ASA 5505 IPSEC VPN Client problem from some remote sites - bizarre

[erol.asim]

Having a bizarre issue that's beyond my knowledge. I configured the ASA 5505 for an IPSEC tunnel. Regardless of what remote site a user tunnels from, the tunnel comes up, both PHASE 1 and PHASE 2. From some sites, the user can successfully ping the office network resources behind the ASA, but for others, from troubleshooting, it seems traffic from the remote end can reach the office network resources, but the the office network resources cannot get past the ASA and not reach the remote end. Logging is no help as I cannot see any traffic dropped by the firewall. It's bizarre as some sites work - where traffic is bi-drectional over the tunnel, and others do not, but for those remote sites where it doesn't work, the problem looks like behind the ASA - where traffic is one-way over the tunnel.

Has anyone seen this before? And advise a corrective action?

[ajay chauhan]

Should be something to do with configuration .

Please post both end configuration so that someone can take a look.

Also mention which site is able to communicate .

Thanks

Ajay

[erol.asim]

Many thanks for the reply. I've pasted the config below. However, it's difficult to provide information from the remote sites as they have differing external IP's.

: Saved

:

ASA Version 8.0(2)

!

hostname ASA-Avaya

domain-name *********.***

enable password ************* encrypted

names

!

interface Vlan1

no nameif

no security-level

no ip address

!

interface Vlan10

nameif inside

security-level 100

ip address 192.168.101.115 255.255.0.0

!

interface Vlan20

nameif outside

security-level 50

ip address ************* 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 20

!

interface Ethernet0/1

switchport access vlan 10

!

interface Ethernet0/2

shutdown

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

passwd ************* encrypted

boot system disk0:/\asa802-k8.bin

boot system disk0:/asa802-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name *************.***

access-list inside_nat0_outbound extended permit icmp any any

access-list inside_nat0_outbound extended permit ip any any

access-list inside_nat0_outbound extended permit ip any 192.168.106.0 255.255.255.0

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit icmp any any

access-list outside_access_in extended permit ip any any

access-list avaya_splitTunnelAcl standard permit any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool avaya-pool 192.168.106.1-192.168.106.254 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

asdm image disk0:/asdm-602.bin

no asdm history enable

arp timeout 14400

nat (inside) 0 access-list inside_nat0_outbound

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 ************* 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

aaa authentication enable console LOCAL

aaa authentication http console LOCAL

aaa authentication ssh console LOCAL

aaa authentication telnet console LOCAL

http server enable

http ************* 255.255.255.255 outside

http 192.168.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-MD5

crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

no crypto isakmp nat-traversal

ssh scopy enable

ssh 0.0.0.0 0.0.0.0 inside

ssh timeout 5

ssh version 2

console timeout 0

management-access inside

threat-detection basic-threat

threat-detection statistics access-list

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

!

service-policy global_policy global

group-policy avaya internal

group-policy avaya attributes

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value avaya_splitTunnelAcl

username admin password ************* encrypted privilege 15

username avaya password ************* encrypted privilege 0

username avaya attributes

vpn-group-policy avaya

tunnel-group avaya type remote-access

tunnel-group avaya general-attributes

address-pool avaya-pool

default-group-policy avaya

tunnel-group avaya ipsec-attributes

pre-shared-key *

prompt hostname context

Cryptochecksum:*************

: end

[Julio Carvajal]

Hello,

I would disable the split tunel from the policy just to clean the config as it is not need it.

Now the configuration looks fine, I would say it something besides the ASA but for that we got to be completely sure about it.

I would like you to run captures while you attempt to connect on the other site...

access-list  capin permit ip host x.x.x.x (local pool IP) y.y.y.y(internal host IP)

access-list capin permit ip host y.y.y.y host x.x.x.x

capture capin access-list capin interface inside

capture asp type asp-drop all

Then try to connect to an internal host...

Afterwards do a sh cap capin

and a Show cap asp

Please send us the information.

Regards,

Do rate the helpful posts

Julio

[Jeff Van Houten · Accepted solution]

Try getting rid of this command

no crypto isakmp nat-traversal

Sent from Cisco Technical Support iPad App