Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

[ASA5505] No traffic in vpn

hello,  

I come to you because I have a problem with my router lab. (I am a student and I work out trying to make small Labs). 
For my Labs, I use a router ASA5505 to set up a Cisco VPN server.  
There is a remote computer with the Cisco VPN client that connects to the router through the Internet. It connects fine but I can't access internal resources on my network.
After days and days of research, I can not find where does the problem. I used Packet Tracer for determining the origin of the problem. This comes NAT rules and Access list.
I tried to put rules on the firewall and NAT rules set but I still can not. 
Could you help me find what's wrong?
I've put below the router configuration. For information, I use ASA with ASDM Version 7.2 Version 5.2 
Thank you, 
Have a nice day, 
Bests regards. 
Yann 

 

--------------------------------

hostname RTR-ASA
domain-name default.domain.invalid
enable password .... encrypted
passwd ..... encrypted
names
name 10.171.80.0 LAN_MERIGNAC description SITE_MERIGNAC
name 10.171.81.0 LAN_NOMADES description VPN_CLIENT
name 10.171.80.10 SRV_TS
name 192.168.80.0 WAN_MERIGNAC description SITE_MERIGNAC
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.171.80.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute 
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name default.domain.invalid
object-group network Terminal_Server
 network-object host SRV_TS
object-group network Obj_Any
 network-object 0.0.0.0 0.0.0.0
object-group network Network_Nomades
 network-object LAN_NOMADES 255.255.255.0
access-list VPN_NOMADES_splitTunnelAcl standard permit LAN_MERIGNAC 255.255.255.0 
access-list VPN_NOMADES_splitTunnelAcl standard permit WAN_MERIGNAC 255.255.255.0 
access-list inside_nat0_outbound extended permit ip WAN_MERIGNAC 255.255.255.0 LAN_NOMADES 255.255.255.0 
access-list inside_nat0_outbound extended permit ip LAN_MERIGNAC 255.255.255.0 LAN_NOMADES 255.255.255.0 
access-list outside_access_in extended permit ip LAN_NOMADES 255.255.255.0 LAN_MERIGNAC 255.255.255.0 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPN_CLIENT 10.171.81.1-10.171.81.254 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (inside) 2 interface
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 192.168.80.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa authentication ssh console LOCAL 
http server enable 444
http LAN_NOMADES 255.255.255.0 outside
http LAN_MERIGNAC 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh LAN_MERIGNAC 255.255.255.0 inside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 10.171.80.2-10.171.80.33 inside
dhcpd dns 89.2.0.1 89.2.0.2 interface inside
dhcpd enable inside
!

group-policy VPN_NOMADES internal
group-policy VPN_NOMADES attributes
 vpn-tunnel-protocol IPSec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value VPN_NOMADES_splitTunnelAcl
username ...... password ..... encrypted privilege 15
tunnel-group VPN_NOMADES type ipsec-ra
tunnel-group VPN_NOMADES general-attributes
 address-pool VPN_CLIENT
 default-group-policy VPN_NOMADES
tunnel-group VPN_NOMADES ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:16f97b9d176d9c498c62435f7aff8dad

--------------------------------

2 REPLIES
New Member

I can't find anything wrong

I can't find anything wrong with your config.

Are you network devices configured to use the internal interface of the firewall as the default gateway? Or do you have a route to 10.171.81.0/24 via 10.171.80.1?

New Member

hello, my problem is solved.I

hello,

 

my problem is solved.

Reset fix my problem

 

Thank you, 
Have a nice day, 
Bests regards. 
Yann 

145
Views
0
Helpful
2
Replies
CreatePlease to create content