Solved: Problem with VPN

rwhanna96 · ‎04-09-2013

I have two problems with IPSEC VPN, using the cisco client and a third that I think could be answered here though it is not strictly VPN related.

1. Cannot get to the internet while VPN is up. This may be a client issue as I *think* I have split tunneling setup correctly.

2. Cannot access other networks except the natively attached network to the inside interface.

3. I cannot ping out to the internet from inside, whether on VPN or not.

I tend to use teh ADSM; please, if possible, keep response to that kindof input.

Here is the config:

Result of the command: "sh run"

: Saved

:

ASA Version 8.4(1)

!

hostname BVGW

domain-name blueVector.com

enable password qWxO.XjLGf3hYkQ1 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

nameif Outside

security-level 10

ip address 5.29.79.10 255.255.255.248

!

interface Ethernet0/1

nameif Inside

security-level 100

ip address 172.17.1.2 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 172.19.1.1 255.255.255.0

management-only

!

ftp mode passive

dns server-group DefaultDNS

domain-name blueVector.com

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network WiFi

subnet 172.17.100.0 255.255.255.0

description WiFi

object network inside-net

subnet 172.17.1.0 255.255.255.0

object network NOSPAM

host 172.17.1.60

object network BH2

host 172.17.1.60

object network EX2

host 172.17.1.61

description Internal Exchange / Outbound SMTP

object network Mail2

host 5.29.79.11

description Ext EX2

object network NETWORK_OBJ_172.17.1.240_28

subnet 172.17.1.240 255.255.255.240

object network NETWORK_OBJ_172.17.200.0_24

subnet 172.17.200.0 255.255.255.0

object-group service DM_INLINE_TCP_1 tcp

port-object eq www

port-object eq https

object-group network DM_INLINE_NETWORK_1

network-object object BH2

network-object object NOSPAM

access-list Outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_1 eq smtp

access-list Outside_access_in extended permit tcp any object BH2 object-group DM_INLINE_TCP_1

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu management 1500

ip local pool VPN 172.17.1.240-172.17.1.250 mask 255.255.255.0

ip local pool VPN2 172.17.200.100-172.17.200.200 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (Inside,Outside) source static EX2 Mail2

nat (Inside,Outside) source static any any destination static NETWORK_OBJ_172.17.1.240_28 NETWORK_OBJ_172.17.1.240_28

nat (Inside,Outside) source static any any destination static NETWORK_OBJ_172.17.200.0_24 NETWORK_OBJ_172.17.200.0_24

nat (Inside,Outside) source static inside-net inside-net destination static NETWORK_OBJ_172.17.1.240_28 NETWORK_OBJ_172.17.1.240_28

!

object network inside-net

nat (Inside,Outside) dynamic interface

object network NOSPAM

nat (Inside,Outside) static 5.29.79.12

access-group Outside_access_in in interface Outside

route Outside 0.0.0.0 0.0.0.0 5.29.79.9 1

route Inside 10.2.0.0 255.255.255.0 172.17.1.1 1

route Inside 10.3.0.0 255.255.255.128 172.17.1.1 1

route Inside 10.10.10.0 255.255.255.0 172.17.1.1 1

route Inside 172.17.100.0 255.255.255.0 172.17.1.3 1

route Inside 172.18.1.0 255.255.255.0 172.17.1.1 1

route Inside 192.168.1.0 255.255.255.0 172.17.1.1 1

route Inside 192.168.11.0 255.255.255.0 172.17.1.1 1

route Inside 192.168.30.0 255.255.255.0 172.17.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server blueVec protocol ldap

aaa-server blueVec (Inside) host 172.17.1.41

ldap-base-dn DC=adrs1,DC=net

ldap-group-base-dn DC=adrs,DC=net

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn CN=Hanna\, Roger,OU=Humans,OU=WPLAdministrator,DC=adrs1,DC=net

server-type microsoft

http server enable

http 192.168.1.0 255.255.255.0 management

http 172.17.1.0 255.255.255.0 Inside

http 24.32.208.223 255.255.255.255 Outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Outside_map interface Outside

crypto ikev1 enable Outside

crypto ikev1 policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 172.17.1.0 255.255.255.0 Inside

ssh timeout 5

console timeout 0

dhcpd address 172.17.1.100-172.17.1.200 Inside

dhcpd dns 4.2.2.2 8.8.8.8 interface Inside

dhcpd lease 100000 interface Inside

dhcpd domain adrs1.net interface Inside

!

