cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1285
Views
0
Helpful
7
Replies

Can connect to IPSec VPN but can't see internal network

bill_baxter
Level 1
Level 1

I have several users that can connect to our VPN ussing IPSec on a 5505. I have one user that can connect, but cannot see the internal network. This user is using DSL with a speedstream 4100. However, I have another user with the same setup that can connect and see the internal network. The logs in ASDM show the connection, but don't seem to show any errors when trying to access internal. Any help will be greatly appreciated. Thanks, Bill.

2 Accepted Solutions

Accepted Solutions

Add..

crypto isakmp nat-traversal

View solution in original post

No it does not. It just negotiates to see if there is any NAT in the transit path (by using HASH values), if the hashes are not equal it encapsulates the IPSEC traffic inside UDP 4500. The VPN is still as secure as it is before.

Regards

Farrukh

View solution in original post

7 Replies 7

Farrukh Haroon
VIP Alumni
VIP Alumni

Are you using split tunneling/local lan access?

Are both Clients seeing the same routes in their VPN Client >> Routes window?

Have you tried to compare the 'route print' output of both machines after the VPN has been established?

Are both machines using Same OS/PATCH level?

Regards

Farrukh

using split tunneling. can't get local lan access to work on client side even if checked on the transport tab.

it only shows 0.0.0.0 0.0.0.0 for network/subnet under secured routes.

i will check the route print stats.

same os and patch levels.

Thanks,

bill

Please have a look at the following two links, please note you can use only ONE of them at a time:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702992.shtml

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702999.shtml

Your output should match the VPN CLient >> Statistics >> Route details mentioned on these links, based on what you want to configure (Local LAN OR Split-tunneling)

Regards

Farrukh

now i have setup antoher user, and the same thing happens. connection established, but no access to internal net. i have three users who can access internal net and two that cannot. can you please take a look at my config and see if there is anything wrong? Thanks, Bill

Add..

crypto isakmp nat-traversal

crypto isakmp nat-traversal worked for one user, and i am going to try the other.

but does this pose any security risks?

No it does not. It just negotiates to see if there is any NAT in the transit path (by using HASH values), if the hashes are not equal it encapsulates the IPSEC traffic inside UDP 4500. The VPN is still as secure as it is before.

Regards

Farrukh

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: