Cannot access a certain network with SSL vpnpool address

Unanswered Question
Feb 28th, 2007

Help! can you look an the config and diagram below and see what my problem is?

Thanks!!!

__________inside (172.0.0.0/8) Sec 100

/

(internet) ---------> outside /___________dmz (192.168.2.66/24) Sec 50

\

\__________corporate (10.2.195.0/24) Sec 90

remote user vpn-pool 192.168.100.0/28 (ssl vpn)

Problem - remote user can get to all networks in the inside, but cannot access the corporate net.

- logs show a syn failure, which indicates a routing problem - I think

Snippet of configuration:

!

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address x.x.83.8 255.255.255.0

!

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 172.31.1.8 255.255.255.0

!

interface GigabitEthernet0/2

nameif dmz

security-level 50

ip address 192.168.2.66 255.255.255.0

!

interface GigabitEthernet0/3

nameif corporate

security-level 100

ip address 10.2.195.28 255.255.255.0

!

access-list outside_access_in remark Conn to MARS

access-list outside_access_in extended permit tcp any host x.x.83.7 eq https log debugging

access-list outside_access_in extended permit tcp any host x.x.83.7 eq ftp log debugging

access-list outside_access_in extended permit tcp any host x.x.83.7 eq 5915 log debugging

access-list outside_access_in extended permit tcp any host x.x.83.7 eq 5910 log debugging

access-list outside_access_in extended permit tcp any host x.x.83.7 eq 5911 log debugging

access-list outside_access_in extended permit tcp any host x.x.83.7 eq 5900 log debugging

access-list outside_access_in extended permit tcp any host x.x.83.7 eq telnet log debugging

access-list outside_access_in extended permit icmp any any log debugging

access-list outside_access_in extended permit ip 192.168.100.0 255.255.255.240 any log debugging

access-list inside_access_in extended permit ip any any log debugging

access-list corporate_access_in extended permit ip any any log debugging

access-list corporate_access_out extended permit ip any any log debugging

access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.240

access-list inside_access_out extended permit ip any any log debugging

access-list corporate_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.240

!

ip local pool vpnpool 192.168.100.1-192.168.100.14 mask 255.255.255.240

!

global (outside) 1 interface

global (inside) 1 interface

global (corporate) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 172.0.0.0 255.0.0.0

nat (corporate) 0 access-list corporate_nat0_outbound

nat (corporate) 1 192.168.100.0 255.255.255.240

nat (management) 0 0.0.0.0 0.0.0.0

static (dmz,outside) tcp x.x.83.7 ftp 192.168.2.67 ftp netmask 255.255.255.255

static (inside,outside) tcp x.x.83.7 5915 172.20.5.15 5915 netmask 255.255.255.255

static (inside,outside) tcp x.x.83.7 5910 172.20.5.10 5910 netmask 255.255.255.255

static (inside,outside) tcp x.x.83.7 5911 172.20.3.11 5911 netmask 255.255.255.255

static (inside,corporate) tcp interface 5910 172.20.5.10 5910 netmask 255.255.255.255

static (inside,outside) tcp x.x.83.7 5900 172.20.5.22 5900 netmask 255.255.255.255

static (inside,outside) tcp x.x.83.7 telnet 172.31.1.39 telnet netmask 255.255.255.255

static (inside,outside) tcp x.x.83.7 https 172.31.1.29 https netmask 255.255.255.255

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

access-group inside_access_out out interface inside

access-group corporate_access_in in interface corporate

access-group corporate_access_out out interface corporate

route outside 0.0.0.0 0.0.0.0 x.x.83.1 1

!

webvpn

port 444

enable outside

svc image disk0:/sslclient-win-1.1.2.169.pkg 1

svc enable

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
dprakken1 Tue, 03/06/2007 - 12:00

Problem solved. I just added:

global (outside) 1 interface

nat (outside) 1 192.168.100.0 255.255.255.240 outside

This allowed the VPN IP Pool to flow through the corporate interface.

Thanks to all that helped - Dave

Actions

This Discussion