Clients Connect via IPSec VPN but can't access local LAN or Internet

Unanswered Question
Mar 31st, 2008
User Badges:

New install - IPSec VPN connects, however, VPN users can not access local LAN or Lnternet resources.


See router and firewall config attach.


Suggestion are much appreciated.


Note: IPAddress have been modified for security.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
alphonsogriffin Mon, 03/31/2008 - 15:40
User Badges:

thx for sharing - Split_tunnel was indeed setup and users can connect just ~ they just can't ping anywhere or access any resources.


Its a collapsed network design - Meaning the CORE does everything and the ASA hang off the CORE.


husycisco Tue, 04/01/2008 - 08:04
User Badges:
  • Gold, 750 points or more

Hi Alphonso

Simply issue the following command in ASA

crypto isakmp nat-traversal 20


Regards

alphonsogriffin Tue, 04/01/2008 - 09:59
User Badges:

Hi, thank you for your comments [much appreciated] However, what does the above command do [provide]?


Do you have any URLs for additional reading.

husycisco Tue, 04/01/2008 - 13:08
User Badges:
  • Gold, 750 points or more

Alphonso,

This commands makes it possible to establish an IPSEC VPN tunnel from the clients, which are behind a device that applies NAT, like most of the routers/modems at home or busines apply, for public IP. Since port numbers and IP addresses are not stable and dynamically built in translation table in Network Address Translation, this creates some incmopability issues with IPSEC. NAT-T lets the original source to be exchanged and this bypasses the possible incompatibilities.

Here is a more technical explaination

http://en.wikipedia.org/wiki/NAT_traversal

Regards

alphonsogriffin Tue, 04/01/2008 - 13:33
User Badges:

Very Interesting - i will try that command - Were you able to review the config that I posted?


Temperary, it got it to work without using any additional commands but I had to place the VPN pool on the inside interface of the firewall uplink [in other words - the firewall inside interface resides on 172.16.50.x and and the VPN pool resides on 172.16.80.x]


Its the only way i was able to get VPN user to access local resources and the internet - although the current solution does compromise the design b/c I had to place the VPN pool on inside ip range assigned to the inside interface of the firewall which connects directly to the CORE infrastructure.


Toplogy Layout: Collapse CORE/DISTRIBUTION DESIGN

FW1 [inside] --> CORE1

FW1 [outside] --> CORE1 [ISP]


I'm not sure if the NAT TRAVERSAL command would be the solution but i'm open to trying all new recommendation since the environment has not yet went live.




-Regards,


-ag

husycisco Tue, 04/01/2008 - 13:57
User Badges:
  • Gold, 750 points or more

"Were you able to review the config that I posted"

After we cover the basics, I will review it. But NAT-T should resolve the issue.

alphonsogriffin Thu, 04/03/2008 - 07:41
User Badges:

Nope - split-tunnel was enabled already - none of the recommendation have worked. I going to chg the design of the infrastructure [routing] just to get this to work.


I will post my solution over the next day or two when i get it working. All work if the VPN pools remains attached to the inside network of the firewall but when I place the vpn pool on another network - all breaks so it forces me to think that its a routing issue b/c the vpn works when the pool remains on the network range of the inside interface.

abison.varghese Fri, 04/18/2008 - 00:15
User Badges:

Alphonso,


Please try this command


crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set reverse-route

Actions

This Discussion