I recently upgraded my ASA5055 from 8.02 to 8.4 and since I upgraded to the new version I can no longer access my network at home through the VPN. I can connect to the VPN with no issues however I can no longer ping or connect to my 10.0 network. Would someone be so kind to look at my config and tell me what needs to be added for this to operate? In my old config I had a NAT statement for the VPN which is no longer here.
Also I wanted to configure WebVPN to work as well and this is one thing that I have never been able to figure out. Is there also a way that I can be on my 20.0 network and connect to the VPN and access the 10.0 network as well? When connected to my 20.0 network I am not presented with the credentials to connect to the VPN. I would be thankful if someone can help me out. The most important part of this is the first part of this question.
My configuration:
ASA Version 8.4(1)
!
hostname ASA5505
domain-name xxxxxxxx.dyndns.org
enable password xxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxx encrypted
names
name 192.168.10.2 server
name 192.168.10.3 desktop
name 192.168.10.5 canon
name 192.168.10.6 mvix
name 192.168.10.7 xbox
name 192.168.10.8 dvr
name 192.168.10.9 bluray
name 192.168.10.10 lcd
name 192.168.10.11 mp620
name 192.168.10.12 kayla
name 192.168.1.1 asa5505
name 192.168.1.2 ap1
name 192.168.10.4 mvix2
name 192.168.10.13 lcd2
name 192.168.10.14 dvr2
!
interface Vlan1
nameif Management
security-level 100
ip address asa5505 255.255.255.248
management-only
!
interface Vlan2
mac-address 0050.8db6.8287
nameif outside
security-level 0
ip address dhcp setroute
!
interface Vlan10
nameif Private
security-level 100
ip address 192.168.10.1 255.255.255.224
!
interface Vlan20
nameif Public
security-level 100
ip address 192.168.20.1 255.255.255.224
!
interface Ethernet0/0
description Pointing towards WAN
switchport access vlan 2
!
interface Ethernet0/1
description Uplink to Linksys port 12
switchport access vlan 10
!
interface Ethernet0/2
description Server 192.168.10.2/27
switchport access vlan 10
!
interface Ethernet0/3
description Uplink to Eth1 Management
!
interface Ethernet0/4
switchport access vlan 30
!
interface Ethernet0/5
switchport access vlan 30
!
interface Ethernet0/6
switchport access vlan 30
!
interface Ethernet0/7
description Cisco 1200 Access Point
switchport trunk allowed vlan 1,10,20
switchport trunk native vlan 1
switchport mode trunk
!
banner motd Authorized users only, all others must disconnect now!
boot system disk0:/asa841-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
domain-name xxxxxxx.dyndns.org
object network obj-192.168.50.0
subnet 192.168.50.0 255.255.255.0
object network server
host 192.168.10.2
object network obj-192.168.10.0
subnet 192.168.10.0 255.255.255.224
object network obj-192.168.20.0
subnet 192.168.20.0 255.255.255.224
object network server-01
host 192.168.10.2
object network server-02
host 192.168.10.2
object network xbox
host 192.168.10.7
object network xbox-01
host 192.168.10.7
object network xbox-02
host 192.168.10.7
object network xbox-03
host 192.168.10.7
object network xbox-04
host 192.168.10.7
object network server-03
host 192.168.10.2
object network server-04
host 192.168.10.2
object network server-05
host 192.168.10.2
object network desktop
host 192.168.10.3
object network kayla
host 192.168.10.12
access-list Home_VPN_splitTunnelAcl standard permit 192.168.10.0 255.255.255.224
access-list outside_access_in extended permit tcp any any eq 3389
access-list outside_access_in extended permit tcp any any eq 2325
access-list outside_access_in extended permit tcp any object server eq ftp
access-list outside_access_in extended permit tcp any any eq 5851
access-list outside_access_in extended permit udp any any eq 5850
access-list outside_access_in extended permit tcp any any eq pptp
access-list outside_access_in extended permit udp any any eq syslog
access-list outside_access_in extended permit udp any any eq 88
access-list outside_access_in extended permit udp any any eq 3074
access-list outside_access_in extended permit tcp any any eq 3074
access-list outside_access_in extended permit tcp any any eq domain
access-list outside_access_in extended permit udp any any eq domain
access-list outside_access_in extended permit tcp any any eq https
access-list outside_access_in extended permit tcp any object server eq ssh
access-list outside_access_in extended permit tcp any any eq 2322
access-list outside_access_in extended permit tcp any any eq 5900
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended permit icmp any any source-quench
access-list outside_access_in extended permit icmp any any unreachable
access-list outside_access_in extended permit icmp any any time-exceeded
access-list outside_access_in extended permit udp any any eq 5852
access-list KaileY_splitTunnelAcl standard permit 192.168.10.0 255.255.255.224
pager lines 24
logging enable
logging timestamp
logging buffer-size 36000
logging buffered warnings
logging trap debugging
logging asdm informational
logging from-address xxxxxxx@yahoo.com
logging recipient-address xxxxxxxx@yahoo.com level errors
logging host Management server
mtu Management 1500
mtu outside 1500
mtu Private 1500
mtu Public 1500
ip local pool IPPOOL 192.168.50.2-192.168.50.10 mask 255.255.255.0
ip local pool VPN_POOL 192.168.100.2-192.168.100.10 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
asdm image disk0:/asdm-641.bin
no asdm history enable
arp timeout 14400
!
