topic Remote Access VPN Clients Cannot Access inside LAN in Network Security

topic Remote Access VPN Clients Cannot Access inside LAN in Network Security https://community.cisco.com/t5/network-security/remote-access-vpn-clients-cannot-access-inside-lan/m-p/1907592#M456985 <P>I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable.</P><P></P><P>: Saved</P><P>:</P><P>ASA Version 8.2(1) </P><P>!</P><P>hostname ASA5505</P><P>domain-name default.domain.invalid</P><P>enable password eelnBRz68aYSzHyz encrypted</P><P>passwd eelnBRz68aYSzHyz encrypted</P><P>names</P><P>!</P><P>interface Vlan1</P><P> nameif inside</P><P> security-level 100</P><P> ip address 192.168.100.1 255.255.255.0 </P><P>!</P><P>interface Vlan2</P><P> nameif outside</P><P> security-level 0</P><P> pppoe client vpdn group dataDSL</P><P> ip address 76.244.75.57 255.255.255.255 pppoe </P><P>!</P><P>interface Vlan3</P><P> nameif dmz</P><P> security-level 50</P><P> ip address 192.168.9.1 255.255.255.0 </P><P>!             </P><P>interface Vlan10</P><P> nameif outside_cable</P><P> security-level 0</P><P> ip address 50.84.96.178 255.255.255.240 </P><P>!</P><P>interface Ethernet0/0</P><P> switchport access vlan 2</P><P>!</P><P>interface Ethernet0/1</P><P> switchport access vlan 10</P><P>!</P><P>interface Ethernet0/2</P><P> switchport access vlan 3</P><P>!</P><P>interface Ethernet0/3</P><P>!</P><P>interface Ethernet0/4</P><P>!</P><P>interface Ethernet0/5</P><P>!</P><P>interface Ethernet0/6</P><P>!</P><P>interface Ethernet0/7</P><P>!             </P><P>ftp mode passive</P><P>clock timezone CST -6</P><P>clock summer-time CDT recurring</P><P>dns server-group DefaultDNS</P><P> domain-name default.domain.invalid</P><P>same-security-traffic permit intra-interface</P><P>object-group service Netbios udp</P><P> port-object eq 139</P><P> port-object eq 445</P><P> port-object eq netbios-ns</P><P>object-group service Netbios_TCP tcp</P><P> port-object eq 445</P><P> port-object eq netbios-ssn</P><P>object-group network DM_INLINE_NETWORK_1</P><P> network-object host 192.168.100.177</P><P> network-object host 192.168.100.249</P><P>object-group service Web_Services tcp</P><P> port-object eq ftp</P><P> port-object eq ftp-data</P><P> port-object eq www</P><P> port-object eq https</P><P>object-group network DM_INLINE_NETWORK_10</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_11</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_2</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_3</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_4</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_5</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_6</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_7</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_8</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_9</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network VPN</P><P> network-object 192.168.255.0 255.255.255.0</P><P>access-list outside_access_in extended permit icmp any host 76.244.75.61 </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp-data </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.62 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.62 eq https </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.59 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.59 eq https </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.60 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.60 eq https </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.58 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.58 eq https </P><P>access-list dmz_access_in remark Quickbooks</P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_6 host 192.168.100.5 eq 56719 </P><P>access-list dmz_access_in remark Quickbooks range</P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_7 host 192.168.100.5 range 55333 55337 </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_8 host 192.168.100.5 eq 1434 </P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_9 host 192.168.100.5 eq 49398 </P><P>access-list dmz_access_in remark QB</P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_10 host 192.168.100.5 eq 8019 </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_2 host 192.168.100.5 eq 2638 </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_11 host 192.168.100.5 object-group Netbios </P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_3 host 192.168.100.5 object-group Netbios_TCP </P><P>access-list dmz_access_in extended deny ip host 192.168.9.4 host 192.168.100.5 inactive </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_4 any </P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_5 any </P><P>access-list dmz_access_in remark Printer</P><P>access-list dmz_access_in extended permit ip 192.168.9.