MSB Client VPN issue

5creedus — Mon, 11 Mar 2019 16:21:33 GMT

customer unable to connect to vpn endpoint when going through a MSB.

He changes the gateway on the host to use the ASA as the exit point and has no problems.

The endpoint is reachable from either the MSB or ASA.

Any know issues with MSB and Cisco client VPN.

Re: MSB Client VPN issue

5creedus — Wed, 30 Sep 2009 21:15:20 GMT

got the solution from another co-worker so sharing:

The "bigmss (MTU) fixup" is used when VPN is not connecting from hosts behind a MSB firewall. Symptoms are:

- no ISAKMP return traffic seen by the client

- the "test" rule allowing ISAKMP inbound increments, indicating the return traffic made it to the firewall outside interface

- no login prompt (popup window)

To resolve do the below in sequence and when complete have the connection tested. The VPN login prompt (popup window) should now be seen. This works with many to one NAT or one to one NAT

1) acl for fixup

access-list tcp_norm line 5 extended permit tcp any any

2) class maps

parameter-map type connection TCPMAP

exceed-mss allow

exit

class-map match-all cmTCPNORM

2 match access-list tcp_norm

exit

3) policy map

policy-map multi-match bigmss

class cmTCPNORM

connection advanced-options TCPMAP

exit

4) apply the policy map to both the external and internal interfaces

interface internal

service-policy input bigmss

exit

interface external

service-policy input bigmss

exit

Ensure you save the policy

topic Re: MSB Client VPN issue in Network Security

MSB Client VPN issue

Re: MSB Client VPN issue