Cisco VPN :: 3745 - Can't Reach Inside Host After Connected To ASA
May 31, 2011
I am having problems accessing our internal network via VPN. We have an ASA at the perimeter that connects to a 3745 router and all of our networks come of that router. I can establish a VPN connection to the ASA but I can’t ping any of our internal host.
The internal network I need to access is 172.18.0.0. When I connect to the ASA I get a dhcp address from a pool created in the ASA, the pool is 172.200.1.x. I can’t ping from the ASA to the connected vpn host and I can’t ping from the host to the ASA ip address or to 3745 connected to it.
ASA config:
group-policy NAMEOFPOLICY internal
group-policy NAMEOFPOLICY attributes
dns-server value 172.18.2.2 172.18.2.23
[Code]....
route inside 172.18.0.0 255.255.0.0 172.18.255.1 1 Route on the 3745 back to the ASA ip route 0.0.0.0 0.0.0.0 172.18.255.2 I can’t see anything on the internal network, I can’t even ping the dns servers and so on.
View 3 Replies
ADVERTISEMENT
Oct 31, 2012
I have created a connection gateway-to-gateway between RV220W and RVL200, is doing without any problems.For example, I can ping the gateway on the other side. But when I connect trough RV220W QuickVPN (or PPTP) I can not reach the gateway (RVL200) or any host behind it.
View 4 Replies
View Related
Jul 7, 2012
I've setup a SSL VPN to a ASA 5505 and can connect.
VPN network 192.168.2.0 /24
Inside Network 192.168.1.0 /24
Outside is connected to Router.
I am trying to RDP to a win server on the inside network but I cant get to it. Can not even ping 192.168.1.1 or (not sure if I could anyways) 192.168.2.1...
I added a ACL on the outside interface and then inside interface permit ip any any but still no ping or RDP...
New at VPN and have survived so far on cisco docs but this problem is evading me.
: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
[Code]....
View 1 Replies
View Related
Jul 6, 2012
I've setup a SSL VPN to a ASA 5505 and can connect.
VPN network 192.168.2.0 /24
Inside Network 192.168.1.0 /24
Outside is connected to Router.
I am trying to RDP to a win server on the inside network but I cant get to it. Can not even ping 192.168.1.1 or (not sure if I could anyways) 192.168.2.1...I can ping from the 192.168.1.0 net to 10.0.0.0 and 192.168.2.0 without issue but not the other way around....I added a ACL on the outside interface and then inside interface permit ip any any but still no ping or RDP...
: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
[code]....
View 1 Replies
View Related
Jun 18, 2012
I am able to reach VPN clients (Anyconnect) only from hosts directly connected to the ASA's inside interface subnet. However, hosts on other internal subnets (177.1.10.0 & 177.1.11.0) are unable to connect to clients on VPN. The ASA is running ver 8.4. [code]
View 8 Replies
View Related
Oct 29, 2012
We use a WLC4112 controller with a number of AP1010s. My controller is uplinked to a 4500, which is then connected to a number of 2950s and 4000s, which are where the APs are connected. All switches, as well as the WLC, are connected together using gig fiber, configured as trunk, with no trunk allowed VLAN restrictions. We operate a guest network on VLAN 4 (192.168.14.0/24), which aside from the internet gateway (192.168.14.3), provides a couple other services:
dhcp (192.168.14.50)
print (192.168.14.49)
The gateway is connected to a copper port set to access vlan 4. The DHCP is provided via an Intel nic configured for vlan 4 (among others). The print is a Hyper-V virtual NIC set to vlan 4. There are also hard-wire ports that access this network in various parts of the building, all as "switchport access vlan 4." I have a "guest" network set up on the WLC, operating on dynamic port "Visitor", vlan 4 (192.168.14.48). My wireless clients get an IP from my DHCP server, but cannot ping (or otherwise communicate with) any hosts EXCEPT the gateway (192.168.14.3), so they can get on the Internet without issue. The WLC itself can ping any of the aforementioned wired hosts, and all of the wired hosts can ping each other and the WLC. It is only the wireless clients that refuse to communicate with anything except the gateway. There are no routers in this network apart from the default gateway, this is a basic /24. All hosts are masked at 255.255.255.0. The wireless clients get an IP from 192.168.14.50, though they cannot ping it (but again, everything wired can).My other wireless network, the "corporate" network, does not display this behavior, everything can ping everything.