threat-detection basic-threat

threat-detection statistics

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

webvpn

group-policy blueV internal

group-policy blueV attributes

wins-server value 172.17.1.41

dns-server value 172.17.1.41 172.17.1.42

vpn-tunnel-protocol ikev1

default-domain value ADRS1.NET

group-policy blueV_1 internal

group-policy blueV_1 attributes

wins-server value 172.17.1.41

dns-server value 172.17.1.41 172.17.1.42

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

default-domain value adrs1.net

username gwhitten password 8fLfC1TTV35zytjA encrypted privilege 0

username gwhitten attributes

vpn-group-policy blueV

username rparker password FnbvAdOZxk4r40E5 encrypted privilege 15

username rparker attributes

vpn-group-policy blueV

username mhale password 2reWKpsLC5em3o1P encrypted privilege 0

username mhale attributes

vpn-group-policy blueV

username VpnUser2 password SlHbkDWqPQLgylxJ encrypted privilege 0

username VpnUser2 attributes

vpn-group-policy blueV

username Vpnuser3 password R6zHxBM9chjqBPHl encrypted privilege 0

username Vpnuser3 attributes

vpn-group-policy blueV

username VpnUser1 password mLHXwxsjJEIziFgb encrypted privilege 0

username VpnUser1 attributes

vpn-group-policy blueV

username dcoletto password g53yRiEqpcYkSyYS encrypted privilege 0

username dcoletto attributes

vpn-group-policy blueV

username jmcleod password aSV6RHsq7Wn/YJ7X encrypted privilege 0

username jmcleod attributes

vpn-group-policy blueV

username rhanna password Pd3E3vqnGmV84Ds2 encrypted privilege 15

username rhanna attributes

vpn-group-policy blueV

username rheimann password tHH5ZYDXJ0qKyxnk encrypted privilege 0

username rheimann attributes

vpn-group-policy blueV

username jwoosley password yBOc8ubzzbeBXmuo encrypted privilege 0

username jwoosley attributes

vpn-group-policy blueV

username kdavis password 2DBQVSUbfTBuxC8u encrypted privilege 0

username kdavis attributes

vpn-group-policy blueV

username mbell password adskOOsnVPnw6eJD encrypted privilege 0

username mbell attributes

vpn-group-policy blueV

username bmiller password dpqK9cKk50J7TuPN encrypted privilege 0

username bmiller attributes

vpn-group-policy blueV

tunnel-group blueV type remote-access

tunnel-group blueV general-attributes

address-pool VPN2

authentication-server-group blueVec

default-group-policy blueV_1

tunnel-group blueV ipsec-attributes

ikev1 pre-shablue-key *****

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

!

service-policy global_policy global

prompt hostname context

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

hpm topN enable

Cryptochecksum:2491a825fb8a81439a6c80288f33818e

: end

Any help appreciated!!!!

-Roger

Jouni Forss · ‎04-09-2013

Hey,

Sadly I dont use ASDM myself but will still mention the things that might be done.

You are not using Split Tunneling. All traffic is Tunneled to the ASA while VPN is active

You have the following line under the "group-policy"

split-tunnel-policy tunnelspecified

You will also need this line

split-tunnel-network-list value

Which defines the destination networks for the VPN Client. If you go to the Group-policy settings on the ASDM side you should see that no ACL is selected. You dont actually seem to have any ACL in the above configuration meant for Split Tunneling?

