topic Re: ASA5510: Routing from ezVPN Client to non-LAN Zone in Network Security

ASA5510: Routing from ezVPN Client to non-LAN Zone

society-gmbh — Tue, 12 Mar 2019 01:05:07 GMT

Good Day,

I got a Problem with Routing on a ASA5510.

I have ezVPN Clients connected to the ASA5510. Those Clients are assigned an IP from 192.168.236.0/24 Pool.

I have a Router of a contractor connected to a dedicated ASA Interface called IBIZA with IP Net 10.100.10.0/24 and the Router itself with the IP 10.100.10.1. Behind that Router is another private Network which I need to reach from the ezVPN Clients.

The Connection from the ezVPN Clients to the "LAN" Interface/Network on the ASA works fine, but I cannot reach either the Contractor Router (10.100.10.1) nor the Network behind that.

From the LAN Network (on the LAN Interface) I can reach both the Contractor Router and the Network behind.

When I use the Packet Tracer Tool from the ASDM it tells me that the Traffic goes through but ends on the LAN Interface.

But it should end on the IBIZA Interface or am I wrong here ?

What do I need to tell the ASA to route the Traffic from the ezVPN Client to the Contractor Router and back ?

I have set up the ezVPN Connection as full-tunnel so all Traffic goes through the VPN Tunnel. That shouldn´t be the Problem.

Thankful for any suggestions/ideas.

Dirk

ASA5510: Routing from ezVPN Client to non-LAN Zone

Jouni Forss — Mon, 25 Feb 2013 13:27:58 GMT

Hi,

Easiest way to go about solving this would be to see the ASA configuration.

Though at this point I suspect it somehow due to NAT configurations on the ASA.

- Jouni

ASA5510: Routing from ezVPN Client to non-LAN Zone

Jouni Forss — Mon, 25 Feb 2013 13:32:54 GMT

Oh,

And also please attach the "packet-tracer" output you have done to test this.

- Jouni

Re: ASA5510: Routing from ezVPN Client to non-LAN Zone

society-gmbh — Mon, 25 Feb 2013 15:20:13 GMT

I have attached the config - had to edit a bit to keep it somewhat safe - and the Screnshot from the Packet Tracer.

Hope it helps you to understand the Problem and the cause.

Thankx in advance for your help

Dirk

ASA5510: Routing from ezVPN Client to non-LAN Zone

Jouni Forss — Mon, 25 Feb 2013 15:54:01 GMT

Hi,

Unfortunately I cant open either of the attachement files.

Either they are being scanned for viruses (not by my computer but by the actual site) or I can download them but they are damaged files.

So until I can actually access them I cant really help you with this

Ofcourse there is always the wonderfull Copy/Paste

- Jouni

Re: ASA5510: Routing from ezVPN Client to non-LAN Zone

society-gmbh — Mon, 25 Feb 2013 16:01:21 GMT

I tells me they are scanned for viruses too. So I guess it is a feature of the community software used here.

I will check tomorrow if the scanning is one or post via Copy-Paste.

Thankx

Dirk

Re: ASA5510: Routing from ezVPN Client to non-LAN Zone

society-gmbh — Tue, 26 Feb 2013 11:08:59 GMT

Hmm. seems the FileUpload Feature of the Community is Buggy so here is the config in plain text.

Thank you.

: Saved

ASA Version 8.4(3)