View 17 Replies
View Related
Jan 2, 2012
So, I've set up Anyconnect client access to an ASA-5510.
I've got a handful of interfaces, which contain hosts that should be accesible to anyconnect clients. I'm unable to reach addresses on a specific network, due to what packet-tracer claims is an implicit deny, though I'm unsure where to apply an access-list in this case.
fw1# show nameif
Interface Name Security
Ethernet0/0.205 SECURE 90
[Code].....
View 7 Replies
View Related
Jul 6, 2011
configure my Cisco ASA5510 (asa version 8.3.1) so that one of the host (e.g.192.168.8.20) behind management interface can ping to the other host (e.g. 192.168.2.246) behind OUTSIDEinterface. I tried modifying the ACLs, NATs and ICMP statement, but still failed[CODE]
View 19 Replies
View Related
May 20, 2011
I have a ASA 5505 Sec Plus. I would like to allow outside hosts to our mail server and also our FTP server. So i would like to allow only SMTP, HTTP (for Outlook Web Access) and FTP.
View 10 Replies
View Related
Sep 29, 2012
I just try to ping a internal Host but it want to go.
Laptop<===>ASA5505
Connected is the Laptop at Ethernet 0/2 Inside
My running-config is a clear config, only VLAN 1 has a IP and Ethernet 0/2 is up.
But If I try to ping to the Laptop I get the followed:
asa5505# ping 192.168.1.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.100, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
asa5505#
From the Laptop to the ASA5505 I can Ping successfully.
View 6 Replies
View Related
Mar 27, 2012
Wondering if on the ASA (8.4) its possible to do something like what DNS rewrite does, but with IP requests. Scenario. Mobile phone accesses a web app inside our network fine over cellular. Once it comes inside on to wifi it still has the public IP address cached so the ASA doesn't allow its request to loop around and the app appears broken. We're considering lowering the TTL on the DNS host entry but I think we are battling phones/mobile OS's that don't have a strict adherence to name resolution standards. A lot just seem to refresh their caches every 10-15 minutes.
View 4 Replies
View Related
Aug 2, 2011
I have Cisco ASA 5505 installed and use as default gateway. I go to Internet through the ASA5505 Here is my Problem.I can not ping from ASA prompt(ASA#) to my Laptop connected to the ASA, but i can ping the ASA inside interface from laptop i can not use ASDM and the VPN Tunnel is not working between the sie
ASA# ping 10.10.10.12
???????????
100% lost
Laptop c
C:/ping 10.10.10.1
!!!!!!!!!!!!!!!!
Here is the Topology
INTERNET .<=========================>ASA<===============================> LAPTOP
I disabled window firewall on the Laptop , but no goof result.
View 3 Replies
View Related
May 13, 2013
I have ASA 5520. I cannot ping the host(192.168.1.20) which is inside firewall from outside hosts. Inside host (192.168.1.20) is translated into (198.24.210.226) using static NAT.From outside host, I used "PING 198.24.210.226". Is it because I used dynamic PAT for inside hosts?
interface GigabitEthernet0/0nameif outsidesecurity-level 0ip address 198.24.210.230 255.255.255.248!interface GigabitEthernet0/1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0
[Code].....
View 3 Replies
View Related
Feb 8, 2011
I have remote access vpn setup and I can get connected with no issues. I assigned the vpn a pool of addresses from the end of my inside interface subnet. When connected I can ping any device on that subnet, I can also connect to my switch on the same subnet via my browser. I can not however access any device located in my dmz while connected. This is a new setup I'm testing but I need vpn user to be able to use rdp to connect to machines in the dmz.
Result of the command: "show running-config"
: Saved
:
ASA Version 8.2(1)
!
hostname ASA1
domain-name
enable password encrypted
[code].....
View 4 Replies
View Related
Mar 9, 2011
We are using an ASA with 8.4 in transparent mode. Connection fails when a host on inside tries to connect to a server on outside. This server uses mac-address 0100.5E00.0000 to load balance but replies with real mac-address.Firewall logs "Deny TCP".ARP inspection is disabled.
View 2 Replies
View Related
Feb 3, 2012
When I tried to upgrading PIX525 6.3 to 7.0 , Not able to Ping the host from the PIX 525 Inside interface which is on the same subnet, Also from the host to Inside Interface , Tried with Directly connected laptop with Cross cable and using Straight cable via switch, But the results end with fail.
