ASA5510 Remote access Server problem

Answered Question

Hello guys,

I have a problem with ASA5510 configured as Remote access server. We are using Windows XP VPN client. Staring at the configuration I don't see any problem but when I try to connect to the Server it doesn't initiate VPN negotiation. I had problem like this before, but at least I saw traffic hitting the ASA. Now I don't see anything hitting the device. I am attaching the current configuration of the ASA. The VPN client on my laptop is configured properly. Thank you in advance!

rvr

I have this problem too.
0 votes
Correct Answer by ajagadee about 8 years 1 month ago

Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4.5 (2 ratings)
Loading.
ajagadee Mon, 10/27/2008 - 12:17

Hi,

In your configuration, you have the below command, which will disable IKE and ESP.

no sysopt connection permit-vpn.

Can you enable this command and run the testing again.

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s8_72.html#wp1198155

If you really want to disable this option, then you need to explicitly configure Access-list applied inbound to permit all ISAKMP and IPSEC ports and also the user traffic.

Regards,

Arul

*Pls rate if it helps*

Correct Answer
ajagadee Wed, 10/29/2008 - 07:41

Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*

Actions

This Discussion