topic ssl vpn connected successfully but I can't ping inside hosts and in Network Security https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449954#M268710 <HTML><HEAD></HEAD><BODY><P>Then you have not enabled the RDP service,</P><P></P><P>Follow the steps I provided and then get back to me</P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Thu, 06 Mar 2014 00:17:58 GMT Julio Carvajal 2014-03-06T00:17:58Z ssl vpn connected successfully but I can't ping inside hosts and vice versa https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449941#M268695 <P>I am configuring SSL vpn and I can connect and get an ip address from my vpn pool. However I can&nbsp; not ping the inside interface from the remote PC and vice versa. I can' t even ping the remote PC from the ASA firewall. This is a ASA 5505 version 9.0.3</P><P></P><P>ciscoasa# ping 192.168.200.13 (Local ip address)</P><P>Type escape sequence to abort.</P><P>Sending 5, 100-byte ICMP Echos to 192.168.200.13, timeout is 2 seconds:</P><P>!!!!!</P><P>Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms</P><P>ciscoasa# ping 172.18.2.10&nbsp;&nbsp; ( VPN ip address)</P><P>Type escape sequence to abort.</P><P>Sending 5, 100-byte ICMP Echos to 172.18.2.10, timeout is 2 seconds:</P><P>?????</P><P>Success rate is 0 percent (0/5)</P><P></P><P>ciscoasa# packet-tracer input inside icmp 172.18.2.10 8 0 192.168.200.13 (no problem, everything is allowed)</P><P>Result:</P><P>input-interface: inside</P><P>input-status: up</P><P>input-line-status: up</P><P>output-interface: inside</P><P>output-status: up</P><P>output-line-status: up</P><P>Action: allow</P><P></P><P>ciscoasa# packet-tracer input inside icmp 192.168.200.13 8 0 172.18.2.10 (no problem , everything is allowed)</P><P>Result:</P><P>input-interface: inside</P><P>input-status: up</P><P>input-line-status: up</P><P>output-interface: outside</P><P>output-status: up</P><P>output-line-status: up</P><P>Action: allow</P><P></P><P>Am I missing something in my config? Please advice, thanks</P><P>Here is my&nbsp; config. </P><P></P><P>ASA Version 9.0(3) </P><P>!</P><P>hostname ciscoasa</P><P>domain-name cisco.com</P><P>enable password 8Ry2YjIyt7RRXU24 encrypted</P><P>names</P><P>ip local pool RA_VPN_Pool 172.18.2.10-172.18.2.200 mask 255.255.255.0</P><P>!</P><P>interface Ethernet0/0</P><P> switchport access vlan 2</P><P>!</P><P>interface Ethernet0/1</P><P>!</P><P>interface Ethernet0/2</P><P>!</P><P>interface Ethernet0/3</P><P>!</P><P>interface Ethernet0/4</P><P>!</P><P>interface Ethernet0/5</P><P>!</P><P>interface Ethernet0/6</P><P>!</P><P>interface Ethernet0/7</P><P>!</P><P>interface Vlan1</P><P> nameif inside</P><P> security-level 100</P><P> ip address 192.168.200.1 255.255.255.0 </P><P>!</P><P>interface Vlan2</P><P> nameif outside</P><P> security-level 0</P><P> ip address dhcp setroute </P><P>!</P><P>interface Vlan3</P><P> no nameif</P><P> no security-level</P><P> no ip address</P><P>!</P><P>ftp mode passive</P><P>clock timezone EST -5</P><P>dns domain-lookup inside</P><P>dns domain-lookup outside</P><P>dns server-group DefaultDNS</P><P> domain-name cisco.com</P><P>same-security-traffic permit intra-interface</P><P>object network LOCAL_NET</P><P> subnet 192.168.200.0 255.255.255.0</P><P> description my local network</P><P>object network NETWORK_OBJ_172.18.2.0_24</P><P> subnet 172.18.2.0 255.255.255.0</P><P> description VPN subnet</P><P>access-list splitacl standard permit 172.18.2.0 255.255.255.0 </P><P>access-list NoNAT extended permit ip 192.168.200.0 255.255.255.0 172.18.2.0 255.255.255.0 </P><P>pager lines 24</P><P>logging asdm informational</P><P>mtu inside 1500</P><P>mtu outside 1500</P><P>icmp unreachable rate-limit 1 burst-size 1</P><P>icmp permit any inside</P><P>icmp permit any outside</P><P>asdm image disk0:/asdm-712-102.bin</P><P>no asdm history enable</P><P>arp timeout 14400</P><P>no arp permit-nonconnected</P><P>nat (inside,outside) source static any any destination static NETWORK_OBJ_172.18.2.0_24 NETWORK_OBJ_172.18.2.0_24 no-proxy-arp route-lookup</P><P>!</P><P>object network LOCAL_NET</P><P> nat (inside,outside) dynamic interface</P><P>object network NETWORK_OBJ_172.18.2.0_24</P><P> nat (outside,outside) dynamic interface</P><P>!