ASA Ipsec vpn with multiple interfaces

[KEN COUSINO JR.]

I am having an issue with a VPN setup on an ASA.  I have setup many before but not with multiple interfaces.  I have the usual inside and outside defined but there are other inside interfaces.  I am trying to go from the outside to another inside interface labelled 'fw-civic'.  I think my problem is with the access list and/or NAT.  Please help!

AU-ASA# wr t

: Saved

:

ASA Version 7.2(4)

!

hostname AU-ASA

domain-name au.org

names

name 192.168.5.5 fwccdc01

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.9.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address X.X.X.X 255.255.255.252

!

interface Vlan3

nameif youth

security-level 50

ip address 192.168.22.1 255.255.255.0

!            

interface Vlan4

nameif free-public-wifi

security-level 10

ip address 192.168.4.1 255.255.255.0

!

interface Vlan5

nameif fw-civic

security-level 50

ip address 192.168.5.1 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 3

switchport trunk allowed vlan 3-5

switchport trunk native vlan 1

switchport mode trunk

!

interface Ethernet0/3

!

interface Ethernet0/4

switchport access vlan 4

!

interface Ethernet0/5

switchport access vlan 5

!

interface Ethernet0/6

!

interface Ethernet0/7

switchport access vlan 3

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 192.168.0.9

domain-name au.org

access-list outside_access_in extended permit tcp any interface outside eq 5910

access-list outside_access_in extended permit tcp any interface outside eq 987

access-list outside_access_in extended permit tcp object-group postini interface outside eq smtp

access-list outside_access_in extended permit tcp any interface outside eq 10001

access-list no_nat extended permit ip 192.168.9.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list no_nat extended permit ip 192.168.9.0 255.255.255.0 172.31.1.0 255.255.255.0

access-list mainOffice extended permit ip 192.168.9.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list inside_access_out extended permit udp any any eq ntp

access-list inside_access_out extended permit udp any any eq isakmp

access-list inside_access_out extended permit icmp any any

access-list inside_access_out extended permit tcp any any eq www

access-list inside_access_out extended permit tcp any any eq https

access-list inside_access_out extended permit tcp any any eq 8080

access-list inside_access_out extended permit udp any any eq domain

access-list inside_access_out extended permit tcp any any eq ftp

access-list inside_access_out extended permit tcp any any eq ssh

access-list inside_access_out extended permit tcp any any eq 3389

access-list inside_access_out extended permit tcp any any eq rtsp

access-list inside_access_out extended permit tcp any any eq 32004

access-list inside_access_out extended permit tcp any any eq gopher

access-list inside_access_out extended permit tcp any any eq 54321

access-list inside_access_out extended permit ip 192.168.9.0 255.255.255.0 192.168.0.0 255.255.255.0

access-list outside_cryptomap extended permit ip 192.168.9.0 255.255.255.0 172.31.1.0 255.255.255.0

access-list SPLIT_ACL extended permit ip 192.168.5.0 255.255.255.0 192.168.5.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu youth 1500

mtu free-public-wifi 1500

mtu fw-civic 1500

ip local pool VPNPOOL2 192.168.5.203-192.168.5.204 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-523.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list no_nat

nat (inside) 1 192.168.9.0 255.255.255.0

nat (youth) 1 192.168.22.0 255.255.255.0

nat (free-public-wifi) 1 192.168.4.0 255.255.255.0

nat (fw-civic) 1 192.168.5.0 255.255.255.0

static (fw-civic,outside) tcp interface smtp fwccdc01 smtp netmask 255.255.255.255

static (fw-civic,outside) tcp interface www fwccdc01 www netmask 255.255.255.255

static (inside,outside) tcp interface 10001 192.168.9.222 10001 netmask 255.255.255.255

access-group inside_access_out in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 X.X.X.X 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

aaa-server au protocol nt

reactivation-mode depletion deadtime 1

max-failed-attempts 5

aaa-server au (inside) host 192.168.0.9

nt-auth-domain-controller au.org

http server enable 444

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set VPNSet esp-3des esp-md5-hmac

crypto ipsec transform-set ClientVPNSet esp-3des esp-md5-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 1 match address mainOffice

crypto map outside_map 1 set pfs group1

crypto map outside_map 1 set peer 1.1.1.1

crypto map outside_map 1 set transform-set VPNSet

crypto map outside_map 2 match address outside_cryptomap

crypto map outside_map 2 set pfs

crypto map outside_map 2 set peer 2.2.2.2

crypto map outside_map 2 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto isakmp identity address

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

console timeout 0

dhcpd auto_config outside

!

dhcpd address 192.168.9.100-192.168.9.131 inside

dhcpd dns 192.168.0.9 4.2.2.2 interface inside

dhcpd enable inside

!

dhcpd address 192.168.22.100-192.168.22.131 youth

dhcpd dns 4.2.2.2 4.2.2.1 interface youth

dhcpd enable youth

!

dhcpd address 192.168.4.100-192.168.4.131 free-public-wifi

dhcpd dns 4.2.2.2 4.2.2.1 interface free-public-wifi

dhcpd enable free-public-wifi

!

dhcpd address 192.168.5.100-192.168.5.199 fw-civic

dhcpd dns 4.2.2.2 4.2.2.1 interface fw-civic

dhcpd enable fw-civic

!

group-policy civicvpn internal

group-policy civicvpn attributes

dns-server value 8.8.8.8 68.105.28.16

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SPLIT_ACL

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 ipsec-attributes

pre-shared-key *

tunnel-group 2.2.2.2 type ipsec-l2l

tunnel-group 2.2.2.2 ipsec-attributes

pre-shared-key *

tunnel-group civicvpn type ipsec-ra

tunnel-group civicvpn general-attributes

address-pool VPNPOOL2

default-group-policy civicvpn

tunnel-group civicvpn ipsec-attributes

pre-shared-key *

isakmp ikev1-user-authentication none

!

class-map inspection_default

match default-inspection-traffic

!

