topic Your NAT statements overlap in Network Security

VPN Connection Problem

Rohit Mangotra — Tue, 12 Mar 2019 04:04:40 GMT

Hi,

The user can login with their valid AD account. The remote laptop receives a correct IP address from the ASA IP DHCP pool (192.168.210.231-192.168.210.250). However, the remote laptop CANNOT communicate with other internal networks (i.e.: PING). The remote laptop CAN PING the VPN interface (outside) of the ASA. There is a VPN remote connection established (IKEv1) when logging into the ASA (see codes below).

Note: The ASA configuration code is attached (Most of the configuration codes were configured with ADSM). I will really appreciate if any one could please have a look at it and let me know what I am doing wrong.

interface GigabitEthernet0/0

speed 1000

duplex full

nameif outside

security-level 0

ip address 200.190.70.66 255.255.255.248

object network NETWORK_OBJ_192.168.210.224_27

subnet 192.168.210.224 255.255.255.224

access-list splittunnel standard permit 172.16.0.0 255.255.0.0

access-list splittunnel standard permit 192.168.1.0 255.255.255.0

access-list SYSTEM_DEFAULT_CRYPTO_MAP extended permit ip any object NETWORK_OBJ_192.168.210.224_27

nat (inside,outside) source static inside-subnet-source inside-subnet-source destination static NETWORK_OBJ_192.168.210.224_27 NETWORK_OBJ_192.168.210.224_27 no-proxy-arp route-lookup

route outside 192.168.210.224 255.255.255.224 200.190.70.65 1

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map ASA-VPN-SITE 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map ASA-VPN-SITE interface outside

crypto ikev1 enable outside

crypto ikev1 policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 172.16.5.31 172.16.5.32

vpn-tunnel-protocol ikev1 l2tp-ipsec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value splittunnel

default-domain value zzzzzz

username user1 password zzzzzz encrypted

username user1 attributes

vpn-group-policy DefaultRAGroup

vpn-tunnel-protocol ikev1

tunnel-group DefaultRAGroup general-attributes

address-pool remote-vpn-pool

default-group-policy DefaultRAGroup

tunnel-group DefaultRAGroup ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group DefaultRAGroup ppp-attributes

no authentication chap

authentication ms-chap-v2

Thanks & Regards

Rohit.

Hi, is ping the only thing

Rudy Sanjoko — Tue, 15 Apr 2014 08:47:12 GMT

Hi, is ping the only thing that is not working? if you can, post/attach the whole config here.

If it's only ping that is not working then couple things to check are:

- if you have enabled inspect icmp command

- if you have configured management-access inside command

Hi Rudy,Thanks for your reply

Rohit Mangotra — Wed, 16 Apr 2014 02:45:42 GMT

Hi Rudy,

Thanks for your reply but I already have these commands in my ASA and it is still the same. I cannot ping the inside interface of ASA 5525 while connected to vpn and cannot ping from inside network to connected vpn. Any suggestion would be really appreciated.

Thanks & Regards

Rohit.

Hi, so is ping the only thing

Rudy Sanjoko — Wed, 16 Apr 2014 07:26:35 GMT

Hi, so is ping the only thing that is not working? are others protocol work fine? try checking the ACL, make sure that the VPN pool ip address are allowed to access the inside network. If you can, post/attach the whole config here.

Hi Rudy,Thanks for you reply.

Rohit Mangotra — Wed, 16 Apr 2014 07:52:32 GMT