is it possible for you to share ASA config? ... View more

is it possible for you to post the configs as well? ... View more

the time you are not able to connect to internal resources, did you try clearing the arp table at the switch end and check if you can reach internal resources? ... View more

Hi Jason, this is the packet flow in ASA: PIX/ASA - VPN - Inside (Higher Sec_Lev) to Outside (Lower SEC_Level) --------------------------------------------------------------- Eg. Type - [Sub-Type] - Description 1. FLOW-LOOKUP - [] - Check for existing connections, if none found create a new connection. 2. ROUTE-LOOKUP - [input] - Initial Checking (Reverse Path Check, etc.) 3. ACCESS-LIST - [log] - ACL Lookup 4. CONN-SETTINGS - [] - class-map, policy-map, service-policy 5. IP-OPTIONS - [] - 6. NAT - [] - xlate 7. NAT - [host-limits] - 8. VPN - [encrypt] - 9. VPN - [ipsec-tunnel-flow] - 10. IP-OPTIONS - [] - 11. FLOW-CREATION - [] - If everything passes up until this point a connection is created. 12. FLOW-LOOKUP - [] - On the new header 13. ACCESS-LIST - [] - On the new header 14. FLOW-CREATION - [] - 15. ROUTE-LOOKUP - [output and adjacency] Since route lookup is done before NAT, you have to change the ip address scheme at your end or ask them to nat. ... View more

try a simple configuration w/o isakmp proflies have a look at this link: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805e8c80.shtml ... View more

you may check the routing table of the client machine as well, check if there is any conflicting persisten route. Also do you see packets getting encrypted at the client machine? ... View more

the error: Invalid SA protocol type: 0 directs that the ID type is not matching. Since the tuneel is in main mode you need to check the ID types. You have to use the IP address as the ID type. You may check the defaults at: To view the basic setting defaults that are configured by the Wizard, click VPN on the menu bar, and then click IPsec > Basic Setting Defaults. also NOTE If you choose Main Mode, then you must use an IP address as the identifier type for both the Local device and the Remote device You may follow the guide as below: http://www.cisco.com/en/US/docs/security/multi_function_security/multi_function_security_appliance/sa_500/administration/guide/SA500_AG_OL1911404.pdf ... View more

Hope you did the following to make it work: Open Registry editor by typingregedit in Run prompt ·    Browse to the Registry Key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\CVirtA ·    Select the DisplayName to modify, and remove the leading characters from the value data upto "%;" i.e. o    For x86, change the value data from something like "@oem8.inf,%CVirtA_Desc%;Cisco Systems VPN Adapter” to "Cisco Systems VPN Adapter” o    For x64, change the value data from something like "@oem8.inf,%CVirtA_Desc%;Cisco Systems VPN Adapter for 64-bit Windows” to "Cisco Systems VPN Adapter for 64-bit Windows” ·    Try connecting again Also could you post logs or captures from ASA when you connect with the machine that does not work. I assume you are connecting to same group. ... View more

I see a mismatch in crypto acl: On HQ: access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0 Colospace_Network_172.16.16.0 255.255.255.0 access-list outside_1_cryptomap extended permit ip Colospace_Network_172.16.16.0 255.255.255.0 10.10.11.0 255.255.255.0 access-list outside_1_cryptomap extended permit ip 10.10.11.0 255.255.255.0 Colospace_Network_172.16.16.0 255.255.255.0 There is no need of the second line access-list outside_1_cryptomap extended permit ip Colospace_Network_172.16.16.0 255.255.255.0 10.10.11.0 255.255.255.0 as Colospace network is remote and not local. ... View more

just run the logs? What I suspect is the issue that there is no translation rule configured for vpn pool on outside interface to outside interface and hence traffic is dropping. Just check the log having source as 10.10.11.x to your colo network. IF it says no translation found, try adding static (outside,outside) 10.10.11.0 10.10.11.0 netmask 255.255.255.0 Logging may be enabled by logging enable logging level 7 and then try to generate traffic from your client towards colo. to stop do: un all ... View more

I will look in to any valid proof if I have but reading the description seems to solve the issue. ... View more

Also try configuring DCD, hope it helps: http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s1.html#wp1429883 ... View more

Do the users disconnects the client themselves or the vpn connection just drops and then you face this tcp issue? ... View more