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 </P><P>access-list dmz_access_in extended permit tcp 192.168.9.0 255.255.255.0 any object-group Web_Services </P><P>access-list dmz_access_in extended permit udp 192.168.9.0 255.255.255.0 any eq domain </P><P>access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.255.0 255.255.255.0 echo-reply </P><P>access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.100.0 255.255.255.0 echo-reply log disable </P><P>access-list dmz_access_in remark QB probably does not need any udp</P><P>access-list dmz_access_in extended permit udp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive </P><P>access-list dmz_access_in remark QB included in other rule range</P><P>access-list dmz_access_in extended permit tcp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive </P><P>access-list dmz_access_in remark May be required for Quickbooks</P><P>access-list dmz_access_in extended permit icmp host 192.168.9.4 host 192.168.100.5 </P><P>access-list CAD_capture extended permit ip host 192.168.9.4 host 192.168.100.5 </P><P>access-list CAD_capture extended permit ip host 192.168.100.5 host 192.168.9.4 </P><P>access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0 </P><P>access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.240 </P><P>access-list inside_nat0_outbound extended permit ip any 172.16.10.0 255.255.255.240 </P><P>access-list inside_nat0_outbound extended permit ip any 172.16.20.0 255.255.255.240 </P><P>access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0 </P><P>access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.9.0 255.255.255.0 </P><P>access-list dmz_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0 </P><P>access-list outside_cable_access_in extended permit icmp any host 50.84.96.182 </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp-data </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq https </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq https </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq https </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq https </P><P>access-list Local_LAN_Access standard permit host 0.0.0.0 </P><P>access-list vpnusers_spitTunnelACL extended permit ip 192.168.100.0 255.255.255.0 any </P><P>access-list nonat-in extended permit ip 192.168.100.0 255.255.255.0 172.16.20.0 255.255.255.0 </P><P>pager lines 24</P><P>logging enable</P><P>logging buffered informational</P><P>logging asdm informational</P><P>mtu inside 1500</P><P>mtu outside 1500</P><P>mtu dmz 1500  </P><P>mtu outside_cable 1500</P><P>ip local pool VPN_IP_range 192.168.255.1-192.168.255.10 mask 255.255.255.0</P><P>ip local pool VPN_Phone 172.16.20.1-172.16.20.10 mask 255.255.255.0</P><P>no failover</P><P>icmp unreachable rate-limit 1 burst-size 1</P><P>no asdm history enable</P><P>arp timeout 14400</P><P>nat-control</P><P>global (outside) 10 interface</P><P>global (outside_cable) 10 interface</P><P>nat (inside) 0 access-list nonat-in</P><P>nat (inside) 10 0.0.0.0 0.0.0.0</P><P>nat (dmz) 0 access-list dmz_nat0_outbound</P><P>nat (dmz) 10 0.0.0.0 0.0.0.0</P><P>static (inside,outside) 76.244.75.62 192.168.100.25 netmask 255.255.255.255 dns </P><P>static (dmz,outside) 76.244.75.61 192.168.9.123 netmask 255.255.255.255 dns </P><P>static (dmz,outside) 76.244.75.59 192.168.9.124 netmask 255.255.255.255 dns </P><P>static (dmz,outside) 76.244.75.58 192.168.9.4 netmask 255.255.255.255 dns </P><P>static (inside,dmz) 192.168.100.0 192.168.100.0 netmask 255.255.255.0 </P><P>static (dmz,outside) 76.244.75.60 192.168.9.10 