</P><P>nat (inside,outside) after-auto source dynamic LOCAL_NET interface</P><P>timeout xlate 3:00:00</P><P>timeout pat-xlate 0:00:30</P><P>timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02</P><P>timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00</P><P>timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00</P><P>timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute</P><P>timeout tcp-proxy-reassembly 0:01:00</P><P>timeout floating-conn 0:00:00</P><P>dynamic-access-policy-record DfltAccessPolicy</P><P>user-identity default-domain LOCAL</P><P>http server enable</P><P>http 192.168.200.0 255.255.255.0 inside</P><P>no snmp-server location</P><P>no snmp-server contact</P><P>snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart</P><P>crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac </P><P>crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac </P><P>crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac </P><P>crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac </P><P>crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac </P><P>crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac </P><P>crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac </P><P>crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac </P><P>crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac </P><P>crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac </P><P>crypto ipsec ikev2 ipsec-proposal AES256</P><P> protocol esp encryption aes-256</P><P> protocol esp integrity sha-1 md5</P><P>crypto ipsec ikev2 ipsec-proposal AES192</P><P> protocol esp encryption aes-192</P><P> protocol esp integrity sha-1 md5</P><P>crypto ipsec ikev2 ipsec-proposal AES</P><P> protocol esp encryption aes</P><P> protocol esp integrity sha-1 md5</P><P>crypto ipsec ikev2 ipsec-proposal 3DES</P><P> protocol esp encryption 3des</P><P> protocol esp integrity sha-1 md5</P><P>crypto ipsec ikev2 ipsec-proposal DES</P><P> protocol esp encryption des</P><P> protocol esp integrity sha-1 md5</P><P>crypto ipsec security-association pmtu-aging infinite</P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1</P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5</P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES</P><P>crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map outside_map interface outside</P><P>crypto ca trustpool policy</P><P>crypto ikev2 policy 1</P><P> encryption aes-256</P><P> integrity sha</P><P> group 5 2</P><P> prf sha</P><P> lifetime seconds 86400</P><P>crypto ikev2 policy 10</P><P> encryption aes-192</P><P> integrity sha</P><P> group 5 2</P><P> prf sha</P><P> lifetime seconds 86400</P><P>crypto ikev2 policy 20</P><P> encryption aes</P><P> integrity sha</P><P> group 5 2</P><P> prf sha</P><P> lifetime seconds 86400</P><P>crypto ikev2 policy 30</P><P> encryption 3des</P><P> integrity sha</P><P> group 5 2</P><P> prf sha&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </P><P> lifetime seconds 86400</P><P>crypto ikev2 policy 40</P><P> encryption des</P><P> integrity sha</P><P> group 5 2</P><P> prf sha</P><P> lifetime seconds 86400</P><P>crypto ikev2 enable outside</P><P>crypto ikev1 enable outside</P><P>crypto ikev1 policy 10</P><P> authentication crack</P><P> encryption aes-256</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 20</P><P> authentication rsa-sig</P><P> encryption aes-256</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 30</P><P> authentication pre-share</P><P> encryption aes-256</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 40</P><P> authentication crack</P><P> encryption aes-192</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 50</P><P> authentication rsa-sig</P><P> encryption aes-192</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 60</P><P> authentication pre-share</P><P> encryption aes-192</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 70</P><P> authentication crack</P><P> encryption aes</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 80</P><P> authentication rsa-sig</P><P> encryption aes</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 90</P><P> authentication pre-share</P><P> encryption aes</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 100</P><P> authentication crack</P><P> encryption 3des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 110</P><P> authentication rsa-sig</P><P> encryption 3des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 120</P><P> authentication pre-share</P><P> encryption 3des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 130</P><P> authentication crack</P><P> encryption des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 140</P><P> authentication rsa-sig</P><P> encryption des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto ikev1 policy 150</P><P> authentication pre-share</P><P> encryption des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>telnet 0.0.0.0 0.0.0.0 inside</P><P>telnet timeout 5</P><P>ssh 0.0.0.0 0.0.0.0 inside</P><P>ssh timeout 5</P><P>console timeout 0</P><P>management-access inside</P><P></P><P>dhcpd dns 8.8.8.8</P><P>dhcpd auto_config outside</P><P>!