' to 'ExternalRDSGatewayIP' using NameResolveMethod_Unknown(0)
[2014-Jun-19 09:40:11] RDP (0): Exception caught: Exception in file '/Users/build/jenkins/workspace/rc-ios-develop/protocols/RDP/librdp/librdp/private/httpendpoint.cpp' at line 217
    User Message : The gateway failed to connect with the message: 403 Forbidden ( The server denied the specified Uniform Resource Locator (URL). Contact the server administrator.
[2014-Jun-19 09:40:11] RDP (0): Error message: The gateway failed to connect with the message: 403 Forbidden ( The server denied the specified Uniform Resource Locator (URL). Contact the server administrator.
)(phase: 0, type: 0, reason: 0, systemCode: -1, systemMessage: )
[2014-Jun-19 09:40:11] RDP (0): Protocol state changed to: ProtocolDisconnecting(7)
[2014-Jun-19 09:40:11] RDP (0): Protocol state changed to: ProtocolDisconnected(8)
[2014-Jun-19 09:40:11] RDP (0): Showing credentials dialog
Then it displays the same settings again except for the gwAutodetectState line changing to:
gwAutodetectState = kConnectionGwAutodectedHTTPSTried;
Then it connects ok. I went to our firewall (MS Forefront TMG) and monitored for traffic from the iPad iOS App (based on network it is on). I don't see the initial connection attempt at all, which is expected because according to the log above it looks
like it tries to connect to the host directly...which it shouldn't?
Then in the second attempt I see it trying to go to http://ExternalRDSGatewayHostName:443/remoteDesktopGateway/ which again it shouldn't be doing because that URL (the remoteDesktopGateway) is not part of the RDSGW or RDSWA 2012 R2 IIS
config or am I missing something? It should be going to Rpc or RDWeb right? or do I need to allow that path through too?
Thanks,
Nate

Need help configuring VPN - problems accessing the networks

Hi everyone, hope someone can help me out here.
I'm administering the network for our small company. We basically have two sets of machines - public ones with fixed net addresses (mail, web, dns servers, etc), and private ones behind a wireless router/nat.
Our main need here is to be able to VPN in to the public side, in particular, the mailserver, so that we can get around all the stupid things that get done to SMTP when we connect at the BedBug Inn ("Free wifi, administered by gibbons").
Secondarily, it would be nice to be able to connect to and browse some of the internal machines.
So here is what I did:
* Installed 10.4.10 Server on a machine with two ethernet interfaces, one that has a public IP address, the other connects into the private network. When I'm actually at that machine, things work fine - I can browse the private network shares, connect to the net, etc.
* Configured VPN. I have no problems getting a VPN connection, both sides are happy. The VPN assigns incoming clients IP addresses in the private network IP range, but outside those assigned by the wireless router's NAT.
* Added 192.168.2.1/255 (the private network) and 12.17.29.193/224 (the public network) to the Network Routing Definition box under VPN/Settings/Client Information.
However, here's where it all falls down. Once the VPN is established, I can't connect to any of the public machines, and the only private-side device that seems to respond is the Wireless/NAT box (A Belkin N1). So the only thing I can do is administer the Belkin remotely, which, while nice, is not exactly what I had in mind.
Doing a traceroute while VPN is active to my mailserver shows the first hop direct to the VPN machine, then off into * * * heaven (though I have no idea if traceroute works over VPN!).
One curious note: when I change the order of the Network Routing Definitions so that the public network comes first, and the private one second, I can't contact the Belkin box.
Any advice, oh wise and powerful masters of technology?
Various, but the server is running on a G4 Mac OS X (10.4.10)

