Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA5510 Remote access Server problem

Hello guys,

I have a problem with ASA5510 configured as Remote access server. We are using Windows XP VPN client. Staring at the configuration I don't see any problem but when I try to connect to the Server it doesn't initiate VPN negotiation. I had problem like this before, but at least I saw traffic hitting the ASA. Now I don't see anything hitting the device. I am attaching the current configuration of the ASA. The VPN client on my laptop is configured properly. Thank you in advance!

rvr

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: ASA5510 Remote access Server problem

Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*

3 REPLIES
Cisco Employee

Re: ASA5510 Remote access Server problem

Hi,

In your configuration, you have the below command, which will disable IKE and ESP.

no sysopt connection permit-vpn.

Can you enable this command and run the testing again.

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s8_72.html#wp1198155

If you really want to disable this option, then you need to explicitly configure Access-list applied inbound to permit all ISAKMP and IPSEC ports and also the user traffic.

Regards,

Arul

*Pls rate if it helps*

New Member

Re: ASA5510 Remote access Server problem

I had the command in the configuration before and didn't work. Now I inserted it onace again(according to your suggestion) and it worked, this is strange.

Is this command mandatory for ASA remote access server?

rvr

Cisco Employee

Re: ASA5510 Remote access Server problem

Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*

121
Views
4
Helpful
3
Replies