</P><P>dhcpd address 192.168.200.10-192.168.200.41 inside</P><P>dhcpd enable inside</P><P>!</P><P>threat-detection basic-threat</P><P>threat-detection statistics access-list</P><P>no threat-detection statistics tcp-intercept</P><P>ntp authenticate</P><P>ntp server 128.9.176.30</P><P>ntp server 216.218.254.202</P><P>webvpn</P><P> enable inside</P><P> enable outside</P><P> anyconnect image disk0:/anyconnect-win-3.1.04063-k9.pkg 1</P><P> anyconnect profiles RA_VPN_Profille disk0:/RAVPN_client_profile.xml</P><P> anyconnect enable</P><P> tunnel-group-list enable</P><P>group-policy RA_VPN internal</P><P>group-policy RA_VPN attributes</P><P> banner value VPN ACCESS FOR REMOTE USERS</P><P> dns-server value 4.2.2.2 8.8.8.8</P><P> vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless</P><P> split-tunnel-policy tunnelspecified</P><P> split-tunnel-network-list value splitacl</P><P> default-domain value cisco.com</P><P> webvpn</P><P>&nbsp; url-list none</P><P>&nbsp; anyconnect keep-installer installed</P><P>&nbsp; anyconnect ssl rekey time 30</P><P>&nbsp; anyconnect ssl rekey method ssl</P><P>&nbsp; anyconnect profiles value RA_VPN_Profille type user</P><P>&nbsp; anyconnect ask none default anyconnect</P><P>username admin password UVFxq5NPrwI3zghU encrypted privilege 15</P><P>username cisco password ffIRPGpDSOJh9YLq encrypted privilege 15</P><P>tunnel-group RA_VPN type remote-access</P><P>tunnel-group RA_VPN general-attributes</P><P> address-pool RA_VPN_Pool</P><P> default-group-policy RA_VPN</P><P>tunnel-group RA_VPN ipsec-attributes</P><P> ikev1 pre-shared-key *****</P><P>tunnel-group RA_VPN_OUT type remote-access</P><P>tunnel-group RA_VPN_OUT general-attributes</P><P> address-pool RA_VPN_Pool</P><P> default-group-policy RA_VPN</P><P>tunnel-group RA_VPN_OUT webvpn-attributes</P><P> group-alias sslgroup_users enable</P><P>!</P><P>class-map inspect_default</P><P> match default-inspection-traffic</P><P>class-map inspection_default</P><P> match default-inspection-traffic</P><P>!</P><P>!</P><P>policy-map type inspect dns preset_dns_map</P><P> parameters</P><P>&nbsp; message-length maximum client auto</P><P>&nbsp; message-length maximum 512</P><P>policy-map global_policy</P><P> class inspection_default</P><P>&nbsp; inspect dns preset_dns_map </P><P>&nbsp; inspect ftp </P><P>&nbsp; inspect h323 h225 </P><P>&nbsp; inspect h323 ras </P><P>&nbsp; inspect rsh </P><P>&nbsp; inspect rtsp </P><P>&nbsp; inspect esmtp </P><P>&nbsp; inspect sqlnet </P><P>&nbsp; inspect skinny&nbsp; </P><P>&nbsp; inspect sunrpc </P><P>&nbsp; inspect xdmcp </P><P>&nbsp; inspect sip&nbsp; </P><P>&nbsp; inspect netbios </P><P>&nbsp; inspect tftp </P><P>&nbsp; inspect ip-options </P><P>&nbsp; inspect icmp </P><P>policy-map type inspect dns migrated_dns_map_1</P><P> parameters</P><P>&nbsp; message-length maximum 512</P><P>!</P><P>service-policy global_policy global</P><P>prompt hostname context </P><P>no call-home reporting anonymous</P><P>Cryptochecksum:532324ff4b43c586ce13016aa19ec002</P><P>: end</P> Tue, 12 Mar 2019 03:53:03 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449941#M268695 soaliou123 2019-03-12T03:53:03Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449942#M268696 <HTML><HEAD></HEAD><BODY><P>Hello Man,</P><P></P><P style="background-color: #ffffff; border-collapse: collapse; font-size: 12px; list-style: none; font-family: Arial, verdana, sans-serif;"><STRONG>access-list splitacl standard permit 172.18.2.0 255.255.255.0</STRONG></P><P></P><P>That's wrong</P><P></P><P>Change it to </P><P></P><P><STRONG style="font-family: Arial, verdana, sans-serif; font-size: 12px;">access-list splitacl standard permit </STRONG><SPAN style="font-size: 10pt;"> 192.168.200.0 255.255.255.0</SPAN></P><P></P><P><SPAN style="font-size: 10pt;">Then let me know how it goes <SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/4.5.4/images/emoticons/happy.gif"></SPAN></SPAN></P><P></P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Tue, 04 Mar 2014 15:37:00 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449942#M268696 Julio Carvajal 2014-03-04T15:37:00Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449943#M268697 <HTML><HEAD></HEAD><BODY><P>Now I can ping (local network) 192.168.200.X from VPN PC ( VPN network) 172.18.2.X,&nbsp; but not the other way around.</P><P></P><P>Any suggestions? Thanks</P></BODY></HTML> Tue, 04 Mar 2014 22:31:45 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449943#M268697 soaliou123 2014-03-04T22:31:45Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449944#M268700 <HTML><HEAD></HEAD><BODY><P>I'm going to go out on a limb here and guess you have Windows Firewall enabled which is blocking ICMP from the network to your PC.</P></BODY></HTML> Tue, 04 Mar 2014 22:50:44 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449944#M268700 jj27 2014-03-04T22:50:44Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449945#M268701 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>Glad to know it's almost working (Half-Way)</P><P></P><P>In this case I would ask you to check:</P><P></P><P>Disable Windows Firewall or any powerful Anti-Virus that could be stopping this and on the client and if it does not work then also do the following</P><P></P><P>cap capin interface inside match icmp host x.x.x.x (VPN client) x.x.x.x (Inside IP)</P><P>cap asp type asp-drop all circular-buffer</P><P></P><P>Try to ping&nbsp; and provide</P><P>show cap capin</P><P>show cap asp | include VPN_CLIENT_IP</P><P></P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Tue, 04 Mar 2014 23:14:52 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449945#M268701 Julio Carvajal 2014-03-04T23:14:52Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449946#M268702 <HTML><HEAD></HEAD><BODY><P>Everything is works fine, But I can connect vpn and try to RDP to inside host (192.168.200.X) it fails.</P><P>Error says:" This computer can't connect to the remote computer"</P><P></P><P>Any idea. Thanks</P></BODY></HTML> Tue, 04 Mar 2014 23:23:51 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449946#M268702 soaliou123 2014-03-04T23:23:51Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449947#M268703 <HTML><HEAD></HEAD><BODY><P>If everything is working now, Please mark question as answered and rate the posts,</P><P></P><P>Then we can help</P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Tue, 04 Mar 2014 23:25:27 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449947#M268703 Julio Carvajal 2014-03-04T23:25:27Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449948#M268704 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>Awesome, thanks for the rating <SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/4.5.4/images/emoticons/happy.gif"></SPAN></P><P></P><P></P><P>Can you do</P><P style="background-color: #ffffff; border-collapse: collapse; font-size: 12px; list-style: none; font-family: Arial, verdana, sans-serif;">cap capin interface inside match tcp host x.x.x.x (VPN client) x.x.x.x (Inside IP) eq 3389</P><P style="background-color: #ffffff; border-collapse: collapse; font-size: 12px; list-style: none; font-family: Arial, verdana, sans-serif;">cap asp type asp-drop all circular-buffer</P><P></P><P style="background-color: #ffffff; border-collapse: collapse; font-size: 12px; list-style: none; font-family: Arial, verdana, sans-serif;">Try to connect and share</P><P style="background-color: #ffffff; border-collapse: collapse; font-size: 12px; list-style: none; font-family: Arial, verdana, sans-serif;">show cap capin</P><P style="background-color: #ffffff; border-collapse: collapse; font-size: 12px; list-style: none; font-family: Arial, verdana, sans-serif;">show cap asp | include VPN_CLIENT_IP</P><P></P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Wed, 05 Mar 2014 02:30:58 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449948#M268704 Julio Carvajal 2014-03-05T02:30:58Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449949#M268705 <HTML><HEAD></HEAD><BODY><P>Nothing came up</P></BODY></HTML> Wed, 05 Mar 2014 03:47:50 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449949#M268705 soaliou123 2014-03-05T03:47:50Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449950#M268706 <HTML><HEAD></HEAD><BODY><P>Nothing at all???? on both captures?</P><P></P><P>Does not make sense, can you share updated configuration....