hostname DE-BN1-fw1

domain-name cuscomer.de

enable password XXXXXXXXXXXXXXXXXXXX encrypted

passwd XXXXXXXXXXXXXXXXXXXX encrypted

names

interface Ethernet0/0

nameif Internet

security-level 0

ip address XXX.XXX.243.43 255.255.255.248

interface Ethernet0/1

nameif LAN

security-level 100

ip address ASA-Inside 255.255.255.0

interface Ethernet0/2

speed 10

duplex half

nameif IBIZA

security-level 10

ip address 10.100.10.2 255.255.255.0

interface Ethernet0/3

description LAN/STATE Failover Interface

interface Management0/0

description Internet Backup Interface

nameif Internet-LTE

security-level 0

ip address 192.168.240.1 255.255.255.0

boot system disk0:/asa843-k8.bin

ftp mode passive

clock timezone CEST 1

clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00

dns domain-lookup Internet

dns server-group DefaultDNS

name-server 145.254.2.11

name-server 145.254.2.75

domain-name customer.de

same-security-traffic permit intra-interface

object network mail

host XXX.XXX.243.42

object network IBIZA-SERVER

host XX.XX.106.235

object network Network1

subnet 192.168.1.0 255.255.255.0

description Class-C Netz Network 1

object network Network20_Netz_intern

subnet 172.19.8.0 255.255.252.0

object network Network7

subnet 192.168.7.0 255.255.255.0

object network ASA-Outside

host 80.150.243.43

description ASA Interface Outside

object network Notes-Zentrale

host 192.168.1.20

object network AP-Schmidt

host 192.168.1.112

object network Alle_Netze_192_168_0_0

subnet 192.168.0.0 255.255.0.0

object network ASA-Inside

host 192.168.1.1

description ASA Interface Inside

object network DE-B2-01

host 192.168.7.10

description Domino und Fileserver Berlin

object network Network2

subnet 192.168.2.0 255.255.255.0

description Class-C Netz Network 2

object network Network4

subnet 192.168.4.0 255.255.255.0

description Class-C Netz Network4

object network Network6

subnet 192.168.6.0 255.255.255.0

description Class-C Netz Network 6

object network Society-NAT

host XXX.XXX.222.254

object network hermes

host XXX.XXX.222.200

object network zentrale

host 192.168.1.20

description Domino Server Zentrale

object network DE-BN1-01

host 192.168.1.10

description Fileserver

object network DE-BN2-01

host 192.168.2.20

description NotesSRV LCC

object network DMS-SRV

host 192.168.1.11

description DMS-SRV BN

object network DE-B2-02

host 192.168.7.1

description Linux Firewall Berlin

object network VPN_Remote_Clients_Netz

subnet 192.168.236.0 255.255.255.0

object network ASA_Interface_IBIZA

host 10.100.10.1

object network EAPS_VMWare_Host

host 192.168.1.200

object network EAPS_VM_PP_1

host 192.168.1.201

object network EAPS_VM_PP_2

host 192.168.1.202

object network EAPS_VM_PP_3

host 192.168.1.203

object network EAPS_VM_PP_4

host 192.168.1.204

object network IBIZA_TransferNetz

subnet 10.100.10.0 255.255.255.0

object network Zentrale-webmail

host 192.168.1.20

description WebMail

object network IBIZA-Netzwerk-Neu

subnet XXX.115.17.40 255.255.255.248

description IBIZA Netzwerk Neu

object network Notes-Service

host 192.168.1.15

object network Notes-Berlin2

host 192.168.7.20

object network Notes-LCC

host 192.168.2.10

object network HoBre-Heim-AP

subnet 192.168.50.0 255.255.255.0

object network Network5

subnet 192.168.5.0 255.255.255.0

object network Network10

subnet 192.168.10.0 255.255.255.0

object-group network Remote-Admin-Gruppe

network-object object Society-NAT

object-group network Netze

network-object object Network7

network-object object Network1

network-object object Network2

network-object object Network4

network-object object Network5

network-object object Network6

network-object object Network10

object-group service TOUR

service-object tcp destination range 4101 4101

object-group network VPN-Netzwerke

network-object object VPN_Remote_Clients_Netz

object-group service DM_INLINE_SERVICE_1

service-object icmp

service-object tcp destination eq smtp

service-object tcp destination eq 390

object-group protocol DM_INLINE_PROTOCOL_1

protocol-object ip

protocol-object icmp

object-group protocol IP_ICMP

protocol-object ip

protocol-object icmp

object-group network DM_INLINE_NETWORK_2

network-object object Notes-Backup

network-object object zentrale

object-group network DM_INLINE_NETWORK_3

network-object object Notes-Backup

network-object object zentrale

object-group network DM_INLINE_NETWORK_4

network-object object Notes-Backup

network-object object zentrale

network-object object Notes-Service

object-group icmp-type DM_INLINE_ICMP_1

icmp-object echo-reply

icmp-object time-exceeded

object-group network DM_INLINE_NETWORK_5