View 2 Replies
View Related
Feb 26, 2011
I am trying to configure our ASA 5505 so that our users can access our ftp site using [URL] while inside the firewall. Our ftp site is setup so that you can reach it by either browsing to the above url or by browsing to ftp://99.23.119.78 but we are unable to access our ftp site from either route while inside the firewall. We can access our ftp site using the internal ip address of 192.168.1.3.
Here is our current confguration:
Result of the command: "show running-config"
: Saved:ASA Version 8.2(1) !hostname ciscoasaenable password qVQaNBP31RadYDLM encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.1.1 255.255.255.0 !interface Vlan2nameif ATTsecurity-level 0pppoe client vpdn group ATTip address pppoe setroute !interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!ftp mode passiveobject-group service DM_INLINE_TCP_1 tcpport-object eq ftpport-object eq ftp-dataport-object eq wwwaccess-list ATT_access_in extended permit tcp any host 99.23.119.78 object-group DM_INLINE_TCP_1 access-list ATT_access_in extended permit tcp any interface ATT eq ftp access-list ATT_access_in extended permit tcp any interface ATT eq ftp-data access-list ATT_access_in extended permit tcp any interface ATT eq www access-list 100 extended permit tcp any interface ATT eq ftp
[code]....
View 6 Replies
View Related
Mar 3, 2013
I have a 5520 in production at a customer's site between an outside 802.11 network and an inside server. The server can get to outside hosts OK, and the traffic is being NATed properly, and sockets initiated by the server on the inside can pass data both ways, but I need to allow outside hosts the ability to send 'announcement' UDP packets to the inside server. I thought this might be an outside-NAT-required issue to get the traffic routed, but I need the inside server to see the actual outside host source IP in the UDP packet, so I basically set the outside host up similar to the inside host, just without the NAT table on the firewall -- it's subnet is outside the destination (inside server) subnet, and its gateway is the outside interface of the ASA, the same way the inside server is able to get to hosts outside. The firewall should just route the packet with a destination of the inside subnet once it sees that it hits a 'permit' ACL.
I have the appropriate ACL's set up, and when I do 'show access-list' I see policy hits for the 'permit' statements where the outside host is generating the announcement and it's hitting the ACL. I even duplicated the ACL into list 101 and 102, and applied 101 for inbound traffic on the outside int, and applied 102 for outbound traffic on the inside int, and I'm seeing policy hits on both permit statements outside and inside, so it looks like the traffic is being passed on to the inside interface and permitted, but the server isn't seeing the packets.
I can ping the outside interface from the outside, but cannot ping the inside interface or any inside hosts from the outside, even though I have 'permit icmp any any' enabled on the ACL on both ints. When I remove the firewall and put the outside clients on the same subnet, the server sees the packets just fine.
I set up the same scenario in my lab with an ASA 5505, with the same results. Below is the running config from the 5505 in the lab. The production firewall is running a slightly older version of ASA, so I made the configuration as basic as possible on the 5505 to match the config in the field:
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password Guh9Xxhb9mcC8lV1 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan2
description Outside WAN Interface
nameif outside
security-level 0
ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
description Inside LAN Interface
nameif inside(code)
View 6 Replies
View Related
Jul 22, 2011
I have build topology like this:
host------c2950(f0/3)------(f0/4)c3550(f0/41)----modem-----Internet
I wanted to monitor c3560 port where modem is connected from host. So for that I configured rspan. configurate show below. But problem is that after configuration f0/4 of c3550 remains up and f0/3 of c2950 goes down. WHen I look at status of f0/4 it show "FastEthernet0/4 is up, line protocol is down (monitoring)". I tried to search websites It seems configuration is fine.
[code]...
View 1 Replies
View Related
Apr 17, 2013
One of the ports on the 3750 stack was configured for VLAN121. It was changed to VLAN40 and the configuration saved. Both VLANs exist in the switch configuration. As soon as a host was connected (in this case, a label printer) the port VLAN reverted back to VLAN121.
View 3 Replies
View Related
Jun 27, 2011
I have a host that can successfully connect to a PIX 515E (7.x OS) via VPN Client; however, I have no IP routing to the LAN from the remote host.The VPN IP pool works finem,The LAN default gateway is the inside interface on the PIX; the network is flat L2 behind it.The default route on the PIX points out; no other routes are defined,The VPN remote host can be pinged from LAN hosts, but the VPN remote host cannot ping any LAN host, not even the PIX inside interface.
