Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5520 - VPN users have no internet.

Hello,

We just migrated from a Pix 515 and VPN Concentrator to an ASA 5520.  The firewall portion is working well but we are having some issue with our remote VPN.

Everything on the inside network is accessible when using remote VPN however there is no access to our DMZ or internet.  I'm sure there is something simple needed that I'm missing, and hoping someone might be able to shed some light on what is needed to allow the VPN tunnel to go back outside and into our DMZ.

The ASA is running 8.2(2)9 and ASDM 6.2(1).

Cheers,

Rob

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions

Re: ASA 5520 - VPN users have no internet.

From the 172.16.68.0/24 you can PING 10.10.10.1 correct?

From the 10.10.10.0/24 you can PING 172.16.68.1 correct?

I am having a hard time now figuring out how this tunnel is up since you have PFS
enabled on the ASA but not on the PIX.

Federico.

51 REPLIES

Re: ASA 5520 - VPN users have no internet.

Hi,

Most likey the nat0 statements to bypass NAT for the DMZ interface, or DMZ not included in the interesting traffic.

For the internet part of the remote VPN clients, are you using Split tunneling, or should the ASA provide the Internet?

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

Hi,

I'd prefer not to use split-tunneling, so I'd like the ASA to provide outside access.  I should mention also that we have a site-to-site connection that cannot access any dmz servers either.  It may be related.   Since they're using internal DNS we've had to add a hosts file for that remote sites clients to get to our main webpage with the public IP as a workaround.

Thanks,

Rob

Re: ASA 5520 - VPN users have no internet.

The ASA can provide the Internet access for the remote clients with the same security permit intra-interface command as well as enabling NAT

for the VPN traffic when going to the Internet.

To be able to access the DMZ, you should have an ACL bypassing NAT for the DMZ interface and the DMZ network included in the interesting traffic (for the site-to-site).

If you can post your configuration, perhaps we can help you with the commands.

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

I'd read about that command but not too sure how to configure it.  Here is my config, edited a bit but let me know if I've pulled too much out.

Thanks,

Rob

Re: ASA 5520 - VPN users have no internet.

nat (dmz) 0 access-list inside_nat0_outbound
To bypass NAT for traffic between DMZ and remote VPN clients.

The ACL outside_1_cryptomap that is applied to the Site-to-Site VPN, should include
the traffic from the DMZ network to the other's side network.

same security permit intra-interface
nat (outside) 1 10.44.99.0 255.255.255.0 outside

The above commands to NAT the outside traffic from the clients to the Internet and allow
the traffic.


I believe that when doing nat (outside) you should specify all other traffic as well to match.

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

Here is what I added:

nat (dmz) 0 access-list inside_nat0_outbound
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 172.16.68.0 255.255.252.0
same-security-traffic permit intra-interface
nat (outside) 1 10.44.99.0 255.255.255.0 outside

Remote VPN can now access the DMZ but still no internet.

The remote site still cannot access the dmz.

Progress at least!

Thanks,

Rob

Re: ASA 5520 - VPN users have no internet.

Ok,

Please check this link for providing Internet access to the remote clients on the ASA:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Federico.

Cisco Employee

Re: ASA 5520 - VPN users have no internet.

Change this line: nat (outside) 1 10.44.99.0 255.255.255.0 outside

To: nat (outside) 1 10.44.99.0 255.255.255.0

That should allow internet access.

New Member

Re: ASA 5520 - VPN users have no internet.

I changed that line as suggested - users still have no Internet.

Re: ASA 5520 - VPN users have no internet.

Can you please post the current output from the following commands:

sh run same-security-traffic

sh run nat

sh run global

sh route

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.


