VPN Access to an IP that can be accessed via EIGRP

ccarter81 — Tue, 12 Mar 2019 03:07:00 GMT

I have a question. I have a VPN that sits on the external interface using the IP of 10.5.79.X/20. I have a production network connected to a corporate network using MPLS and EIGRP to share the routes. The production network can access the corporate network, but the the VPN users can't. I need to be able to access anything on that network which is mainly a 172.18.0.0 summarized by EIGRP network. I had this working before, but can't get it working again about my Firewall dumped on me.

ASA Version 8.4(2)

hostname hp-asa-5510-DR

enable password 1qF1n5PuI7A.2DV. encrypted

passwd 1qF1n5PuI7A.2DV. encrypted

names

dns-guard

interface Ethernet0/0

speed 100

duplex full

nameif external

security-level 0

ip address *142.189.26 255.255.255.252

interface Ethernet0/1

nameif internal

security-level 100

ip address 10.5.64.6 255.255.240.0

interface Ethernet0/1.1

vlan 2

nameif Guest

security-level 90

ip address 192.168.3.1 255.255.255.0

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

boot system disk0:/asa842-k8.bin

boot system disk0:/asa821-k8.bin

ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns domain-lookup external

dns domain-lookup internal

dns server-group DefaultDNS

name-server 208.67.222.222

dns server-group Guest

name-server 10.5.64.197

name-server 8.8.8.8

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network obj-10.5.65.239

host 10.5.65.239

object network obj-10.5.65.253

host 10.5.65.253

object network obj-10.5.65.42

host 10.5.65.42

object network obj-10.5.65.219

host 10.5.65.219

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network Cegedim

subnet 10.5.250.0 255.255.255.248

description dendrite site to site VPN

object network dfb

subnet 10.5.0.0 255.255.0.0

object network lausanne

subnet 192.168.250.0 255.255.255.0

description Lausanne

object network dfbgroup

subnet 10.5.0.0 255.255.0.0

object network DPT

subnet 10.5.16.0 255.255.240.0

object network hpbexch

host 10.5.64.198

object network hpbmsvpn

host 10.5.64.196

object network kacehost

host 10.5.65.189

object network hpbsentry

host 10.5.64.194

object network hpbMDM

host 10.5.64.195

object network hperoom

host 10.5.65.211

description healthpoint eroom server

object network spintranet

host 10.5.65.185

description sharepoint intranet

object network spsales

host 10.5.65.194

description sharepoint sales

object network spteams

host 10.5.65.183

description sharepoint teams

object network Guest

subnet 192.168.3.0 255.255.255.0

object network Crystal

host 10.5.65.203

object network ERPLN

host 10.5.65.234

object network ERPLNDB

host 10.5.65.237

object service dpt

service tcp source range 1 65000 destination range 1 65000

description dpt ports

object network Documentum

host 10.5.17.216

object network DPTDocumentum

host 10.5.17.216

description Documentum

object network EzDocs

host 10.5.17.235

description EzDocs

object network Aerosol

subnet 10.5.32.0 255.255.240.0

object network Brooks

subnet 10.5.128.0 255.255.240.0

object network DPTScience

subnet 10.5.48.0 255.255.240.0

object network LakeWood

subnet 10.5.80.0 255.255.240.0

object network Plant

subnet 10.5.0.0 255.255.240.0

object network warehouse

subnet 10.5.240.0 255.255.240.0

object network NotesApps

host 10.5.65.235

object network DPTNotes

host 10.5.17.246

object network DNSServer

host 10.5.64.197

object network GuestNetwork

subnet 192.168.3.0 255.255.255.0

object network KACE

host 10.5.65.189

object network mdm2

host 10.5.64.195

object network guesterooms

host 10.5.65.211

object network DNSServer2

host 10.5.64.199

object network asa_LAN

host 10.5.64.6

object network guestspsales

host 10.5.65.194

object network JohnsonControlServer

host 10.5.65.33

description JC Server

object network guestexchange

host 10.5.64.198

description Guest Exchange

object network guestmobile2

host 10.5.64.194

object network DPTDocB

host 10.5.17.215

object-group service EDI tcp

port-object eq 50080

port-object eq 6080

port-object eq www

object-group service Exchange tcp

port-object eq 587

port-object eq www

port-object eq https

port-object eq smtp

object-group service Lotus-Sametime tcp

port-object eq 1503

port-object eq 1516

port-object eq 1533

port-object eq 8081

port-object range 8082 8084

port-object range 9092 9094

port-object eq www

port-object eq https

port-object eq lotusnotes

port-object eq rtsp

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group service VPN-MS tcp-udp

