Showing results for 
Search instead for 
Did you mean: 

Client VPN connectivity issues

Hello folks,

I posted a discussion earlier detailing my problem which got some help. I applied the user's fix and seemingly had my configuration working so I accepted the answer. However, after disconnecting/reconnecting the VPN I am faced with the same problem again. He had me change some nat rules which, once applied allowed me to connect to RDP. Once disconnecting/reconnecting the original issue occurred again.

The Problem: When using IPSec Remote Access VPN configuration I am unable to ping or connect with RDP/VNC protocols. At times I get a single ping response but I can't understand why that would happen if I cannot establish any other connections.


- Router is a Cisco ASA 5505 with ASDM 6.4

- Internal VLAN is, has DHCP enabled

- All current internal hosts have static addresses somewhere near with configured as a gateway

- VPN Users receive a address

- Cisco VPN Client is used to connect and there are no network connectivity issues between my remote computer and the ASDM application

My Configuration:

Result of the command: "show config"

: Saved

: Written by enable_15 at 15:06:09.524 CDT Mon Sep 9 2013


ASA Version 8.2(5)


hostname host

enable password D37rIydCZ/bnf1uj encrypted

passwd 2KFQnbNIdI.2KYOU encrypted


name inside-network description Internal Network devices

ddns update method DDNS_Update

ddns both

interval maximum 0 4 0 0



interface Ethernet0/0

switchport access vlan 2


interface Ethernet0/1


interface Ethernet0/2


interface Ethernet0/3


interface Ethernet0/4


interface Ethernet0/5


interface Ethernet0/6


interface Ethernet0/7


interface Vlan1

description VLAN to inside hosts

nameif inside

security-level 100

ddns update hostname

ddns update DDNS_Update

dhcp client update dns server both

ip address


interface Vlan2

description External VLAN to internet

nameif outside

security-level 0

ip address xx.xx.xx.xx


ftp mode passive

clock timezone CST -6

clock summer-time CDT recurring

dns domain-lookup inside

dns server-group DefaultDNS



same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group service DM_INLINE_TCP_1 tcp

port-object eq www

port-object eq https

access-list outside_access_in extended permit icmp any interface inside

access-list outside_access_in extended permit ip any

access-list Remote_splitTunnelAcl standard permit inside-network

access-list inside_nat0_outbound extended permit ip inside-network

access-list inside_access_in extended permit ip any

access-list inside_access_in extended permit ip interface inside interface inside

access-list inside_access_in extended permit ip any

access-list inside_access_in extended permit icmp any any

access-list inside_access_out extended permit icmp inside-network any

access-list inside_access_out extended permit ip any

access-list inside_access_out extended permit ip inside-network

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool VPN_IP_Pool mask

ipv6 access-list inside_access_ipv6_in permit ip interface inside interface inside

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any echo-reply inside

icmp permit any echo-reply outside

icmp permit any outside

no asdm history enable

arp timeout 14400


global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1

access-group inside_access_in in interface inside

access-group inside_access_ipv6_in in interface inside

access-group outside_access_in in interface outside

route outside xx.xx.xx.xx 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http inside-network inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcpd auto_config outside


dhcpd address inside

dhcpd enable inside


no threat-detection basic-threat

threat-detection statistics access-list

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ntp server source inside

ntp server source inside prefer


group-policy Remote internal

group-policy Remote attributes

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Remote_splitTunnelAcl

username StockUser password t6a0Nv8HUfWtUdKz encrypted privilege 0

username StockUser attributes

vpn-group-policy Remote

tunnel-group Remote type remote-access

tunnel-group Remote general-attributes

address-pool VPN_IP_Pool

default-group-policy Remote

tunnel-group Remote ipsec-attributes

pre-shared-key *


class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp


service-policy global_policy global

prompt hostname context

no call-home reporting anonymous




Are you able to ping the  inside interface of ASA?

I would suggest you to change the address-pool for clients and then test the issue.



Yes I am able to ping reliably.

I'm not extremely familiar with Cisco devices and configuring, how would changing the address pool help resolve this issue?

Content for Community-Ad