I said:
"let's assume I VPN to the wireless box"
You replied:
"That's not correct as it is not the device running the VPN endpoint - in this case. "
But wouldn't I have to (on the VPN client) specify the public IP of the wireless box in order connect (because the packets are forwarded) to the actual OS X box running the VPN? Otherwise, it can't see it.
Part of the problem I have is that I can't dedicate a whole machine to VPN. The OS X machine running VPN is also running DNS, and will eventually run our mailserver and perhaps FTP, web, etc, as I slowly migrate stuff to it.
So this machine has to have a public IP address. It cannot be hidden behind the wireless NAT. And it seems to me that this is the crux of the problem. What I think you are telling me is that if the VPN machine was entirely hidden behind the wireless NAT, and had no direct public (WAN) interface, then since all the packets destined for the outside world (including my public servers)would have to go through the NAT, and all would be OK.
If so, then it seems to me that the best solution is to use something like OpenVPN on another OS X (not OS X Server, since I only have one of those) machine in the private network. Since the incoming VPN traffic will be Mac only, it shouldn't be an issue, L2TP-only is fine.
"Otherwise you have to run NAT and the firewall in the VPN server too and use private IPs for VPN clients - or use "only" it (remove the other NAT box and put it on the LAN only). Using only one device for NAT/gw means less configuration."
It is entirely unclear to me, in my setup, what effect turning on NAT on the VPN box (or perhaps, just IP forwarding) would have -- and if I do turn on NAT, would I still have the VPN assign IP's to clients in the internal private network's range, or would I use a different range (ie: private is 192.168.237.xxx, VPN assigns 192.168.239.xxx) and expect the NAT to handle the conversion?
I'm a bit leery of just trying it and seeing what happens because it if mucks things up so badly that the server becomes unreachable (via server admin), I'll have to schlep down to the office to fix it.
"Other things to consider is "bottlenecks" between your LAN and WAN."
Not a real issue. We have a small office, and a relatively small pipe to the internet. Most of the traffic from that pipe is from the public machines anyway. The traffic that goes through the wireless router is basically websurfing and hitting the mailserver.
I could, of course, use the VPN OS X machine as the NAT/DHCP server, and hang the wireless router off the internal network as a simple access point. But would that resolve all the VPN issues?
Once again, thanks for your helpful and prompt replies.

ASA 5505 VPN no access to inside network

Trying to set up ipsec/l2tp vpn to provide full access to internal network for remote users with only Windows built-in vpn client.
The vpn client can connect successfully, but can't see anything on the inside network.
The ASA is not the gateway for hosts on the internal network
name x.y.z.129 isp-gateway
name 172.16.1.0 vpn-address-pool
name 10.11.10.0 inside-network
name x.y.z.128 outside-network
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list vpn extended permit ip inside-network 255.255.254.0 vpn-address-pool 255.255.255.0
access-list outside_access_in extended permit ip any any
global (outside) 1 interface
nat (outside) 1 vpn-address-pool 255.255.255.0
nat (inside) 0 access-list vpn
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 isp-gateway 1
ciscoasa# show route
Gateway of last resort is cic-gateway to network 0.0.0.0
C    outside-network 255.255.255.128 is directly connected, outside
S    172.16.1.5 255.255.255.255 [1/0] via isp-gateway, outside
C    inside-network 255.255.254.0 is directly connected, inside
S*   0.0.0.0 0.0.0.0 [1/0] via isp-gateway, outside

Do you configure split tunnel or no split tunnel policy?
Also when you are connected and try to access internal network, can you pls share the output of :
show cry isa sa
show cry ipsec sa

ASA 5505 VPN Network access problem

I have been working on this thing all night and I can't seem to get any where. I have a very straight forward set up, and so far the only issue I'm having is being able to access the network when connected through VPN, I have internet access, but nothing else and it's really strange.
Here is my config, I thought this would be a pretty straight forward set up, and I got everything else up and running with in a few minutes, but not being able to access the network via VPN is frustrating after I have tried all night to get it to work. I have read a lot of stuff online, and I keep on thinking im close but never get anywhere. Any help is appreciated.
Attached is the config.
Thanks

Your NAT config confuses me. Are those "static (inside,inside)" lines for real?
try this:
no global (inside) 1 interface
no nat (T1) 1 access-list outside_nat dns
nat (inside) 0 access-list Local_LAN_Access
And remove those dodgy "static (inside,inside)" NATs!
I recommend staying with tunnelling everything.
You should tighten "access-list T1_access_in" because at the moment all IP is allowed from the internet to those "static (inside,T1)" NATs.
If you put "no sysopt connection permit-vpn" then all VPN traffic is forced through "access-list T1_access_in" - an easy way of filtering it.
I would tighten "access-list inside_access_in" but unapply and remove "access-list inside_access_out".

Remote access vpn clients, access to Internet resources

Hello, we currently have a remote access vpn set up terminating on an ASA 5520. Remote access users connect into this ASA and are able to access resources inside of the firewall- the public IP of the ASA is 1.1.1.135. We need these users to be able to access resources natted behind another ASA firewall on the same public IP segment, at IP address 1.1.1.165.
I have gotten to the point where I believe I have all of my Nat/global statements in place, along with my ACLs on both firewalls, but I am not able to make the connection to the server behind the second ASA.
running packet tracer on the second ASA (hosting the 1.1.1.165 server) shows that the packet will be allowed. RUnning packet tracer on the Remote access VPN ASA is showing that the packet is dropped due to :
Action: drop
Drop-reason: (ipsec-spoof) IPSEC Spoof detected
To me, this should be a simple setup, very similar to a company that tunnels all traffic (including Internet traffic) for remote access VPN users. It just doesn't seem like my traffic is getting to the second ASA wioth the remote host.
Anyone have any ideas?