FrecASA# sh run same-security-traffic
same-security-traffic permit intra-interface

FrecASA# sh run nat
nat (outside) 1 10.44.99.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz) 0 access-list inside_nat0_outbound


FrecASA# sh run global
global (outside) 1 199.216.81.20


FrecASA# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 199.216.81.1 to network 0.0.0.0

S    172.16.255.80 255.255.255.240 [1/0] via 192.168.0.1, inside
S    172.16.164.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.160.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.132.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.128.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.56.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.52.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.48.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.44.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.40.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.32.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.252.240 255.255.255.240 [1/0] via 192.168.0.1, inside
S    172.16.254.240 255.255.255.240 [1/0] via 192.168.0.1, inside
S    172.16.8.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.4.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.112.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.108.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.255.144 255.255.255.240 [1/0] via 192.168.0.1, inside
S    172.16.104.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.100.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.96.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.255.176 255.255.255.240 [1/0] via 192.168.0.1, inside
S    172.16.72.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    172.16.64.0 255.255.252.0 [1/0] via 192.168.0.1, inside
C    10.10.10.0 255.255.255.0 is directly connected, dmz
S    10.3.16.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.3.32.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.48.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.16.52.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.16.40.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.16.44.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.48.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.32.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.64.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.72.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.80.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.64.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.96.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.112.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.16.104.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.16.108.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.112.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.96.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.16.100.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.128.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.3.144.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.16.128.0 255.255.252.0 [1/0] via 192.168.0.1, inside
S    10.3.160.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.3.176.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.3.192.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.3.208.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.4.208.0 255.255.240.0 [1/0] via 192.168.0.1, inside
S    10.3.224.0 255.255.240.0 [1/0] via 192.168.0.1, inside
C    192.168.0.0 255.255.255.0 is directly connected, inside
C    199.216.81.0 255.255.255.0 is directly connected, outside
S*   0.0.0.0 0.0.0.0 [1/0] via 199.216.81.1, outside

FrecASA#

Re: ASA 5520 - VPN users have no internet.

Ok, configuration seems fine.

The VPN client when it connects it will receive an IP from 10.44.99.0/24

So, do the following:

When a VPN client is connected, make sure that on the client, on statistics, on route details, it says 0.0.0.0 (meaning its sending all traffic through the tunnel).

You should have under the group-policy for the tunnel-group defined split-tunneling tunnel all (as explained in the link I sent you).

Then, let's say the VPN client got its IP 10.44.99.x

On the ASA, look at ''sh xlate local 10.44.99.x'' to make sure if there's a translation to the outside IP of the ASA when trying to reach Internet.

Federico.

Silver

Re: ASA 5520 - VPN users have no internet.

As Frederico indicated, along with the other changes you need this statement which seems to be missing from the configuration under your tunnel policy.

split-tunnel-policy tunnelall

New Member

Re: ASA 5520 - VPN users have no internet.

Confirmed, the vpn client received the IP 10.4.99.1.

On statistics, route details - secured routes shows 0.0.0.0.

Group policy on the ASA has "Tunnel all networks".

Sh xlate local 10.4.99.1 returns: 1643 in use, 4162 most used.

Re: ASA 5520 - VPN users have no internet.

Seems there's no XLATE created for the VPN client.

Are you trying to open a browser to get out to the Internet from the client?

What's the client DNS server?

Can you also PING 4.2.2.2 from the client to see if its succesful? (To discard a DNS problem).

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

Clients are using internal DNS, nslookup works but pings do not:

nslookup 4.2.2.2 - vnsc-bak.sys.gtei.net

ping 4.2.2.2

Request timed out.

Request timed out.

Request timed out.

Request timed out.

New Member

Re: ASA 5520 - VPN users have no internet.

Alright, I'm embarrassed now.

I fat-fingered the nat entry: nat (outside) 1 10.44.99.0 255.255.255.0

It should have been 10.4 not 10.44

Added:

no nat (outside) 1 10.44.99.0 255.255.255.0
nat (outside) 1 10.4.99.0 255.255.255.0

And it works.

Lots of points all around and thanks for all the help, and patience.

Now all that remains is my site-to-site connection that cannot access the DMZ.  Any thoughts there?

Re: ASA 5520 - VPN users have no internet.

199.216.81.1

The above IP is the default gateway for the ASA.

Can the VPN clients PING that IP?

This will let us know if the VPN clients terminate the tunnel on the ASA, their traffic is decrypted and then sent back out the outside interface to the next-hop.

Is this gateway under your control?

Does it has a route back to the ASA pointing to the pool of VPN addresses?

Federico.

Re: ASA 5520 - VPN users have no internet.

