Problem to access share from VPN

Thiago Cella — Tue, 12 Mar 2019 02:44:04 GMT

Im having troubles to access share over vpn.

When the source is the vpnclient(11.11.7.0/24) and i try access the share in server 11.11.18.2, dont works.

But the inverse works, if i create the share on vpn client (11.11.7.0/24), and try access this with source 11.11.18.2 , works! This problem occurs only when try access the share, if try access any application (3389,80,22,23) all works.

Could you help-me?

Tks

Follow the topology :

Follow the ASA -- version 8.2(5)--- Config :

===================================== NAT ======================================

global (outside) 1 interface

nat (inside) 0 access-list nat0

nat (inside) 1 0.0.0.0 0.0.0.0

access-list nat0 extended permit ip 11.11.7.0 255.255.255.0 11.11.17.0 255.255.255.0

access-list nat0 extended permit ip 11.11.17.0 255.255.255.0 11.11.7.0 255.255.255.0

===================================== ACL- Inside ======================================

access-group inside_in in interface inside

access-list inside_in extended permit ip 11.11.7.0 255.255.255.0 11.11.18.0 255.255.255.0

access-list inside_in extended permit ip 11.11.18.0 255.255.255.0 11.11.7.0 255.255.255.0

===================================== MTU ======================================

mtu outside 1500

mtu inside 1500

===================================== Route ======================================

route inside 11.11.18.0 255.255.0.0 11.11.3.129

===================================== Timeouts======================================

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

===================================== Threat e Sec ======================================

threat-detection basic-threat

threat-detection statistics

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ip verify reverse-path interface outside

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

===================================== VPN Config ======================================

access-list vpn standard permit 11.11.18.0 255.255.255.0

ip local pool access-vpn 11.11.7.0-11.11.7.254 mask 255.255.255.0

group-policy vpn internal

group-policy vpn attributes

dns-server value 11.11.1.10 11.11.1.11

vpn-tunnel-protocol IPSec

split-tunnel-network-list value vpn

default-domain value xxx.xxx.xx

tunnel-group vpn type remote-access

tunnel-group vpn general-attributes

address-pool access-vpn

authentication-server-group xxxx.xxx

default-group-policy vpn

password-management

tunnel-group vpn ipsec-attributes

pre-shared-key *****

crypto dynamic-map outside_dyn_map 10 set transform-set ESP-3DES-SHA ESP-AES-128-SHA

crypto dynamic-map outside_dyn_map 10 set security-association lifetime seconds 86400

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto isakmp policy 1

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 43200

crypto isakmp policy 20

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash sha

group 1

lifetime 86400

crypto isakmp policy 40

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 60

authentication pre-share

encryption aes-256

hash sha

group 5

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

===================================== Policy-Map ======================================

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

inspect icmp error

inspect ip-options

inspect netbios

service-policy global_policy global

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Follow the 3560 config :

service tcp-keepalives-in

service tcp-keepalives-out

system mtu routing 1500

no ip source-route

ip routing

ip tcp selective-ack

ip tcp path-mtu-discovery age-timer 10

interface Vlan60

ip address 11.11.60.254 255.255.255.0

interface Vlan3

description -=- Internet -=-

ip address 11.11.3.129 255.255.255.252

ip route 0.0.0.0 0.0.0.0 11.11.3.130

ip route 11.11.18.0 255.255.255.0 11.11.60.2

This sounds like there is an

Marius Gunnerud — Tue, 01 Apr 2014 06:47:15 GMT

This sounds like there is an issue with the share on the server. If you try to access the share from a host on the 11.11.60.0/24 network, are you able to access the share? If not then take a closer look at the file server as there is most likely a permissions issue or similar.

Please remember to rate and select a correct answer

topic Problem to access share from VPN in Network Security

Problem to access share from VPN

This sounds like there is an