To enable Internet access through the VPN Client now in the current configuration I would suggest the following NAT configuration

object-group network VPN-CLIENT-PAT-SOURCE

network-object 172.17.200.0 255.255.255.0

nat (Outside,Outside) after-auto source dynamic VPN-CLIENT-PAT-SOURCE interface

With regards to the traffic not working for the other networks I am not really sure. I guess they arent hitting the NAT rule which are configured. I think they should but I guess they are not since its not working

I might myself try out the following NAT configuration

object-group network LAN-NETWORKS

network-object 10.2.0.0 255.255.255.0

network-object 10.3.0.0 255.255.255.128

network-object 10.10.10.0 255.255.255.0

network-object 172.17.100.0 255.255.255.0

network-object 172.18.1.0 255.255.255.0

network-object 192.168.1.0 255.255.255.0

network-object 192.168.11.0 255.255.255.0

network-object 192.168.30.0 255.255.255.0

object-group network VPN-POOL

network-object 172.17.200.0 255.255.255.0

nat (Inside,Outside) source static LAN-NETWORKS LAN-NETWORKS destination static VPN-POOL VPN-POOL

For ICMP add the ICMP Inspection

policy-map global_policy

class inspection_default

inspect icmp

or alternatively

fixup protocol icmp

This will automatically allow the ICMP Echo Reply messages to get through the firewall. I presume they are getting blocked by the firewall now since you have not previously enabled ICMP Inspection.

- Jouni

View solution in original post

Jouni Forss · ‎04-09-2013

Hey,

Sadly I dont use ASDM myself but will still mention the things that might be done.

You are not using Split Tunneling. All traffic is Tunneled to the ASA while VPN is active

You have the following line under the "group-policy"

split-tunnel-policy tunnelspecified

You will also need this line

split-tunnel-network-list value

Which defines the destination networks for the VPN Client. If you go to the Group-policy settings on the ASDM side you should see that no ACL is selected. You dont actually seem to have any ACL in the above configuration meant for Split Tunneling?

To enable Internet access through the VPN Client now in the current configuration I would suggest the following NAT configuration

object-group network VPN-CLIENT-PAT-SOURCE

network-object 172.17.200.0 255.255.255.0

nat (Outside,Outside) after-auto source dynamic VPN-CLIENT-PAT-SOURCE interface

With regards to the traffic not working for the other networks I am not really sure. I guess they arent hitting the NAT rule which are configured. I think they should but I guess they are not since its not working

I might myself try out the following NAT configuration

object-group network LAN-NETWORKS

network-object 10.2.0.0 255.255.255.0

network-object 10.3.0.0 255.255.255.128

network-object 10.10.10.0 255.255.255.0

network-object 172.17.100.0 255.255.255.0

network-object 172.18.1.0 255.255.255.0

network-object 192.168.1.0 255.255.255.0

network-object 192.168.11.0 255.255.255.0

network-object 192.168.30.0 255.255.255.0

object-group network VPN-POOL

network-object 172.17.200.0 255.255.255.0

nat (Inside,Outside) source static LAN-NETWORKS LAN-NETWORKS destination static VPN-POOL VPN-POOL

For ICMP add the ICMP Inspection

policy-map global_policy

class inspection_default

inspect icmp

or alternatively

fixup protocol icmp

This will automatically allow the ICMP Echo Reply messages to get through the firewall. I presume they are getting blocked by the firewall now since you have not previously enabled ICMP Inspection.

- Jouni

rwhanna96 · ‎04-24-2013

Sorry for delay in getting back.

Well that helped with the internet access issue; Thanks!.

I still cannot get access to the internal networks; I am posting the SH RUN below as current config if anyone has a thought. FYI: The core switch is a 3750, handling routing and I can access these networks fine form a machine hooked to the core (172.17.1.1).

Result of the command: "sh run"

: Saved

:

ASA Version 8.4(1)

!

hostname RVGW

domain-name RedVector.com

enable password b5aqRk/6.KRmypWW encrypted

passwd 1ems91jznlfZHhfU encrypted

names

!

interface Ethernet0/0

nameif Outside

security-level 10

ip address 5.29.79.10 255.255.255.248

!

interface Ethernet0/1

nameif Inside

security-level 100

ip address 172.17.1.2 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 172.19.1.1 255.255.255.0

management-only

!