netmask 255.255.255.255 dns </P><P>static (inside,outside_cable) 50.84.96.183 192.168.100.25 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.182 192.168.9.123 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.180 192.168.9.124 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.179 192.168.9.4 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.181 192.168.9.10 netmask 255.255.255.255 dns </P><P>access-group outside_access_in in interface outside</P><P>access-group dmz_access_in in interface dmz</P><P>access-group outside_cable_access_in in interface outside_cable</P><P>route outside_cable 0.0.0.0 0.0.0.0 50.84.96.177 1</P><P>timeout xlate 3:00:00</P><P>timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02</P><P>timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00</P><P>timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00</P><P>timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute</P><P>timeout tcp-proxy-reassembly 0:01:00</P><P>dynamic-access-policy-record DfltAccessPolicy</P><P>http server enable</P><P>http 192.168.1.0 255.255.255.0 inside</P><P>http 192.168.100.0 255.255.255.0 inside</P><P>http 204.107.173.0 255.255.255.0 outside</P><P>http 204.107.173.0 255.255.255.0 outside_cable</P><P>http 0.0.0.0 0.0.0.0 outside_cable</P><P>no snmp-server location</P><P>no snmp-server contact</P><P>snmp-server enable traps snmp authentication linkup linkdown coldstart</P><P>crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac </P><P>crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport</P><P>crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac </P><P>crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac </P><P>crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac </P><P>crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac </P><P>crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac </P><P>crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac </P><P>crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac </P><P>crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac </P><P>crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac </P><P>crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac </P><P>crypto ipsec security-association lifetime seconds 28800</P><P>crypto ipsec security-association lifetime kilobytes 4608000</P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs </P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5</P><P>crypto map outside_cable_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map outside_cable_map interface outside_cable</P><P>crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map outside_map interface outside</P><P>crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map inside_map interface inside</P><P>crypto isakmp enable inside</P><P>crypto isakmp enable outside</P><P>crypto isakmp enable outside_cable</P><P>crypto isakmp policy 10</P><P> authentication pre-share</P><P> encryption 3des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto isakmp policy 30</P><P> authentication pre-share</P><P> encryption 3des</P><P> hash md5</P><P> group 2</P><P> lifetime 86400</P><P>telnet 192.168.100.0 255.255.255.0 inside</P><P>telnet timeout 5</P><P>ssh 192.168.100.0 255.255.255.0 inside</P><P>ssh 204.107.173.0 255.255.255.0 outside</P><P>ssh 204.107.173.0 255.255.255.0 outside_cable</P><P>ssh 0.0.0.0 0.0.0.0 outside_cable</P><P>ssh timeout 15</P><P>console timeout 0</P><P>vpdn group dataDSL request dialout pppoe</P><P><SPAN>vpdn group dataDSL localname </SPAN><A class="jive-link-email-small" href="mailto:cadspecialties@static.sbcglobal.net" target="_blank">cadspecialties@static.sbcglobal.net</A></P><P>vpdn group dataDSL ppp authentication pap</P><P><SPAN>vpdn username </SPAN><A class="jive-link-email-small" href="mailto:cadspecialties@static.sbcglobal.net" target="_blank">cadspecialties@static.sbcglobal.net</A><SPAN> password ********* </SPAN></P><P>dhcpd address 192.168.100.30-192.168.100.99 inside</P><P>dhcpd dns 192.168.100.5 68.94.156.1 interface inside</P><P>!