Solved: ASA 5505 IPSec client-to-site no LAN access?

3moloz123 · ‎09-04-2010

Hi,

Like many others, I have problems getting the ipsec vpn clients to communicate with my LAN.

I setup the ipsec with the wizard, I did also add an ACL to let vpn client pool network communicate to LAN, but with little success.

Many of the answers I have seen includes changes in the NAT table, I have tried many of them but also with no success.

It has to be something really simple, it's so frustrating because I guess it's supposed to be a relatively simple thing to get running.

VPN client (Linux, no iptables rules) get 10.80.80.100 address, but cant connect to a TCP service on a LAN machine (no firewall on the LAN machine), and cannot ping LAN.

VPN client's routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
85.24.249.35    212.112.31.254 255.255.255.255 UGH   0      0        0 eth0
10.80.80.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
212.112.31.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 tun0

: Saved
:
ASA Version 7.2(4) 
!
hostname ciscoasa
domain-name default.domain.invalid
enable password xxx encrypted
passwd xxx encrypted
names
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute 
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
same-security-traffic permit inter-interface
access-list tictac_splitTunnelAcl remark allow vpn tunnel users to LAN
access-list tictac_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip any 10.80.80.0 255.255.255.0 
access-list inside_access_in extended permit ip any any log disable 
access-list outside_access_out extended permit ip any any 
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool vpnpool 10.80.80.100-10.80.80.120 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_out out interface outside
access-group inside_access_in in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.0.2-192.168.0.33 inside
dhcpd dns 8.8.8.8 4.2.2.2 interface inside
dhcpd enable inside
!

group-policy tictac internal
group-policy tictac attributes
 dns-server value 8.8.8.8 4.2.2.2
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list none
username mattiasb password SVCZv/HMkykG.ikA encrypted privilege 0
username mattiasb attributes
 vpn-group-policy tictac
tunnel-group tictac type ipsec-ra
tunnel-group tictac general-attributes
 address-pool vpnpool
 default-group-policy tictac
tunnel-group tictac ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:6e456ab21d08182ca41ed0f1be031797
: end
asdm image disk0:/asdm-524.bin
no asdm history enable

Jennifer Halim · ‎09-04-2010

The split tunnel network list has been set to "none" in your configuration:

group-policy tictac attributes
 dns-server value 8.8.8.8 4.2.2.2
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list none

Please configure the tunnel list to reference the split tunnel ACL as follows:

group-policy tictac attributes
   split-tunnel-network-list value tictac_splitTunnelAcl

Hope that helps.

View solution in original post

Jennifer Halim · ‎09-04-2010

The split tunnel network list has been set to "none" in your configuration:

group-policy tictac attributes
 dns-server value 8.8.8.8 4.2.2.2
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list none

Please configure the tunnel list to reference the split tunnel ACL as follows:

group-policy tictac attributes
   split-tunnel-network-list value tictac_splitTunnelAcl

Hope that helps.

3moloz123 · ‎09-04-2010

Hi,

Thanks for the quick response. I changed it accordingly, still no traffic between inside LAN and VPN though.

The client now got the route to the lan network:
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0

Tried icmp and nmapping known open-ports on both sides. The VPN client also can't reach internet. Could it be something like a missing or incorrect NAT rule?

See attached updated config

Jennifer Halim · ‎09-04-2010

What are you trying to ping? You can try enabling the following:

management-access inside

policy-map global_policy

class inspection_default

inspect icmp

Disconnect from your existing VPN session, and reconnect, then try to ping the ASA inside interface: 192.168.0.1.

With split tunnel configured, the VPN Client should be able to access the internet. Is DNS resolution working? Can you ping the internet (ping 4.2.2.2 for example).

3moloz123 · ‎09-05-2010

Hi,

I still didnt get it to work. I used the built in macos x client and the vpnc client for linux, so I asked a friend to test using the official Cisco client and it works as expected. Many thanks!

I have one little question more, I would like all the clients traffic to go via the ASA. But if I understand the configuration correctly the split tunneling ACL/ACE allows the vpn clients to communicate with LAN, so if I remove it will they a) have all traffic tunneled through the ASA and b) will they be able to communicate with the LAN?

Thanks in advance

Jennifer Halim · ‎09-06-2010

Split tunnel basically means to send traffic from VPN Client towards the LAN specific in the split tunnel ACL towards the ASA, and all other internet traffic to go out directly via the VPN Client host internet connection, ie: not being routed towards the ASA.

To tunnel all traffic (inc. the internet traffic) from the VPN Client, you would need to change the split tunnel policy from "tunnelspecific" to "tunnelall". And all traffic ie: LAN and Internet will be routed towards the ASA.

3moloz123 · ‎09-06-2010

Makes sense.

I added an ACL/ACE to permit any. I also changed so that all networks are tunneled, and I made sure that the new ACL is choosen.

For all interfaces, both incomming and outgoing have permit any any ip.

The vpn clients can't reach anything on the internet though, this is what I see in the logs:

6|Sep 06 2010|08:03:37|302014|10.80.80.100|212.112.31.10|Teardown TCP connection 125784 for outside:10.80.80.100/1379 to outside:200.112.31.10/22 duration 0:00:00 bytes 0 Flow is a loopback (mattiasb)
6|Sep 06 2010|08:03:31|302014|10.80.80.100|212.112.31.10|Teardown TCP connection 125783 for outside:10.80.80.100/1379 to outside:200.112.31.10/22 duration 0:00:00 bytes 0 Flow is a loopback (mattiasb)
6|Sep 06 2010|08:03:28|302014|10.80.80.100|212.112.31.10|Teardown TCP connection 125782 for outside:10.80.80.100/1379 to outside:200.112.31.10/22 duration 0:00:00 bytes 0 Flow is a loopback (mattiasb)
6|Sep 06 2010|08:03:28|302016|10.80.80.100|4.2.2.2|Teardown UDP connection 125781 for outside:10.80.80.100/54663 to outside:4.2.2.2/53 duration 0:00:00 bytes 0 (mattiasb)
6|Sep 06 2010|08:03:28|302016|10.80.80.100|8.8.8.8|Teardown UDP connection 125780 for outside:10.80.80.100/54663 to outside:8.8.8.8/53 duration 0:00:00 bytes 0 (mattiasb)

Jennifer Halim · ‎09-06-2010

Yes, to access the internet from the vpn client with tunnelAll, the vpn pool subnet also needs to be NATed to public ip address, otherwise, it can't route on the Internet.

You would need to add the following on the ASA:

nat (outside) 1 10.80.80.0 255.255.255.0

same-security-traffic permit intra-interface

3moloz123 · ‎09-06-2010

Thanks, everything works. You're help is much appreciated. I hope this might help others too.

I tested with the iphone's built in ipsec client too, with same result as vpnc in linux and the mac os x built in - no connection to LAN. I figure this is not the right forum for this.