Cicsco Software VPN Client connect fails to pass through ASA5505 to PIX515

[nathanmccoy]

I am trying to connect my cisco software vpn client (latest version)from home, behind an ASA5505(v8.2), to my work VPN hosted by a PIX515(v7.2).

(word diagram)

client->ASA5505->internet->PIX515

I've attached both logs.

The ASA and the PIX.

The 515 is confirmed to work, if I take the ASA out of the equation the client connects. I have l2l connections on the PIX that were taken out of the log before uploading.

I could set the ASA up as an L2L also, but I really want to understand why I can't get the client to connect if I put them behind an ASA.

I misspoke, I do connect if behind the ASA, and the PIX issues a 100.100.100.2 address from the PIX pool dealer. I can't ping the 192.168.125.x network though, I'm calling it unable to connect.

I tried to run these commands on the ASA:

sysopt connection permit-vpn

crypto isakmp nat-traversal 20

And it seems to accept them, but when I do a show run, the commands are not there. I know these are vital, so if you could help me find out how to fix this, it would be greatly appreciated.

Thanks in advance,

Nathan

[Collin Clark]

Nathan-

Do you have an extra public IP on the ASA side? If so, create a full static NAT to the client and try VPN. That's the only way I've ever been able to get the client to traverse a firewall and establish a remote VPN connection. More of a work-around than a fix.

[nathanmccoy]

No, the ASA is my home network with only a single static outside IP assigned to it.

The main reason for my post, and this setup, is that I plan to be shipping the ASA5505 to clients in the field that will still need to be able to connect via VPN client while behind the ASA because they don't have static outside IP addresses.

That's why I didn't just setup an l2l tunnel on the ASA. I need to be certain the cisco vpn client can traverse the ASA to the PIX and back.

This was initially, what I thought would be a simple 'see it works' project that would take about an hour, but has turned into quite the task.

Thanks for the idea though.

[Collin Clark]

If you do get this working, I'd appreciate if you could post the fix. Maybe you could open a TAC case on it?

[nathanmccoy]

I know it will work, it's just a matter of fixing what I've done in the ASA config.

Unfotunately I do not have a TAC contract or this would have been solved a week ago.

I used the only other fountain of knowledge available to me, experts-exchange.

If I get the resolution, I will post it here also though. I'm sure I'm not the only NA facing this issue.

[nathanmccoy]

Solution found.

Look back at my configs the PIX and the ASA.

Are you ready?

I entered:

crypto isakmp nat-traversal 20

on the !PIX! and everything works fine.

I knew it would be that command somehow, I just didn't know where I was dogging it up.

There was nothing wrong with the ASA config, well as far as the tunnels went.

[Collin Clark]

Can you establish more than one tunnel?

[nathanmccoy]

Yes, I was able to establish multiple tunnels.

I tried it from the ASA here at work, it's on a separate ISP, and on the ASA from my home network.

The one I established here at work received an IP of 100.100.100.2 and the one from the house received an IP of 100.100.100.3 .

Both of these were established in combination with the 15+ static lan 2 lan tunnels that are already in place on the PIX515.

Everything clicks right along.

[Collin Clark]

Sweet, appreciate the info.