Solved: ASA5510 Remote access Server problem

rvr_76bg · ‎10-27-2008

Hello guys,

I have a problem with ASA5510 configured as Remote access server. We are using Windows XP VPN client. Staring at the configuration I don't see any problem but when I try to connect to the Server it doesn't initiate VPN negotiation. I had problem like this before, but at least I saw traffic hitting the ASA. Now I don't see anything hitting the device. I am attaching the current configuration of the ASA. The VPN client on my laptop is configured properly. Thank you in advance!

rvr

ajagadee · ‎10-29-2008

Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*

View solution in original post

ajagadee · ‎10-27-2008

Hi,

In your configuration, you have the below command, which will disable IKE and ESP.

no sysopt connection permit-vpn.

Can you enable this command and run the testing again.

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s8_72.html#wp1198155

If you really want to disable this option, then you need to explicitly configure Access-list applied inbound to permit all ISAKMP and IPSEC ports and also the user traffic.

Regards,

Arul

*Pls rate if it helps*

rvr_76bg · ‎10-29-2008

I had the command in the configuration before and didn't work. Now I inserted it onace again(according to your suggestion) and it worked, this is strange.

Is this command mandatory for ASA remote access server?

rvr

ajagadee · ‎10-29-2008

Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*