VPN client cannot access inside hosts

[rudedwg17]

Hello,

    I have an ASA 5505 device with the attached configuration and my vpn clients can connect to it fine.  Although, once a vpn client is connected they cannot RDP, ping, or telnet any internal hosts.  The goal is to have a connected vpn client to have all access rights as anyone sitting on the internal network.  Any assistance is greatly appreciated.

: Saved
:
ASA Version 7.2(3)
!
hostname Kappa-GW01
domain-name Kappa.com
enable password xxxxxxxxx encrypted
names
name 172.20.42.42 UMEFTP2 description UMAP FTP2
name 172.20.40.246 UMEMAIL1 description Exchange Server
name 172.20.41.3 UMERPS
name x.x.81.81 Wilkes
name x.x.84.41 KappaPittston
dns-guard
!
interface Ethernet0/0
shutdown
nameif outside
security-level 0
ip address x.x.148.194 255.255.255.248
!
interface Ethernet0/1
nameif Outside_Windstream
security-level 0
ip address x.x.205.210 255.255.255.240
!
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.0
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd 7Tpgc2AiWGxbNjkj encrypted
boot system disk0:/asa723-k8.bin
ftp mode passive
dns server-group DefaultDNS
domain-name Kappa.com
object-group network Blue_Bell_Internal_Networks
description Blue Bell internal network Group
network-object 192.168.100.0 255.255.255.0
network-object 10.0.0.0 255.255.255.0
network-object 10.0.1.0 255.255.255.0
network-object 10.0.2.0 255.255.255.0
object-group network VPN-Sites
network-object host Wilkes
network-object host KappaPittston
object-group network Michigan_VPN_GRP
network-object 172.20.40.0 255.255.252.0
object-group network ASA_OutSide_Vendors
description ASA OutSide Vendor Access
access-list 101 extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list 101 extended permit ip 10.0.1.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list 101 extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list 101 extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
access-list KappaVPN_splitTunnelAcl remark Blue Bell Office
access-list KappaVPN_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
access-list KappaVPN_splitTunnelAcl remark Williamston Office
access-list KappaVPN_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
access-list KappaVPN_splitTunnelAcl remark Pittston Office
access-list KappaVPN_splitTunnelAcl standard permit 10.0.10.0 255.255.255.0
access-list KappaVPN_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 10.0.30.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.255.255.0 172.20.40.0 255.255.252.0 inactive
access-list inside_nat0_outbound extended permit ip 10.0.2.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.10.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.0.30.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.30.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.10.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.20.40.0 255.255.252.0 10.0.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
access-list outside_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
access-list umeemp_splitTunnelAcl standard permit 10.0.0.0 255.255.255.0
access-list umeemp_splitTunnelAcl standard permit 172.20.40.0 255.255.252.0
access-list umeemp_splitTunnelAcl standard permit 10.0.30.0 255.255.255.0
access-list umeemp_splitTunnelAcl standard permit 10.0.2.0 255.255.255.0
access-list outside_5_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
access-list inside_access_in extended permit ip any any
access-list 102 extended permit tcp any any eq 2000
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq smtp
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.220 eq pop3 inactive
access-list Outside_Winstream_access_in extended permit udp object-group VPN-Sites interface Outside_Windstream eq isakmp
access-list Outside_Winstream_access_in extended permit tcp object-group ASA_OutSide_Vendors host x.x.205.217 eq 4080
access-list Outside_Winstream_access_in remark SMTP Access
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq smtp
access-list Outside_Winstream_access_in remark POP access
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq pop3
access-list Outside_Winstream_access_in remark OWA Access
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.218 eq https
access-list Outside_Winstream_access_in extended permit tcp host x.x.87.65 host x.x.205.218 eq 3389
access-list Outside_Winstream_access_in extended permit udp host x.x.56.111 eq ntp host x.x.205.216 eq ntp
access-list Outside_Winstream_access_in remark OWA UMAP
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq https
access-list Outside_Winstream_access_in remark JLAN
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.215 eq https
access-list Outside_Winstream_access_in remark UMERPS
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq https
access-list Outside_Winstream_access_in remark UMERPS
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.212 eq ssh
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq https
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.213 eq 5494
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.214 eq www
access-list Outside_Winstream_access_in extended permit tcp any host x.x.205.211 eq 8081
access-list Outside_Winstream_access_in extended permit icmp any any echo
access-list outside_6_cryptomap extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
access-list outside_6_cryptomap extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
access-list Outside_Windstream_cryptomap_11 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
access-list Outside_Windstream_cryptomap_10 extended permit ip 10.0.0.0 255.255.255.0 10.0.2.0 255.255.255.0
access-list Outside_Windstream_cryptomap_5 extended permit ip 10.0.0.0 255.255.255.0 10.0.10.0 255.255.255.0
access-list Outside_Windstream_cryptomap_12 extended permit ip 172.20.40.0 255.255.255.0 10.0.2.0 255.255.255.0
access-list Outside_Windstream_2_cryptomap extended permit ip 10.0.0.0 255.255.255.0 172.20.48.0 255.255.252.0
access-list nonat extended permit ip any any inactive
pager lines 24
logging enable
logging asdm debugging
logging flash-bufferwrap
mtu outside 1500
mtu Outside_Windstream 1500
mtu inside 1500
mtu management 1500
ip local pool vpn-pool 192.168.100.100-192.168.100.200
no failover
monitor-interface outside
monitor-interface Outside_Windstream
monitor-interface inside
monitor-interface management
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
nat-control
global (Outside_Windstream) 1 x.x.205.216 netmask 255.0.0.0
