Randy thanks for the time you

johnnyboy788 · ‎01-01-2016

Hello, i'm currently trying to transform my home network into something better by adding a Cisco ASA 5510.

I'm going to post my current running config.

the idea is for everyone who gets in by VPN to transfer all traffic to my public IP address.

All traffic must be passing by the outside interface.

the problem is that i can conect to the VPN but cant ping anything or access any computer or even the router by VPN

i get a VPN ip address but no pings or SSH connections or response.

I also would like to ask if anyone see that the network and config can have more protection features, just send your sugestions for it to be saffer.

I have a SDM Module if it has any use i can give at it just let me know how

All help will be apreeciated.

Thanks

---------------------------------------------------------------------

Running Config

!
hostname ciscoasa
enable password [password]
passwd [password]
!
!Interface setup:
!
interface Ethernet0/0
nameif outside
security-level 0
ip address dhcp setroute
no shutdown
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.15.254 255.255.255.0
no shutdown
!
!clock timezone
!
clock timezone WEST 0
clock summer-time WEST recurring last Sun Mar 1:00 last Sun Oct 1:00
!
!DNS server group
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 192.168.7.254
!
object-group network net_vpnclients
network-object 192.168.21.0 255.255.255.0
!
!Acls
access-list outside-in extended permit icmp any any echo-reply
access-list outside-in extended permit icmp any any time-exceeded
!
access-list ClientVPN_ACCESS extended permit ip 192.168.21.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list Split_ClientVPN permit 192.168.15.0 255.255.255.0 any
access-list nonat extended permit ip 192.168.15.0 255.255.255.0 192.168.21.0 255.255.255.0
!
!Logging (http://www.cisco.com/c/en/us/support/doc...sa-00.html)
!
logging enable
logging timestamp
logging buffered notifications
logging asdm informational
!
ip local pool vpnpool 192.168.21.10-192.168.21.200 mask 255.255.255.0
!
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
!
asdm history enable
!
!NAT/PAT (http://www.cisco.com/c/en/us/support/doc...t-pat.html)
global (outside) 1 interface
!
nat (inside) 0 access-list nonat
nat (inside) 1 192.168.15.0 255.255.255.0
!
access-group outside-in in interface outside
!
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication enable console LOCAL
!
http server enable 10443
http 192.168.15.0 255.255.255.0 inside
http 192.168.21.0 255.255.255.0 outside
!
!Phase 2 Configurations
!
crypto ipsec transform-set AES esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map DYNAMAP 50 set transform-set AES
crypto map IPSEC_GW 50 ipsec-isakmp dynamic DYNAMAP
crypto map IPSEC_GW interface outside
!
!Phase 1 Configurations
!
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
!
!
!
ssh 192.168.15.0 255.255.255.0 inside
ssh 192.168.21.0 255.255.255.0 outside
!
!DHCP Server (http://www.cisco.com/c/en/us/support/doc...tml#server)
!
dhcpd address 192.168.15.20-192.168.15.249 inside
dhcpd dns 192.168.7.254
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
!
ntp server 194.117.9.130 source outside prefer
!
webvpn
enable outside
svc image disk0:/anyconnect-win-2.2.0133-k9.pkg 1
svc enable
!
!IPSEC VPN Client (http://www.cisco.com/c/en/us/support/doc...nt-ca.html)
!Create a group policy
!
group-policy VPNClient_GRP internal
group-policy VPNClient_GRP attributes
vpn-filter value ClientVPN_ACCESS
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
vpn-simultaneous-logins 10
split-tunnel-network-list value Split_ClientVPN
acl Split_ClientVPN
address-pools value vpnpool
!
!Create a Tunnel Connection
!
tunnel-group VPNClient_CONN type remote-access
tunnel-group VPNClient_CONN general-attributes
address-pool vpnpool
default-group-policy VPNClient_GRP
tunnel-group VPNClient_CONN ipsec-attributes
pre-shared-key [PRE KEY]
!
!SSL VPN
!
group-policy SSLClient_GRP internal
group-policy SSLClient_GRP attributes
dns-server value 192.168.7.254
vpn-simultaneous-logins 1
vpn-filter value ClientVPN_ACCESS
vpn-tunnel-protocol svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split_ClientVPN
webvpn
svc keep-installer none
svc rekey time 30
svc rekey method ssl
svc ask none default webvpn
!customization value VPN
!
tunnel-group SSLClient_CONN type remote-access
tunnel-group SSLClient_CONN general-attributes
address-pool vpnpool
default-group-policy SSLClient_GRP
tunnel-group SSLClient_CONN webvpn-attributes
!customization VPN
group-alias SSLClient_GRP enable
!
!user admin
username admin password [Password] privilege 15
!
!user VPNIPSEC
username vpnuser password [Password]
username vpnuser attributes
vpn-group-policy VPNClient_GRP
!
!user VPNSSL
username ssluser password [Password]
username ssluser attributes
vpn-group-policy SSLClient_GRP
!
!
class-map inspection_default
match default-inspection-traffic
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global

