ASDM access impossible - EZVPN

Unanswered Question
Apr 8th, 2010

Hi,

Why does my ASDM access get cut off when i turn on EasyVPN in client mode on the ASA 5505?

I can access with console, but no longer with ASDM.

Have not tested SSH/Telnet, although im guessing that wont work either.

Why does it get cut off and what can i do to get around this?

TIA,

Stan

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
StanDamen Thu, 04/08/2010 - 03:46

The inside interface. Only inside and outside interface are configured.

I used ASDM from a computer in the network connected to the inside interface.

This is also the network shared by NEM/EZVPN....im guessing that could be the problem?

If i use a separate interface for management it should work?

Thanks for the help,

Stan

Jennifer Halim Thu, 04/08/2010 - 04:01

Shouldn't be a problem if you are connecting from the inside, especially if you are running ezvpn in NEM mode.

What version is the ASA 5505?

StanDamen Thu, 04/08/2010 - 04:05

Its version 8.2., the latest I think.

So just to clarify, inside interface is IP 172.17.0.1 with DHCP pool 172.17.0.0/24

ASDM is from PC with IP in the DHCP pool

Thanks!

Stan

Jennifer Halim Thu, 04/08/2010 - 04:23

Sorry, can you please clarify again whether it is client mode or network extension mode?

StanDamen Thu, 04/08/2010 - 04:49

Its network-extension-mode.

Maybe this picture will clear things up again.

The PC using ASDM is in one of the customer LANs. It is connected to the ASA that acts as EasyVPN client with ASDM.

When i enable easyvpn with " vpnclient enable"  on the ASA, the ASDM connection no longer functions.

Attachment: 
StanDamen Fri, 04/09/2010 - 04:01

Anyone got any idea?

In the ASDM logging (Through CLI since that keeps working) it says:

ASA-6-106015: Deny TCP (no connection) from 172.17.0.5/4871 to 172.17.0.1/443 flags FIN ACK  on interface inside

172.17.0.5 is client, 172.17.0.1 is ASA.

Jennifer Halim Fri, 04/09/2010 - 04:57

Did you try to log out of ASDM and log back in?

From the error log, it seems to be denying on FIN-ACK packet.

StanDamen Fri, 04/09/2010 - 05:08

Yup tried that, didnt work unfortanetly

What does it mean what it denies the FIN ACK packet?

Thanks for thinking with me though

Jennifer Halim Fri, 04/09/2010 - 04:42

With NEM, you can't have the 2 remote LANs in the same subnet (172.16.0.0/24). HQ will not be able to know where to route the packet destined for 172.16.0.0/24.

StanDamen Fri, 04/09/2010 - 04:46

Yes it is possible by using ACL's linked to the connection profiles.

Also the network at the HQ side are VM's that get there address from a local address pool on the HQ ASA.

Every ACL (and thus every customer) has its own address pool.

I have that all working.

None of this has anything to do with ASDM though, as the ASDM connection shouldn't even pass through the ASA.

Actions

This Discussion

Related Content