10-27-2014 05:07 AM
Hello, i have asa 5505. Users can connect to inside network (192.168.1.0) throught L2TP VPN and can ping inside network. Need to allow vpn users (192.168.2.0) to ping each other.
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
same-security-traffic permit inter-interface
access-list Local_LAN_Access remark VPN Client Local LAN Access
access-list Local_LAN_Access standard permit 192.168.1.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip any 192.168.3.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip any 192.168.2.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip any 192.168.4.0 255.255.255.0
access-list Inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.4.0 255.255.255.0
access-list vpn extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list Local_LAN_Access_l2tp remark l2tp Client Local LAN Access
access-list Local_LAN_Access_l2tp standard permit 192.168.1.0 255.255.255.0
access-list Local_LAN_Access_l2tp standard permit 192.168.2.0 255.255.255.0
access-list vpn_l2tp extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list split-tunnel standard permit 192.168.1.0 255.255.255.0
access-list split-tunnel remark match Anyconn client to tunnel traffic
ip local pool l2tp-ipsec_address 192.168.2.100-192.168.2.114 mask 255.255.255.0
nat-control
global (inside) 2 192.168.1.101
global (inside) 3 192.168.1.102
global (outside) 1 interface
nat (inside) 0 access-list Inside_nat0_outbound
nat (inside) 1 192.168.1.0 255.255.255.0
nat (outside) 2 access-list vpn
nat (outside) 3 access-list vpn_l2tp
crypto ipsec transform-set trans esp-3des esp-sha-hmac
crypto ipsec transform-set trans mode transport
crypto dynamic-map dyno 10 set transform-set trans
crypto map vpn 65535 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
crypto isakmp policy 10
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal 30
vpn-addr-assign local reuse-delay 5
group-policy l2tp-ipsec_policy internal
group-policy l2tp-ipsec_policy attributes
dns-server value 192.168.1.10
vpn-tunnel-protocol l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Local_LAN_Access_l2tp
10-27-2014 08:12 AM
Hello,
You will have to configure hair pinning / u turning to get this working. Make sure the vpn pool is allowed in the split access-list for L2TP clients.
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml
Hope this helps.
Regards,
Dinesh Moudgil
P.S. Please rate helpful posts.
10-31-2014 02:02 PM
Please go through the document given in the post above also right of the top of my head I can see you are missing
same-security permit intra-interface, this is required as traffic comes from outside interface and then goes to the outside interface.
Regards,
Nitish Emmnauel
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide