Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

SSH to ASA through VPN

Here is a variation on a theme I've seen on the boards here.  I have an ASA 5580 configured for client ipsec vpns.  I can connect via the vpn, ping the interface being used for management, and complete the TCP handshake for telnet or SSH.  After that, the connection times out.  I know I'm missing something small, but can't find it.  Any help would be greatly appreciated. 

Here are the relevant parts of the config:

!

interface TenGigabitEthernet0/8

nameif INSIDE

security-level 100

ip address 10.50.254.249 255.255.255.248 standby 10.50.254.250

!

!

interface GigabitEthernet0/0

nameif OUTSIDE

security-level 0

ip address x.x.x.x x.x.x.x

!

interface GigabitEthernet0/1

nameif ToMGMT

security-level 10

ip address 10.50.253.18 255.255.255.0

!

ftp mode passive

dns server-group DefaultDNS

domain-name local

object-group network Inside_NETWORK_ALL

network-object 10.0.0.0 255.0.0.0

network-object 172.16.0.0 255.248.0.0

object-group network Outside_REMOTE_VPN

network-object 10.50.224.0 255.255.254.0

object-group network MGMT_NET

network-object 10.50.253.0 255.255.255.0

access-list PERMIT_ANY extended permit ip any any

access-list RemoteVPN_SPLIT standard permit 10.50.253.0 255.255.255.0

access-list RemoteVPN_SPLIT standard permit 10.50.0.0 255.255.0.0

access-list RemoteVPN_SPLIT standard permit 10.50.224.0 255.255.254.0

access-list NO-NAT-VPN extended permit ip any 10.50.224.0 255.255.254.0

access-list MGMT-2-VPN extended permit ip 10.50.253.0 255.255.255.0 10.50.224.0 255.255.254.0

mtu INSIDE 1500

mtu OUTSIDE 1500

mtu ToMGMT 1500

ip local pool RemoteVPN_POOL 10.50.224.0-10.50.225.0 mask 255.255.254.0

monitor-interface DMZ

no monitor-interface OUTSIDE

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (INSIDE,any) source static Inside_NETWORK_ALL Inside_NETWORK_ALL destination static Inside_NETWORK_ALL Inside_NETWORK_ALL

nat (INSIDE,OUTSIDE) source dynamic Inside_NETWORK_ALL interface

access-group OUTSIDE_IN in interface OUTSIDE

!

!

route OUTSIDE 0.0.0.0 0.0.0.0 200.200.100.10 1

route INSIDE 10.50.0.0 255.255.224.0 10.50.254.254 1

route INSIDE 10.50.253.0 255.255.255.0 10.50.254.254 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

dynamic-access-policy-record DfltAccessPolicy

aaa-server RADIUS_COLO protocol radius

aaa authentication enable console LOCAL

aaa authentication serial console LOCAL

aaa authentication ssh console LOCAL

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set 3dessha-Transport esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set 3dessha-Transport mode transport

crypto ipsec ikev1 transform-set dessha esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set 3dessha esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac

crypto dynamic-map RemoteVPN_DM 5 set ikev1 transform-set 3dessha

crypto dynamic-map PUB_IPSEC_CLIENT 1 set ikev1 transform-set ESP-3DES-MD5

crypto map CRYPTO_MAP 1 ipsec-isakmp dynamic RemoteVPN_DM

crypto map CRYPTO_MAP 2 ipsec-isakmp dynamic PUB_IPSEC_CLIENT

crypto map CRYPTO_MAP interface OUTSIDE

crypto isakmp identity key-id ***********

crypto ikev1 enable OUTSIDE

crypto ikev1 policy 65534

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 65535

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

ssh 10.0.0.0 255.0.0.0 INSIDE

ssh 10.50.253.0 255.255.255.0 ToMGMT

ssh 10.50.224.0 255.255.254.0 ToMGMT

ssh 10.0.0.0 255.0.0.0 ToMGMT

ssh timeout 5

ssh version 2

console timeout 0

management-access ToMGMT

!

tls-proxy maximum-session 1000

!

ssl trust-point localtrust OUTSIDE

webvpn

enable OUTSIDE

anyconnect image disk0:/anyconnect-win-2.5.3055-k9.pkg 1

anyconnect enable

tunnel-group-list enable

group-policy SSLClientPolicy internal

group-policy SSLClientPolicy attributes

dns-server value 10.50.223.10

vpn-tunnel-protocol ssl-client

split-tunnel-policy tunnelspecified

split-tunnel-network-list value RemoteVPN_SPLIT

address-pools value RemoteVPN_POOL

group-policy RemoteVPN internal

group-policy RemoteVPN attributes

dns-server value 10.200.0.6

password-storage enable

split-tunnel-network-list value RemoteVPN_SPLIT

group-policy IPSEC-POLICY internal

group-policy IPSEC-POLICY attributes

vpn-simultaneous-logins 20

vpn-tunnel-protocol ikev1

ip-comp enable

split-tunnel-policy tunnelspecified

split-tunnel-network-list value RemoteVPN_SPLIT

user-authentication enable

tunnel-group RemoteVPN type remote-access

tunnel-group RemoteVPN general-attributes

address-pool RemoteVPN_POOL

default-group-policy RemoteVPN

tunnel-group RemoteVPN ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group SSLClientProfile type remote-access

tunnel-group SSLClientProfile general-attributes

default-group-policy SSLClientPolicy

tunnel-group SSLClientProfile webvpn-attributes

group-alias SSLVPNClient enable

tunnel-group IPSECGROUP type remote-access

tunnel-group IPSECGROUP general-attributes

address-pool RemoteVPN_POOL

default-group-policy IPSEC-POLICY

authorization-required

tunnel-group IPSECGROUP ipsec-attributes

ikev1 pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

!

467
Views
0
Helpful
0
Replies
CreatePlease to create content