Problems accessing 1 remote desktop when connected with VPN

[angelo_vam]

Hi everyone,

I have an ASA 5505 and have a problem where when I connect through VPN I can RDP into a server using its internal address but I cannot RDP to another server using its internal address.

The one I can connect to has an IP of 192.168.2.10 and the one I cannot connect to has an IP of 192.168.2.11 on port 3390.

Both rules are configured exactly the same except for the IP addresses and I cannot see why I cannot connect to this one server.

I am also able to connect to my camera system with an IP 192.168.2.25 on port 37777 and able to ping any other device on the internal network.

I've also tried pinging it and telneting to port 3390 with no success.

Here is the config.

ASA Version 8.4(4)1

!

!

interface Ethernet0/0

switchport access vlan 3

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan2

nameif inside

security-level 100

ip address 192.168.2.2 255.255.255.0

!

interface Vlan3

nameif outside

security-level 0

ip address 10.1.1.1 255.255.255.0

!

ftp mode passive

clock timezone EST -5

clock summer-time EDT recurring

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network CTSG-LAN-OUT

range 10.1.1.10 10.1.1.49

object network CTSG-LAN-IN

subnet 192.168.2.0 255.255.255.0

object service RDP3389

service tcp destination eq 3389

description To DC

object network SERVER-IN

host 192.168.2.10

object network SERVER-OUT

host 10.1.1.50

object network CAMERA-IN-TCP

host 192.168.2.25

object network CAMERA-OUT

host 10.1.1.51

object service CAMERA-TCP

service tcp destination eq 37777

object network SERVER-Virt-IN

host 192.168.2.11

object network SERVER-Virt-OUT

host 10.1.1.52

object service RDP3390

service tcp destination eq 3390

description To VS for Master

object network CAMERA-IN-UDP

host 192.168.2.25

object service CAMERA-UDP

service udp destination eq 37778

object network CTSG-LAN-OUT-VPN

subnet 10.1.1.128 255.255.255.128

object network SERVER-Virt-IN-VPN

host 192.168.2.11

object network SERVER-IN-VPN

host 192.168.2.10

object network CAMERA-IN-VPN

host 192.168.2.25

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

access-list inside1_access_in remark Implicit rule: Permit all traffic to less secure networks

access-list inside1_access_in extended permit ip any any

access-list outside_access_in extended permit object RDP3389 any host 192.168.2.10

access-list outside_access_in extended permit object RDP3390 any host 192.168.2.11

access-list outside_access_in extended permit object CAMERA-TCP any host 192.168.2.25

access-list outside_access_in extended permit object CAMERA-UDP any host 192.168.2.25

pager lines 24

logging enable

logging buffer-size 10240

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool RAVPN 10.1.1.129-10.1.1.254 mask 255.255.255.128

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static SERVER-IN-VPN SERVER-IN-VPN destination static CTSG-LAN-OUT-VPN CTSG-LAN-OUT-VPN

nat (inside,outside) source static CAMERA-IN-VPN CAMERA-IN-VPN destination static CTSG-LAN-OUT-VPN CTSG-LAN-OUT-VPN

nat (inside,outside) source static SERVER-Virt-IN-VPN SERVER-Virt-IN-VPN destination static CTSG-LAN-OUT-VPN CTSG-LAN-OUT-VPN

!

object network CTSG-LAN-IN

nat (inside,outside) dynamic interface

object network SERVER-IN

nat (inside,outside) static SERVER-OUT service tcp 3389 3389

object network CAMERA-IN-TCP

nat (inside,outside) static CAMERA-OUT service tcp 37777 37777

object network SERVER-Virt-IN

nat (inside,outside) static SERVER-Virt-OUT service tcp 3390 3390

access-group inside1_access_in in interface inside

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 10.1.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 192.168.2.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP

-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment terminal

subject-name CN=SACTSGRO

crl configure

crypto ikev1 enable outside

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet 192.168.2.0 255.255.255.0 inside

telnet timeout 15

ssh 192.168.2.0 255.255.255.0 inside

ssh timeout 5

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 15

dhcpd auto_config inside

!

threat-detection basic-threat

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username admin password xxxxx encrypted privilege 15

username admin attributes

vpn-group-policy DfltGrpPolicy

tunnel-group CTSGRA type remote-access

tunnel-group CTSGRA general-attributes

address-pool RAVPN

tunnel-group CTSGRA ipsec-attributes

ikev1 pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:0140431e7642742a856e91246356e6a2

: end

Thanks for your help

[Jouni Forss]

Hi,

Some questions

• So we are talking about a AnyConnect VPN Client connection to the ASA through which you access Internal recourses?
• Do you have a need to control the traffic coming from the VPN client users to the LAN behind the ASA?

