VPN

[tobamarus]

Hi,
I have a site-to-site vpn which is working fine but when i use the client vpn to connect to another network I am not able to connect to any machine on my site-to-site vpn.

Thanks,

[GioGonza · Accepted solution]

Hello @tobamarus, 

Can you share your config in order to look forward?

Gio

[tobamarus]

ASA Version 9.2(2)4
!
interface GigabitEthernet0/0
 description LAN interface
 nameif Inside
 security-level 100
 ip address 192.168.0.253 255.255.255.0
!
interface GigabitEthernet0/1
 description wan interface
 nameif outside
 security-level 0
 
!

              
interface GigabitEthernet0/2

              
 shutdown

              
 no nameif

              
 no security-level

              
 no ip address

              
!

              
interface GigabitEthernet0/3

              
 shutdown

              
 no nameif

              
 no security-level

              
 no ip address

              
!

              
interface GigabitEthernet0/4

              
 shutdown

              
 no nameif

              
 no security-level

              
 no ip address

              
!

              
interface GigabitEthernet0/5

              
 shutdown

              
 no nameif

              
 no security-level

              
 no ip address

              
!

              
interface Management0/0

              
 management-only

              
 shutdown

              
 nameif management

              
 security-level 100

              
 ip address 192.168.1.1 255.255.255.0

              
!

              
boot system disk0:/asa922-4-smp-k8.bin

              
ftp mode passive

              
dns server-group DefaultDNS

              
 domain-name inspyrus.com

              
object network Interface_In

              
 subnet 192.168.0.0 255.255.255.0

              
object network Prod_192.168.100

              
 subnet 192.168.100.0 255.255.255.0

              
object network Prod_192.168.112

              
 subnet 192.168.112.0 255.255.252.0

              
object network Prod_192.168.99

              
 subnet 192.168.99.0 255.255.255.0

              
object network 192.168.100

              
 subnet 192.168.100.0 255.255.252.0

              
 description prod

              
object network Local

              
 subnet 192.168.0.0 255.255.255.0

              
 description local

              
object network NETWORK_OBJ_192.168.0.0_24

              
 subnet 192.168.0.0 255.255.255.0

              
object network RackSpace_local

              
 subnet 192.168.100.0 255.255.252.0

              
object network DEV_Rack_local_172.24.32

              
 subnet 172.24.32.0 255.255.255.0

              
 description RackSpace_local_Dev_32

              
object network DEV_Rack_local_172.24.64

              
 subnet 172.24.64.0 255.255.255.0

              
 description DEV_Rack_local_172.24.64

              
object network Testing_Enviroment_172.24.48.0

              
 subnet 172.24.48.0 255.255.255.0

              
 description Rtesting Enviroment Rackspace

              
object network Load_bal_Production

              
 host 192.168.99.3

              
 description Load_bal_in_Production

              
object network Prod_AD_10.10.20.6

              
 host 10.10.20.6

              
 description ad_production

              
object network hyp3

              
 host 172.16.96.158

              
object network hyp2

              
 host 172.16.96.152

              
object network hyp1

              
 host 172.16.96.153

              
object-group network Production_VPN_Local

              
 network-object object Prod_192.168.112

              
 network-object object Prod_192.168.99

              
 network-object object Prod_192.168.100

              
 network-object object Load_bal_Production

              
 network-object object Prod_AD_10.10.20.6

              
object-group network RackSpace_DEV_Local_GROUP

              
 network-object object DEV_Rack_local_172.24.32

              
 network-object object DEV_Rack_local_172.24.64

              
 network-object object Testing_Enviroment_172.24.48.0

              
 network-object object hyp3

              
 network-object object hyp2

              
 network-object object hyp1

              
access-list Inside_access_in extended permit ip any any

              
access-list outside_access_in extended permit icmp any any

              
access-list in_to_internet extended permit ip any any

              
access-list outside_cryptomap extended permit ip object Interface_In object-group Production_VPN_Local

              
access-list outside_cryptomap_1 extended permit ip object Interface_In object-group RackSpace_DEV_Local_GROUP

