Paul Carco Fri, 04/30/2010 - 11:46
User Badges:

your 'ssh x.x.x.0 Outside'   doesnt match your ip local pool vpnpool mask and since you are vpn'd in you must be getting an IP from that pool ?

laurabolda Fri, 04/30/2010 - 13:32
User Badges:

Thanks both of you.  I added "ssh Inside".  I was able to SSH to the inside interface when I login to VPN client.

May I ask you another question?   Since I allow the VPN pool to SSH to the ASA, it means all VPN users can SSH to the ASA.   Will it create a security issue to the ASA?  Would you setup this way?  I want to be able to do administration when I login to VPN client.  Thanks.

Paul Carco Fri, 04/30/2010 - 16:10
User Badges:

Yes, you are correct this could be considered insecure.

Since you are defining the users locally why not assign your username a static IP ( from the IP Pool  and be sure to edit the pool to end at .249

use the 'vpn-framed-ip-address' command

"   Enter the IP address and the net mask to be assigned to the client"

CiscoASA#1(config-username)# vpn-framed-ip-address ?

username mode commands/options:
  A.B.C.D  The IP address to be assigned to the client

After taking care of that change your ssh/http(ASDM)  permissions to only allow the single host.instead of the range.

Good luck.


This Discussion