</P><P></P><P></P><P>threat-detection basic-threat</P><P>threat-detection statistics port</P><P>threat-detection statistics protocol</P><P>threat-detection statistics access-list</P><P>threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200</P><P>webvpn</P><P>group-policy DefaultRAGroup internal</P><P>group-policy DefaultRAGroup attributes</P><P> dns-server value 192.168.100.5</P><P> vpn-tunnel-protocol IPSec l2tp-ipsec </P><P>group-policy cad_supplies_RAVPN internal</P><P>group-policy cad_supplies_RAVPN attributes</P><P> vpn-tunnel-protocol IPSec </P><P> split-tunnel-policy tunnelspecified</P><P> split-tunnel-network-list value cad_supplies_RAVPN_splitTunnelAcl</P><P>group-policy VPNPHONE internal</P><P>group-policy VPNPHONE attributes</P><P> dns-server value 192.168.100.5</P><P> vpn-tunnel-protocol IPSec </P><P> split-tunnel-policy excludespecified</P><P> split-tunnel-network-list value Local_LAN_Access</P><P> client-firewall none</P><P> client-access-rule none</P><P>username swinc password BlhBNWfh7XoeHcQC encrypted</P><P>username swinc attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P>username meredithp password L3lRjzwb7TnwOyZ1 encrypted</P><P>username meredithp attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P> service-type remote-access</P><P>username ipphone1 password LOjpmeIOshVdCSOU encrypted privilege 0</P><P>username ipphone1 attributes</P><P> vpn-group-policy VPNPHONE</P><P>username ipphone2 password LOjpmeIOshVdCSOU encrypted privilege 0</P><P>username ipphone2 attributes</P><P> vpn-group-policy VPNPHONE</P><P>username ipphone3 password LOjpmeIOshVdCSOU encrypted privilege 0</P><P>username ipphone3 attributes</P><P> vpn-group-policy VPNPHONE</P><P>username oethera password WKJxJq7L6wmktFNt encrypted</P><P>username oethera attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P> service-type remote-access</P><P>username markh password nqH+bk6vj0fR83ai0SAxkg== nt-encrypted</P><P>username markh attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P>tunnel-group DefaultRAGroup general-attributes</P><P> default-group-policy DefaultRAGroup</P><P>tunnel-group DefaultRAGroup ipsec-attributes</P><P> pre-shared-key *</P><P>tunnel-group DefaultRAGroup ppp-attributes</P><P> authentication ms-chap-v2</P><P>tunnel-group cad_supplies_RAVPN type remote-access</P><P>tunnel-group cad_supplies_RAVPN general-attributes</P><P> address-pool VPN_IP_range</P><P> default-group-policy cad_supplies_RAVPN</P><P>tunnel-group cad_supplies_RAVPN ipsec-attributes</P><P> pre-shared-key *</P><P>tunnel-group VPNPHONE type remote-access</P><P>tunnel-group VPNPHONE general-attributes</P><P> address-pool VPN_Phone</P><P> default-group-policy VPNPHONE</P><P>tunnel-group VPNPHONE ipsec-attributes</P><P> pre-shared-key *</P><P>!</P><P>class-map inspection_default</P><P> match default-inspection-traffic</P><P>!</P><P>!</P><P>policy-map type inspect dns preset_dns_map</P><P> parameters</P><P>  message-length maximum 1500</P><P>policy-map global_policy</P><P> class inspection_default</P><P>  inspect dns preset_dns_map </P><P>  inspect ftp </P><P>  inspect h323 h225 </P><P>  inspect h323 ras </P><P>  inspect rsh </P><P>  inspect rtsp </P><P>  inspect sqlnet </P><P>  inspect skinny  </P><P>  inspect sunrpc </P><P>  inspect xdmcp </P><P>  inspect sip  </P><P>  inspect netbios </P><P>  inspect tftp </P><P>!</P><P>service-policy global_policy global</P><P>prompt hostname context </P><P>Cryptochecksum:8b25ecc61861a2baa6d2556a3679cc7c</P><P>: end</P> Mon, 11 Mar 2019 22:54:27 GMT lee.owensby 2019-03-11T22:54:27Z Remote Access VPN Clients Cannot Access inside LAN https://community.cisco.com/t5/network-security/remote-access-vpn-clients-cannot-access-inside-lan/m-p/1907592#M456985 <P>I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable.</P><P></P><P>: Saved</P><P>:</P><P>ASA Version 8.2(1) </P><P>!</P><P>hostname ASA5505</P><P>domain-name default.domain.invalid</P><P>enable password eelnBRz68aYSzHyz encrypted</P><P>passwd eelnBRz68aYSzHyz encrypted</P><P>names</P><P>!</P><P>interface Vlan1</P><P> nameif inside</P><P> security-level 100</P><P> ip address 192.168.100.1 255.255.255.0 </P><P>!</P><P>interface Vlan2</P><P> nameif outside</P><P> security-level 0</P><P> pppoe client vpdn group dataDSL</P><P> ip address 76.244.75.57 255.255.255.255 pppoe </P><P>!