banner login RedV GW

ftp mode passive

dns server-group DefaultDNS

domain-name RedVector.com

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network WiFi

subnet 172.17.100.0 255.255.255.0

description WiFi

object network inside-net

subnet 172.17.1.0 255.255.255.0

object network NOSPAM

host 172.17.1.60

object network BH2

host 172.17.1.60

object network EX2

host 172.17.1.61

description Internal Exchange / Outbound SMTP

object network Mail2

host 5.29.79.11

description Ext EX2

object network NETWORK_OBJ_172.17.1.240_28

subnet 172.17.1.240 255.255.255.240

object network NETWORK_OBJ_172.17.200.0_24

subnet 172.17.200.0 255.255.255.0

object network VPN-CLIENT

subnet 172.17.200.0 255.255.255.0

object-group service DM_INLINE_TCP_1 tcp

port-object eq www

port-object eq https

object-group network DM_INLINE_NETWORK_1

network-object object BH2

network-object object NOSPAM

object-group network VPN-CLIENT-PAT-SOURCE

description VPN-CLIENT-PAT-SOURCE

network-object object VPN-CLIENT

object-group network LAN-NETWORKS

network-object host 10.10.10.0

network-object host 10.2.0.0

network-object host 172.17.100.0

network-object host 172.18.1.0

network-object host 192.168.1.0

network-object host 192.168.11.0

network-object host 192.168.30.0

network-object host 10.3.0.0

object-group network VPN-POOL

network-object host 172.17.200.0

object-group protocol DM_INLINE_PROTOCOL_1

protocol-object ip

protocol-object icmp

access-list Outside_access_in extended permit tcp any object-group DM_INLINE_NETWORK_1 eq smtp

access-list Outside_access_in extended permit tcp any object BH2 object-group DM_INLINE_TCP_1

access-list global_mpc extended permit ip any any

access-list Inside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any

pager lines 24

logging enable

logging asdm informational

no logging message 106015

no logging message 313001

no logging message 313008

no logging message 106023

no logging message 710003

no logging message 106100

no logging message 302015

no logging message 302014

no logging message 302013

no logging message 302018

no logging message 302017

no logging message 302016

no logging message 302021

no logging message 302020

flow-export destination Inside 172.17.1.52 9996

mtu Outside 1500

mtu Inside 1500

mtu management 1500

ip local pool VPN 172.17.1.240-172.17.1.250 mask 255.255.255.0

ip local pool VPN2 172.17.200.100-172.17.200.200 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (Inside,Outside) source static EX2 Mail2

nat (Inside,Outside) source static any any destination static NETWORK_OBJ_172.17.1.240_28 NETWORK_OBJ_172.17.1.240_28

nat (Inside,Outside) source static any any destination static NETWORK_OBJ_172.17.200.0_24 NETWORK_OBJ_172.17.200.0_24

nat (Inside,Outside) source static inside-net inside-net destination static NETWORK_OBJ_172.17.1.240_28 NETWORK_OBJ_172.17.1.240_28

nat (Inside,Outside) source static LAN-NETWORKS LAN-NETWORKS destination static VPN-POOL VPN-POOL

!

object network inside-net

nat (Inside,Outside) dynamic interface

object network NOSPAM

nat (Inside,Outside) static 5.29.79.12

!

nat (Outside,Outside) after-auto source dynamic VPN-CLIENT-PAT-SOURCE interface

access-group Outside_access_in in interface Outside

access-group Inside_access_in in interface Inside

route Outside 0.0.0.0 0.0.0.0 5.29.79.9 1

route Inside 10.2.0.0 255.255.255.0 172.17.1.1 1

route Inside 10.3.0.0 255.255.255.128 172.17.1.1 1

route Inside 10.10.10.0 255.255.255.0 172.17.1.1 1

route Inside 172.17.100.0 255.255.255.0 172.17.1.3 1

route Inside 172.18.1.0 255.255.255.0 172.17.1.1 1

route Inside 192.168.1.0 255.255.255.0 172.17.1.1 1

route Inside 192.168.11.0 255.255.255.0 172.17.1.1 1

route Inside 192.168.30.0 255.255.255.0 172.17.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server RedVec protocol ldap

aaa-server RedVec (Inside) host 172.17.1.41

ldap-base-dn DC=adrs1,DC=net

ldap-group-base-dn DC=adrs,DC=net

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn CN=Hanna\, Roger,OU=Humans,OU=WPLAdministrator,DC=adrs1,DC=net

server-type microsoft

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 management

http 172.17.1.0 255.255.255.0 Inside

http 24.32.208.223 255.255.255.255 Outside

snmp-server host Inside 172.17.1.52 community *****

snmp-server location Server Room 3010

snmp-server contact Roger Hanna

snmp-server community *****