03-31-2008 05:28 AM - edited 02-21-2020 03:38 PM
New install - IPSec VPN connects, however, VPN users can not access local LAN or Lnternet resources.
See router and firewall config attach.
Suggestion are much appreciated.
Note: IPAddress have been modified for security.
03-31-2008 06:49 AM
Any/All contribution are greatly appreciated
03-31-2008 09:47 AM
ANY HELP, would be greatly appreciated..
03-31-2008 11:20 AM
Scroll down toward bottom of the page you will find a thread that I posted regarding the same issues. Good luck.
03-31-2008 03:40 PM
thx for sharing - Split_tunnel was indeed setup and users can connect just ~ they just can't ping anywhere or access any resources.
Its a collapsed network design - Meaning the CORE does everything and the ASA hang off the CORE.
04-01-2008 08:04 AM
Hi Alphonso
Simply issue the following command in ASA
crypto isakmp nat-traversal 20
Regards
04-01-2008 09:59 AM
Hi, thank you for your comments [much appreciated] However, what does the above command do [provide]?
Do you have any URLs for additional reading.
04-01-2008 01:08 PM
Alphonso,
This commands makes it possible to establish an IPSEC VPN tunnel from the clients, which are behind a device that applies NAT, like most of the routers/modems at home or busines apply, for public IP. Since port numbers and IP addresses are not stable and dynamically built in translation table in Network Address Translation, this creates some incmopability issues with IPSEC. NAT-T lets the original source to be exchanged and this bypasses the possible incompatibilities.
Here is a more technical explaination
http://en.wikipedia.org/wiki/NAT_traversal
Regards
04-01-2008 01:33 PM
Very Interesting - i will try that command - Were you able to review the config that I posted?
Temperary, it got it to work without using any additional commands but I had to place the VPN pool on the inside interface of the firewall uplink [in other words - the firewall inside interface resides on 172.16.50.x and and the VPN pool resides on 172.16.80.x]
Its the only way i was able to get VPN user to access local resources and the internet - although the current solution does compromise the design b/c I had to place the VPN pool on inside ip range assigned to the inside interface of the firewall which connects directly to the CORE infrastructure.
Toplogy Layout: Collapse CORE/DISTRIBUTION DESIGN
FW1 [inside] --> CORE1
FW1 [outside] --> CORE1 [ISP]
I'm not sure if the NAT TRAVERSAL command would be the solution but i'm open to trying all new recommendation since the environment has not yet went live.
-Regards,
-ag
04-01-2008 01:57 PM
"Were you able to review the config that I posted"
After we cover the basics, I will review it. But NAT-T should resolve the issue.
04-01-2008 07:32 PM
Does "split-tunneling" work on this case?
04-03-2008 07:41 AM
Nope - split-tunnel was enabled already - none of the recommendation have worked. I going to chg the design of the infrastructure [routing] just to get this to work.
I will post my solution over the next day or two when i get it working. All work if the VPN pools remains attached to the inside network of the firewall but when I place the vpn pool on another network - all breaks so it forces me to think that its a routing issue b/c the vpn works when the pool remains on the network range of the inside interface.
04-18-2008 12:15 AM
Alphonso,
Please try this command
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set reverse-route
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide