Networks

Ask something
Question Locked

Cisco ASA 5505 VPN problem

0 helpful
15 replies

by sinteur

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've got a new 5505, and I've run through two wizards: one to start up, one to add client VPN.

As a result, I can now connect from a client, the client gets the right info (ip adress, dns, gateway), but it cannot connect to any of the servers on the 'inside' network.

The config is here: ://www.dubbele.com/asaconfig.txt.

I've tried a lot of different things, but I cannot seem to get what's going wrong. Any clues would be very welcome!

15 replies

by japonzio

I am having a similar issue with my 5505 as well. I am looking into possible solutions with a couple of people and we cannot seem to find out why. I can access the 5505 through a VPN tunnel but cannot get through to the inside network.

by sinteur

I'm trying to escalate to cisco right now. I suggest you do the same.

by netman1958

did you run? The "Remote Access" or the "Site-to-Site" ?
Are you trying to connect using the Cisco VPN client running on a PC or from another VPN device such as a router or PIX or another ASA?

by sinteur

And once that works, I've got a RSA Authentication manager and a bunch of secureID tokens to take over authentication. There will also be a site-to-site vpn, but first I have to fix the remote access vpn.

by netman1958

I see several things in your config that are not correct. I suggest resetting the config to defaults and starting over.
Use this guide to configure it:
http://www.cisco.com/en/US/docs/security/asa/asa80/getting_started/asa5500/quick/guide/remvpn.html

When you get to this section "Configuring an IPsec Remote-Access VPN" be sure to select the checkbox next to "Enable inbound ipsec sessions to bypass interface access lists"

When you get to this step "Configuring Address Pools" use a completely different subnet than your LAN...that is if your LAN is 192.168.6.0/24 use 10.0.1.0/24

After you complete that, try it out and post the new config if you need additional help.

by sinteur

Already tried that - I'm waiting for confirmation on a smartnet subscription, and then I'll escalate to Cisco..

by netman1958

already try my suggestions. I didn't see
"sysopt connection permit-ipsec"
in the config you posted the link to.

That config also listed the following address pools:
ip local pool vpnhaarlem 192.168.6.150-192.168.6.175 mask 255.255.255.0
ip local pool rotterdam 192.168.5.150-192.168.5.175 mask 255.255.255.0

That config also included the following NAT statement:
access-list inside_nat0_outbound_2 extended permit ip 192.168.6.0 255.255.255.0 192.168.6.128 255.255.255.192
(Those are overlapping subnets)

If you had tried what I posted, those would be corrected.

by sinteur

The nat pool inside has been 10.0.0 for a week now, I have tried what you said (both the nat and the sysopt), with email assistance from a network admin the results of which don't show on this site. And I thank you very much for the suggestion, I apologize if I gave you the impression I was ignoring your suggestions.

The results so far are still the same. I get a valid address on connection, but no access to any network resource whatsoever.

by netman1958

in seeing your current config if you would like to post it.

by netman1958

If it is going to be a while before you're able to work with Cisco TAC on this, I'd like to suggest that you reset the device to defaults, then just go through the general set-up wizard, but no VPN wizard. Then post that config and it will be easier to work with.

I do see 1 thing you try quickly that might make a difference. Add this line to your config:
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 match address inside_nat0_outbound

by netman1958

Be sure that the devices on the 192.168.6.0 network have 192.168.6.25 configured as their default gateway.

by japonzio

A coworker and I updated to asa803-k8.bin & asdm-615.bin. This seems to have fixed my problem with getting inside the network through the vpn connection. I upgraded one 5505 & tested it and it is working properly.

Please feel free to contact me if you have any questions. My email is japonzio@fayettecountyga.gov.

God Bless,

This discussion is closed to new replies.