              
pager lines 24

              
logging asdm informational

              
mtu Inside 1500

              
mtu outside 1500

              
mtu management 1500

              
no failover

              
icmp unreachable rate-limit 1 burst-size 1

              
asdm image disk0:/asdm-7221.bin

              
no asdm history enable

              
arp timeout 14400

              
no arp permit-nonconnected

              
nat (any,outside) source static Local Local destination static Production_VPN_Local Production_VPN_Local no-proxy-arp route-lookup

              
nat (Inside,outside) source static Interface_In Interface_In destination static RackSpace_DEV_Local_GROUP RackSpace_DEV_Local_GROUP no-proxy-arp route-lookup

              
nat (Inside,outside) source static Interface_In Interface_In destination static Production_VPN_Local Production_VPN_Local no-proxy-arp route-lookup

              
!

              
object network Interface_In

              
 nat (any,outside) dynamic interface

              
access-group Inside_access_in in interface Inside

              
access-group in_to_internet in interface outside

              
route outside 0.0.0.0 0.0.0.0 96.74.80.70 1

              
timeout xlate 3:00:00

              
timeout pat-xlate 0:00:30

              
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

              
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

              
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

              
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

              
timeout tcp-proxy-reassembly 0:01:00

              
timeout floating-conn 0:00:00

              
dynamic-access-policy-record DfltAccessPolicy

              
user-identity default-domain LOCAL

              
http server enable

              
http 192.168.1.0 255.255.255.0 management

              
http 192.168.0.0 255.255.255.0 Inside

              
http 192.168.0.0 255.255.255.0 management

              
no snmp-server location

              
no snmp-server contact

              
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac

              
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport

              
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac

              
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport

              
crypto ipsec ikev1 transform-set AES256-SHA esp-aes-256 esp-sha-hmac

              
crypto ipsec ikev2 ipsec-proposal DES

              
 protocol esp encryption des

              
 protocol esp integrity sha-1 md5

              
crypto ipsec ikev2 ipsec-proposal 3DES

              
 protocol esp encryption 3des

              
 protocol esp integrity sha-1 md5

              
crypto ipsec ikev2 ipsec-proposal AES

              
 protocol esp encryption aes

              
 protocol esp integrity sha-1 md5

              
crypto ipsec ikev2 ipsec-proposal AES192

              
 protocol esp encryption aes-192

              
 protocol esp integrity sha-1 md5

              
crypto ipsec ikev2 ipsec-proposal AES256

              
 protocol esp encryption aes-256

              
 protocol esp integrity sha-1 md5

              
crypto ipsec security-association pmtu-aging infinite

              
crypto map outside_map 1 match address outside_cryptomap

              
crypto map outside_map 1 set peer 204.232.253.155

              
crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

              
crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256

              
crypto map outside_map 2 match address outside_cryptomap_1

              
crypto map outside_map 2 set peer 148.62.16.115

              
crypto map outside_map 2 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

              
crypto map outside_map 2 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256

