Configuring Remote LAN and WAN access...

CrackerJackSoftware · ‎12-16-2010

Okay so I have followed this information here but still users can not get access to the remote site's LAN. And on top of it all when connected to the VPN users can't browse the internet. What have I done wrong?

Federico Coto Fajardo · ‎12-16-2010

Hi,

If when connected you lose internet is because split-tunneling is not configured (all traffic is sent through the tunnel and the VPN server is not configured to provide internet access to the client).

If the clients cannot access the LAN through the tunnel could be because of NAT configuration or no route back to the VPN pool, or NAT-T not configured and required.

In short, could be many things... please provide more information.

Federico.

CrackerJackSoftware · ‎12-16-2010

Here is my running config....

ASA Version 7.2(4)

!

hostname bmpeCisco

domain-name bmpe.bmpelocal.com

enable password B1XG9Q2KwgM/dmyh encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.2.1 255.0.0.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

dns server-group DefaultDNS

domain-name bmpe.bmpelocal.com

same-security-traffic permit intra-interface

access-list inside_nat0_outbound extended permit ip any 10.0.8.0 255.255.255.240

access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.0.0.0 10.0.8.0 255.255.255.240

access-list inside_nat0_outbound extended permit ip 10.0.0.0 255.0.0.0 10.0.9.0 255.255.255.240

access-list inside_nat0_outbound extended permit ip any 10.0.9.0 255.255.255.240

access-list BMPE_splitTunnelAcl standard permit any

access-list inside_access_in extended permit ip any any

access-list Local_LAN_Access standard permit host 0.0.0.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool BMPVPN 10.0.8.1-10.0.8.10 mask 255.0.0.0

ip local pool BMPEVPN 10.0.9.1-10.0.9.10

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 0.0.0.0 0.0.0.0 dns

access-group inside_access_in in interface inside

route inside 10.0.8.0 255.255.255.240 10.0.2.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

http server enable

http 10.0.0.0 255.255.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no sysopt connection permit-vpn

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto dynamic-map outside_dyn_map 40 set pfs

crypto dynamic-map outside_dyn_map 40 set transform-set TRANS_ESP_3DES_SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

no vpn-addr-assign aaa

telnet 0.0.0.0 0.0.0.0 inside

telnet 0.0.0.0 0.0.0.0 outside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

management-access inside

dhcpd auto_config outside

!

dhcpd address 10.0.2.2-10.0.2.33 inside

dhcpd enable inside

!

webvpn

enable outside

group-policy DefaultRAGroup internal

group-policy DefaultRAGroup attributes

dns-server value 10.0.1.1

vpn-tunnel-protocol l2tp-ipsec

group-policy bmp internal

group-policy bmp attributes

dns-server value 10.0.1.1

vpn-tunnel-protocol l2tp-ipsec

group-policy IPSEC-VPN internal

group-policy IPSEC-VPN attributes

dns-server value 10.0.2.1

vpn-tunnel-protocol IPSec

default-domain value bmp.bmpenterprise.com

group-policy BMPENTERPRISE internal

group-policy BMPENTERPRISE attributes

dns-server value 10.0.2.1

vpn-tunnel-protocol IPSec

default-domain value BMP.BMPEnterprise.com

group-policy BMPE internal

group-policy BMPE attributes

wins-server none

dns-server value 10.0.1.1

vpn-access-hours none

vpn-simultaneous-logins 10

vpn-idle-timeout 30

vpn-session-timeout none

vpn-filter none

vpn-tunnel-protocol l2tp-ipsec

password-storage disable

group-lock value BMPE

ipsec-udp enable

split-tunnel-policy excludespecified

split-tunnel-network-list value Local_LAN_Access

intercept-dhcp disable

secure-unit-authentication enable

user-authentication enable

user-authentication-idle-timeout none

ip-phone-bypass disable

backup-servers keep-client-config

msie-proxy server none

msie-proxy method auto-detect

msie-proxy local-bypass disable

address-pools value BMPVPN

smartcard-removal-disconnect enable

client-firewall none

client-access-rule none

group-policy BMPELocal internal

group-policy BMPELocal attributes

dns-server value 10.0.1.1

vpn-tunnel-protocol IPSec

default-domain value bmpe.bmpelocal.com

username brian password meufPwVyeELT3IA8 encrypted privilege 0

username brian attributes

vpn-group-policy IPSEC-VPN