ASA 5510 7.0(7) Unable to manage over VPN

Unanswered Question
Jul 9th, 2008
User Badges:

Hi Everyone,


I am hoping that someone on here can help me out, as I am going out of my mind with this issue that I've been working on for the last few days.


I have a customer that has an ASA5510 behind their ISP router, and we are using it as a RAS VPN server for some remote workers. The VPNs all work fine, and we can connect, and reach devices on the network ok. However, when it comes to managing the ASA over the VPN either via asdm or telnet, the session fails.


The RAS users get allocated an address in the 10.9.1.0/24 subnet, and this is routable from the ASA (the route table shows it as a static route, via the ISP router when an VPN user is connected). The VPN users can ping the inside interface on the ASA ok as well. Users on the inside interface (LAN side) can use telnet & ASDM, so I know that the server processes are running on the ASA ok.


Looking at the debug/monitor on the ASA, I don't see the telnet/http sessions being blocked by any ACLS or anything which is what is really confusing me!


I've attached a config if you would like to take a look...


As an aside - the customer has a 2nd ASA on the same LAN segment (10.0.1.x), and when users are connected to the 1st ASA via VPN, they can manage the 2nd ASA with telnet/ASDM no problem. I suspect that this is because the 2nd box sees the 10.9.1.x addresses as inside, whereas the 1st ASA sees the 10.9.1.x addresses as outside.


Any help would be really appreciated!


Thanks,


-Gordon



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
JORGE RODRIGUEZ Wed, 07/09/2008 - 20:47
User Badges:
  • Green, 3000 points or more

Gordon,


Please correct the following statements.


no http 10.9.1.0 255.255.255.0 outside

no telnet 10.9.1.0 255.255.255.0 outside


and replace with


http 10.9.1.0 255.255.255.0 inside

telnet 10.9.1.0 255.255.255.0 inside


After making above changes, vpn network will be able to manage firewall while VPN in.


Rgds

-Jorge



gordonmarkus Thu, 07/10/2008 - 09:17
User Badges:

Hi,


Thanks for that. I did try it when I was implementing the VPN's, and again today but it didn't make any difference unfortunately.


When you do a 'show route' on the ASA, it sees the 10.9.1.x clients as outside, via the service provider router, hence why I have the http & telnet set as outside.


Any further advice/comments appreciated!


Thanks,


-Gordon


a.alekseev Thu, 07/10/2008 - 09:28
User Badges:
  • Gold, 750 points or more

management-access

To allow management access to an interface other than the onefrom which you entered the security appliance when using IPSec VPN, use the management-access command in global configuration mode. To disable, use the no form of this command.


management-access mgmt_if


[Pls RATE if HELPS]

gordonmarkus Thu, 07/10/2008 - 09:35
User Badges:

Hi,


Thanks for that.


I have the line:


management-access inside


in my config, so I would have thought that would allow management access to the 10.0.1.249 (inside) interface.


Any further ideas/advice welcome.


-Gordon


lchancy Thu, 07/10/2008 - 10:39
User Badges:

I'm having a similar problem with SSH to an ASA through remote VPN. Hopefully if your issue gets resolved there will be some tips to solving my own.


The "management-access Inside" statement was added and I have an "ssh [vpnpool] [vpnmask] Inside" statement already (from K77528143 of the CiscoWiki), but the SSH connection times out, although I can ping the Inside IP as well as SSH without the VPN to the Outside interface.


acomiskey Thu, 07/10/2008 - 10:41
User Badges:
  • Green, 3000 points or more

7.0.7 is pretty old.

JORGE RODRIGUEZ Thu, 07/10/2008 - 10:57
User Badges:
  • Green, 3000 points or more

Larry,.. Adam brought up interesting point perhaps common denominator, what version of code are you running , is the the same code as origincal poster? although I don't see any bugs on caveats related to asa management over vpn , but may well be new.

lchancy Thu, 07/10/2008 - 11:09
User Badges:

In this particular case, yes it is 7.0(7).


I'll see if I can get it migrated to 7.2(3) to find out if the problem persists.

a.alekseev Thu, 07/10/2008 - 11:18
User Badges:
  • Gold, 750 points or more


I have 7.2(3) and it works, I can get access to asa through VPN

gordonmarkus Thu, 07/10/2008 - 11:30
User Badges:

That's encouraging.


I'll get our boxes upgraded asap!


Thanks for all the help/advice.


Regards,


-Gordon


lchancy Thu, 07/10/2008 - 12:13
User Badges:

I upgraded from 7.0(7) to 7.2(3) and SSH worked for me without any additional changes.


I'd bet this works for you as well.

JORGE RODRIGUEZ Thu, 07/10/2008 - 13:52
User Badges:
  • Green, 3000 points or more

Larry, thanks for updating the post with such positive results, would you mind to rate this post as resolved as well as rate participants who helped , Adam brought the spark in untimately resolving this.


Posts that are resolved helps others in the search for an answer who may have similar issues.



Rgds

Jorge

Actions

This Discussion