cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
288
Views
5
Helpful
1
Replies

do i need NAT rules with client mode easy VPN

splendidskates
Level 1
Level 1

Hello and thanks in advance for your help.

 

I am way over my head on understanding my issue and the more i read the further down the rabbit hole of confusion i go.

Long story short i work as an IT admin and ive been given an ASA to connect to a remote site.  I knew nothing about the ASA when i got it but im trying to get up to speed quickly and i understand the concepts. The ASA is working in client mode and i followed the guide they supplied to the very detail.  The guide took me through using easy VPN to setup the connection and it all worked fine no problems and the status through the gui shows connected.  Yet i cant ping nor connect to any thing on the remote/server side of the connection.

I can see that im being given the IP address 10.191.192.2 when run 'show vpnclient' and other stuff like DNS server addresses are being pushed to my ASA also.

The team that supplied me the ASA are no help at all and tell me i need to create a NAT rule and the NAT rule is done at my side and not at theirs.  I asked them do i need to create a NAT rule to map all my IP's to 10.191.192.2 using the ASA but they dont understand what i mean by that.  Im pretty lost at this stage.

So do i need to create a NAT rule to allow traffic coming into the ASA to be NATed to the remote network?  Do i need to allow NATed traffic to come back from the remote network?  Or do i actually need to NAT to the address that the VPN server is giving me.  Aghhh my heads gonna explode!

I do see traffic going through the ASA using the ADSM thing but it keeps telling me its building a connection and then it tears it down again two seconds later.  I have ssh access to the ASA only now as im connected from home.

Im happy share parts of my config to give you a laugh if nothing else.  Thank you good people for any advice you can offer :-)

1 Reply 1

splendidskates
Level 1
Level 1

The answer was no, you need no NAT rules if you are operating in client mode on an ASA, all nat rules get pushed down by the server.  I deleted the default rule to NAT the traffic and it started working fine.  Make sure you have no NAT rules showing in the NAT section on the ADSM console.

 

Hope this helps someone, sometime