</P><P>interface Vlan3</P><P> nameif dmz</P><P> security-level 50</P><P> ip address 192.168.9.1 255.255.255.0 </P><P>!             </P><P>interface Vlan10</P><P> nameif outside_cable</P><P> security-level 0</P><P> ip address 50.84.96.178 255.255.255.240 </P><P>!</P><P>interface Ethernet0/0</P><P> switchport access vlan 2</P><P>!</P><P>interface Ethernet0/1</P><P> switchport access vlan 10</P><P>!</P><P>interface Ethernet0/2</P><P> switchport access vlan 3</P><P>!</P><P>interface Ethernet0/3</P><P>!</P><P>interface Ethernet0/4</P><P>!</P><P>interface Ethernet0/5</P><P>!</P><P>interface Ethernet0/6</P><P>!</P><P>interface Ethernet0/7</P><P>!             </P><P>ftp mode passive</P><P>clock timezone CST -6</P><P>clock summer-time CDT recurring</P><P>dns server-group DefaultDNS</P><P> domain-name default.domain.invalid</P><P>same-security-traffic permit intra-interface</P><P>object-group service Netbios udp</P><P> port-object eq 139</P><P> port-object eq 445</P><P> port-object eq netbios-ns</P><P>object-group service Netbios_TCP tcp</P><P> port-object eq 445</P><P> port-object eq netbios-ssn</P><P>object-group network DM_INLINE_NETWORK_1</P><P> network-object host 192.168.100.177</P><P> network-object host 192.168.100.249</P><P>object-group service Web_Services tcp</P><P> port-object eq ftp</P><P> port-object eq ftp-data</P><P> port-object eq www</P><P> port-object eq https</P><P>object-group network DM_INLINE_NETWORK_10</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_11</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_2</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_3</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_4</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_5</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_6</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_7</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_8</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network DM_INLINE_NETWORK_9</P><P> network-object host 192.168.9.10</P><P> network-object host 192.168.9.4</P><P>object-group network VPN</P><P> network-object 192.168.255.0 255.255.255.0</P><P>access-list outside_access_in extended permit icmp any host 76.244.75.61 </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.61 eq ftp-data </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.62 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.62 eq https </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.59 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.59 eq https </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.60 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.60 eq https </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.58 eq www </P><P>access-list outside_access_in extended permit tcp any host 76.244.75.58 eq https </P><P>access-list dmz_access_in remark Quickbooks</P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_6 host 192.168.100.5 eq 56719 </P><P>access-list dmz_access_in remark Quickbooks range</P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_7 host 192.168.100.5 range 55333 55337 </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_8 host 192.168.100.5 eq 1434 </P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_9 host 192.168.100.5 eq 49398 </P><P>access-list dmz_access_in remark QB</P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_10 host 192.168.100.5 eq 8019 </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_2 host 192.168.100.5 eq 2638 </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_11 host 192.168.100.5 object-group Netbios </P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_3 host 192.168.100.5 object-group Netbios_TCP </P><P>access-list dmz_access_in extended deny ip host 192.168.9.4 host 192.168.100.5 inactive </P><P>access-list dmz_access_in extended permit udp object-group DM_INLINE_NETWORK_4 any </P><P>access-list dmz_access_in extended permit tcp object-group DM_INLINE_NETWORK_5 any </P><P>access-list dmz_access_in remark Printer</P><P>access-list dmz_access_in extended permit ip 192.168.9.