Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

ASA 5505 IPSec client-to-site no LAN access?

Hi,

Like many others, I have problems getting the ipsec vpn clients to communicate with my LAN.

I setup the ipsec with the wizard, I did also add an ACL to let vpn client pool network communicate to LAN, but with little success.

Many of the answers I have seen includes changes in the NAT table, I have tried many of them but also with no success.

It has to be something really simple, it's so frustrating because I guess it's supposed to be a relatively simple thing to get running.

VPN client (Linux, no iptables rules) get 10.80.80.100 address, but cant connect to a TCP service on a LAN machine (no firewall on the LAN machine), and cannot ping LAN.

VPN client's routing table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
85.24.249.35    212.112.31.254  255.255.255.255 UGH   0      0        0 eth0
10.80.80.0      0.0.0.0         255.255.255.0   U     0      0        0 tun0
212.112.31.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 tun0

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password xxx encrypted
passwd xxx encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
access-list tictac_splitTunnelAcl remark allow vpn tunnel users to LAN
access-list tictac_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 10.80.80.0 255.255.255.0
access-list inside_access_in extended permit ip any any log disable
access-list outside_access_out extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
ip local pool vpnpool 10.80.80.100-10.80.80.120 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_out out interface outside
access-group inside_access_in in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.0.2-192.168.0.33 inside
dhcpd dns 8.8.8.8 4.2.2.2 interface inside
dhcpd enable inside
!

group-policy tictac internal
group-policy tictac attributes
dns-server value 8.8.8.8 4.2.2.2
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list none
username mattiasb password SVCZv/HMkykG.ikA encrypted privilege 0
username mattiasb attributes
vpn-group-policy tictac
tunnel-group tictac type ipsec-ra
tunnel-group tictac general-attributes
address-pool vpnpool
default-group-policy tictac
tunnel-group tictac ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:6e456ab21d08182ca41ed0f1be031797
: end
asdm image disk0:/asdm-524.bin
no asdm history enable
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: ASA 5505 IPSec client-to-site no LAN access?

The split tunnel network list has been set to "none" in your configuration:

group-policy tictac attributes
dns-server value 8.8.8.8 4.2.2.2
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list none

Please configure the tunnel list to reference the split tunnel ACL as follows:

group-policy tictac attributes
   split-tunnel-network-list value tictac_splitTunnelAcl

Hope that helps.

8 REPLIES
Cisco Employee

Re: ASA 5505 IPSec client-to-site no LAN access?

The split tunnel network list has been set to "none" in your configuration:

group-policy tictac attributes
dns-server value 8.8.8.8 4.2.2.2
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list none

Please configure the tunnel list to reference the split tunnel ACL as follows:

group-policy tictac attributes
   split-tunnel-network-list value tictac_splitTunnelAcl

Hope that helps.

Community Member

Re: ASA 5505 IPSec client-to-site no LAN access?

Hi,

Thanks for the quick response. I changed it accordingly,  still no traffic between inside LAN and VPN though.

The client now got the route to the lan network:
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 tun0

Tried icmp and nmapping known open-ports on both sides. The VPN client also can't reach internet. Could it be something like a missing or incorrect NAT rule?

See attached updated config

Cisco Employee

Re: ASA 5505 IPSec client-to-site no LAN access?

What are you trying to ping? You can try enabling the following:

management-access inside

policy-map global_policy

class inspection_default

     inspect icmp

Disconnect from your existing VPN session, and reconnect, then try to ping the ASA inside interface: 192.168.0.1.

With split tunnel configured, the VPN Client should be able to access the internet. Is DNS resolution working? Can you ping the internet (ping 4.2.2.2 for example).

Community Member

Re: ASA 5505 IPSec client-to-site no LAN access?

Hi,

I still didnt get it to work. I used the built in macos x client and the vpnc client for linux, so I asked a friend to test using the official Cisco client and it works as expected. Many thanks!

I have one little question more, I would like all the clients traffic to go via the ASA. But if I understand the configuration correctly the split tunneling ACL/ACE allows the vpn clients to communicate with LAN, so if I remove it will they a) have all traffic tunneled through the ASA and b) will they be able to communicate with the LAN?

Thanks in advance

Cisco Employee

Re: ASA 5505 IPSec client-to-site no LAN access?

Split tunnel basically means to send traffic from VPN Client towards the LAN specific in the split tunnel ACL towards the ASA, and all other internet traffic to go out directly via the VPN Client host internet connection, ie: not being routed towards the ASA.

To tunnel all traffic (inc. the internet traffic) from the VPN Client, you would need to change the split tunnel policy from "tunnelspecific" to "tunnelall". And all traffic ie: LAN and Internet will be routed towards the ASA.

Community Member

Re: ASA 5505 IPSec client-to-site no LAN access?

Makes sense.

I added an ACL/ACE to permit any. I also changed so that all networks are tunneled, and I made sure that the new ACL is choosen.

For all interfaces, both incomming and outgoing have permit any any ip.

The vpn clients can't reach anything on the internet though, this is what I see in the logs:

6|Sep 06 2010|08:03:37|302014|10.80.80.100|212.112.31.10|Teardown TCP connection 125784 for outside:10.80.80.100/1379 to outside:200.112.31.10/22 duration 0:00:00 bytes 0 Flow is a loopback (mattiasb)
6|Sep 06 2010|08:03:31|302014|10.80.80.100|212.112.31.10|Teardown TCP connection 125783 for outside:10.80.80.100/1379 to outside:200.112.31.10/22 duration 0:00:00 bytes 0 Flow is a loopback (mattiasb)
6|Sep 06 2010|08:03:28|302014|10.80.80.100|212.112.31.10|Teardown TCP connection 125782 for outside:10.80.80.100/1379 to outside:200.112.31.10/22 duration 0:00:00 bytes 0 Flow is a loopback (mattiasb)
6|Sep 06 2010|08:03:28|302016|10.80.80.100|4.2.2.2|Teardown UDP connection 125781 for outside:10.80.80.100/54663 to outside:4.2.2.2/53 duration 0:00:00 bytes 0 (mattiasb)
6|Sep 06 2010|08:03:28|302016|10.80.80.100|8.8.8.8|Teardown UDP connection 125780 for outside:10.80.80.100/54663 to outside:8.8.8.8/53 duration 0:00:00 bytes 0 (mattiasb)

Cisco Employee

Re: ASA 5505 IPSec client-to-site no LAN access?

Yes, to access the internet from the vpn client with tunnelAll, the vpn pool subnet also needs to be NATed to public ip address, otherwise, it can't route on the Internet.

You would need to add the following on the ASA:

nat (outside) 1 10.80.80.0 255.255.255.0

same-security-traffic permit intra-interface

Community Member

Re: ASA 5505 IPSec client-to-site no LAN access?

Thanks, everything works. You're help is much appreciated. I hope this might help others too.

I tested with the iphone's built in ipsec client too, with same result as vpnc in linux and the mac os x built in - no connection to LAN. I figure this is not the right forum for this.

2075
Views
0
Helpful
8
Replies
CreatePlease to create content