topic Re: ASA firewall issue in Network Security

ASA firewall issue

manivelengg — Mon, 11 Mar 2019 19:07:55 GMT

I have configured remote access VPN with local pool in ASA firewall however im accessing all the resources(my private network such as servers ) through asa firewall after getting connected the VPN but i cant the mailing server through webmail(ports like 80).Please check the configs.

Re: ASA firewall issue

Maykol Rojas — Thu, 11 Nov 2010 15:26:15 GMT

Hello,

Would you please take a look at the split tunneling list? Where is the OWA server located?

Cheers.

Mike

Re: ASA firewall issue

Federico Coto Fajardo — Thu, 11 Nov 2010 17:04:16 GMT

Hi,

It seems the OWA has 192.168.100.1 correct?

That IP is internal to the ASA via a static route.

In order for you to be able to reach that server via port 80, the server must be included in the nat0 ACL.

Question.

Can you PING 192.168.100.1 from the VPN client?

I just want to make sure that packets from the VPN client reaches the server and that the problem is specifically with the port 80.

Federico.

Re: ASA firewall issue

manivelengg — Sat, 13 Nov 2010 06:39:22 GMT

Hi....thanks.

Yes.I can ping 192.168.100.1 from the vpn client.

But i can't access web mail from the vpn client.

Re: ASA firewall issue

manivelengg — Sat, 13 Nov 2010 09:33:30 GMT

My OWA server locataed at my corperate office.

Re: ASA firewall issue

manivelengg — Mon, 15 Nov 2010 03:04:21 GMT

The OWA sserver is located at my Corporate office and the server ip is 192.168.100.1.After getting connected the vpn client,im pinging the server ip i.e 192.168.100.1 but i cant access my webmail.

R u considering the problem is at 80 port?

Re: ASA firewall issue

apothula — Mon, 15 Nov 2010 13:26:08 GMT

Do you have a route on the 10.10.20.2 router, pointing the VPN pool back to the ASA ??

a route like,

ip route 172.16.1.0 255.255.255.0 10.10.20 1 ??

Cheers,

Nash.

Re: ASA firewall issue

manivelengg — Tue, 16 Nov 2010 04:37:03 GMT

Hi.....Thanks,

But VPN ip pool was 182.16.1.1-182.16.1.10.Whenever he connected the vpn client,it will assigned this network 182.16.1.0

Can i put this command,

ip route 182.16.1.0 255.255.255.0 10.10.20.1?..

Please advice me.

Thanks.

Re: ASA firewall issue

apothula — Tue, 16 Nov 2010 04:48:57 GMT

Hi,

Was that a typo 182 in place of 172 ??

I saw the pool as 172.16.1.0/24 in the configuration.

Yeah, you could add that route

ip route 172.16.1.0 255.255.255.0 10.10.20.1

If it is 182

then

ip route 182.16.1.0 255.255.255.0 10.10.20.1

Let me know how it goes.

Cheers,

Nash.

Re: ASA firewall issue

Alan Huseyin Kayahan — Tue, 16 Nov 2010 05:00:36 GMT

PING is a tool that can also work in suboptimal routing cases. First configure syslogging either in ASDM or to an external syslog server. Then try telnetting 192.168.100.1 on port 80 from the VPN client. Check if a blank screen appears, then filter the syslogs that contain 192.168.100.1 and paste here. Also a network diagram will be helpfull.

Re: ASA firewall issue

manivelengg — Tue, 16 Nov 2010 05:06:30 GMT

Hi.....

When i put this command,it is saying,

IFASA#

IFASA#config terminal

IFASA(config)#

IFASA(config)# ip route 172.16.1.0 255.255.255.0 10.10.20.1

ERROR: % invalid input deteced at '^' maker

IFASA(config)#

Please advice me.

Thanks.

Re: ASA firewall issue

apothula — Tue, 16 Nov 2010 05:08:45 GMT

Are you adding that route on 10.10.20.2 router ??

Cheers,

Nash

Re: ASA firewall issue

manivelengg — Tue, 16 Nov 2010 05:34:33 GMT

Hi......

Ya.....i put this command the router.

the command was ,

ip route 172.16.1.0 255.255.255.0 10.10.20.1

Thanks.

Re: ASA firewall issue

apothula — Tue, 16 Nov 2010 05:56:42 GMT

What kind of a device is the 10.10.20.2 ??

is that an ASA or a Router ??

Cheers,

Nash.

Re: ASA firewall issue

manivelengg — Tue, 16 Nov 2010 06:37:28 GMT

Hi.......

10.10.20.2 this kind of divice is that an ASA.

Thanks.

Re: ASA firewall issue

apothula — Tue, 16 Nov 2010 07:29:52 GMT

On what interface is the 10.10.20.2 Ip address configured ??

Depending on the interface name,please add the following,

route "interface name" 172.16.10.0 255.255.255.0 10.10.20.1

For ex, if the 10.10.20.2 ip address is configured on the outside interface,

add

route outside 172.16.10.0 255.255.255.0 10.10.20.1

Cheers,

Nash.

Re: ASA firewall issue

manivelengg — Tue, 16 Nov 2010 08:11:43 GMT

Hi....

whenever he tried to connected to vpn client port 80,it's not showing blank screen.also i sent a network daigram.

Thanks.

Re: ASA firewall issue

manivelengg — Tue, 16 Nov 2010 08:16:44 GMT

Hi.....

Ya i put this command,

route inside 172.16.1.0 255.255.255.0 10.10.20.1

but still not happened.

Thanks.

Re: ASA firewall issue

Alan Huseyin Kayahan — Tue, 16 Nov 2010 11:45:03 GMT

"whenever he tried to connected to vpn client port 80"

I didnt understand. I mean, VPN client should try to telnet 192.168.100.1 on port 80, not to be telnetted. Instead of pinging the server, use telnet on port 80.

Diagram is usefull. Please post the outut of "show ip route" command from 3560G core switch?

Please post the output of "route print" command from exchange server's command line (cmd).

Please post the output of "show ip route" command from firewall.

Please post the output of "route print" command from the VPN client cmd line

Did you set syslog? Did you get any syslog entries when you tried to connect exchange server on port 80 via telnet from VPN client?

Re: ASA firewall issue

manivelengg — Wed, 17 Nov 2010 08:40:02 GMT

Hi......

Please find the attachment for the "route print" & "show ip route" files.

Thanks.