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 </P><P>access-list dmz_access_in extended permit tcp 192.168.9.0 255.255.255.0 any object-group Web_Services </P><P>access-list dmz_access_in extended permit udp 192.168.9.0 255.255.255.0 any eq domain </P><P>access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.255.0 255.255.255.0 echo-reply </P><P>access-list dmz_access_in extended permit icmp 192.168.9.0 255.255.255.0 192.168.100.0 255.255.255.0 echo-reply log disable </P><P>access-list dmz_access_in remark QB probably does not need any udp</P><P>access-list dmz_access_in extended permit udp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive </P><P>access-list dmz_access_in remark QB included in other rule range</P><P>access-list dmz_access_in extended permit tcp host 192.168.9.4 host 192.168.100.5 eq 55333 inactive </P><P>access-list dmz_access_in remark May be required for Quickbooks</P><P>access-list dmz_access_in extended permit icmp host 192.168.9.4 host 192.168.100.5 </P><P>access-list CAD_capture extended permit ip host 192.168.9.4 host 192.168.100.5 </P><P>access-list CAD_capture extended permit ip host 192.168.100.5 host 192.168.9.4 </P><P>access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0 </P><P>access-list inside_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.240 </P><P>access-list inside_nat0_outbound extended permit ip any 172.16.10.0 255.255.255.240 </P><P>access-list inside_nat0_outbound extended permit ip any 172.16.20.0 255.255.255.240 </P><P>access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0 </P><P>access-list cad_supplies_RAVPN_splitTunnelAcl standard permit 192.168.9.0 255.255.255.0 </P><P>access-list dmz_nat0_outbound extended permit ip any 192.168.255.0 255.255.255.0 </P><P>access-list outside_cable_access_in extended permit icmp any host 50.84.96.182 </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.182 eq ftp-data </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.183 eq https </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.180 eq https </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.181 eq https </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq www </P><P>access-list outside_cable_access_in extended permit tcp any host 50.84.96.179 eq https </P><P>access-list Local_LAN_Access standard permit host 0.0.0.0 </P><P>access-list vpnusers_spitTunnelACL extended permit ip 192.168.100.0 255.255.255.0 any </P><P>access-list nonat-in extended permit ip 192.168.100.0 255.255.255.0 172.16.20.0 255.255.255.0 </P><P>pager lines 24</P><P>logging enable</P><P>logging buffered informational</P><P>logging asdm informational</P><P>mtu inside 1500</P><P>mtu outside 1500</P><P>mtu dmz 1500  </P><P>mtu outside_cable 1500</P><P>ip local pool VPN_IP_range 192.168.255.1-192.168.255.10 mask 255.255.255.0</P><P>ip local pool VPN_Phone 172.16.20.1-172.16.20.10 mask 255.255.255.0</P><P>no failover</P><P>icmp unreachable rate-limit 1 burst-size 1</P><P>no asdm history enable</P><P>arp timeout 14400</P><P>nat-control</P><P>global (outside) 10 interface</P><P>global (outside_cable) 10 interface</P><P>nat (inside) 0 access-list nonat-in</P><P>nat (inside) 10 0.0.0.0 0.0.0.0</P><P>nat (dmz) 0 access-list dmz_nat0_outbound</P><P>nat (dmz) 10 0.0.0.0 0.0.0.0</P><P>static (inside,outside) 76.244.75.62 192.168.100.25 netmask 255.255.255.255 dns </P><P>static (dmz,outside) 76.244.75.61 192.168.9.123 netmask 255.255.255.255 dns </P><P>static (dmz,outside) 76.244.75.59 192.168.9.124 netmask 255.255.255.255 dns </P><P>static (dmz,outside) 76.244.75.58 192.168.9.4 netmask 255.255.255.255 dns </P><P>static (inside,dmz) 192.168.100.0 192.168.100.0 netmask 255.255.255.0 </P><P>static (dmz,outside) 76.244.75.60 192.168.9.10 netmask 255.255.255.255 dns </P><P>static (inside,outside_cable) 50.84.96.183 192.168.100.25 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.182 192.168.9.123 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.180 192.168.9.124 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.179 192.168.9.4 netmask 255.255.255.255 dns </P><P>static (dmz,outside_cable) 50.84.96.181 192.168.9.10 netmask 255.255.255.255 dns </P><P>access-group outside_access_in in interface outside</P><P>access-group