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 172.20.40.0 255.255.252.0
nat (inside) 1 10.0.0.0 255.255.0.0
static (inside,Outside_Windstream) x.x.205.217 10.0.0.20 netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.220 10.0.0.21 netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.218 10.0.0.15 netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.215 172.20.40.145 netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.211 UMEMAIL1 netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.212 UMERPS netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.213 172.20.40.243 netmask 255.255.255.255
static (inside,Outside_Windstream) x.x.205.214 172.20.40.146 netmask 255.255.255.255
access-group acl_inbound in interface outside
access-group Outside_Winstream_access_in in interface Outside_Windstream
route Outside_Windstream 0.0.0.0 0.0.0.0 x.x.205.209 1
route inside 172.20.40.0 255.255.252.0 10.0.0.3 1
route inside 10.0.30.0 255.255.255.0 10.0.0.254 1
route inside 10.0.1.0 255.255.255.0 10.0.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server BBPA-SRV-DC01 protocol radius
aaa-server BBPA-SRV-DC01 host 10.0.0.15
timeout 5
key G6G7#02bj!
aaa-server UMAP protocol radius
aaa-server UMAP host 172.20.40.245
timeout 5
key gfrt1a
aaa-server UMAP host 172.20.40.244
timeout 5
key gfrt1a
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 10.0.0.0 255.255.255.0 inside
http 10.0.0.15 255.255.255.255 inside
http 192.168.1.0 255.255.255.0 management
http 192.168.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs
crypto dynamic-map outside_dyn_map 40 set transform-set ESP-3DES-SHA
crypto dynamic-map Outside_Windstream_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map Outside_Windstream_dyn_map 40 set pfs
crypto dynamic-map Outside_Windstream_dyn_map 40 set transform-set ESP-3DES-SHA
crypto map outside_map 5 match address outside_5_cryptomap
crypto map outside_map 5 set peer Wilkes
crypto map outside_map 5 set transform-set ESP-3DES-SHA
crypto map outside_map 10 match address outside_6_cryptomap
crypto map outside_map 10 set peer KappaPittston
crypto map outside_map 10 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto map Outside_Windstream_map 5 match address Outside_Windstream_cryptomap_5
crypto map Outside_Windstream_map 5 set peer Wilkes
crypto map Outside_Windstream_map 5 set transform-set ESP-3DES-SHA
crypto map Outside_Windstream_map 10 match address Outside_Windstream_cryptomap_10
crypto map Outside_Windstream_map 10 set peer KappaPittston
crypto map Outside_Windstream_map 10 set transform-set ESP-3DES-SHA
crypto map Outside_Windstream_map 65535 ipsec-isakmp dynamic Outside_Windstream_dyn_map
crypto map Outside_Windstream_map interface Outside_Windstream
crypto isakmp enable Outside_Windstream
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 3600
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp nat-traversal  20
telnet 10.0.0.0 255.255.0.0 inside
telnet timeout 5
ssh 10.0.0.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
management-access inside
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns migrated_dns_map_1
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect sqlnet
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ftp
  inspect skinny
  inspect pptp
!
service-policy global_policy global
webvpn
enable Outside_Windstream
svc image disk0:/sslclient-win-1.1.4.177.pkg 1
svc enable
group-policy DfltGrpPolicy attributes
banner none
wins-server none
dns-server none
dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelspecified
split-tunnel-network-list none
default-domain none
split-dns none
intercept-dhcp 255.255.255.255 disable
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
backup-servers keep-client-config
msie-proxy server none
msie-proxy method no-modify
msie-proxy except-list none
msie-proxy local-bypass disable
nac disable
nac-sq-period 300
nac-reval-period 36000
nac-default-acl none
address-pools none
smartcard-removal-disconnect enable
client-firewall none
client-access-rule none
webvpn
  functions url-entry
  html-content-filter none
  homepage none
  keep-alive-ignore 4
  http-comp gzip
  filter none
  url-list none
  customization value DfltCustomization
  port-forward none
  port-forward-name value Application Access
  sso-server none
  deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
  svc required
  svc keep-installer installed
  svc keepalive none
  svc rekey time none
  svc rekey method none
  svc dpd-interval client none
  svc dpd-interval gateway none
  svc compression deflate
group-policy umeemp internal
group-policy umeemp attributes
dns-server value 172.20.40.245
vpn-filter none
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value KappaVPN_splitTunnelAcl
default-domain value umapinc.com
group-policy KappaVPN internal
group-policy KappaVPN attributes
wins-server value 10.0.0.15
dns-server value 10.0.0.15
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value umeemp_splitTunnelAcl
default-domain value kappa.loc
username gwadmin password AVjtEPq7nvtiAAk0 encrypted
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool vpn-pool
authentication-server-group BBPA-SRV-DC01
authorization-required
tunnel-group KappaVPN type ipsec-ra
tunnel-group KappaVPN general-attributes
address-pool vpn-pool
authentication-server-group BBPA-SRV-DC01
default-group-policy KappaVPN
tunnel-group KappaVPN ipsec-attributes
pre-shared-key *
tunnel-group x.x.131.62 type ipsec-l2l
tunnel-group x.x.131.62 ipsec-attributes
pre-shared-key *
tunnel-group x.x.232.2 type ipsec-l2l
tunnel-group x.x.232.2 ipsec-attributes
pre-shared-key *
tunnel-group x.x.49.114 type ipsec-l2l
tunnel-group x.x.49.114 ipsec-attributes
pre-shared-key *
tunnel-group x.x.226.218 type ipsec-l2l
tunnel-group x.x.226.218 ipsec-attributes
pre-shared-key *
tunnel-group x.x.116.133 type ipsec-l2l
tunnel-group x.x.116.133 ipsec-attributes
pre-shared-key *
tunnel-group x.x.21.36 type ipsec-l2l
tunnel-group x.x.21.36 ipsec-attributes
pre-shared-key *
tunnel-group umeemp type ipsec-ra
tunnel-group umeemp general-attributes
address-pool vpn-pool
authentication-server-group UMAP
default-group-policy umeemp
tunnel-group umeemp ipsec-attributes
pre-shared-key *
tunnel-group x.x.81.81 type ipsec-l2l
tunnel-group x.x.81.81 ipsec-attributes
pre-shared-key *
tunnel-group x.x.84.41 type ipsec-l2l
tunnel-group x.x.84.41 ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxx
: end
asdm image disk0:/asdm-523.bin
no asdm history enable
 