port-object eq 1701

port-object eq 1723

port-object eq 4500

port-object eq 500

object-group network Verizon-Servers

network-object 216.82.240.0 255.255.240.0

network-object 85.158.136.0 255.255.248.0

network-object 193.109.254.0 255.255.254.0

network-object 194.106.220.0 255.255.254.0

network-object 195.245.230.0 255.255.254.0

network-object 62.231.131.0 255.255.255.0

network-object 64.124.170.128 255.255.255.240

network-object 212.125.74.44 255.255.255.255

network-object 195.216.16.211 255.255.255.255

object-group network FDA_SecureEmail

network-object host 150.148.2.65

network-object host 150.148.2.66

object-group network Web-Server-Stuff

network-object host 204.71.89.34

network-object host 204.71.89.35

network-object host 204.71.89.33

network-object host 66.240.207.149

network-object host 68.168.88.169

network-object host 50.112.164.102

object-group service DFB-eRoom tcp

port-object eq www

port-object eq https

object-group network EDI-Customers

network-object host 129.33.204.13

network-object host 143.112.144.25

network-object host 160.109.101.195

network-object host 198.89.160.113

network-object host 199.230.128.125

network-object host 199.230.128.85

network-object host 205.233.244.208

network-object host 198.89.170.134

network-object host 198.89.170.135

network-object host 199.230.128.54

object-group service MDM tcp

description MobileIron ports

port-object eq 9997

port-object eq 9998

port-object eq https

object-group network OpenDNS

description OpenDNS Servers

network-object host 208.67.220.220

network-object host 208.67.222.222

network-object host 8.8.8.8

network-object host 68.113.206.10

object-group network healthpoint

network-object 10.5.64.0 255.255.240.0

object-group network vpnpool

network-object 10.5.79.0 255.255.255.0

object-group network dfb_group

network-object object dfbgroup

object-group network lausanne_group

network-object 192.168.250.0 255.255.255.0

object-group network DPTNetwork

network-object object DPT

network-object object Aerosol

network-object object Brooks

network-object object LakeWood

network-object object Plant

object-group network DM_INLINE_NETWORK_1

network-object object Cegedim

network-object object lausanne

group-object DPTNetwork

network-object object DPTNotes

object-group service DFB-Allow tcp

port-object eq 1025

port-object eq 1119

port-object eq 1120

port-object range 1222 1225

port-object eq 1433

port-object eq 1503

port-object eq 1516

port-object eq 1533

port-object range 16384 16403

port-object eq 1755

port-object eq 1919

port-object eq 1935

port-object range 2195 2196

port-object eq 3050

port-object eq 3080

port-object eq 3101

port-object eq 3244

port-object eq 3264

port-object eq 3306

port-object eq 3389

port-object eq 3724

port-object eq 4000

port-object eq 402

port-object range 4080 4081

port-object eq 4085

port-object eq 50080

port-object eq 5085

port-object range 5220 5223

port-object eq 5297

port-object eq 5298

port-object eq 5353

port-object eq 5550

port-object eq 5678

port-object eq 58570

port-object eq 5900

port-object eq 6080

port-object eq 6112

port-object eq 6114

port-object eq 6900

port-object eq 7800

port-object eq 8010

port-object eq 8080

port-object eq 8084

port-object eq 81

port-object eq 9081

port-object eq 9090

port-object eq 9997

port-object eq aol

port-object eq citrix-ica

port-object eq echo

port-object eq ftp

port-object eq ftp-data

port-object eq www

port-object eq https

port-object eq lotusnotes

port-object eq rtsp

port-object eq sip

port-object eq sqlnet

port-object eq ssh

port-object eq 442

object-group network webservers

network-object host 204.71.89.34

network-object host 204.71.89.35

object-group network DM_INLINE_NETWORK_2

network-object object KACE

network-object object guesterooms

network-object object guestspsales

network-object object JohnsonControlServer

network-object object mdm2

object-group network DM_INLINE_NETWORK_3

network-object host 10.5.65.230

network-object host 10.5.65.232

network-object object hpbexch

object-group service DM_INLINE_TCP_1 tcp

port-object eq www

port-object eq https

object-group service kace tcp

port-object eq 52230

port-object eq www

port-object eq https

port-object eq 445

port-object eq netbios-ssn

object-group service DM_INLINE_TCP_0 tcp

port-object eq www

port-object eq https

