L2tp through ASA5506 at the remote site

[peat]

I have a ASA5506 at my office and a guest from a different company is trying to connect to their VPN at their office but its failing to connect.

The VPNs i use going outwards all work fine with no ACLs or NAT (sophos VPN, cisco anyconnect) but theirs is windows VPN using L2TP.

I have set up ACLs and NATs to allow VPN traffic through before but that has only been my office side where people are VPN'ing in from their homes etc.  This time its a user trying to VPN from my network out to their office (which I have no knowledge of apart from I have the IP address they are VPN'ing to)

I cant get my head around what way I do the NAT and ACLs for this to work.

I know i need to pass through/allow UDP 4500, 500, 1701 and IP 50 for L2TP but that's about it.

I also have a router outside of the firewall so im guessing i need to double nat as well.

any help would be appreciated.

[Rob Ingram]

Hi,
As far as NAT is concerned you probably don't need to create a specfic NAT for an outbound connection, it would just nat on your dynamic nat which all outbound traffic would hit.

I assume you've got an outbound ACL on the ASA (there isn't one as default). Can you upload your ACL configuration please?

[peat]

object-group service L2TP udp
port-object eq 1701
port-object eq 4500
port-object eq isakmp

access-list 101 extended permit udp any any object-group L2TP
access-list 101 extended permit esp any any
access-group 101 in interface WAN

[Rob Ingram]

Isn't the direction of this VPN from inside the network to outside? I assume the inside interface is not called WAN?

[peat]

inside is call WIFI.
I have put those ACLs on the wifi interface now. Just have to wait for the user to come in to test.
fingers crossed! :)

[peat]

This is config now and it doesnt work.   Neither direction ACLs are getting hit.

access-list WIFI_access_in extended permit udp any any object-group L2TP

access-list WIFI_access_in extended permit esp any any

access-list WIFI_access_in extended permit IP any any

access-list WIFI_access_out extended permit udp any any object-group L2TP

access-list WIFI_access_out extended permit esp any any

access-list WIFI_access_out extended permit IP any any

access-group WIFI_access_in in interface WIFI

access-group WIFI_access_out out interface WIFI