rvarelac · ‎01-04-2016

Hi johnnyboy788,

The configuration looks fine, please run a packet-tracer to verify the ASA is behaving properly.

packet-tracer inside icmp 192.168.15.10 8 0 192.168.21.10 detailed.

Hope it helps

-Randy-

johnnyboy788 · ‎01-05-2016

This is whith local computer and VPN connected

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.21.10 255.255.255.255 outside

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (sp-security-failed) Slowpath security checks failed

johnnyboy788 · ‎01-05-2016

This is with local client and no vpnclient

ciscoasa(config)# packet-tracer input inside icmp 192.168.15.0 8 0 192.168.21.$

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xca8bc6b0, priority=1, domain=permit, deny=false
hits=28412, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (sp-security-failed) Slowpath security checks failed

johnnyboy788 · ‎01-05-2016

My ideias is for all traffic to pass through the vpn tunnel also any vpn client can get out with my public IP

Also i would like that the same user that uses the IPSEC login can also use the IPSEC login on SSL anyconnect, so that i only create one user instead of 2

Can you show me that

rvarelac · ‎01-05-2016

Hi,

In order to have the vpn client to get out to the internet with the ASA public IP, you need to configure a U-Turn policy, you can find the example below:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100918-asa-sslvpn-00.html

If the username is created locally on the ASA, can be used for both IPSEC and SSL connections by default, if the username is created on an external server, the server must be specified under the tunnel-group of the connection.

Hope it helps

-Randy-

johnnyboy788 · ‎01-05-2016

Randy thanks for the time you are spending with me. But the VPN packet Tracer is abouve and packets are dropped still cand ping or connect to anything

rvarelac · ‎01-06-2016

Hi Johnny,

Is the configuration still the same as the one posted? Looks like this log might be caused by a security feature of the ASA, but the configuration posted looks fine.

Can you grab a recent config file, also try the packet-tracer with TCP and advise if we have the same results.

Example:

packet-tracer inside tcp 192.168.15.10 22 192.168.21.10 22 detailed

-Randy-

johnnyboy788 · ‎01-06-2016

result and current config

Can you help me modify the current config so that the vpn clients can ping all networks and have internet acceso from ASA

Also that the User from ipsec can use SSL (Default group i think)

you can edit this current config from asa

make the necessary arrangements you fill fit

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xca8bc6a0, priority=1, domain=permit, deny=false
hits=1, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000

Result:
input-interface: inside
input-status: up
input-line-status: up
Action: drop
Drop-reason: (no-route) No route to host