Do the following:

access-list dmz_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 172.16.68.0 255.255.252.0

nat (dmz) 0 access-list dmz_nat0_outbound

access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 172.16.68.0 255.255.252.0

Assuming 172.16.68.0/22 is the remote's Site-to-Site LAN.

If you have already a nat (dmz) 0 access-list statement, just adjust it to include the above line.

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

I already have:

nat (dmz) 0 access-list inside_nat0_outbound

access-list inside_nat0_outbound extended permit ip 172.16.128.0 255.255.252.0 172.16.68.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip any 10.4.99.0 255.255.255.0

access-list outside_1_cryptomap extended permit ip 172.16.128.0 255.255.252.0 172.16.68.0 255.255.252.0
access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 172.16.68.0 255.255.252.0

I added:

access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 172.16.68.0 255.255.252.0

The remote site cannot browse or ping the dmz server (10.10.10.11).

Re: ASA 5520 - VPN users have no internet.

My questions will be...

The dmz network 10.10.10.0/24 has its default gateway as the ASA?

If not, there should be a route to 172.16.128.0/22 pointing to the ASA.

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

Yes, the dmz network uses the dmz interface of the ASA (10.10.10.1) as the default gateway.

Re: ASA 5520 - VPN users have no internet.

Enter the command:

management  access-dmz

See, if you can PING from the ASA to the other side.

ping dmz x.x.x.x

x.x.x.x --> should be an live IP from the other side of the tunnel.

Also, the other side has a route to 10.10.10.0/24 to send it through the tunnel?  As they have it for your INSIDE LAN?

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

Here are the results:


FrecASA(config)# management-access dmz

FrecASA(config)# ping dmz 172.16.69.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.69.1, timeout is 2 seconds:
?!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 20/20/20 ms


I've also attached the config for the remote site PIX relevant to the VPN connection.

Re: ASA 5520 - VPN users have no internet.

It worked.

The only thing missing to make this working is to allow the traffic to the remote site in the ACL applied to the DMZ.

access-list dmz_acl

Try it and it should work fine.

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

I tried opening up the dmz_acl to try that but it doesn't appear to work.  Here is the config:

access-list dmz_acl extended permit icmp 10.10.10.0 255.255.255.0 172.16.0.0 255.255.0.0
access-list dmz_acl extended permit icmp 10.10.10.0 255.255.255.0 10.3.0.0 255.255.0.0
access-list dmz_acl extended permit tcp 10.10.10.0 255.255.255.0 172.16.0.0 255.255.0.0 eq www
access-list dmz_acl extended permit tcp 10.10.10.0 255.255.255.0 10.3.0.0 255.255.0.0 eq www
access-list dmz_acl extended permit ip any any


access-group dmz_acl in interface dmz

Re: ASA 5520 - VPN users have no internet.

Ok,

We are trying to accomplish the VPN connection between the DMZ 10.10.10.x and the remote network 172.16.69.x

We know that we can PING 172.16.69.x from the ASA's DMZ IP.

The ACL on the DMZ is now permitting the traffic.

Try sending traffic again and check the following command on the ASA:

sh cry ips sa

You should see two IPsec security associations created for the traffic flowing between those networks (one outgoing and one incoming).

Check also the packets encapsulated/decapsulated so that you can see for example that you're sending traffic but not receiving anything back.

Let me know.

Federico.

New Member

Re: ASA 5520 - VPN users have no internet.

We can ping only when setting management-access to the dmz interface.  Without it, the pings fail.

I posted the results of the two pings (with and without management-access) and the sh cry ips sa.

Rob

Re: ASA 5520 - VPN users have no internet.

From the file that you attached, I see the security association created between 10.10.10.0/24 and 172.16.68.0/24

and the packets are being sent and received fine.

The fact that you can PING from the ASA's DMZ IP (when having the management access-dmz command), means there's communication between both networks correctly.

Let's do a test between two hosts (10.10.10.x and 172.16.68.x)

Try to PING and let me know the default gateway for both (and check on the sh cry ip sa) if you see the packets encrypted/decrypted incrementing everytime).

Federico.

2532
Views
75
Helpful
51
Replies
CreatePlease login to create content