Solved: Cisco ASA 5505 remote VPN access to local network

ciunetworks · ‎09-12-2010

I have Two ASA 5505's setup in a site to site VPN which works perfectly. Now I also need to have remote client VPN access with the Cisco VPN dialer to the 1st site. I can get the VPN dialer to connect the the VPN and get a VPN IP address, but I have no access to the remote network. can someone take a look and see what I am missing? I have attached the ASA running config.

Jennifer Halim · ‎09-13-2010

Apologize for the misunderstanding.

To access the 10.10.100.x subnet from remote vpn client, the vpn-filter ACL is the other way round.

Please kindly swap the following ACL:

FROM:

access-list outside_cryptomapVPN extended permit ip any 10.10.20.0 255.255.255.224

TO:

access-list outside_cryptomapVPN extended permit ip 10.10.20.0 255.255.255.224 any

Hope that helps.

View solution in original post

Jennifer Halim · ‎09-12-2010

The configuration hasn't included VPN access from remote VPN client towards the remote network via the site-to-site VPN.

There are a few things that need to be added/modified to this ASA as follows:

Add the following:

access-list outside_20_cryptomap extended permit ip 10.10.20.0 255.255.255.0 192.168.100.0 255.255.255.0

same-security-traffic permit intra-interface

access-list DSILREMOTE_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0

Modify the following:

no crypto map outside_map 10 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map 1000 ipsec-isakmp dynamic outside_dyn_map

VPN Client dynamic crypto map can't be on the lowest sequence number hence updating it from seq# of 10 to 1000.

On the remote ASA, you would need to also add the following:

1) Mirror image crypto ACL on the site-to-site VPN to include the above:

permit ip 192.168.100.0 255.255.255.0 10.10.20.0 255.255.255.0

2) NAT exemption ACL to include the following:

permit ip 192.168.100.0 255.255.255.0 10.10.20.0 255.255.255.0

Hope that helps.

ciunetworks · ‎09-12-2010

Thanks for the reply.

I changed the Seq # on the dynamic map to 1000 and that has not seemed to do anything for me.

As for the 192.168.100.0 network, I do not need the remote VPN dialer users to get to that Network.

I have two sites:

Site 1 : 10.10.100.x

Site 2: 192.168.100. x

remote VPN users using the VPN Dialer need access to Site 1.

Right now, the Site to Site VPN between Site 1 and Site 2 works perfectly, the VPN Client will connect, but I cannot see Site 1 LAN devices, such as the server which is 10.10.100.25.

Any other suggestions?

Jennifer Halim · ‎09-13-2010

Apologize for the misunderstanding.

To access the 10.10.100.x subnet from remote vpn client, the vpn-filter ACL is the other way round.

Please kindly swap the following ACL:

FROM:

access-list outside_cryptomapVPN extended permit ip any 10.10.20.0 255.255.255.224

TO:

access-list outside_cryptomapVPN extended permit ip 10.10.20.0 255.255.255.224 any

Hope that helps.

ciunetworks · ‎09-13-2010

Perfect.... Thanks so much!