Help with Remote VPN

[Ben Sebborn]

Hi

We have a Remote IPSec VPN setup on our Cisco ASA 5505.

This allows a connection, however when we try and route traffic for our internal network, plus a set of external IPs, we get the traffic blocked for VPN users.

I am presuming this is either an ACL or NAT issue but I'm not sure exactly.

I have created the following:

access-list skiddlevpn_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0 
access-list skiddlevpn_splitTunnelAcl standard permit 164.177.132.16 255.255.255.252 
access-list skiddlevpn_splitTunnelAcl standard permit 164.177.128.200 255.255.255.25

I have also noticed that the DHCP pool we use for VPN clients is overlapping with our internal network:

ip local pool CiscoVPNDHCPPool 192.168.2.130-192.168.2.149 mask 255.255.255.0

This has worked before, but perhaps I'm now missing something?

I have noticed a few errors such as this, which I'm not sure if they are connected:

%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for udp src outside:192.168.2.130/54762 dst inside:OfficeWindowsServer/53 denied due to NAT reverse path failure

[Ben Sebborn]

I have now reconfigured this so the VPN DHCP pool does not overlap

address-pools value RemoteVPNPool

ip local pool RemoteVPNPool 192.168.4.1-192.168.4.254 mask 255.255.255.0

However, still no joy. I wonder i there's an issue because we use a gateway on our outside interface (192.168.3.1) - do I need to set this up for the VPN traffic?

route publicinternet 0.0.0.0 0.0.0.0 192.168.3.1 1

[Peter Koltl]

Are you sure this is the current config and it was in place when this log appeared?

%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse  flows; Connection for udp src outside:192.168.2.130/54762 dst  inside:OfficeWindowsServer/53 denied due to NAT reverse path failure

In your config the interface names are

publicinternet and officenetwork

and  not inside and outside.

Do you still have such error messages with the above config?

Note: the pool is called 'VPN address pool' and not 'DHCP pool'. DHCP protocol is not used between VPN client and firewall.

[Ben Sebborn]

Hi Peter

I've just updated the running config in the first post with the current info.

I'm not sure if we're getting that exact error I will need to check. The last time I tested the VPN, we were able to connect to non-tunnelled networks (the internet, etc) fine, but anthing defined in the tunnel was timing out.

Many thanks

[Ben Sebborn]

Hi,

Can anyone help with the above?

Many thanks

[pcarco]

Not sure I am 100% clear on the issue but would be worth trying to add a route.

route officenetwork 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx tunneled    (xxx.xxx..xxx.xxx = Next hop

[Ben Sebborn]

Thanks,

If I try to add another route, I get the following:

Result of the command: "route officenetwork 0.0.0.0 0.0.0.0 192.168.3.1 tunneled"

ERROR: ERROR: Tunnel default gateway specified exists in route table.

ERROR: Cannot add route entry, possible conflict with existing routes

Result of the command: "show route"

Gateway of last resort is 192.168.3.1 to network 0.0.0.0

C    192.168.2.0 255.255.255.0 is directly connected, officenetwork

C    192.168.3.0 255.255.255.0 is directly connected, publicinternet

S*   0.0.0.0 0.0.0.0 [1/0] via 192.168.3.1, publicinternet

[pcarco]

Hello Ben,

If you use a address pool using a network tnat is not local to the ASA it makes the routing more difficult.  I understand you had an overlap but for testing edit the pool that worlked before

(ip local pool CiscoVPNDHCPPool 192.168.2.130-192.168.2.149 mask 255.255.255.0)   This network is local because the inside interface or in your case the officenetwork.

Does this 192.168.4.x  newtork exist downstream from your ASA ?

[Ben Sebborn]

Hi

I have now changed the pool, as below:

ip local pool CiscoVPNDHCPPool 192.168.2.33-192.168.2.62 mask 255.255.255.224

group-policy skiddlevpn attributes

dns-server value 192.168.2.199

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value skiddlevpn_splitTunnelAcl

default-domain value skiddle.internal

split-dns value skiddle.internal

address-pools value CiscoVPNDHCPPool

We can now ping the ASA, however if we ping a device locally on the network:

5

Nov 28 2013

13:57:44

305013

192.168.2.33

OfficeWindowsServer

Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src publicinternet:192.168.2.33 dst officenetwork:OfficeWindowsServer (type 8, code 0)denied due to NAT reverse path failure

If we try to access an external server, which is included in our tunnel group:

6

Nov 28 2013

13:56:24

302014

192.168.2.33

1401

164.177.132.19

80

Teardown TCP connection 1562997 for publicinternet:192.168.2.33/1401 to publicinternet:164.177.132.19/80 duration 0:00:30 bytes 0SYN Timeout (username)

[Ben Sebborn]

I'm going to close this post now and start a new as I've managed to progress.

Thanks