network-object object Notes-Service

network-object object Notes-Zentrale

object-group service DM_INLINE_SERVICE_2

service-object icmp

service-object tcp destination eq 390

service-object tcp destination eq smtp

object-group protocol DM_INLINE_PROTOCOL_2

protocol-object ip

protocol-object icmp

object-group service DM_INLINE_TCP_1 tcp

port-object eq 8043

port-object eq https

object-group network DM_INLINE_NETWORK_7

network-object object Society-NAT

group-object TOUR-Datenabgleich

object-group network DM_INLINE_NETWORK_8

network-object object AP-Schmidt

network-object object ASA-Outside

object-group protocol DM_INLINE_PROTOCOL_3

protocol-object ip

protocol-object icmp

object-group network DM_INLINE_NETWORK_9

network-object object DMS-SRV

network-object object EAPS_VM_PP_1

network-object object EAPS_VM_PP_2

network-object object EAPS_VM_PP_3

network-object object EAPS_VM_PP_4

network-object object Notes-Zentrale

object-group network DM_INLINE_NETWORK_6

network-object object zentrale

network-object object ASA-Outside

object-group network DM_INLINE_NETWORK_10

network-object object Network7

network-object object Network1

network-object object Network2

network-object object Network4

network-object object Network5

network-object object Network6

network-object object Network10

object-group protocol DM_INLINE_PROTOCOL_4

protocol-object icmp

protocol-object ip

object-group service LotusNotes tcp

port-object eq lotusnotes

object-group network IBIZA

network-object object IBIZA-Netzwerk-Neu

network-object object IBIZA-SERVER

object-group icmp-type DM_INLINE_ICMP_2

icmp-object time-exceeded

icmp-object unreachable

object-group network DM_INLINE_NETWORK_11

network-object object Network7

network-object object HoBre-Heim-AP

object-group network DM_INLINE_NETWORK_12

group-object Remote-Admin-Gruppe

network-object object aunt

object-group protocol DM_INLINE_PROTOCOL_5

protocol-object ip

protocol-object icmp

object-group network DM_INLINE_NETWORK_13

network-object 10.100.10.0 255.255.255.0

group-object IBIZA

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

object-group network DM_INLINE_NETWORK_14

network-object object VPN_Remote_Clients_Netz

network-object object HoBre-Heim-AP

object-group protocol DM_INLINE_PROTOCOL_6

protocol-object ip

protocol-object icmp

access-list LAN_nat0_outbound extended permit ip any object-group VPN-Netzwerke log

access-list LAN_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_4 object mail

access-list LAN_nat0_outbound extended permit ip object-group Netze object IBIZA-SERVER

access-list LAN_nat0_outbound extended permit ip object Network1 object Network20

access-list LAN_nat0_outbound extended permit ip object Network1 object Network7

access-list LAN_nat0_outbound extended permit ip object Network1 object ASA-Outside

access-list Internet_access_in extended permit icmp any any object-group DM_INLINE_ICMP_1

access-list Internet_access_in remark Lotus Notes Webmail Zugriff

access-list Internet_access_in extended permit tcp any object Notes-Zentrale eq https log

access-list Internet_access_in remark Society Lotus Notes Zugriff (Notes-Protokoll)

access-list Internet_access_in extended permit object-group DM_INLINE_SERVICE_1 object mail object-group DM_INLINE_NETWORK_2 log

access-list Internet_access_in extended permit tcp object-group Remote-Admin-Gruppe object Notes-Zentrale eq lotusnotes log

access-list Internet_access_in remark TOUR Update auf AP Schmidt

access-list Internet_access_in extended permit object-group TOUR object-group DM_INLINE_NETWORK_1 object AP-Schmidt log

access-list Internet_access_in remark SMTP-Routing eingehende Emails

access-list Network1 standard permit 192.168.1.0 255.255.255.0

access-list Network1 standard permit 192.168.7.0 255.255.255.0

access-list Internet_cryptomap_65535.1 extended permit ip object Network7 object IBIZA-SERVER

access-list Split_Networks_West standard permit 192.168.1.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.7.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.2.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.5.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.4.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.6.0 255.255.255.0

access-list Society_splitTunnelAcl standard permit any

access-list Internet_nat0_outbound extended permit ip object mail object-group DM_INLINE_NETWORK_3

access-list LAN_access_in extended permit tcp any host 87.79.27.245 eq ssh log warnings

access-list LAN_access_in extended permit object-group TCPUDP object-group DM_INLINE_NETWORK_14 object-group IBIZA log warnings

access-list LAN_access_in remark IBIZA Zugriff

access-list LAN_access_in extended permit object-group IP_ICMP object-group Netze object-group IBIZA log notifications

access-list LAN_access_in remark Voller Internetzugriff aus dem LAN

access-list LAN_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any

access-list LAN_access_in extended permit object-group DM_INLINE_PROTOCOL_2 object-group Netze object ASA-Inside

access-list outside-in-acl extended permit object-group DM_INLINE_PROTOCOL_6 object VPN_Remote_Clients_Netz any log notifications

access-list outside-in-acl remark Allow ICMP Type 11 for Windows tracert

access-list outside-in-acl extended permit object-group DM_INLINE_SERVICE_2 object mail object-group DM_INLINE_NETWORK_5

access-list outside-in-acl extended permit icmp any any object-group DM_INLINE_ICMP_2

access-list outside-in-acl remark Email-Routing eingehender Emails

access-list outside-in-acl remark Zugriff Network7 via VPN

access-list outside-in-acl extended permit object-group DM_INLINE_PROTOCOL_3 object-group DM_INLINE_NETWORK_11 object Network1

access-list outside-in-acl remark Webmail Zugriff aus dem Internet

access-list outside-in-acl remark 8043/mail/

access-list outside-in-acl extended permit tcp any object-group DM_INLINE_NETWORK_6 object-group DM_INLINE_TCP_1

access-list outside-in-acl remark TOUR Update Zugriff

access-list outside-in-acl extended permit tcp object-group DM_INLINE_NETWORK_7 object-group DM_INLINE_NETWORK_8 eq 4101

access-list outside-in-acl remark Direkter Lotus Notes Zugriff für Society

access-list outside-in-acl extended permit tcp object-group DM_INLINE_NETWORK_12 object zentrale eq lotusnotes log disable

access-list ohne_LCC standard permit 192.168.6.0 255.255.255.0

access-list ohne_LCC standard permit 192.168.4.0 255.255.255.0

access-list ohne_LCC standard permit 192.168.5.0 255.255.255.0

access-list ohne_LCC standard permit 192.168.1.0 255.255.255.0

access-list ohne_LCC standard permit 192.168.7.0 255.255.255.0

access-list Internet_cryptomap extended permit ip object Network1 object Network20

access-list DSGV_VPN_in remark Zugang

access-list DSGV_VPN_in extended permit ip object Network20 object-group DM_INLINE_NETWORK_9 log disable

access-list DSGV_VPN_in extended deny ip any any

access-list IBIZA_access_in extended permit object-group DM_INLINE_PROTOCOL_4 object-group DM_INLINE_NETWORK_13 object-group DM_INLINE_NETWORK_10

access-list IBIZA_access_in extended permit object-group DM_INLINE_PROTOCOL_5 any any

pager lines 24

logging enable

logging timestamp

logging asdm-buffer-size 512

logging trap warnings

logging asdm notifications

logging facility 23

logging host LAN Notes-Backup

logging permit-hostdown

logging rate-limit 1 9999999 message 313004

mtu Internet 1500

mtu LAN 1500

mtu IBIZA 1500

mtu Internet-LTE 1500

ip local pool VPN-Clients-Pool 192.168.236.10-192.168.236.100 mask 255.255.255.0

no failover

no monitor-interface Internet

no monitor-interface LAN

no monitor-interface IBIZA

icmp unreachable rate-limit 10 burst-size 5

asdm image disk0:/asdm-647.bin

asdm history enable

arp timeout 300

nat (Internet,LAN) source static mail mail destination static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3

nat (Internet,IBIZA) source static mail mail destination static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3

nat (LAN,any) source static any any destination static VPN-Netzwerke VPN-Netzwerke

nat (LAN,any) source static DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 destination static mail mail

nat (LAN,any) source static Netze Netze destination static IBIZA IBIZA

nat (LAN,any) source static Network1 Network1 destination static Network20 Network20

nat (LAN,any) source static Network1 Network1 destination static Network7 Network7

nat (LAN,any) source static Network1 Network1 destination static ASA-Outside ASA-Outside

nat (LAN,any) source static Network2 Network2 destination static Network7 Network7

nat (LAN,any) source static Network1 Network1 destination static HoBre-Heim-AP HoBre-Heim-AP