If you can answer those questions I could probably suggest an alternative, simpler NAT configuration for this setup

- Jouni

[Jouni Forss]

Reading too fast again.

It seems your ASAs "outside" interface IP address is private. I guess you have some other device doing NAT in front of the actual ASA.

- Jouni

[angelo_vam]

Hi Jouni,

I'm using the Cisco VPN client right now to access internal resources.

Yes, I want to control the traffic coming from the VPN client users to my LAN.

I have an internet facing router in front of the ASA which explains the private IP of 10.1.1.1

Right now I have the ASA setup to allow either VPN connections or non VPN connections until I can get my problem fixed. Ideally I want to use only VPN connections.

Thank you

Angelo

[Jouni Forss · Accepted solution]

Ok,

So you basically have configured the router so that you can connect directly to the ASA using the Cisco VPN Client. And also the objective was to in the end only allow traffic to the LAN through the VPN Client connection ONLY.

It would seem to me to achieve that, you would only need the following NAT configurations

VPN Client NAT0 / NAT Exempt / Identity NAT

object network LAN

subnet 192.168.2.0 255.255.255.0

object network VPN-POOL

subnet 10.1.1.128 255.255.255.128

nat (inside,outside) source static LAN LAN destination static VPN-POOL VPN-POOL

The purpose of the above NAT configuration is simply to tell the ASA that dont do any kind of NAT when there is traffic between the LAN network of 192.168.2.0/24 and the VPN Pool of 10.1.1.128/25. This way if you have any additional hosts on the LAN that need to be connected to, you wont have to make any form of changes to the NAT configurations for the VPN client users. You just allow the connections in the ACL (explained later below)

Default PAT

object-group network DEFAULT-PAT-SOURCE

network-object 192.168.2.0 255.255.255.0

nat (inside,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface

This configurations purpose is just to replace the earlier Dynamic PAT rule on the ASA. I guess your router will be doing the translation from the ASA "outside" interface IP address to the routers public IP address and this configuration should therefore allow normal Internet usage from the LAN.

I would suggest removing all the other NAT configuration before adding these.

Controlling VPN clients access to internal resources

Also I assume that your current VPN client is configured as Full Tunnel. In other words it will tunnel all traffic to the the VPN connection while its active?

To control the traffic coming from the VPN Client users I would suggest that you do the following

• Configure "no sysopt connection permit-vpn"
  • This will change the ASA operation so that connections coming through a VPN connections ARE NOT allowed by default to bypass the "outside" interface ACL. Therefore after this change you can allow the connections you need in the "outside" interface ACL.
• Configure any rules you need regarding the VPN client connections to the "outside" interface ACL. Though I guess they already exist since you are connecting there without the VPN also

I cant guarantee this with 100% certainty but it would seem to me that the above things should get you to the point where you can access the internal resources ONLY after when you have connected to the ASA through the VPN client connection. Naturally take precautions like configuration backups if you are going to do major configuration changes. Also if you are remotely managing the ASA then you also have the option to configure a timer on the ASA after which it will automatically reload. This could help in situations where a missconfiguration breaks you management connection and you have no other way to connect remotely. Then the ASA would simply reboot after the timer ran out and also reboot with the original configuration (provided you hadnt saved anything in between)

Why are you using a different port for the other devices RDP connection? I can understand it if its used through the Internet but if the RDP connection would be used through the VPN Client only then I dont think there is no need to manipulate the default port of 3389 on the server or on the ASA.

Also naturally if there is something on the actual server side preventing these connections then these configuration changes might not help at all.

Let me know if I have understood something wrong

- Jouni

[angelo_vam]

Once I get a chance I will make these changes and let you know how it works out. Makes for a cleaner config and a lot less room for error.

The reason for the port change to 3390 is because at first I had set this up to allow connections from the internet to the server passing through the ASA. I am doing port-forwarding on my router thus I had to change the port to allow the connection to the proper server.

