VPN ping application issue

[rhopkins_rcps]

I have setup a vpn for vendor access to hvac equipment.

The profile is RCPS_Vendor

DHCP pool is RCPS_Vendor

Terminated to Outside int

These are the steps I took:

remote access, outside->psk(password), name RCPS_Vendors->local authen->Hoff_Vendor(password)->RCPS_Vendors 192.168.10.2-192.168.10.128->10.1.252.101/103->3DES SHA 2->3DES SHA->10.0.0.0/8 en split tunnel

from: http://www.cisco.com/en/US/docs/security/asa/asa71/getting_started/asa5500/quick/guide/rem_acc.html

The issue is the vendor needs ping to internal units, and his program will not connect to the units.

Modified config attached.

Thanks in advance.

[slmansfield]

Just wondering if you verified that you have network reachability between your internal hosts and the ranges of address pools assigned to your VPN clients.

The address pool for RCPS_Vendors is in the 192.168.10.x range, which does not have a specific static route on the ASA so it is using your default route, which points outside to 192.175.57.1.

[rhopkins_rcps]

You wondered right, just tested and I cant access anything inside.

Ok, so to get RCPS_Vendors, going would I put a route inside 192.168.10.0 0.0.0.255 10.200.1.3 ? Do I need to create and acl for ping traffic?

Thanks for the quick response.

[slmansfield · Accepted solution]

If all of the internal units are one hop away from the ASA, then you could put that static route on each of those units. That would point them to the inside interface on the ASA. The ASA would use its default route to send traffic back to the VPN clients.

If the internal units are further inside your network and you are using a dynamic routing protocol, you can redistribute the static route to 192.168.10.0/24 on the next hop router (from the ASA) inside your network so that the default gateways of the internal units know where to send traffic destined for 192.168.10.0/24.

Since your remote clients are sending traffic through VPN tunnels I don't believe you need to add an ACL on the ASA to allow specific traffic from the VPN clients to the internal units.

[rhopkins_rcps]

Well I did a little work around and kept the vpn pool in the 10.0.0.0 subnet, works fine. Thanks for your advice