object-group service DM_INLINE_SERVICE_1

service-object ip

service-object tcp destination eq www

service-object tcp destination eq https

object-group service DM_INLINE_TCP_2 tcp

port-object eq www

port-object eq https

object-group network VLAN_Switches

network-object host 192.168.10.10

network-object host 192.168.10.11

network-object host 192.168.10.12

network-object host 192.168.10.13

network-object host 192.168.10.14

network-object host 192.168.10.15

network-object host 192.168.10.16

network-object host 192.168.10.17

network-object host 192.168.10.1

object-group network Crystal_ERP

description Crystal Enterprise and Infor LN

network-object object Crystal

network-object object ERPLN

network-object object ERPLNDB

network-object object NotesApps

object-group service DM_INLINE_SERVICE_2

service-object ip

service-object tcp destination eq www

service-object tcp destination eq https

object-group network GuestDNS

description DNS Servers for Guest

network-object object DNSServer

network-object object DNSServer2

object-group service DM_INLINE_TCP_3 tcp

port-object eq 3389

port-object eq 3390

object-group network DM_INLINE_NETWORK_4

group-object healthpoint

group-object vpnpool

access-list external_access_out extended permit object-group DM_INLINE_SERVICE_1 192.168.3.0 255.255.255.0 any

access-list external_access_out remark Production ACL

access-list external_access_out extended permit tcp any any object-group DFB-Allow

access-list external_access_out extended permit icmp any any

access-list external_access_out extended permit tcp any object-group Web-Server-Stuff

access-list external_access_out remark Site to Site connections

access-list external_access_out extended permit ip any object-group DM_INLINE_NETWORK_1

access-list external_access_out extended permit udp any object-group OpenDNS eq domain

access-list external_access_out extended permit ip object-group DM_INLINE_NETWORK_3 any

access-list split standard permit 10.5.64.0 255.255.240.0

access-list split standard permit 10.5.250.0 255.255.255.248

access-list split standard permit 10.5.128.0 255.255.240.0

access-list split standard permit 10.5.144.0 255.255.240.0

access-list split standard permit 10.5.16.0 255.255.240.0

access-list split standard permit 10.5.32.0 255.255.240.0

access-list split standard permit 10.5.96.0 255.255.240.0

access-list split standard permit 10.5.80.0 255.255.240.0

access-list split standard permit 10.5.48.0 255.255.240.0

access-list split standard permit 10.5.0.0 255.255.240.0

access-list split remark lausanne

access-list split standard permit 192.168.250.0 255.255.255.0

access-list split standard permit 172.18.0.0 255.255.0.0

access-list split remark HP

access-list external_access_in extended permit object-group DM_INLINE_SERVICE_2 any 192.168.3.0 255.255.255.0

access-list external_access_in remark Sharepoint

access-list external_access_in extended permit tcp any object spsales object-group DM_INLINE_TCP_2

access-list external_access_in remark Sharepoint

access-list external_access_in extended permit tcp any object spteams object-group DM_INLINE_TCP_1

access-list external_access_in remark Sharepoint

access-list external_access_in extended permit tcp any object spintranet object-group DM_INLINE_TCP_0

access-list external_access_in remark healthpoint erooms

access-list external_access_in extended permit tcp any object hperoom object-group DFB-eRoom

access-list external_access_in remark MDM2 VSP

access-list external_access_in extended permit tcp any object hpbMDM object-group MDM

access-list external_access_in remark New Sentry

access-list external_access_in extended permit tcp any object hpbsentry eq https

access-list external_access_in remark kace mgmt appliacne

access-list external_access_in extended permit tcp any object kacehost object-group kace

access-list external_access_in remark authentication server

access-list external_access_in extended permit object-group TCPUDP any object hpbmsvpn object-group VPN-MS

access-list external_access_in extended permit gre any object hpbmsvpn

access-list external_access_in remark HPB.NET new forest Exchange

access-list external_access_in extended permit tcp any object hpbexch object-group Exchange

access-list external_access_in remark EDI Inbound

access-list external_access_in extended permit tcp any host 10.5.65.42 object-group EDI

