Cisco VPN client connects, but cannot ping the server

[leonnikolaou]

Hi,

At my office I have a cisco ASA firewall 5505. I'm trying to connect to another location by using a cisco vpn client.

I'm connected sussesful to the other location with my vpn client but then I cannot ping or remote desktop to my remote server.

When I try to connect with my wireless connection from the office, everything works fine, I can connect and can rdp my server.

I think there is something on my Cisco ASA firewall that propaply blocking me from accessing my remote server, since by wireless everything is ok.

Below you can see printshoots from my ASA that shows the ports that I have opened.

I would appreciate any suggestions.

Thank you!

Regards

Leon

.

[Federico Coto Fajardo]

Hi,

If your VPN client connection is going through the ASA (and the ASA is doing PAT for your connection) you might need to make sure that NAT-T is enabled on both the server and client.

On the client under transport by default NAT-T should be enabled under the transport tab.

On the VPN endpoint (server) you need to check for NAT-T

You can try enabling IPsec/TCP on both ends as well.

Federico.

[leonnikolaou]

Hi Federico,

thanks for your reply. When using the wireless the connection is ok.

when going out through the ASA then is doing the problem.

On the client the NAT-T it is enabled.

You mean to check on my remote ASA firewall which the vpn is configured if the NAT-T is enable? if yes, how can I check that?

Also, how can I enable the IPsec/TCP on both ends?

Thank you for your time

Regards

Leon

[Federico Coto Fajardo · Accepted solution]

On the ASA it should be enabled by default but you can check it out doing:

sh run all cry isa

You should see:

crypto isakmp nat-traversal 20

To test IPsec/TCP you need to chose that option on the client (where NAT-T is chosen) and on the server  cry isakmp ipsec-over-tcp port 10000

Hope it helps.

Federico.

[leonnikolaou]

Federico you rock!!

Thank you so much!! for some reason the crypto isakmp nat-traversal 20

was not enable on neither ASA so as soon as I entered that command it worked!

Thank you!!

Regards

Leon