Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Problem to access share over VPN Client

Im having troubles to access share over vpn.

When the source is the vpnclient(11.11.7.0/24) and i try access the share in server 11.11.18.2, dont works.

But the inverse works, if i create the share on vpn client (11.11.7.0/24), and try access this with source 11.11.18.2 , works! This problem occurs only when try access the share, if try access any application (3389,80,22,23) all works.

Could you help-me?

Tks

Follow the topology :

pergunta.jpg

Follow the ASA -- version 8.2(5)--- Config :

===================================== NAT ======================================

global (outside) 1 interface

nat (inside) 0 access-list nat0

nat (inside) 1 0.0.0.0 0.0.0.0

access-list nat0 extended permit ip 11.11.7.0 255.255.255.0 11.11.17.0 255.255.255.0

access-list nat0 extended permit ip 11.11.17.0 255.255.255.0 11.11.7.0 255.255.255.0

===================================== ACL- Inside ======================================

access-group inside_in in interface inside

access-list inside_in extended permit ip 11.11.7.0 255.255.255.0 11.11.18.0 255.255.255.0

access-list inside_in extended permit ip 11.11.18.0 255.255.255.0 11.11.7.0 255.255.255.0

===================================== MTU ======================================

mtu outside 1500

mtu inside 1500

===================================== Route ======================================

route inside 11.11.18.0 255.255.0.0 11.11.3.129

===================================== Timeouts======================================

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

===================================== Threat e Sec ======================================

threat-detection basic-threat

threat-detection statistics

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ip verify reverse-path interface outside

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

===================================== VPN Config ======================================

access-list vpn standard permit 11.11.18.0 255.255.255.0

ip local pool access-vpn 11.11.7.0-11.11.7.254 mask 255.255.255.0

group-policy vpn internal

group-policy vpn attributes

dns-server value 11.11.1.10 11.11.1.11

vpn-tunnel-protocol IPSec

split-tunnel-network-list value vpn

default-domain value xxx.xxx.xx

tunnel-group vpn type remote-access

tunnel-group vpn general-attributes

address-pool access-vpn

authentication-server-group xxxx.xxx

default-group-policy vpn

password-management

tunnel-group vpn ipsec-attributes

pre-shared-key *****

crypto dynamic-map outside_dyn_map 10 set transform-set ESP-3DES-SHA ESP-AES-128-SHA

crypto dynamic-map outside_dyn_map 10 set security-association lifetime seconds 86400

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto isakmp policy 1

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 43200

crypto isakmp policy 20

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash sha

group 1

lifetime 86400

crypto isakmp policy 40

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 60

authentication pre-share

encryption aes-256

hash sha

group 5

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

===================================== Policy-Map ======================================

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

  inspect icmp

  inspect icmp error

  inspect ip-options

  inspect netbios

!

service-policy global_policy global


-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Follow the 3560 config :

service tcp-keepalives-in

service tcp-keepalives-out

system mtu routing 1500

no ip source-route

ip routing

ip tcp selective-ack

ip tcp path-mtu-discovery age-timer 10

interface Vlan60

ip address 11.11.60.254 255.255.255.0

!

interface Vlan3

description -=- Internet -=-

ip address 11.11.3.129 255.255.255.252

ip route 0.0.0.0 0.0.0.0 11.11.3.130

ip route 11.11.18.0 255.255.255.0 11.11.60.2

1 REPLY
New Member

Problem to access share over VPN Client

Any idea?

159
Views
0
Helpful
1
Replies
CreatePlease login to create content