With the VPN connection I won't need to use a port number other than 3390

Thanks for all your help. I will let you know how this works out.

Angelo

[Jouni Forss]

Hi,

One more thing that I am not quite clear about.

Are you saying that with the above configuration you arent able to connect to the other server with RDP wether you were connected through the VPN or the through the Internet?

Is there an actual option to change the port which the Windows machine uses for RDP? I mean is the other server actually listening on different TCP port than the default 3389?  EDIT: A quick question to Google tells me that this can be done with a registry change?

It would just seem to me that you are doing the following

Router forward :3390 --> :3390 --> :3390

Wouldnt it be possible to do use the default port on the actual machine but forward the ports this way

Router forward :3390 --> :3390 --> :3389

Meaning that the ASA you actually forward the port TCP/3390 to TCP/3389 on the ASA and the connection taken from Internet would end up hitting the second server on the default port of TCP/3389?

- Jouni

[angelo_vam]

Hello,

I am not able to connect to the other server when connected through VPN but I am able to when through the internet.

Yes, the second option would have been better but the server was already listening on port 3390.

Angelo

[Jouni Forss]

Well that is strange,

I can't see any reason why the VPN Client wouldnt be able to reach the second server on port TCP/3390

Still the connections from the Internet are working just fine.

The only difference regarding NAT with these 2 connections is that the connection coming from VPN uses the Twice NAT while the connection coming from the Internet uses Network Object NAT

Which kinda starts sounding like a bug. I mean a situation where the server is being connected to using the same port in both situations but only difference regarding the ASA is the NAT. There have been several bugs in the newer ASA software and usually related to the Twice NAT format (3 NAT configurations you are using for VPN).

I guess IF you want to check even more you could always configure a traffic capture on the ASA "inside" interface to capture the traffic that is supposedly coming from the VPN Client to the second server.

Configuration for that would be

access-list SERVER-CAP permit ip 10.1.1.128 255.255.255.128 host 192.168.2.11

access-list SERVER-CAP permit ip host 192.168.2.11 10.1.1.128 255.255.255.128

capture SERVER-CAP type raw-data access-list SERVER-CAP interface inside buffer 1000000 circular-buffer

After this you could test the connection through the VPN once

Then you could confirm if any traffic got capture with either

show capture

show capture SERVER-CAP

You could even copy the capture from the ASA to some computer as a PCAP file which can be opened with Wireshark program/software

copy /pcap capture:SERVER-CAP tftp://x.x.x.x/SERVER-CAP.pcap

- Jouni

[angelo_vam]

Well I found what my problem was. I had a PC at home with the same IP address as the server at the remote location. As soon as I changed the IP of the PC I was able to connect with no problems.

Thank you for all your help

Angelo

[angelo_vam]

Is there a way to prevent these problems within the connection profile?

It's not uncommon for someone home network to have the same IP addressing as you LAN network.

Angelo

[Jouni Forss]

Hi,

Well I guess you could NAT the LAN behind the ASA to something different. Something more uncommon than it currently is.

The borrow some of the configurations I previously posted

Static Policy NAT for VPN Client to Server connections

object network LAN

subnet 192.168.2.0 255.255.255.0

object network MAPPED-LAN

subnet 10.10.2.0 255.255.255.0

object network VPN-POOL

subnet 10.1.1.128 255.255.255.128

nat (inside,outside) source static LAN MAPPED-LAN destination static VPN-POOL VPN-POOL

The above configuration would NAT your 192.168.2.0/24 network to the network 10.10.2.0/24. Since we are talking about equal size network with a "static" type configuration you would have a simple translation

If you want to connect to 192.168.2.10 then the VPN Client users would connect to IP 10.10.2.10

If you want to connect to 192.168.2.11 then the VPN Client users would connect to IP 10.10.2.11

If you want to connect to 192.168.2.25 then the VPN Client users would connect to IP 10.10.2.25

And so on. And since we have mentioned the "destination" as VPN-POOL then this NAT would only apply for traffic between the LAN network and the VPN-POOL and nothing else.

This way you would be able to atleast avoid possible overlaps in the network ranges. Dont know if the one used in my example is a good one to use but its just an example

Hope this helps, please rate if so

- Jouni