</P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Wed, 05 Mar 2014 03:50:12 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449950#M268706 Julio Carvajal 2014-03-05T03:50:12Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449951#M268707 <HTML><HEAD></HEAD><BODY><P>this is what I got</P><P>ciscoasa# show cap capin&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </P><P></P><P>12 packets captured</P><P></P><P>&nbsp;&nbsp; 1: 18:51:15.213550&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 172.18.2.10.7208 &gt; 192.168.200.10.3389: S 230826238:230826238(0) win 64512 <MSS 1378=""> </MSS></P><P>&nbsp;&nbsp; 2: 18:51:15.213917&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.7208: R 0:0(0) ack 230826239 win 0 </P><P>&nbsp;&nbsp; 3: 18:51:18.163535&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 172.18.2.10.7208 &gt; 192.168.200.10.3389: S 3681248740:3681248740(0) win 64512 <MSS 1378=""> </MSS></P><P>&nbsp;&nbsp; 4: 18:51:18.163886&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.7208: R 0:0(0) ack 3681248741 win 0 </P><P>&nbsp;&nbsp; 5: 18:52:39.778005&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 172.18.2.10.9641 &gt; 192.168.200.10.3389: S 1026845418:1026845418(0) win 64512 <MSS 1378=""> </MSS></P><P>&nbsp;&nbsp; 6: 18:52:39.778386&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.9641: R 0:0(0) ack 1026845419 win 0 </P><P>&nbsp;&nbsp; 7: 18:52:42.796284&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 172.18.2.10.9641 &gt; 192.168.200.10.3389: S 1342445616:1342445616(0) win 64512 <MSS 1378=""> </MSS></P><P>&nbsp;&nbsp; 8: 18:52:42.796543&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.9641: R 0:0(0) ack 1342445617 win 0 </P><P>&nbsp;&nbsp; 9: 18:53:03.589233&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 172.18.2.10.10424 &gt; 192.168.200.10.3389: S 669986592:669986592(0) win 64512 <MSS 1378=""> </MSS></P><P>&nbsp; 10: 18:53:03.589584&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.10424: R 0:0(0) ack 669986593 win 0 </P><P>&nbsp; 11: 18:53:04.509983&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 172.18.2.10.10424 &gt; 192.168.200.10.3389: S 307456710:307456710(0) win 64512 <MSS 1378=""> </MSS></P><P>&nbsp; 12: 18:53:04.510349&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.10424: R 0:0(0) ack 307456711 win 0 </P><P>12 packets shown</P><P>ciscoasa# show cap asp | include 172.18.2.10 (nothing came up)</P><P>ciscoasa#</P><P></P><P>I also added these commands but no success</P><P>access-list OUTSIDE remark Allow RDP</P><P>access-list OUTSIDE permit tcp any host 24.99.39.170 eq 3389</P><P> access-group OUTSIDE in interface outside</P></BODY></HTML> Wed, 05 Mar 2014 23:55:16 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449951#M268707 soaliou123 2014-03-05T23:55:16Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449952#M268708 <HTML><HEAD></HEAD><BODY><P>Awesome...........</P><P></P><P></P><P>So </P><P>ciscoasa# show cap asp | include 172.18.2.10 (nothing came up) Means: ASA is not dropping any packets.</P><P></P><P></P><P>For the cap capin:</P><P> 2: 18:51:15.213917&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.7208: <SPAN style="text-decoration: underline;"><STRONG>R </STRONG></SPAN>0:0(0) ack 230826239 win 0</P><P></P><P>All of the even lines have something in common: and that is the RESET packet.</P><P></P><P>This let us know the server is not allowing the connection.</P><P></P><P>Make sure your Antivirus/Firewall allows that connection and more important.MAKE sure you have configured ur PC to allow RDP connections for this:</P><P>Go to system/Properties/Remote Access Config/ and then allow RDP.</P><P></P><P></P><P>ASA is not the problem man <SPAN __jive_emoticon_name="grin" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/4.5.4/images/emoticons/grin.gif"></SPAN></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Thu, 06 Mar 2014 00:00:51 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449952#M268708 Julio Carvajal 2014-03-06T00:00:51Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449953#M268709 <HTML><HEAD></HEAD><BODY><P>I disabled all firewalls in this PC.</P></BODY></HTML> Thu, 06 Mar 2014 00:14:41 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449953#M268709 soaliou123 2014-03-06T00:14:41Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449954#M268710 <HTML><HEAD></HEAD><BODY><P>Then you have not enabled the RDP service,</P><P></P><P>Follow the steps I provided and then get back to me</P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Thu, 06 Mar 2014 00:17:58 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449954#M268710 Julio Carvajal 2014-03-06T00:17:58Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449955#M268711 <HTML><HEAD></HEAD><BODY><P>RDP is enabled. That was the first I did before I try to connect to it</P></BODY></HTML> Thu, 06 Mar 2014 00:21:06 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449955#M268711 soaliou123 2014-03-06T00:21:06Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449956#M268712 <HTML><HEAD></HEAD><BODY><P>Hello,</P><P></P><P>Hmm does not make any sense.