[Tarik Admani]

Hi,

Which tunnel group are you trying to connect to?

Tarik Admani
*Please rate helpful posts*

[rudedwg17]

I am connecting to KappaVPN tunnel

[Tarik Admani]

Rudolph,

I wanted to know which ip addresses are you trying to connect to? Based on your configuration I wanted to confirm that you are being mapped to the KappaVPN group-policy? If so then the you are hitting the umeemp_Split rule.

Also i wanted to know if all the networks listed in this split rule set behind on the ASA or outside the ASA, because your routing only shows three networks on the inside (your 172.20.40, 10.0.30, and 10.0.1). Let me know if the rest of the clients sit on the outside.

Thanks,

Tarik Admani
*Please rate helpful posts*

[rudedwg17]

I'm sorry, I misunderstood what you were asking.  Yes those three networks are on the inside of our ASA.  we have 2 outside of the ASA (10.0.2.x, 10.0.10.x).  When our clients vpn they connect to the x.x.205.210 ip address, which maps them depending on the preshared key that puts them on either the kappaVPN or the umeempVPN.  (I am kind of new to configuring the ASA).  When the cisco vpn client connects to the network, I checked the statistics and it lists all of our LAN networks under secure routes.  I cannot ping anything inside the LAN nor can I connect RDP, telnet or anything.

Hope this answers your questions, just let me know if you need any more information.

-Rudy

[rudedwg17]

Not sure if this helps but when I do a 'ipconfig' I do not have a gateway address listed for the VPN connection.  should there be an address?

[rudedwg17]

I hate to be a pester but I kind of need some help with this much sooner than later.  Can anyone help out?  I just can't seem to find where the connection is failing.

-Rudy

[Tarik Admani]

Rudolph,

The configuration looks pretty good, however I wanted to know what credentials you are using since the KappaVPN group uses radius for authentication, I am interested to see what attributes (if any) are being sent back.

can you share the debug crypto ipsec 7 and the debug crypto isakmp 7 then reproduce the issue.

Thanks,

Tarik Admani
*Please rate helpful posts*