asa 5505 vpn

[KpaH4iTooo]

Hello, i have asa 5505. Users can connect to inside network (192.168.1.0) throught L2TP VPN and can ping inside network. Need to allow vpn users (192.168.2.0) to ping each other.

interface Vlan1 
nameif inside 
security-level 100 
ip address 192.168.1.1 255.255.255.0 

interface Vlan2 
nameif outside 
security-level 0 
ip address dhcp setroute 

same-security-traffic permit inter-interface 
access-list Local_LAN_Access remark VPN Client Local LAN Access 
access-list Local_LAN_Access standard permit 192.168.1.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip any 192.168.3.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip any 192.168.2.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip any 192.168.4.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.4.0 255.255.255.0 
access-list vpn extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0 
access-list Local_LAN_Access_l2tp remark l2tp Client Local LAN Access 
access-list Local_LAN_Access_l2tp standard permit 192.168.1.0 255.255.255.0 
access-list Local_LAN_Access_l2tp standard permit 192.168.2.0 255.255.255.0 
access-list vpn_l2tp extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 
access-list split-tunnel standard permit 192.168.1.0 255.255.255.0 
access-list split-tunnel remark match Anyconn client to tunnel traffic 
ip local pool l2tp-ipsec_address 192.168.2.100-192.168.2.114 mask 255.255.255.0 
nat-control 
global (inside) 2 192.168.1.101 
global (inside) 3 192.168.1.102 
global (outside) 1 interface 
nat (inside) 0 access-list Inside_nat0_outbound 
nat (inside) 1 192.168.1.0 255.255.255.0 
nat (outside) 2 access-list vpn 
nat (outside) 3 access-list vpn_l2tp 

crypto ipsec transform-set trans esp-3des esp-sha-hmac 
crypto ipsec transform-set trans mode transport 
crypto dynamic-map dyno 10 set transform-set trans 
crypto map vpn 65535 ipsec-isakmp dynamic dyno 
crypto map vpn interface outside 
crypto isakmp enable outside 
crypto isakmp policy 1 
authentication pre-share 
encryption 3des 
hash sha 
group 2 
lifetime 43200 
crypto isakmp policy 10 
authentication rsa-sig 
encryption 3des 
hash sha 
group 2 
lifetime 86400 
crypto isakmp nat-traversal 30 
vpn-addr-assign local reuse-delay 5 
group-policy l2tp-ipsec_policy internal 
group-policy l2tp-ipsec_policy attributes 
dns-server value 192.168.1.10 
vpn-tunnel-protocol l2tp-ipsec 
split-tunnel-policy tunnelspecified 
split-tunnel-network-list value Local_LAN_Access_l2tp

[Dinesh Moudgil]

Hello,

You will have to configure hair pinning / u turning to get this working. Make sure the vpn pool is allowed in the split access-list for L2TP clients.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Hope this helps.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[niemmanu]

Please go through the document given in the post above also right of the top of my head I can see you are missing

same-security permit intra-interface, this is required as traffic comes from outside interface and then goes to the outside interface.

Regards,

Nitish Emmnauel