object network server
nat (Private,outside) static interface service tcp ftp 5851
object network obj-192.168.10.0
nat (Private,outside) dynamic interface
object network obj-192.168.20.0
nat (Public,outside) dynamic interface
object network server-01
nat (Private,outside) static interface service tcp 2325 2325
object network server-02
nat (Private,outside) static interface service udp syslog syslog
object network xbox
nat (Private,outside) static interface service udp 88 88
object network xbox-01
nat (Private,outside) static interface service udp 3074 3074
object network xbox-02
nat (Private,outside) static interface service tcp 3074 3074
object network xbox-03
nat (Private,outside) static interface service tcp domain domain
object network xbox-04
nat (Private,outside) static interface service udp domain domain
object network server-03
nat (Private,outside) static interface service tcp https https
object network server-04
nat (Private,outside) static interface service tcp ssh 2322
object network server-05
nat (Private,outside) static interface service tcp 5900 5900
object network desktop
nat (Private,outside) static interface service tcp 3389 3389
object network kayla
nat (Private,outside) static interface service udp 5852 5852
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.248 Management
http redirect outside 80
snmp-server location Upstairs Office
snmp-server contact xxxxxxxx@yahoo.com
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
no sysopt connection permit-vpn
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs group1
crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.1.0 255.255.255.248 Management
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 30
console timeout 30
management-access Management
dhcpd dns 24.205.1.14 66.215.64.14
dhcpd ping_timeout 750
dhcpd domain xxxxxxxx.dyndns.org
dhcpd auto_config outside
!
dhcpd address 192.168.1.4-192.168.1.5 Management
dhcpd enable Management
!
dhcpd address 192.168.10.20-192.168.10.30 Private
dhcpd enable Private
!
dhcpd address 192.168.20.2-192.168.20.30 Public
dhcpd enable Public
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 192.43.244.18
ntp server 129.6.15.28
webvpn
group-policy Home_VPN internal
group-policy Home_VPN attributes
dns-server value 8.8.8.8 4.2.2.2
vpn-tunnel-protocol ikev1 ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Home_VPN_splitTunnelAcl
default-domain value www.xxxxxx.com
address-pools value IPPOOL
webvpn
url-list value ClientlessBookmark
group-policy KaileY internal
group-policy KaileY attributes
dns-server value 8.8.8.8 4.2.2.2
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
split-tunnel-network-list value KaileY_splitTunnelAcl
default-domain value xxxxxxx.dyndns.org
username scottrog password xxxxxxxxxxxxxx encrypted privilege 0
username john password xxxxxxxxxxxxxxx encrypted privilege 0
username joek password xxxxxxxxxxxx encrypted privilege 0
username eostrike password xxxxxxxxxxxx encrypted privilege 15
username almostsi password xxxxxxxxxxxxxx encrypted privilege 0
username ezdelarosa password xxxxxxxxxxxxxxencrypted privilege 0
tunnel-group Home_VPN type remote-access
tunnel-group Home_VPN general-attributes
address-pool IPPOOL
authorization-server-group LOCAL
authorization-server-group (outside) LOCAL
default-group-policy Home_VPN
authorization-required
tunnel-group Home_VPN ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile webvpn-attributes
group-alias SSLVPNClient enable
tunnel-group ClientLESS type remote-access
tunnel-group KaileY type remote-access
tunnel-group KaileY general-attributes
address-pool VPN_POOL
default-group-policy KaileY
tunnel-group KaileY ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group-map default-group Home_VPN
!
!
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:438ed6084bb3dc956574b1ce83f52b86
: end
ASA5505#