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

access-list external_cryptomap extended permit ip object-group healthpoint object Cegedim

access-list external_cryptomap_1 extended permit ip object-group dfb_group object-group lausanne_group

access-list external_cryptomap_2 extended permit ip object-group DM_INLINE_NETWORK_4 object-group DPTNetwork

access-list Guest_access_in extended deny tcp 192.168.3.0 255.255.255.0 object-group GuestDNS object-group DM_INLINE_TCP_3 inactive

access-list Guest_access_in extended permit ip 192.168.3.0 255.255.255.0 object-group GuestDNS inactive

access-list Guest_access_in extended permit ip 192.168.3.0 255.255.255.0 object-group DM_INLINE_NETWORK_2

access-list Guest_access_in extended deny ip 192.168.3.0 255.255.255.0 10.5.64.0 255.255.240.0

access-list Guest_access_in extended permit ip 192.168.3.0 255.255.255.0 any

access-list Guest_access_out extended permit ip any any inactive

access-list Guest_access_out extended permit ip any 192.168.3.0 255.255.255.0

no pager

logging enable

logging buffer-size 1045786

logging asdm informational

mtu external 1500

mtu internal 1500

mtu Guest 1500

mtu management 1500

ip local pool HPVPNClients 10.5.79.0-10.5.79.254 mask 255.255.255.0

ip verify reverse-path interface external

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any external

icmp permit any internal

asdm image disk0:/asdm-645.bin

no asdm history enable

arp external *142.189.93 0024.c4c0.4cc0

arp timeout 14400

nat (internal,external) source static dfb dfb destination static vpnpool vpnpool route-lookup

nat (internal,external) source static dfb dfb destination static lausanne lausanne

nat (internal,external) source static healthpoint healthpoint destination static Cegedim Cegedim

nat (external,internal) source static DPTNetwork DPTNetwork destination static Crystal_ERP Crystal_ERP no-proxy-arp

nat (internal,external) source static healthpoint healthpoint destination static DPTDocumentum DPTDocumentum unidirectional

nat (internal,external) source static healthpoint healthpoint destination static DPTDocB DPTDocB unidirectional

nat (internal,external) source static healthpoint healthpoint destination static EzDocs EzDocs unidirectional

nat (internal,external) source static healthpoint healthpoint destination static DPTNotes DPTNotes unidirectional

object network obj-10.5.65.239

nat (internal,external) static *142.189.82

object network obj-10.5.65.253

nat (internal,external) static *142.189.83

object network obj-10.5.65.42

nat (internal,external) static *142.189.84

object network obj-10.5.65.219

nat (internal,external) static *142.189.87

object network obj_any

nat (internal,external) dynamic interface dns

object network hpbexch

nat (internal,external) static *142.189.91

object network hpbmsvpn

nat (internal,external) static *142.189.82

object network kacehost

nat (internal,external) static *142.189.90

object network hpbsentry

nat (internal,external) static *142.189.92

object network hpbMDM

nat (internal,external) static *142.189.93

object network hperoom

nat (internal,external) static *142.189.88

object network spintranet

nat (internal,external) static *142.189.85

object network spsales

nat (internal,external) static *142.189.89

object network spteams

nat (internal,external) static *142.189.94

object network GuestNetwork

nat (Guest,external) dynamic interface

access-group external_access_in in interface external

access-group external_access_out out interface external

access-group Guest_access_in in interface Guest

access-group Guest_access_out out interface Guest

route external 0.0.0.0 0.0.0.0 *142.189.25 1

route external 10.5.16.0 255.255.240.0 *142.189.25 1

route external 10.5.32.0 255.255.240.0 *142.189.25 1

route external 10.5.80.0 255.255.240.0 *142.189.25 1

route external 10.5.128.0 255.255.240.0 *142.189.25 1

route external 10.5.240.0 255.255.240.0 *142.189.25 1

route external 10.5.250.0 255.255.255.248 *142.189.25 1

route internal 172.18.0.0 255.255.255.255 10.5.64.1 1

route external 192.168.250.0 255.255.255.0 *142.189.25 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server VPN-RADAuth protocol radius

aaa-server VPN-RADAuth (internal) host 10.5.65.253

key *****

radius-common-pw *****

aaa-server VPN-RADAuth (internal) host 10.5.65.240

key *****

aaa-server VPN-RADAuthHPB protocol radius

aaa-server VPN-RADAuthHPB (internal) host 10.5.64.196

key *****

radius-common-pw *****

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 management

http 10.5.0.0 255.255.0.0 internal

http 0.0.0.0 0.0.0.0 external

http 0.0.0.0 0.0.0.0 internal

snmp-server host internal 10.5.65.210 community ***** version 2c

snmp-server location Healthpoint.Vickery

snmp-server contact Jonathan Henry

snmp-server community *****

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256