topic Re: Client VPN through ASA in Network Security

Client VPN through ASA

kinskins01 — Mon, 11 Mar 2019 11:01:11 GMT

HI,

Does anyone know whats going on here? One of the clients on the network launches a cisco vpn client to an external resource and the client connects and is authenticated but no traffic passes.

PAT is in use on the outside interface.

I have enabled nat traversal and sysopt connection permit-ipsec.

Thanks

Re: Client VPN through ASA

mattiaseriksson — Wed, 22 Aug 2007 14:06:23 GMT

Hi, it is not you but the owner of the remote vpn server that has to enable nat traversal as it is part of the IKE negotiation between the IPSec peers.

Regards,

/Mattias

Re: Client VPN through ASA

kinskins01 — Wed, 22 Aug 2007 14:38:26 GMT

HI thanks for the response.

I have recently replaced a Sonicwall with an ASA and the connection worked fine through the Sonicwall.

Any ideas?

Re: Client VPN through ASA

mattiaseriksson — Wed, 22 Aug 2007 14:50:31 GMT

If you only have one client on your LAN you can use IPSec passthrough which is not enabled by default.

In ASA I think the command is inspect ipsec-pass-thru.

A sonicwall has probably all features enabled by default, wouldn't suprise me.

Re: Client VPN through ASA

kinskins01 — Thu, 23 Aug 2007 07:46:36 GMT

HI,

When the vpn was established from the client I got the following warnings on the ASA:

regular translation creation failed for protocol 50 src inside:192.X.X.X. dst outside:159.X.X.X

Its related to PAT so I went and put in a static entry for the client so it nats out to its own Public IP and hey presto it worked.

Thanks for your help

Re: Client VPN through ASA

anandramapathy — Thu, 23 Aug 2007 12:12:46 GMT

Right -

This is usually set on the Remote server end.

The option - IKE over TCP & Port number is available in the client. there is a UDP option also for this.

The default port for cisco is 10000.

you can find this by inititing a session form the client & typing the following command

show conn local ( ip of the client )

it will show you the connections

Re: Client VPN through ASA

sdvorderh — Thu, 23 Aug 2007 12:14:31 GMT

Hello there, you might want to have a look at this article that explains that you need to create an ACL with ACE in the new verison 8.0 of the ASA IOS to get the traffic flowing!

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702992.shtml