topic Re: VPN Client is Connected but Unable to Ping Internal Network in Network Security

VPN Client is Connected but Unable to Ping Internal Network

noorzulfadli.mustafa — Tue, 12 Mar 2019 01:16:03 GMT

Dear Experts,

I have created a VPN connection for ASA 5512-X by using the wizards and nothing seems to be wrong on the wizards's config.

I am able to connect to the network by using the VPN but unable to ping internal network.

Below is my config for your reference:

Result of the command: "sh run"

: Saved

ASA Version 8.6(1)2

hostname FAA-ASA-1

enable password crzcsirI44h2BHoz encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface GigabitEthernet0/0

nameif outside

security-level 0

ip address 211.25.191.2 255.255.255.224

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 172.16.2.5 255.255.255.0

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/4

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/5

shutdown

no nameif

no security-level

no ip address

interface Management0/0

nameif mgmt

security-level 0

ip address 192.168.1.1 255.255.255.0

management-only

ftp mode passive

clock timezone MYT 8

dns server-group DefaultDNS

name-server 203.121.16.85

name-server 203.121.16.120

object network FAA-PubIP

range 211.25.191.3 211.25.191.31

description FAA Pub IP Pool

object network FAA-Net

subnet 172.16.0.0 255.255.0.0

object network obj_211.25.191.3

host 211.25.191.3

object network NETWORK_OBJ_172.16.48.0_24

subnet 172.16.48.0 255.255.255.0

object network IP_Management

subnet 172.16.2.0 255.255.255.0

object network Private

subnet 172.16.11.0 255.255.255.0

object network Private_Wifi

subnet 172.16.14.0 255.255.255.0

object network Public

subnet 172.16.120.0 255.255.254.0

object network Server

subnet 172.16.0.128 255.255.255.128

object network obj_211.25.191.4

host 211.25.191.4

object network obj_211.25.191.5

host 211.25.191.5

object network obj_211.25.191.6

host 211.25.191.6

object network obj_211.25.191.7

host 211.25.191.7

object network FAA-PrivateITvLAN

subnet 172.16.16.0 255.255.255.248

description FAA IT VLAN Only

object network obj_211.25.191.10

host 211.25.191.10

object network VPN

subnet 172.16.48.0 255.255.255.0

object network CoreSwitch

host 172.16.2.1

object-group network FAA_PubIP

network-object object FAA-PubIP

access-list outside_access_in extended permit icmp any any

access-list outside_access_in extended deny ip any any

access-list FAA_Split_Tunnelling_ACL standard permit any

access-list inside_access_in extended permit ip any any

pager lines 24

logging enable

logging asdm informational

logging from-address kahlil@faa.org.my

mtu outside 1500

mtu inside 1500

mtu mgmt 1500

ip local pool vpn-pool 172.16.48.11-172.16.48.240 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source dynamic any FAA-PubIP inactive

nat (outside,inside) source dynamic any FAA-PubIP inactive

nat (inside,outside) source static Server obj_211.25.191.3

nat (inside,outside) source static Private_Wifi obj_211.25.191.5

nat (inside,outside) source static Private obj_211.25.191.4

nat (inside,outside) source static Private_Wifi obj_211.25.191.6

nat (inside,outside) source static Public obj_211.25.191.7

nat (inside,outside) source static FAA-PrivateITvLAN obj_211.25.191.10

nat (inside,outside) source static FAA-Net obj_211.25.191.3 inactive

nat (inside,any) source static any any destination static VPN VPN

access-group outside_access_in in interface outside

access-group inside_access_in in interface inside

route outside 0.0.0.0 0.0.0.0 211.25.191.1 1

route inside 172.16.0.0 255.255.0.0 172.16.2.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication http console LOCAL

aaa authentication serial console LOCAL

aaa authentication ssh console LOCAL

aaa authentication telnet console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 mgmt

http 0.0.0.0 0.0.0.0 inside

http 202.162.24.10 255.255.255.255 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des