-------------------------------------------------

runing conf

hostname ciscoasa
enable password XXXX encrypted
passwd XXXXX encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.15.254 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
!
ftp mode passive
clock timezone WEST 0
clock summer-time WEDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 192.168.7.254
object-group network net_vpnclients
network-object 192.168.21.0 255.255.255.0
access-list outside-in extended permit icmp any any echo-reply
access-list outside-in extended permit icmp any any time-exceeded
access-list ClientVPN_ACCESS extended permit ip 192.168.21.0 255.255.255.0 192.168.15.0 255.255.255.0
access-list Split_ClientVPN standard permit 192.168.15.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.15.0 255.255.255.0 object-group net_vpnclients
pager lines 24
logging enable
logging timestamp
logging buffered notifications
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
ip local pool vpnpool 192.168.21.10-192.168.21.200 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound outside
nat (inside) 1 192.168.15.0 255.255.255.0
access-group outside-in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication enable console LOCAL
http server enable 10443
http 192.168.1.0 255.255.255.0 management
http 192.168.15.0 255.255.255.0 inside
http 192.168.21.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set AES esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map DYNAMAP 50 set transform-set AES
crypto map IPSEC_GW 50 ipsec-isakmp dynamic DYNAMAP
crypto map IPSEC_GW interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.21.0 255.255.255.0 outside
ssh 192.168.15.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
management-access inside
dhcpd dns 192.168.7.254
!
dhcpd address 192.168.15.20-192.168.15.249 inside
dhcpd enable inside
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 194.117.9.130 source outside prefer
webvpn
enable outside
svc image disk0:/anyconnect-win-2.2.0133-k9.pkg 1
svc enable
tunnel-group-list enable
group-policy SSLClient_GRP internal
group-policy SSLClient_GRP attributes
dns-server value 192.168.7.254
vpn-simultaneous-logins 1
vpn-filter value ClientVPN_ACCESS
vpn-tunnel-protocol svc webvpn
split-tunnel-policy tunnelall
address-pools value vpnpool
ipv6-address-pools none
webvpn
svc keep-installer none
svc rekey time 30
svc rekey method ssl
svc ask none default webvpn
group-policy VPNClient_GRP internal
group-policy VPNClient_GRP attributes
vpn-simultaneous-logins 10
vpn-filter value ClientVPN_ACCESS
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split_ClientVPN
address-pools value vpnpool
username admin password XXXXXXX encrypted privilege 15
username USER password XXXXXXX encrypted
username USERattributes
vpn-group-policy VPNClient_GRP
service-type remote-access
username USERSSL password XXXXX encrypted
username USERSSL attributes
vpn-group-policy SSLClient_GRP
service-type remote-access
tunnel-group VPNClient_CONN type remote-access
tunnel-group VPNClient_CONN general-attributes
address-pool vpnpool
default-group-policy VPNClient_GRP
tunnel-group VPNClient_CONN ipsec-attributes
pre-shared-key *****
tunnel-group SSLClient_CONN type remote-access
tunnel-group SSLClient_CONN general-attributes
address-pool vpnpool
default-group-policy SSLClient_GRP
tunnel-group SSLClient_CONN webvpn-attributes
group-alias SSLClient_GRP enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:XXXXXXXXXXXXX
: end

rvarelac · ‎01-07-2016

The routing seems to be the problem at this point, you need to add a default route or specific route to the ASA in order to be capable to route the traffic.

Example:

route outside 0 0 1.1.1.1

Where "1.1.1.1" is the IP of the next hop. The rest of the configuration looks fine.

Cheers,

johnnyboy788 · ‎01-11-2016

Randy, thanks for all help but nothing yet

After doing that correction, i have the ACLs and the tcp and icmp they give packed drop by rule, after checking asdm i see the the default deny implicit rules are taking affect, even if i create one for each adapter saying allow any any the deny is always used.

I had to create a virtual adapter ethernet0/1.101 with vpn address

Can you help?

Can you re-write a new config step by step to see whats wrong my Asa is 8.2 or 8.3 version

johnnyboy788 · ‎01-06-2016

P

Cisco ASA 5510 - VPN e Security