object network AP-Schmidt

nat (LAN,Internet) static interface service tcp 4101 4101

object network Alle_Netze_192_168_0_0

nat (LAN,Internet) dynamic interface

object network zentrale

nat (LAN,Internet) static interface service tcp lotusnotes lotusnotes

object network Zentrale-webmail

nat (any,Internet) static interface service tcp https 8043

object network Notes-Service

nat (LAN,Internet) static interface service tcp smtp smtp

access-group outside-in-acl in interface Internet

access-group LAN_access_in in interface LAN

access-group IBIZA_access_in in interface IBIZA

route Internet 0.0.0.0 0.0.0.0 80.150.243.41 1

route IBIZA IBIZA-SERVER 255.255.255.255 IBIZA-BINTEC-ROUTER 1

route IBIZA XX.115.17.40 255.255.255.248 IBIZA-BINTEC-ROUTER 1

route LAN LCC-Bonn 255.255.255.0 192.168.1.252 1

route LAN 192.168.3.0 255.255.255.0 192.168.1.254 1

route LAN 192.168.4.0 255.255.255.0 192.168.1.252 1

route LAN 192.168.5.0 255.255.255.0 192.168.1.252 1

route LAN 192.168.6.0 255.255.255.0 192.168.1.252 1

route LAN 192.168.7.0 255.255.255.0 192.168.1.252 1

route LAN 192.168.10.0 255.255.255.0 192.168.1.252 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

http server enable

http server idle-timeout 15

http Society-NAT 255.255.255.255 Internet

http 80.156.188.90 255.255.255.255 Internet

http Network1 255.255.255.0 LAN

http 81.173.222.136 255.255.255.255 Internet

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sysopt connection tcpmss 0

sysopt noproxyarp Internet

sysopt noproxyarp LAN

sysopt noproxyarp IBIZA

no service resetoutbound interface IBIZA

service resetoutside

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map Internet_dyn_map 1 match address Internet_cryptomap_65535.1

crypto dynamic-map Internet_dyn_map 1 set ikev1 transform-set ESP-AES-256-SHA

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map Internet_map0 1 match address Internet_cryptomap

crypto map Internet_map0 1 set pfs group5

crypto map Internet_map0 1 set peer XXX.158.227.34

crypto map Internet_map0 1 set ikev1 transform-set ESP-AES-256-SHA

crypto map Internet_map0 1 set nat-t-disable

crypto map Internet_map0 65534 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Internet_map0 65535 ipsec-isakmp dynamic Internet_dyn_map

crypto map Internet_map0 interface Internet

crypto ikev1 enable Internet

crypto ikev1 ipsec-over-tcp port 10000

crypto ikev1 policy 10

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication pre-share

encryption aes-256

hash sha

group 5

lifetime 86400

telnet timeout 5

ssh Society-NAT 255.255.255.255 Internet

ssh Network1 255.255.255.0 LAN

ssh timeout 5

ssh version 2

console timeout 0

vpdn username XXXXXXXXXXX password ***** store-local

no vpn-addr-assign aaa

no vpn-addr-assign dhcp

vpn load-balancing

interface lbpublic IBIZA

interface lbprivate IBIZA

threat-detection basic-threat

threat-detection scanning-threat shun except ip-address Network1 255.255.255.0

threat-detection scanning-threat shun duration 3600

threat-detection statistics

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ntp server 192.53.103.108 source Internet

