VPN no access to other networks on ASA

[cco_heerema]

Hi,

I'm trying to get my vpn clients access to all my networks on my ASA

But when i ping a host from a client which is connected via a VPN tunnel to a host which is not on the MGMT interface i get :

no translation group found for ICMP src outside 10.100.50.100

In my logging.

This has probably something to do with my nat configuration ( Routing is ok because i can ping the host from the ASA itself)

So can somebody please help me understand why this is going wrong and what i need to do to get this working.

Thanks !

Description of my network

Eth0 = Public IP on internet

ETh2 = DMZ ( back 2 back with ISA server)

Eth3= Management

I want to get in with VPN clients from the internet and get access to all networks. No i only can reach the MGMT and not the ISA srv

[5220 · Accepted solution]

Hi,

First, the VPN pool should be a different subnet from the LAN:

LAN 10.100.50.0/24

VPN pool 10.100.60.0/24

In order to make the traffic work add the following command:

access-list NONAT permit ip 10.100.60.0 255.255.255.0 10.100.50.0 255.255.255.0

nat(inside) 0 access-list NONAT

Please rate if this helped.

Regards,

Daniel

[cco_heerema]

Thanks for your help Daniel,

This solved my issue, BUT as i am using this tunnel to have access to all network resources to manage this network.

I also would like to have access to my ASA

I allready included an

ssh 10.100.60.0 255.255.255.0 Inside

ssh 10.100.60.0 255.255.255.0 Outside

ssh 10.100.60.0 255.255.255.0 MGMT

telnet 10.100.60.0 255.255.255.0 Inside

telnet 10.100.60.0 255.255.255.0 Outside

telnet 10.100.60.0 255.255.255.0 MGMT

But the i am not able to access the ASA itself from a VPN connected client.

A telnet session behaves verry strange, it looks like the session does start, but it never passes on making the windows CLI telnet tool to hang (it doesn't exit)

What am i missing here ?

[m.sir · Accepted solution]

Can you try management-access inside command

check following link for more info

http://www.ciscotaccc.com/kaidara-advisor/security/showcase?case=K17708166

M.

[cco_heerema]

This issue has kept me awake for 2 nights .. so i am SO gratefull !

Thank you so much !

Maikel