topic Re: Local Lan Access thru the ASA5510 in Network Security

Local Lan Access thru the ASA5510

broow — Fri, 21 Feb 2020 11:21:50 GMT

I am at my wits end trying to figure this out. We are in the process of replacing our good ol' 3030 with an ASA 5510 for vpn purposes. I have setup the ASA as follows:

E0/0 is the public interface: xxx.xxx.199.10/24

E0/1 is the private interface: 172.20.72.0/24

The remote clients get a 10.12.27.xxx address from the ASA.

The client get the address fine, but can not access anything on the 172.20.72.xxx network. What piece am I missing? Some type of NAT?

Re: Local Lan Access thru the ASA5510

JORGE RODRIGUEZ — Wed, 18 Mar 2009 20:23:28 GMT

check your nonat acl to make sure you permit RA vpn pool network,

access-list nside_nat0_outbound extended permit ip 172.20.72.0 255.255.255.0 10.12.27.0

nat (inside) 0 access-list inside_nat0_outbound

if you already have a nonat acl peimiting the traffic then make sure you have NAT-T enabled globally in ASA :

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#Solution1

Regards

Re: Local Lan Access thru the ASA5510

JORGE RODRIGUEZ — Thu, 19 Mar 2009 21:52:30 GMT

William, is your problem resolved with the suggestions I have provided, let us know otherwise to assist you fruther.

Regards

Re: Local Lan Access thru the ASA5510

oneirishpollack — Fri, 20 Mar 2009 13:22:44 GMT

I am in the same boat, but I am missing the big picture.

Here is my IP configs of my VPN connected client:

PPP adapter NationalAccess - BroadbandAccess:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 70.211.67.89

Subnet Mask . . . . . . . . . . . : 255.255.255.255

Default Gateway . . . . . . . . . : 70.211.67.89

Ethernet adapter VPN#1:

Connection-specific DNS Suffix . :

IP Address. . . . . . . . . . . . : 172.16.100.1

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . :

I have attached the ipconfig and route print. The ASA address is: 163.105.74.249

I can ping the ASA and Yahoo, but no inside addresses (10.4.4.x)

Can you give me some ideas of what is wrong. I am using split tunneling.

Re: Local Lan Access thru the ASA5510

broow — Fri, 20 Mar 2009 14:42:54 GMT

still stuck,

I will send my config file if that is okay.

Re: Local Lan Access thru the ASA5510

broow — Fri, 20 Mar 2009 15:10:27 GMT

attached is the config file

Re: Local Lan Access thru the ASA5510

broow — Fri, 20 Mar 2009 20:03:24 GMT

The vpn is now working. I added your suggestions. I also added a route I had oitted in the router for the 172.20.72.x network to send 10.12.27.x traffic to the asa5510 at 172.20.72.5. After that, pings and access worked. Thanks

Re: Local Lan Access thru the ASA5510

JORGE RODRIGUEZ — Fri, 20 Mar 2009 21:24:58 GMT

William, glad all has worked, don't forget to rate helpful posts.

Regards