!            

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

[Jouni Forss]

Hi,

I would need to know the L2L VPN connection to your are referring to be able to give you the exact configurations

But if I understood you correctly based on your post and configuration above

• You have an existing L2L VPN connection that you want to add another network (behind another interface) on your side
• The network you want to add on one of the L2L VPN connections is 192.168.5.0/24 behind interface "fw-civic"

It seems you would have to add atleas the following configurations

access-list fw-civic-nat0 permit ip 192.168.5.0 255.255.255.0

nat (fw-civic) 0 access-list fw-civic-nat0

access-list permit ip 192.168.5.0 255.255.255.0

Also if you ACL named "inside_access_out" doesnt already allow the traffic you are going to initiate to the remote end, be sure to add a rule for it in the ACL.

ALSO, you will have to make sure the remote end (the other VPN device) has the corresponding configuration on their side for connections to work. In their ofcourse your network of 192.168.5.0/24 would be remote network for them.

- Jouni

[KEN COUSINO JR.]

Sorry, the connection in question is the 'tunnel-group civicvpn type ipsec-ra'  it is the remote access  connection.

[Jouni Forss]

Hi,

I would suggest changing some configuration completely

Here is what I would do

• Configuring the VPN Client Pool with different network than the actual LAN you are connecting to
• Configure the Split tunnel ACL as "standard ACL" instead of "extended ACL"

Here is the configuration that would accomplish this

• I presume since you are talking about 2 different inside interfaces that you also want to access the "inside" network of 192.168.9.0/24?

Removing Old configurations

group-policy civicvpn attributes

no split-tunnel-network-list value SPLIT_ACL

tunnel-group civicvpn general-attributes

  no address-pool VPNPOOL2

no access-list SPLIT_ACL extended permit ip 192.168.5.0 255.255.255.0 192.168.5.0 255.255.255.0

no ip local pool VPNPOOL2 192.168.5.203-192.168.5.204 mask 255.255.255.0

Configuring the new

access-list SPLIT_ACL standard permit 192.168.5.0 255.255.255.0

ip local pool VPNPOOL2 192.168.105.10-192.168.105.15 mask 255.255.255.0

group-policy civicvpn attributes

split-tunnel-network-list value SPLIT_ACL

tunnel-group civicvpn general-attributes

  address-pool VPNPOOL2

access-list fw-civic-nat0 permit ip 192.168.5.0 255.255.255.0 192.168.105.0 255.255.255.0

nat (fw-civic) 0 access-list fw-civic-nat0

access-list no_nat permit ip 192.168.9.0 255.255.255.0 192.168.105.0 255.255.255.0

All in all the above does the following

• First it removes the Split tunnel ACL and the VPN Pool under the VPN settings so the actual ACL and Pool can be removed and made again
• Second it creates the new Split tunnel ACL and VPN Pool and attaches them back to the VPN configurations.
• It also adds NAT0 rules for the traffic from the VPN Client to both of the LAN networks 192.168.9.0/24 and 192.168.5.0/24

- Jouni

[KEN COUSINO JR.]

I added those lines of config and I am still not able to ping or rdp to addresses in the 192.168.5.0 subnet.  I can ping those addresses from the ASA directly.  Any other thoughts?

[Jouni Forss]

Hi,

Cant say that I would see anything more in the configuration preventing connecting to the hosts.

Sometimes the problem might be that the user with the VPN Client might be connected to 2 networks at the sametime (wired and wireless) and that causes problems.

Sometimes its simply software firewall on the hosts on the LAN

Sometimes its wrong or NO default gateway configured on the LAN host. In your case it seems that the LAN in question is configured for DHCP. Ofcourse might be that there are staticly configured hosts in the LAN also.

Have you tried monitoring what happens to the connections through ASDM while you have a VPN Client connection on and trying to access the LAN resources?

Packet Capture can also be used to confirm if traffic is heading to LAN from the VPN Client and if anything is coming back.

Are you connecting to the ASA through some other Internet connection or where is the test Client connecting from?

- Jouni

[KEN COUSINO JR.]

Can you look at the configuration now with the changes to see if I did something wrong?

[Jouni Forss]

Sure,

But I'd suggest going through the above things I mentioned also.

- Jouni

[Jouni Forss]

Hi,

Are you trying to establish the connection from VPN Client to LAN by using the DNS name or the IP address directly?

Is is possible for you to test the connections with some other service? Perhaps installing UltraVNC on the LAN host and VPN Client host and trying to establish VNC connection to the server/host on the LAN.

I can't really see anything wrong with the firewall configuration anymore.

- Jouni