Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

VPN ping application issue

I have setup a vpn for vendor access to hvac equipment.

The profile is RCPS_Vendor

DHCP pool is RCPS_Vendor

Terminated to Outside int

These are the steps I took:

remote access, outside->psk(password), name RCPS_Vendors->local authen->Hoff_Vendor(password)->RCPS_Vendors 192.168.10.2-192.168.10.128->10.1.252.101/103->3DES SHA 2->3DES SHA->10.0.0.0/8 en split tunnel

from: http://www.cisco.com/en/US/docs/security/asa/asa71/getting_started/asa5500/quick/guide/rem_acc.html

The issue is the vendor needs ping to internal units, and his program will not connect to the units.

Modified config attached.

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: VPN ping application issue

If all of the internal units are one hop away from the ASA, then you could put that static route on each of those units. That would point them to the inside interface on the ASA. The ASA would use its default route to send traffic back to the VPN clients.

If the internal units are further inside your network and you are using a dynamic routing protocol, you can redistribute the static route to 192.168.10.0/24 on the next hop router (from the ASA) inside your network so that the default gateways of the internal units know where to send traffic destined for 192.168.10.0/24.

Since your remote clients are sending traffic through VPN tunnels I don't believe you need to add an ACL on the ASA to allow specific traffic from the VPN clients to the internal units.

4 REPLIES
Silver

Re: VPN ping application issue

Just wondering if you verified that you have network reachability between your internal hosts and the ranges of address pools assigned to your VPN clients.

The address pool for RCPS_Vendors is in the 192.168.10.x range, which does not have a specific static route on the ASA so it is using your default route, which points outside to 192.175.57.1.

New Member

Re: VPN ping application issue

You wondered right, just tested and I cant access anything inside.

Ok, so to get RCPS_Vendors, going would I put a route inside 192.168.10.0 0.0.0.255 10.200.1.3 ? Do I need to create and acl for ping traffic?

Thanks for the quick response.

Silver

Re: VPN ping application issue

If all of the internal units are one hop away from the ASA, then you could put that static route on each of those units. That would point them to the inside interface on the ASA. The ASA would use its default route to send traffic back to the VPN clients.

If the internal units are further inside your network and you are using a dynamic routing protocol, you can redistribute the static route to 192.168.10.0/24 on the next hop router (from the ASA) inside your network so that the default gateways of the internal units know where to send traffic destined for 192.168.10.0/24.

Since your remote clients are sending traffic through VPN tunnels I don't believe you need to add an ACL on the ASA to allow specific traffic from the VPN clients to the internal units.

New Member

Re: VPN ping application issue

Well I did a little work around and kept the vpn pool in the 10.0.0.0 subnet, works fine. Thanks for your advice

122
Views
0
Helpful
4
Replies
CreatePlease to create content