Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5500 - Cannot connect to Internal Network via VPN

I am a newbie interested in learning and setting up VPN IPSec with Cisco ASA 5505.  I've managed to successfully setup VPN and
can connect to it from outside and browse securely to the outside/internet via tunnel.  However, once I am connected to VPN,
I cannot access any of my internal hosts/servers via VPN client.  I am wondering it its a missing ACL/NAT.... any
help would be appreciated.

ASA Version 8.2(5) ! hostname ciscoasa enable password xxxxxxxxxxx encrypted passwd xxxxxxxxx encrypted names ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.2 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 pppoe client vpdn group verizonfios ip address pppoe setroute ! ftp mode passive clock timezone CST -6 clock summer-time CDT recurring dns domain-lookup inside dns domain-lookup outside same-security-traffic permit inter-interface same-security-traffic permit intra-interface pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 ip local pool VPNPool 10.10.11.1-10.10.11.254 mask 255.255.255.0 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 192.168.1.0 255.255.255.0 nat (outside) 1 10.10.11.0 255.255.255.0 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL aaa authorization exec LOCAL http server enable http 192.168.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 10 authentication crack encryption aes-256 hash sha group 2 lifetime 86400 crypto isakmp policy 20 authentication rsa-sig encryption aes-256 hash sha group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400 crypto isakmp policy 40 authentication crack encryption aes-192 hash sha group 2 lifetime 86400 crypto isakmp policy 50 authentication rsa-sig encryption aes-192 hash sha group 2 lifetime 86400 crypto isakmp policy 60 authentication pre-share encryption aes-192 hash sha group 2 lifetime 86400 crypto isakmp policy 70 authentication crack encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 80 authentication rsa-sig encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 90 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 100 authentication crack encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 110 authentication rsa-sig encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 120 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 130 authentication crack encryption des hash sha group 2 lifetime 86400 crypto isakmp policy 140 authentication rsa-sig encryption des hash sha group 2 lifetime 86400 crypto isakmp policy 150 authentication pre-share encryption des hash sha group 2 lifetime 86400 crypto isakmp nat-traversal 30 telnet timeout 5 ssh 192.168.1.0 255.255.255.0 inside ssh timeout 60 console timeout 0 management-access inside vpdn group verizonfios request dialout pppoe vpdn group verizonfios localname verizonfios vpdn group verizonfios ppp authentication pap vpdn username verizonfios password ***** dhcpd auto_config outside ! dhcpd address 192.168.1.131-192.168.1.146 inside dhcpd dns 4.2.2.2 8.8.8.8 interface inside dhcpd auto_config outside interface inside dhcpd enable inside ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn group-policy VPNGroupPolicy1 internal group-policy VPNGroupPolicy1 attributes dns-server value 4.2.2.2 8.8.8.8 vpn-tunnel-protocol IPSec l2tp-ipsec address-pools value VPNPool username muser password xxxxxxxx nt-encrypted privilege 15 tunnel-group VPNTunnelGroup1 type remote-access tunnel-group VPNTunnelGroup1 general-attributes default-group-policy VPNGroupPolicy1 tunnel-group VPNTunnelGroup1 ipsec-attributes pre-shared-key ***** ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters   message-length maximum client auto   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns preset_dns_map   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny    inspect sunrpc   inspect xdmcp   inspect sip    inspect netbios   inspect tftp   inspect ip-options ! service-policy global_policy global prompt hostname context no call-home reporting anonymous Cryptochecksum:fe94c61c82f0597b5804fe47388c8f35 : end
2 REPLIES
New Member

ASA 5500 - Cannot connect to Internal Network via VPN

I have found the following entries in the log files:

Dec 31 2011|08:35:19|305013|10.10.11.255|137|||Asymmetric NAT rules matched for forward and reverse flows; Connection for udp src outside:10.10.11.1/137 dst outside:10.10.11.255/137 denied due to NAT reverse path failure

New Member

ASA 5500 - Cannot connect to Internal Network via VPN

I resolved it.  I had a NAT rule backwards.

702
Views
0
Helpful
2
Replies
CreatePlease login to create content