This has been driving me mad for days now so any guidance would save me pulling out the remainder of my hair. I have searched the posts here and in other places and tried all the advice offered but have failed to make any progress.
I have an ASA-5505 which has been reset to factory defaults. I have configured the required 2 interfaces and set up a simple local user authenticated IPsec VPN. The VPN establishes fine from an iPhone5 to the ASA but I am unable to browse to a web server on the inside LAN. The routing table shows that the return route to the iPhone has been created when the tunnel established and if I run a ping from the web server to the VPN supplied IP address of the iPhone it hits the inside of the ASA so the basic routing seems to be all OK.
I have ACL's that as far as I can see say any traffic for any source is permitted in and out of both inside and outside interfaces.
The outside interface of the ASA has a public ip address passed through to it from a Virgin Media SuperHUB.
Output from sh crypto sa (below) shows encaps and decaps increasing
I guess is going to be an ACL somewhere but my Cisco knowledge has run out at this point - Oh and yes I did turn on ASDM to help me with the config
Any help would be greatly appreciated
Regards
Colin
MDM-ASA# sh ipsec sa
interface: Outside
Crypto map tag: SYSTEM_DEFAULT_CRYPTO_MAP, seq num: 65535, local addr: 82.xxx.xxx.214
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (10.10.30.50/255.255.255.255/0/0)
current_peer: 31.99.161.129, username: test
dynamic allocated peer ip: 10.10.30.50
#pkts encaps: 16, #pkts encrypt: 16, #pkts digest: 16
#pkts decaps: 34, #pkts decrypt: 34, #pkts verify: 34
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 16, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 82.xxx.xxx.214/0, remote crypto endpt.: 31.99.161.129/0
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 0497140C
current inbound spi : F2CF6DB6
inbound esp sas:
spi: 0xF2CF6DB6 (4073680310)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, IKEv1, }
slot: 0, conn_id: 90112, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 3484
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x0000007F 0xFFFFFFFF
outbound esp sas:
spi: 0x0497140C (77009932)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, IKEv1, }
slot: 0, conn_id: 90112, crypto-map: SYSTEM_DEFAULT_CRYPTO_MAP
sa timing: remaining key lifetime (sec): 3484
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
