Hi,
I've got a site-to-site vpn that is terminating on my outside interface. I need to have the client traffic that is coming in over that tunnel leave the asa on the same interface. I thought this would be as simple as setting up a default route and intra-interface permit statement. This is not the case as when I do this I get a ton of Reset-O and SYN timeouts as the clients try to communicate with anything on my network (reachable via outside.) Nat-control is disabled and there is no nat needed in this situation. Below is my config along with a snippet of the errors I was getting. Please help!
!
hostname vpn
enable password 3tlXDSM7b9bR0jns encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 167.217.2.25 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
no ip address
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
management-only
!
boot system disk0:/asa821-11-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list outside_cryptomap extended permit ip any 10.50.0.0 255.255.192.0
access-list outside_access_in extended permit ip any any
pager lines 24
logging enable
logging trap informational
logging asdm informational
logging host outside 167.217.2.60
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-623.bin
no asdm history enable
arp timeout 14400
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 167.217.2.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 167.217.0.0 255.255.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map2 1 match address outside_cryptomap
crypto map outside_map2 1 set peer 209.183.33.233
crypto map outside_map2 1 set transform-set ESP-3DES-SHA ESP-3DES-MD5
crypto map outside_map2 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map2 interface outside
crypto isakmp enable outside
crypto isakmp policy 5
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 6
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
telnet timeout 5
ssh 167.217.0.0 255.255.0.0 outside
ssh 167.217.0.0 255.255.0.0 inside
ssh timeout 60
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 167.217.3.220 source outside prefer
webvpn
group-policy DfltGrpPolicy attributes
vpn-idle-timeout none
vpn-tunnel-protocol IPSec svc
username admin password /RrfNVdJ/j8owCEC encrypted
tunnel-group 209.183.33.233 type ipsec-l2l
tunnel-group 209.183.33.233 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
______________________________
Errors:
Feb 12 04:57:11 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6824 for outside:10.50.0.3/3993 to outside:68.23.85.123/32543 duration 0:00:00 bytes 0 TCP Reset-O
Feb 12 04:57:11 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6825 for outside:10.50.0.3/3994 to outside:76.217.94.224/5208 duration 0:00:00 bytes 0 TCP Reset-O
Feb 12 04:57:11 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6826 for outside:10.50.0.3/3995 to outside:67.171.56.198/12310 duration 0:00:00 bytes 0 TCP Reset-O
Feb 12 04:57:14 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6843 for outside:10.50.0.2/3993 to outside:69.115.174.81/9967 duration 0:00:00 bytes 0 TCP Reset-O
Feb 12 04:57:15 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6844 for outside:10.50.0.2/3994 to outside:76.116.201.27/20848 duration 0:00:00 bytes 0 TCP Reset-O
Feb 12 04:57:15 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6845 for outside:10.50.0.2/3995 to outside:69.7.94.190/22957 duration 0:00:00 bytes 0 TCP Reset-O
Feb 12 04:56:04 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6686 for outside:10.50.0.3/3974 to outside:167.217.12.58/8192 duration 0:00:30 bytes 0 SYN Timeout
Feb 12 04:56:50 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6724 for outside:10.50.0.3/3974 to outside:167.217.12.58/8192 duration 0:00:30 bytes 0 SYN Timeout
Feb 12 04:57:29 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6762 for outside:10.50.0.5/1386 to outside:71.230.227.2/443 duration 0:00:30 bytes 0 SYN Timeout
Feb 12 04:57:30 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6763 for outside:10.50.0.5/1387 to outside:71.71.11.83/443 duration 0:00:30 bytes 0 SYN Timeout
Feb 12 04:57:30 vpn.ips.k12.in.us %ASA-6-302014: Teardown TCP connection 6764 for outside:10.50.0.5/1388 to outside:68.205.81.111/443 duration 0:00:30 bytes 0 SYN Timeout