              
crypto map outside_map interface outside

              
crypto ca trustpool policy

              
crypto ikev2 policy 1

              
 encryption aes-256

              
 integrity sha

              
 group 5 2

              
 prf sha

              
 lifetime seconds 86400

              
crypto ikev2 policy 10

              
 encryption aes-192

              
 integrity sha

              
 group 5 2

              
 prf sha

              
 lifetime seconds 86400

              
crypto ikev2 policy 20

              
 encryption aes

              
 integrity sha

              
 group 5 2

              
 prf sha

              
 lifetime seconds 86400

              
crypto ikev2 policy 30

              
 encryption 3des

              
 integrity sha

              
 group 5 2

              
 prf sha

              
 lifetime seconds 86400

              
crypto ikev2 policy 40

              
 encryption des

              
 integrity sha

              
 group 5 2

              
 prf sha

              
 lifetime seconds 86400

              
crypto ikev2 enable outside

              
crypto ikev1 enable outside

              
crypto ikev1 policy 10

              
 authentication crack

              
 encryption aes-256

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 20

              
 authentication rsa-sig

              
 encryption aes-256

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 30

              
 authentication pre-share

              
 encryption aes-256

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 40

              
 authentication crack

              
 encryption aes-192

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 50

              
 authentication rsa-sig

              
 encryption aes-192

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 60

              
 authentication pre-share

              
 encryption aes-192

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 70

              
 authentication crack

              
 encryption aes

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 80

              
 authentication rsa-sig

              
 encryption aes

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 90

              
 authentication pre-share

              
 encryption aes

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 100

              
 authentication crack

              
 encryption 3des

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 110

              
 authentication rsa-sig

              
 encryption 3des

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 120

              
 authentication pre-share

              
 encryption 3des

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 130

              
 authentication crack

              
 encryption des

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 140

              
 authentication rsa-sig

              
 encryption des

              
 hash sha

              
 group 2

              
 lifetime 86400

              
crypto ikev1 policy 150

              
 authentication pre-share

              
 encryption des

              
 hash sha

              
 group 2

              
 lifetime 86400

              
telnet 192.168.0.0 255.255.255.0 Inside

              
telnet timeout 5

              
no ssh stricthostkeycheck

              
ssh timeout 5

              
ssh key-exchange group dh-group1-sha1

              
console timeout 0

              
dhcpd dns 75.75.75.75

              
!

              
dhcpd address 192.168.0.100-192.168.0.200 Inside

              
dhcpd dns 75.75.75.75 75.75.76.76 interface Inside

              
dhcpd enable Inside

              
!

              
dhcpd address 192.168.1.2-192.168.1.254 management

              
dhcpd enable management

              
!

              
threat-detection basic-threat

              
threat-detection statistics access-list

              
no threat-detection statistics tcp-intercept

              
ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1

              
group-policy GroupPolicy_204.232.253.155 internal

              
group-policy GroupPolicy_204.232.253.155 attributes

              
 vpn-tunnel-protocol ikev1 ikev2 ssl-client ssl-clientless

              
group-policy GroupPolicy_148.62.16.115 internal

              
group-policy GroupPolicy_148.62.16.115 attributes

              
 vpn-tunnel-protocol ikev1 ikev2

              
username inspy password mL0K41e1OzaW.prH encrypted

              
tunnel-group 204.232.253.155 type ipsec-l2l

              
tunnel-group 204.232.253.155 general-attributes

              
 default-group-policy GroupPolicy_204.232.253.155

              
tunnel-group 204.232.253.155 ipsec-attributes

              
 ikev1 pre-shared-key *****

              
 ikev2 remote-authentication pre-shared-key *****

              
 ikev2 local-authentication pre-shared-key *****

              
tunnel-group 148.62.16.115 type ipsec-l2l

              
tunnel-group 148.62.16.115 general-attributes

              
 default-group-policy GroupPolicy_148.62.16.115

              
tunnel-group 148.62.16.115 ipsec-attributes

              
 ikev1 pre-shared-key *****

              
 ikev2 remote-authentication pre-shared-key *****

              
 ikev2 local-authentication pre-shared-key *****

              
!

              
class-map inspection_default

              
 match default-inspection-traffic

              
!

              
!

              
policy-map type inspect dns preset_dns_map

              
 parameters

              
  message-length maximum client auto

              
  message-length maximum 512

              
policy-map global_policy

              
 class inspection_default

              
  inspect dns preset_dns_map

              
  inspect ftp

              
  inspect h323 h225

              
  inspect h323 ras

              
  inspect rsh

              
  inspect rtsp

              
  inspect esmtp

              
  inspect sqlnet

              
  inspect skinny  

              
  inspect sunrpc

              
  inspect xdmcp

              
  inspect sip  

              
  inspect netbios

              
  inspect tftp

              
  inspect ip-options

              
policy-map global-policy

              
 class inspection_default

              
  inspect icmp

              
!

              
service-policy global_policy global

              
prompt hostname context

              
no call-home reporting anonymous             
: end

[GioGonza · Accepted solution]

Hello @tobamarus, 

I was checking the configuration and you don´t have anything for Remote Access on your ASA, based on this I will say you are connecting to a Vendor device and after you do that, you cannot reach any subnet on the VPN tunnels you previously configured. 

If this is the case, you need to verify with the Vendor that is giving you the connection since they can be using Tunnel All and it is sending all your traffic to the vendor and that can be a reason why it doesn´t work after you connect remotely. 

If you have access to the other, share the information in order to look further.

HTH

Gio

[tobamarus]

Thanks Gio,

I had to disable the Nat Exempt and now it's working