VPN ping application issue

Answered Question
Sep 16th, 2009
User Badges:

I have setup a vpn for vendor access to hvac equipment.


The profile is RCPS_Vendor

DHCP pool is RCPS_Vendor

Terminated to Outside int


These are the steps I took:

remote access, outside->psk(password), name RCPS_Vendors->local authen->Hoff_Vendor(password)->RCPS_Vendors 192.168.10.2-192.168.10.128->10.1.252.101/103->3DES SHA 2->3DES SHA->10.0.0.0/8 en split tunnel

from: http://www.cisco.com/en/US/docs/security/asa/asa71/getting_started/asa5500/quick/guide/rem_acc.html


The issue is the vendor needs ping to internal units, and his program will not connect to the units.


Modified config attached.


Thanks in advance.





Correct Answer by slmansfield about 7 years 10 months ago

If all of the internal units are one hop away from the ASA, then you could put that static route on each of those units. That would point them to the inside interface on the ASA. The ASA would use its default route to send traffic back to the VPN clients.


If the internal units are further inside your network and you are using a dynamic routing protocol, you can redistribute the static route to 192.168.10.0/24 on the next hop router (from the ASA) inside your network so that the default gateways of the internal units know where to send traffic destined for 192.168.10.0/24.


Since your remote clients are sending traffic through VPN tunnels I don't believe you need to add an ACL on the ASA to allow specific traffic from the VPN clients to the internal units.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
slmansfield Wed, 09/16/2009 - 12:33
User Badges:
  • Silver, 250 points or more

Just wondering if you verified that you have network reachability between your internal hosts and the ranges of address pools assigned to your VPN clients.


The address pool for RCPS_Vendors is in the 192.168.10.x range, which does not have a specific static route on the ASA so it is using your default route, which points outside to 192.175.57.1.


rhopkins_rcps Wed, 09/16/2009 - 14:55
User Badges:

You wondered right, just tested and I cant access anything inside.


Ok, so to get RCPS_Vendors, going would I put a route inside 192.168.10.0 0.0.0.255 10.200.1.3 ? Do I need to create and acl for ping traffic?


Thanks for the quick response.

Correct Answer
slmansfield Wed, 09/16/2009 - 18:10
User Badges:
  • Silver, 250 points or more

If all of the internal units are one hop away from the ASA, then you could put that static route on each of those units. That would point them to the inside interface on the ASA. The ASA would use its default route to send traffic back to the VPN clients.


If the internal units are further inside your network and you are using a dynamic routing protocol, you can redistribute the static route to 192.168.10.0/24 on the next hop router (from the ASA) inside your network so that the default gateways of the internal units know where to send traffic destined for 192.168.10.0/24.


Since your remote clients are sending traffic through VPN tunnels I don't believe you need to add an ACL on the ASA to allow specific traffic from the VPN clients to the internal units.

rhopkins_rcps Tue, 09/22/2009 - 14:13
User Badges:

Well I did a little work around and kept the vpn pool in the 10.0.0.0 subnet, works fine. Thanks for your advice

Actions

This Discussion