topic Re: Remote-Access_vpn in Network Security

Remote-Access_vpn

pranuvpandit — Mon, 11 Mar 2019 13:43:31 GMT

I have configured Remote access VPN on ASA5510. VPN clients are able to connect to the internal network and they can ping local Lan computers but I am not able to assign the DNS address of the local Subnet to the VPN Clients. Please suggest what needs to be configured on the ASA.

Re: Remote-Access_vpn

acomiskey — Thu, 11 Sep 2008 19:30:49 GMT

group-policy internal

group-policy attributes

dns-server value

Re: Remote-Access_vpn

pranuvpandit — Fri, 12 Sep 2008 14:10:02 GMT

Thanx Bro...it works.

Re: Remote-Access_vpn

jstabl — Thu, 09 Oct 2008 19:17:14 GMT

I did this setting and when my users connect to the VPN the IPConfig /all shows the dns servers and they can do an NSlookup and the dns returns the correct value. But when they try to ping or browse to the destination by name this fails.

It was working for about an hour and then just stopped working. I have this in my config.

group-policy default internal

group-policy default attributes

wins-server value 10.1.1.25 10.1.1.21

dns-server value 10.1.1.25 10.1.1.21

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value default_splitTunnelAcl

default-domain value legalplans.com

Re: Remote-Access_vpn

pranuvpandit — Fri, 10 Oct 2008 14:33:45 GMT

Are you able to ping by using IP address.

Re: Remote-Access_vpn

jstabl — Fri, 10 Oct 2008 16:09:04 GMT

yea I can ping by IP to all the networks. I added the line. Split-DNS legalplans.com

I think it takes a few minutes for the dns to start working to the client. I cant ping within the first minute of connecting but if I stay connected long enough it seems to work. (sometimes)

Ever heard of this issue?

Re: Remote-Access_vpn

pranuvpandit — Fri, 10 Oct 2008 17:54:12 GMT

this problem is being faced by the VPN users only or everybodu in the LOCAL LAN.

Re: Remote-Access_vpn

jstabl — Fri, 10 Oct 2008 18:13:13 GMT

VPN users only. Works fine on the LAN

Re: Remote-Access_vpn

pranuvpandit — Fri, 10 Oct 2008 18:19:12 GMT

DNS- Server is able to resolve the name.Right? But after that it is not pinging that particular IP!

LAN users are accessing the internet through Firewaal. If yes....share the commands you configured for NAT or PAT.

Thanx

Re: Remote-Access_vpn

jstabl — Mon, 13 Oct 2008 14:33:01 GMT

nat (inside) 0 access-list inside_outbound_nat0_acl

nat (inside) 10 0.0.0.0 0.0.0.0

nat (dmz) 0 access-list dmz_outbound_nat0_acl

nat (dmz) 10 0.0.0.0 0.0.0.0

Re: Remote-Access_vpn

pranuvpandit — Mon, 13 Oct 2008 16:29:45 GMT

you are not using any NAT id for the given subnets. And which statements you are using for providing internet connectivity. these statements are for Nat_exemption, I assume.

2ndly is your DNS server is resolving the DNS names to ip addresses for VPN users?

Re: Remote-Access_vpn

jstabl — Mon, 13 Oct 2008 17:25:34 GMT

The NAT statements let the traffic to the internal and DMZ networks and to the Internet on PAT. THen I have route statements for the VPN network that route it too.

ALl of the routing works fine. The VPN users can do a nslookup and the DNS server responds but when doing a ping by name their is no response. Again by IP to these same computers ping works fine.

Not sure what the issue is.

Re: Remote-Access_vpn

pranuvpandit — Mon, 13 Oct 2008 17:45:34 GMT

IF possible can you paste your run-config here.?