ntp server 192.53.103.104 source Internet

tftp-server LAN DE-BN1-01 WTR-ASA5510-

webvpn

group-policy West internal

group-policy West attributes

dns-server value 192.168.1.10 192.168.7.10

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless

password-storage disable

ip-comp enable

pfs enable

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy tunnelall

split-tunnel-network-list none

default-domain value customer.de

group-policy DfltGrpPolicy attributes

wins-server value 192.168.1.10

dns-server value 192.168.1.10

vpn-tunnel-protocol ikev1 ssl-client

ip-comp enable

pfs enable

ipsec-udp enable

webvpn

anyconnect ask enable default anyconnect timeout 30

group-policy Network20 internal

group-policy Network20 attributes

banner none

wins-server value 192.168.1.10

dns-server value 192.168.1.10

dhcp-network-scope none

vpn-access-hours none

vpn-simultaneous-logins 3

vpn-idle-timeout 30

vpn-session-timeout none

vpn-filter value DSGV_VPN_in

ipv6-vpn-filter none

vpn-tunnel-protocol ikev1

password-storage disable

ip-comp enable

re-xauth disable

group-lock none

pfs enable

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy tunnelall

split-tunnel-network-list none

default-domain none

split-dns none

intercept-dhcp disable

secure-unit-authentication disable

user-authentication disable

user-authentication-idle-timeout none

ip-phone-bypass disable

leap-bypass disable

nem disable

backup-servers keep-client-config

msie-proxy server none

msie-proxy method no-modify

msie-proxy except-list none

msie-proxy local-bypass disable

msie-proxy pac-url none

vlan none

address-pools none

ipv6-address-pools none

smartcard-removal-disconnect enable

client-firewall none

client-access-rule none

webvpn

url-list none

filter none

homepage none

port-forward disable

http-proxy disable

sso-server none

anyconnect ssl dtls enable

anyconnect mtu 1406

anyconnect keep-installer installed

anyconnect ssl keepalive 20

anyconnect ssl rekey time none

anyconnect ssl rekey method none

anyconnect dpd-interval client 30

anyconnect dpd-interval gateway 30

anyconnect ssl compression deflate

anyconnect modules none

anyconnect profiles none

anyconnect ask enable default anyconnect timeout 30

customization value DfltCustomization

keep-alive-ignore 4

http-comp gzip

user-storage none

storage-objects value credentials,cookies

storage-key none

hidden-shares none

smart-tunnel disable

activex-relay enable

file-entry enable

file-browsing enable

url-entry enable

deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.

smart-tunnel auto-signon disable

group-policy GroupPolicy1 internal

group-policy GroupPolicy1 attributes

vpn-tunnel-protocol ikev1

group-policy Society2 internal

group-policy Society2 attributes

dns-server value 192.168.1.10 192.168.7.10

vpn-tunnel-protocol ikev1 ikev2 ssl-client ssl-clientless

password-storage disable

ip-comp enable

pfs enable

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy tunnelall

split-tunnel-network-list none

default-domain value customer.de

group-policy Society internal

group-policy Society attributes

dns-server value 192.168.1.10 192.168.7.10

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless

password-storage enable

ip-comp enable

pfs enable

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Split_Networks_West

default-domain value customer.de

group-policy ezVPN_HBre_Home internal

group-policy ezVPN_HBre_Home attributes

dns-server value 192.168.1.10 192.168.1.20

vpn-access-hours none

vpn-simultaneous-logins 1

vpn-idle-timeout none

vpn-session-timeout none

vpn-filter none

ipv6-vpn-filter none

vpn-tunnel-protocol ikev1

password-storage enable

ip-comp enable

re-xauth disable

group-lock none

pfs enable

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Split_Networks_West

split-dns value customer.de

secure-unit-authentication disable

user-authentication disable

user-authentication-idle-timeout none

ip-phone-bypass enable

leap-bypass enable

nem enable

vlan none

nac-settings none

smartcard-removal-disconnect enable

group-policy ezVPN_Berlin internal

group-policy ezVPN_Berlin attributes

dns-server value 192.168.1.10 192.168.1.20

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelall

split-tunnel-network-list value Network20

secure-unit-authentication disable

user-authentication disable

user-authentication-idle-timeout none

ip-phone-bypass disable

leap-bypass disable

nem enable

username root password XXXXXXXXXXXXXXXXXXXXXX encrypted privilege 15

username root attributes

vpn-group-policy DfltGrpPolicy

vpn-simultaneous-logins 0

vpn-session-timeout 1

vpn-tunnel-protocol l2tp-ipsec

password-storage disable

tunnel-group ezVPN_Berlin type remote-access

tunnel-group ezVPN_Berlin general-attributes

default-group-policy ezVPN_Berlin

tunnel-group ezVPN_Berlin ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group Society type remote-access

tunnel-group Society general-attributes

address-pool VPN-Clients-Pool

default-group-policy Society

tunnel-group Society ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group West type remote-access

tunnel-group West general-attributes

address-pool VPN-Clients-Pool

default-group-policy West

tunnel-group West ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group XXX.158.227.34 type ipsec-l2l