dmz_access_in in interface dmz</P><P>access-group outside_cable_access_in in interface outside_cable</P><P>route outside_cable 0.0.0.0 0.0.0.0 50.84.96.177 1</P><P>timeout xlate 3:00:00</P><P>timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02</P><P>timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00</P><P>timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00</P><P>timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute</P><P>timeout tcp-proxy-reassembly 0:01:00</P><P>dynamic-access-policy-record DfltAccessPolicy</P><P>http server enable</P><P>http 192.168.1.0 255.255.255.0 inside</P><P>http 192.168.100.0 255.255.255.0 inside</P><P>http 204.107.173.0 255.255.255.0 outside</P><P>http 204.107.173.0 255.255.255.0 outside_cable</P><P>http 0.0.0.0 0.0.0.0 outside_cable</P><P>no snmp-server location</P><P>no snmp-server contact</P><P>snmp-server enable traps snmp authentication linkup linkdown coldstart</P><P>crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac </P><P>crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport</P><P>crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac </P><P>crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac </P><P>crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac </P><P>crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac </P><P>crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac </P><P>crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac </P><P>crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac </P><P>crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac </P><P>crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac </P><P>crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac </P><P>crypto ipsec security-association lifetime seconds 28800</P><P>crypto ipsec security-association lifetime kilobytes 4608000</P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs </P><P>crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5</P><P>crypto map outside_cable_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map outside_cable_map interface outside_cable</P><P>crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map outside_map interface outside</P><P>crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP</P><P>crypto map inside_map interface inside</P><P>crypto isakmp enable inside</P><P>crypto isakmp enable outside</P><P>crypto isakmp enable outside_cable</P><P>crypto isakmp policy 10</P><P> authentication pre-share</P><P> encryption 3des</P><P> hash sha</P><P> group 2</P><P> lifetime 86400</P><P>crypto isakmp policy 30</P><P> authentication pre-share</P><P> encryption 3des</P><P> hash md5</P><P> group 2</P><P> lifetime 86400</P><P>telnet 192.168.100.0 255.255.255.0 inside</P><P>telnet timeout 5</P><P>ssh 192.168.100.0 255.255.255.0 inside</P><P>ssh 204.107.173.0 255.255.255.0 outside</P><P>ssh 204.107.173.0 255.255.255.0 outside_cable</P><P>ssh 0.0.0.0 0.0.0.0 outside_cable</P><P>ssh timeout 15</P><P>console timeout 0</P><P>vpdn group dataDSL request dialout pppoe</P><P><SPAN>vpdn group dataDSL localname </SPAN><A class="jive-link-email-small" href="mailto:cadspecialties@static.sbcglobal.net" target="_blank">cadspecialties@static.sbcglobal.net</A></P><P>vpdn group dataDSL ppp authentication pap</P><P><SPAN>vpdn username </SPAN><A class="jive-link-email-small" href="mailto:cadspecialties@static.sbcglobal.net" target="_blank">cadspecialties@static.sbcglobal.net</A><SPAN> password ********* </SPAN></P><P>dhcpd address 192.168.100.30-192.168.100.99 inside</P><P>dhcpd dns 192.168.100.5 68.94.156.1 interface inside</P><P>!