</P><P></P><P>2: 18:51:15.213917&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.3389 &gt; 172.18.2.10.7208:</P><P> <STRONG style="border-collapse: collapse; list-style: none;">R </STRONG></P><P>0:0(0) ack 230826239 win 0</P><P></P><P></P><P>A reset is usually seen when the Service is not enabled on the server side or when there is something blocking it.</P><P></P><P>Can you run wireshark on the PC? so you can determine if packets are even reaching the PC (I would say they are).</P><P></P><P>Look for something blocking this trafic inside the PC</P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Thu, 06 Mar 2014 00:23:17 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449956#M268712 Julio Carvajal 2014-03-06T00:23:17Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449957#M268713 <HTML><HEAD></HEAD><BODY><P>ciscoasa# show cap asp | include 192.168.200.10 ( local network)</P><P>I have this : Does it make any sense? or I am supposed to capture VPN ip address only?</P><P></P><P> 636: 19:24:03.258119&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 637: 19:24:04.009063&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 638: 19:24:04.758108&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 639: 19:24:04.998086&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 640: 19:24:05.508015&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 641: 19:24:05.748023&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 642: 19:24:06.260408&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security checks failed</P><P> 643: 19:24:06.497944&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 802.1Q vlan#1 P0 192.168.200.10.137 &gt; 192.168.200.255.137:&nbsp; udp 50 Drop-reason: (sp-security-failed) Slowpath security c</P></BODY></HTML> Thu, 06 Mar 2014 00:31:02 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449957#M268713 soaliou123 2014-03-06T00:31:02Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449958#M268714 <HTML><HEAD></HEAD><BODY><P>That ASP capture will show you all of the packets being dropped by the ASA. </P><P></P><P>In this case is showing us UDP 137 which I think is for Netbios, Not related to our issue.</P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Thu, 06 Mar 2014 00:32:38 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449958#M268714 Julio Carvajal 2014-03-06T00:32:38Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449959#M268716 <HTML><HEAD></HEAD><BODY><P>So you think more than likely it is a firewall issue in the PC even though I turned them off?</P></BODY></HTML> Thu, 06 Mar 2014 00:45:50 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449959#M268716 soaliou123 2014-03-06T00:45:50Z ssl vpn connected successfully but I can't ping inside hosts and https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449960#M268719 <HTML><HEAD></HEAD><BODY><P>Not necesarlly the firewall but there is a service not turned on or an app blocking the traffic.</P><P></P><P>Again a RESET means I dont want you to connect as I am not listening on this port.</P><P></P><P>There is nothing we can do on the FW side to change this behavior.</P><P></P><P>Try with another PC and see how it goes.</P><P></P><P>Captures don't lie bud <SPAN __jive_emoticon_name="grin" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/4.5.4/images/emoticons/grin.gif"></SPAN></P><P></P><P></P><P>Looking for some Networking Assistance?&nbsp; <BR /><SPAN>Contact me directly at </SPAN><A class="jive-link-email-small" href="mailto:jcarvaja@laguiadelnetworking.com">jcarvaja@laguiadelnetworking.com</A><SPAN> </SPAN><BR /> <BR />I will fix your problem ASAP. <BR /> <BR />Cheers, <BR /> <BR />Julio Carvajal Segura <BR /><A class="jive-link-external-small" href="http://laguiadelnetworking.com">http://laguiadelnetworking.com</A></P></BODY></HTML> Thu, 06 Mar 2014 00:59:02 GMT https://community.cisco.com/t5/network-security/ssl-vpn-connected-successfully-but-i-can-t-ping-inside-hosts-and/m-p/2449960#M268719 Julio Carvajal 2014-03-06T00:59:02Z