cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
832
Views
15
Helpful
5
Replies

Remote access vpn connects to 5505 but cannot ping any servers

gray25251
Beginner
Beginner

I have a cisco 5505 and am trying to configure it with ASDM 6.4.

My vpn client connects ok to the network but I am unable to reach any of the servers.

I'm sure its a simple configuration issue as I don't have much experience with Cisco configuation.

Any suggestions on where to look would be much appreciated.

Thanks in advance

Graham

1 Accepted Solution

Accepted Solutions

Hi Graham,

Please add the following command:

access-list Inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.100.0 255.255.255.0

Thanks.

Portu.

View solution in original post

5 Replies 5

Jennifer Halim
Cisco Employee
Cisco Employee

Possibly missing the NAT exemption?

Pls share your current configuration (show run) and we might spot something.

Thanks Jennifer.

Running config:

Cryptochecksum: 21ec6d8c 73515258 ed808b45 e154b1c6

: Saved

: Written by admin at 17:42:19.318 GMT/IDT Thu Sep 20 2012

!

ASA Version 8.2(5)

!

hostname IS-18241

enable password p2SKmVPuBXX32cE encrypted

passwd 2KFnbXXKXX encrypted

names

name 78.129.xxx.xx IS-18223_External

name 192.168.100.2 IS-18223_Internal

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

shutdown

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif Inside

security-level 100

ip address 192.168.100.1 255.255.255.0

!

interface Vlan2

nameif Outside

security-level 0

ip address 78.129.xxx.xx 255.255.255.0

!

boot system disk0:/asa825-k8.bin

ftp mode passive

clock timezone GMT/IST 0

clock summer-time GMT/IDT recurring last Sun Mar 1:00 last Sun Oct 2:00

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list basic extended permit tcp any any eq 3389

access-list basic extended permit tcp any any eq ssh

access-list basic extended permit tcp any any eq www

access-list basic extended permit tcp any any eq 902

access-list basic extended permit tcp any any eq https

access-list basic extended permit icmp any any

access-list allow extended permit ip any any

access-list Inside_nat0_outbound extended permit ip any host IS-18223_Internal

access-list SplitTunnel standard permit 192.168.100.0 255.255.255.0

access-list Inside_nat_outbound extended permit ip 192.168.100.0 255.255.255.0 any

pager lines 24

logging enable

logging asdm informational

mtu Inside 1500

mtu Outside 1500

ip local pool RemoteAddressPool 192.168.100.100-192.168.100.150 mask 255.255.255.128

icmp unreachable rate-limit 1 burst-size 1

asdm location IS-18223_External 255.255.255.255 Inside

asdm location IS-18223_Internal 255.255.255.255 Inside

no asdm history enable

arp timeout 14400

global (Inside) 1 interface

global (Outside) 1 interface

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 1 access-list Inside_nat_outbound

static (Inside,Outside) IS-18223_External IS-18223_Internal netmask 255.255.255.255

access-group allow in interface Inside

access-group allow out interface Inside

access-group basic in interface Outside

access-group allow out interface Outside

route Outside 0.0.0.0 0.0.0.0 78.129.xxx.x 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication enable console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 Outside

no snmp-server location

no snmp-server contact

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Outside_map interface Outside

crypto isakmp enable Outside

crypto isakmp policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto isakmp policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto isakmp policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 Outside

ssh timeout 60

ssh version 2

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy DfltGrpPolicy attributes

dns-server value 87.117.198.200 87.117.237.100

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SplitTunnel

username XX password uvgXvd9nQEHdkA73 encrypted privilege 15

username XX password 3CUtfh8r/IKb6DxX encrypted

username XX attributes

service-type remote-access

tunnel-group Remote type remote-access

tunnel-group Remote general-attributes

address-pool RemoteAddressPool

tunnel-group Remote ipsec-attributes

pre-shared-key 5|J5XX&6u*

!

!

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:21ec6d8c73515258ed808b45e154b1c6

: end

Hi Graham,

Please add the following command:

access-list Inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.100.0 255.255.255.0

Thanks.

Portu.

It works!

Thank you very much Portu!

Great

Have a nice weekend!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers