cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
303
Views
0
Helpful
4
Replies
Highlighted
Beginner

VPN connected but unable to reach other interfaces

I have  remote access vpn setup and I can get connected with no issues. I assigned the vpn a pool of addresses from the end of my inside interface subnet. When connected I can ping any device on that subnet, I can also connect to my switch on the same subnet via my browser. I can not however access any device located in my dmz while connected. This is a new setup I'm testing but I need vpn user to be able to use rdp to connect to machines in the dmz. I have attached my config any advice would be greatly appreciated.

Result of the command: "show running-config"

: Saved

:

ASA Version 8.2(1)

!

hostname ASA1

domain-name

enable password  encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 10.10.10.3

name 10.10.10.4

name 10.10.10.5

name 10.10.10.6

name 10.10.10.7

name 10.10.10.8

!

interface Ethernet0/0

nameif Outside

security-level 0

ip address 38.***.***.2 255.255.255.0

!

interface Ethernet0/1

nameif Inside

security-level 100

ip address 192.1.168.1 255.255.255.0

!

interface Ethernet0/2

nameif DMZ

security-level 50

ip address 10.10.10.1 255.255.255.0

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

ftp mode passive

dns domain-lookup Outside

dns domain-lookup Inside

dns domain-lookup DMZ

dns server-group DefaultDNS

name-server **.28.0.45

name-server **.28.0.61

domain-name

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list Outside_access_in extended permit tcp any host 38.***.***.5 eq 3389

access-list <outside_access_in> extended permit icmp any any

access-list Outside_nat0_outbound extended permit ip 192.1.168.0 255.255.255.0 192.1.168.240 255.255.255.240

access-list Outside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0 192.1.168.240 255.255.255.240

access-list Fruitionvpn_splitTunnelAcl_2 standard permit 10.10.10.0 255.255.255.0

access-list Fruitionvpn_splitTunnelAcl_2 standard permit 192.1.168.0 255.255.255.0

access-list Fruitionvpn_splitTunnelAcl_2 standard permit 38.101.248.0 255.255.255.0

access-list Inside_nat0_outbound extended permit ip 192.1.168.0 255.255.255.0 192.1.168.240 255.255.255.240

access-list Outside_nat0_outbound_1 extended permit ip 38.***.***.0 255.255.255.0 192.1.168.240 255.255.255.240

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu DMZ 1500

mtu management 1500

ip local pool vpn 192.1.168.240-192.1.168.254

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat-control

global (Outside) 101 interface

global (DMZ) 2 10.10.10.2-10.10.10.254 netmask 255.255.255.0

nat (Outside) 0 access-list Outside_nat0_outbound

nat (Outside) 0 access-list Outside_nat0_outbound_1 outside

nat (Inside) 0 access-list Inside_nat0_outbound

nat (Inside) 101 192.1.168.0 255.255.255.0

nat (DMZ) 101 10.10.10.0 255.255.255.0

static (DMZ,Outside) 38.***.***.5 Webserver2 netmask 255.255.255.255

access-group Outside_access_in in interface Outside

route Outside 0.0.0.0 0.0.0.0 38.***.***.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map management_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map management_map interface management

crypto map DMZ_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map DMZ_map interface DMZ

crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Inside_map interface Inside

crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Outside_map interface Outside

crypto isakmp enable Outside

crypto isakmp enable Inside

crypto isakmp enable DMZ

crypto isakmp enable management

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.1.168.3-192.1.168.254 Inside

!

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy Fruitionvpn internal

group-policy Fruitionvpn attributes

dns-server value 66.28.0.45 66.28.0.61

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Fruitionvpn_splitTunnelAcl_2

default-domain value fruition

username ksuber password y4A2QiB9t5hlOCGW encrypted privilege 15

username ksuber attributes

vpn-group-policy Fruitionvpn

tunnel-group Fruitionvpn type remote-access

tunnel-group Fruitionvpn general-attributes

address-pool vpn

default-group-policy Fruitionvpn

tunnel-group Fruitionvpn ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:a5ec2459f53c4f1fa34d267a6903bea9

: end

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Rising star

Re: VPN connected but unable to reach other interfaces

some suggestions

1. Use a network address in a different subnet from inside network for vpn client IP pool. saying 192.168.10.0/24

2. enable nat 0 on dmz interface

access-list no_nat_dmz permit ip 10.10.10.0 255.255.255.0 192.168.10.0 255.255.255.0

nat (DMZ) 0 access-list no_nat_dmz

View solution in original post

4 REPLIES 4
Highlighted
Rising star

Re: VPN connected but unable to reach other interfaces

some suggestions

1. Use a network address in a different subnet from inside network for vpn client IP pool. saying 192.168.10.0/24

2. enable nat 0 on dmz interface

access-list no_nat_dmz permit ip 10.10.10.0 255.255.255.0 192.168.10.0 255.255.255.0

nat (DMZ) 0 access-list no_nat_dmz

View solution in original post

Highlighted
Beginner

Re: VPN connected but unable to reach other interfaces

Tried that and I still can not access anything on the dmz interface. Here is what my config looks like now.

ftp mode passive

dns domain-lookup Outside

dns domain-lookup Inside

dns domain-lookup DMZ

dns server-group DefaultDNS

name-server 66.***.***.45

name-server 66.***.***.61

domain-name

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list Outside_access_in extended permit tcp any host 38.***.***.5 eq 3389

access-list extended permit icmp any any

access-list Fruitionvpn_splitTunnelAcl standard permit 10.10.10.0 255.255.255.0

access-list Fruitionvpn_splitTunnelAcl standard permit 192.1.168.0 255.255.255.0

access-list Fruitionvpn_splitTunnelAcl standard permit 38.***.***.0 255.255.255.0

access-list no_nat_dmz extended permit ip host 192.168.10.0 10.10.10.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu Inside 1500

mtu DMZ 1500

mtu management 1500

ip local pool vpn 192.168.10.1-192.168.10.25 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat-control

global (Outside) 101 interface

global (DMZ) 2 10.10.10.2-10.10.10.254 netmask 255.255.255.0

nat (Inside) 101 192.1.168.0 255.255.255.0

nat (DMZ) 0 access-list no_nat_dmz

nat (DMZ) 101 10.10.10.0 255.255.255.0

static (DMZ,Outside) 38.***.***.5 Webserver2 netmask 255.255.255.255

access-group Outside_access_in in interface Outside

route Outside 0.0.0.0 0.0.0.0 38.***.***.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map management_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map management_map interface management

crypto map DMZ_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map DMZ_map interface DMZ

crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Inside_map interface Inside

crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map Outside_map interface Outside

crypto isakmp enable Outside

crypto isakmp enable Inside

crypto isakmp enable DMZ

crypto isakmp enable management

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.1.168.3-192.1.168.254 Inside

!

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy Fruitionvpn internal

group-policy Fruitionvpn attributes

dns-server value 66.28.0.45 68.28.0.61

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Fruitionvpn_splitTunnelAcl

default-domain value Fruition

username ksuber password y4A2QiB9t5hlOCGW encrypted privilege 0

username ksuber attributes

vpn-group-policy Fruitionvpn

tunnel-group Fruitionvpn type remote-access

tunnel-group Fruitionvpn general-attributes

address-pool vpn

default-group-policy Fruitionvpn

tunnel-group Fruitionvpn ipsec-attributes

pre-shared-key *

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:969f058aef211435cad38ab4b203428b

: end

Highlighted
Rising star

Re: VPN connected but unable to reach other interfaces

Are you access DMZ network by using 10.10.10.x IP or Nat-ed IP 38.x.x.x?

Please try to use 10.10.10.x IP.

You can check the following to narrow down the issue.

1. make sure the host in DMZ allows the access from 192.168.10.x

2. check client statistics info to see if both encry/decry count is incrementing

3. you do a packet capture on dmz interface to see if you could see traffic in both direction.

access-list dmz permit ip 10.10.10.0 255.255.255.0 192.168.10.0 255.255.255.0

access-list dmz permit ip 192.168.10.0 255.255.255.0 10.10.10.0 255.255.255.0

capture cap access-list dmz interface DMZ

use "show capture cap" to see what packet is seen in DMZ interface.

4. check the log to see if there is any clue. - "show log"

Highlighted
Beginner

Re: VPN connected but unable to reach other interfaces

Thanks for your help I was finally able to get it working after i cleared the Nat translation. Your No Nat for the DMZ network command seemed to do the trick..