I figured out the answer- I had to add a nat statement form my VPN user subnet to be natted to the outside global IP:
nat (outside) 1 10.2.2.0 255.255.255.0 (this is my vpn subnet)
global (outside) 1 interface

How do I get a VPN acct accessed using Airport Extreme Base station?

I have PC running Windows 2000. For my job, I access a hospital VPN at home. In my home, I am able to set up the Extreme Base Station for wireless conductivity with computers in my home and all have access internet wirelessly. No problem.
The problem is that I cant get it all to work together. How do I configure the base station to recognize/allow the VPN client to enter my network?
I currently have WEP 128 on. The computer used for VPN is hardwired to the base station. Even with security turn-off, I cant access the VPN via base station set up as it is.
help!
PC Windows 2000

I recently got my roommate's Lenovo t43p with VPN to finally work with my Airport Extreme.
1. Open the Airport Utility
2. Double click on your Airport Express on the left side to open up the panel.
3. Click on the "Internet" tab and then select the "DHCP" tab.
4. Click the "+" sign under "DHCP Reservations"
5. Create a name for the profile like "XP Work Laptop" or whatever, and then click Continue
6. You'll need to get your Windows laptop's MAC address which is sometimes under your laptop on a sticker, or you'll have to dig through XP's ridiculous Control Panel to find it.
7. Enter your laptop's MAC address in the field.
8. Lastly, in the 'IPv4 Address" field designate an IP address for your XP laptop that is within your router's range, if you're not sure of the range, the "IPv4 Address" range should be auto-populated with an IP address and you can just try it with that, or if it doesn't work you can change the last number to something higher but no more than like 4-5 digits more.
Hope this helps, Good luck!!

Static NAT - VPN - Internet Access

Does anyone know how to configure the following?
1. An static NAT from an inside ip address to another inside ip address (not physical subnet).
2. The traffic static Natted at the step 1 need to go into a tunnel VPN and at the same time to have internet access.
My router just have two interfaces a WAN and a LAN.
I just created the VPN, the static NAT and the PAT for other users of the subnet to have internet access, but the traffic static Natted just goes over the ipsec tunnel but cannot have internet access.
I tried to apply a route map after the static nat command but since i do not have a physical interface in the same subnet were i am translating the route-map is not applied to the static nat command.
in an extract:
LAN traffic (specific server) --->> static nat to inside not real subnet --->> traffic goes over Tunnel (OK), but no internet access.
BTW. I need to configure the nat before de ipsec tunnel because both lan subnets of the ipsec tunnel endpoint are the same.

Why do you need an inside host to be natted to another inside IP address?
You need to configure a "no nat" policy, for the internet traffic.

VPN to access NAS attached to WRT300N remotely?

I have a WRT300N which has a SimpleShare network attached storage device (NAS) connected. I would like to be able to access files on the NAS and use the attached printer remotely when I am away from the house. The SimpleShare has a print server built in also.
Is the best way to do this with a VPN? Ultimately I would like to be able to access the files directly on the SimpleShare rather than setting up a server at home.
Thanks for any and all help.

There are two options. Firstly, if your NAS supports FTP hosting and your printer supports IPP (internet Printing) then you can simply host an FTP server through the NAS and enable IPP on the printer. You may just required ports on the router. Secondly you can try a VPN, for that you may need a VPN router so using it you can create a VPN connection.

Two VPNs, one accesses DNS properly, one does not.

I have two Offices with two separate RRAS servers setup in each one on Windows 2012
Office 1
DHCP server on separate VM from RRAS server.
RRAS Server on VM
Office 2
RRAS and DHCP servers on same VM
Both DHCP servers and RRAS servers are configured exactly the same except, of course, the DHCP server scopes are different subnets. I literally brought both up in two different screens and went screen by screen.
I running a Mac at home, however, I have the same problem on my PC. If I connect to the VPN in Office 1. Then run nslookup and do a DNS lookup, it uses my VPN's DNS servers and resolves the IP. If I connect to the VPN in Office 2. Then run NSLookup
and do a DNS Lookup, it shows me that I'm using my local (to my Mac) DNS servers and it won't resolve the IP.
I have checked my Mac (and PC) VPN settings and they are also identical.
I don't even know where to check to solve this problem.

Both servers are the same. Ethernet on top and then Remote Access connections.
I noticed while searching on this just now that there is this article: http://www.isaserver.org/articles-tutorials/configuration-general/work-around-VPN-clients-split-DNS.html
but nowhere in my registry is this \Device\NdisWanIp that they're talking about.

VPN logon Access prompt

Similar Messages

Maybe you are looking for