tunnel-group XXX.158.227.34 general-attributes

default-group-policy West_VPN_DSG

tunnel-group XXX.158.227.34 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group WTR_SSL type remote-access

tunnel-group ezVPN_HBre_Home type remote-access

tunnel-group ezVPN_HBre_Home general-attributes

default-group-policy GroupPolicy1

tunnel-group ezVPN_HBre_Home ipsec-attributes

ikev1 pre-shared-key *****

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

inspect icmp error

inspect dns preset_dns_map dynamic-filter-snoop

inspect ip-options

class class-default

set connection decrement-ttl

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

hpm topN enable

Cryptochecksum:6a5a94f2fcd80c8566747a7fb726efb1

: end

asdm image disk0:/asdm-647.bin

asdm location Alle_Netze_192_168_0_0 255.255.0.0 LAN

asdm history enable

ASA5510: Routing from ezVPN Client to non-LAN Zone

Jouni Forss — Tue, 26 Feb 2013 11:22:35 GMT

Hi,

There is so much configuration I am not exactly sure which "tunnel-group" was the one used for this EzVPN connection without looking through it some more.

In general if the VPN is Full Tunnel where all the connections are forwarded from the remote site to the local site, you will need a NAT configuration to permit that traffic to flow

To me it seems you have NAT configuration related to "LAN" interface only (I personally try to avoid using the "any" keywords in my NAT configurations to avoid any wierd/wrong behaviour)

I guess the basic configuration format to allow VPN -> IBIZA traffic would be to configure

object-group network IBIZA-NETWORKS

network-object

object network VPN-NETWORK

subnet

nat (IBIZA,Internet) source static IBIZA-NETWORKS IBIZA-NETWORKS destination static VPN-NETWORK VPN-NETWORK

Wether there is something else in the configuration that would need changing I dont know yet. Should look through the configurations a bit more.

Can you clarify the "tunnel-group" being used? Is it the one using "Society" group-policy?

- Jouni

ASA5510: Routing from ezVPN Client to non-LAN Zone

society-gmbh — Tue, 26 Feb 2013 14:07:11 GMT

Hello Jouni,

thanks for having a look at the config already. Indeed the Tunnel Group using "Society" is the correct one.

Dirk

ASA5510: Routing from ezVPN Client to non-LAN Zone

Jouni Forss — Wed, 27 Feb 2013 07:38:18 GMT

Hi,

So below should be the "tunnel-group" and "group-policy" related to this connection

tunnel-group Society type remote-access

tunnel-group Society general-attributes

address-pool VPN-Clients-Pool

default-group-policy Society

tunnel-group Society ipsec-attributes

ikev1 pre-shared-key *****

group-policy Society internal

group-policy Society attributes

dns-server value 192.168.1.10 192.168.7.10

vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless

password-storage enable

ip-comp enable

pfs enable

ipsec-udp enable

ipsec-udp-port 10000

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Split_Networks_West

default-domain value customer.de

According to the above there is a Split Tunnel configuration on the VPN connection and the ACL specifying the Split Tunnel is below

access-list Split_Networks_West standard permit 192.168.1.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.7.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.2.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.5.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.4.0 255.255.255.0

access-list Split_Networks_West standard permit 192.168.6.0 255.255.255.0

I imagine that list doesnt contain the networks needed to reach the IBIZA networks.

So it seems to me tthat you would alteast need the previous NAT configuration I suggested and addition to the above Split Tunnel ACL

access-list Split_Networks_West standard permit

object-group network IBIZA-NETWORKS

network-object

object network VPN-NETWORK

subnet

nat (IBIZA,Internet) source static IBIZA-NETWORKS IBIZA-NETWORKS destination static VPN-NETWORK VPN-NETWORK

I've left the actual network/address segments unspecified. You should just use the actual networks you are using.

Those should atleast be some things you need for the traffic to flow from VPN to IBIZA and vice versa.

- Jouni

ASA5510: Routing from ezVPN Client to non-LAN Zone

society-gmbh — Thu, 28 Feb 2013 10:54:05 GMT

Good Morning and Thank you,

the NAT Rule did the trick. I had seen the problem with the Splitz-Tunneling too and tried but it did not help.

The NAT Rule you proposed helped me fix the Problem.

Thank you very much for your kind support.

Dirk