Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Connected to ASA via software "VPN Client", but cannot ping devices.

I have a network that looks something like this:

vpn-client-diagram-2.fw.png

I have successfully connected to the inside network of the ASA via a software "VPN Client" tunnel and obtained an IP address of 10.45.99.100/16.

I'm trying to ping 10.45.7.2 from the outside 10.45.99.100, but the ping fails (request timed out).

On the ASA, with "logging console notifications" set, I notice the following message:


"%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src outside:10.45.99.100 dst inside:10.45.7.2 (type 8, code 0) denied due to NAT reverse path failure"

I have a vague sense that I'm missing a NAT rule, but not entire sure. What have I missed?

Here's my ASA configuration: http://pastebin.com/raw.php?i=ad6p1Zac


1 ACCEPTED SOLUTION

Accepted Solutions
Super Bronze

Connected to ASA via software "VPN Client", but cannot ping devi

Hi,

You seem to have a NAT0 ACL configured but its not actually in use with a "nat" command

You would probably need

nat (inside) 0 access-list inside_nat0_outside

This should handle the NAT0

I would personally avoid using large subnets/networks. You probably wont ever have host behind ASA that would fill /16 mask subnet.

I would also keep the VPN pool as a separate network compared to the LAN networks behind the ASA. Both the LAN 10.45.0.0/16 and 10.45.99.100-200 are from the same network.

- Jouni

2 REPLIES
Super Bronze

Connected to ASA via software "VPN Client", but cannot ping devi

Hi,

You seem to have a NAT0 ACL configured but its not actually in use with a "nat" command

You would probably need

nat (inside) 0 access-list inside_nat0_outside

This should handle the NAT0

I would personally avoid using large subnets/networks. You probably wont ever have host behind ASA that would fill /16 mask subnet.

I would also keep the VPN pool as a separate network compared to the LAN networks behind the ASA. Both the LAN 10.45.0.0/16 and 10.45.99.100-200 are from the same network.

- Jouni

Community Member

Re: Connected to ASA via software "VPN Client", but cannot ping

Thanks, that resolved the failure message I was getting.

276
Views
0
Helpful
2
Replies
CreatePlease to create content