</P><P></P><P></P><P>threat-detection basic-threat</P><P>threat-detection statistics port</P><P>threat-detection statistics protocol</P><P>threat-detection statistics access-list</P><P>threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200</P><P>webvpn</P><P>group-policy DefaultRAGroup internal</P><P>group-policy DefaultRAGroup attributes</P><P> dns-server value 192.168.100.5</P><P> vpn-tunnel-protocol IPSec l2tp-ipsec </P><P>group-policy cad_supplies_RAVPN internal</P><P>group-policy cad_supplies_RAVPN attributes</P><P> vpn-tunnel-protocol IPSec </P><P> split-tunnel-policy tunnelspecified</P><P> split-tunnel-network-list value cad_supplies_RAVPN_splitTunnelAcl</P><P>group-policy VPNPHONE internal</P><P>group-policy VPNPHONE attributes</P><P> dns-server value 192.168.100.5</P><P> vpn-tunnel-protocol IPSec </P><P> split-tunnel-policy excludespecified</P><P> split-tunnel-network-list value Local_LAN_Access</P><P> client-firewall none</P><P> client-access-rule none</P><P>username swinc password BlhBNWfh7XoeHcQC encrypted</P><P>username swinc attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P>username meredithp password L3lRjzwb7TnwOyZ1 encrypted</P><P>username meredithp attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P> service-type remote-access</P><P>username ipphone1 password LOjpmeIOshVdCSOU encrypted privilege 0</P><P>username ipphone1 attributes</P><P> vpn-group-policy VPNPHONE</P><P>username ipphone2 password LOjpmeIOshVdCSOU encrypted privilege 0</P><P>username ipphone2 attributes</P><P> vpn-group-policy VPNPHONE</P><P>username ipphone3 password LOjpmeIOshVdCSOU encrypted privilege 0</P><P>username ipphone3 attributes</P><P> vpn-group-policy VPNPHONE</P><P>username oethera password WKJxJq7L6wmktFNt encrypted</P><P>username oethera attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P> service-type remote-access</P><P>username markh password nqH+bk6vj0fR83ai0SAxkg== nt-encrypted</P><P>username markh attributes</P><P> vpn-group-policy cad_supplies_RAVPN</P><P>tunnel-group DefaultRAGroup general-attributes</P><P> default-group-policy DefaultRAGroup</P><P>tunnel-group DefaultRAGroup ipsec-attributes</P><P> pre-shared-key *</P><P>tunnel-group DefaultRAGroup ppp-attributes</P><P> authentication ms-chap-v2</P><P>tunnel-group cad_supplies_RAVPN type remote-access</P><P>tunnel-group cad_supplies_RAVPN general-attributes</P><P> address-pool VPN_IP_range</P><P> default-group-policy cad_supplies_RAVPN</P><P>tunnel-group cad_supplies_RAVPN ipsec-attributes</P><P> pre-shared-key *</P><P>tunnel-group VPNPHONE type remote-access</P><P>tunnel-group VPNPHONE general-attributes</P><P> address-pool VPN_Phone</P><P> default-group-policy VPNPHONE</P><P>tunnel-group VPNPHONE ipsec-attributes</P><P> pre-shared-key *</P><P>!</P><P>class-map inspection_default</P><P> match default-inspection-traffic</P><P>!</P><P>!</P><P>policy-map type inspect dns preset_dns_map</P><P> parameters</P><P>  message-length maximum 1500</P><P>policy-map global_policy</P><P> class inspection_default</P><P>  inspect dns preset_dns_map </P><P>  inspect ftp </P><P>  inspect h323 h225 </P><P>  inspect h323 ras </P><P>  inspect rsh </P><P>  inspect rtsp </P><P>  inspect sqlnet </P><P>  inspect skinny  </P><P>  inspect sunrpc </P><P>  inspect xdmcp </P><P>  inspect sip  </P><P>  inspect netbios </P><P>  inspect tftp </P><P>!</P><P>service-policy global_policy global</P><P>prompt hostname context </P><P>Cryptochecksum:8b25ecc61861a2baa6d2556a3679cc7c</P><P>: end</P> Mon, 11 Mar 2019 22:54:27 GMT https://community.cisco.com/t5/network-security/remote-access-vpn-clients-cannot-access-inside-lan/m-p/1907592#M456985 lee.owensby 2019-03-11T22:54:27Z Remote Access VPN Clients Cannot Access inside LAN https://community.cisco.com/t5/network-security/remote-access-vpn-clients-cannot-access-inside-lan/m-p/1907593#M456986 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>You have your "group-policy" set so that you have excluding some networks from being tunneled.</P><P></P><P>In this access-list named <STRONG>Local_LAN_Access</STRONG> you specify "0.0.0.0"</P><P></P><P>Doesnt this mean you are excluding all networks from being tunneled? In other words no traffic goes to your tunnel.</P><P></P><P>This access-list should only contain your local LAN network from where you are connecting with the VPN Client. If you dont need to access anything on your local LAN while having the VPN on, you don't even need this setting on. You could just tunnel all traffic instead of excluding some networks.</P><P></P><P>- Jouni</P></BODY></HTML> Mon, 16 Apr 2012 23:24:25 GMT https://community.cisco.com/t5/network-security/remote-access-vpn-clients-cannot-access-inside-lan/m-p/1907593#M456986 Jouni Forss 2012-04-16T23:24:25Z