View 2 Replies
View Related
May 7, 2012
ASA 5510
Ver 8.2(5)
I have been looking all over the place for the answer of how to allow clients on an IPSEC VPN to ping from host to host.
View 4 Replies
View Related
Feb 10, 2011
I'm just wondering if its possible to ping an IPv4 host using the IPv6 host assuming that the NAT64 has already been implemented?
[code]...
View 2 Replies
View Related
Dec 18, 2010
I have 2 questions.Om my cisco 2811 (IOS 12.4(15) T9 IPBASE W/O Crypto) i am using 3 interfaces.And i have a pool of Global addresses: 200.x.z.97-200.x.z.126 255.255.255.0
FastEthernet 0/1 description WAN interfaceip nat outsideip address 200.x.y.253 255.255.255.0
GigabitInterface 0/2/0description DMZ interfaceip nat insideip address 10.0.0.1 255.255.255.0
GigabitInterface 0/3/0description LAN interfaceip nat insideip address 192.168.0.251 255.255.255.0
[Code]....
View 8 Replies
View Related
Nov 25, 2011
I'm trying to configure hairpinning on my Cisco 887VA VDSL router, so all LAN users can connect to the server using SMTP port 25 which is also in the same LAN subnet, using external router address, which is assigned to dialer1 interface.Traffic comming in from outside works fine.
External IP: 1.1.1.1/29
PC address connecting to the server: 192.168.101.28
Server address: 192.168.101.200
IOS: 15.1.4M1
[code]....
I'm running tcpdump on the server on port 25 and... nothing happens. The traffic is not going through.One thing that I've notices in debug ip packet is this line:
s=1.1.1.1 (Vlan1), d=192.168.101.200 (Vlan1), len 52, rcvd local pkt
shouldn't source be internal vlan1 IP - 192.168.101.1?
View 3 Replies
View Related
Jun 6, 2011
I need to connect site to MPLS provider and run Cisco GETVPN.Problem:I have been browsing Cisco Feature Navigator Tool and to my surprise when I enter "platform:3745" I can't find an image compatible with GET VPN. there is no workaround (image) I can run GET VPN on 3745? I need IP routing (BGP, OSPF) as well.
View 1 Replies
View Related
Jan 22, 2012
we've got a pair of old 3745's that are getting upgraded to new 2911's, and I'm trying to run IOS 15.2 on the new routers to get them most current before going into test and production use.The routers are doing BGP, IPv4, and HSRP, and I'm trying to put one in at a time as to not have to big bang everything at once. I'm putting the one that matters least in first, and basically using the same config as the old one, which was running IOS 11.
I was using "no ip mroute-cache" on ethernet interfaces, and it says that command is deprecated and I should use the MFIB commands instead. Darn if I know what that means, I believe it was set up so the ethernet interfaces had IP multicast fast switching disabled, which was set up by our vendor 10 years ago so I'm not sure if it matters. It would seem logical to me this would have an impact on HSRP and speed of failover. Does this matter, and if so how in the world do I do this with IOS 15.2?The second one is the use of "no fair-queue" on our serial connection for a T1. This command isn't there either, and I'm not sure if I even need to bother on this. It was set up on the old router on a T1 Frame Relay circuit.
View 2 Replies
View Related
Jan 15, 2012
There is no special requirements, just need new hardware with some reserve availability. As for now it's 3745 EOL and I assume to use 3945.
View 4 Replies
View Related
Feb 8, 2012
I have two routers I am trying to connect via the WIC-2T port. I can ping from router to router, but not from my PC (192.168.2.122) to the 3745 (10.0.1.3)..
3640:
Current configuration : 1846 bytes
!
version 12.2
[Code].....
View 15 Replies
View Related
Jun 19, 2012
i just configured GRE over IPSEC on my Cisco 3745 router with VPN module installed. As soon i hit 25Mbps traffic, my CPU is touching 80%.
What maximum Traffic 3745 with GRE over IPSEC it can support?
Also show process CPU sorted dont show any evidence of which process eating it up.
sh processes cpu sorted
CPU utilization for five seconds: 75%/75%; one minute: 77%; five minutes: 78%
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
[Code].....
View 3 Replies
View Related
Mar 29, 2012
I have to replace the 3745 which is our edge router (running (C3745-ADVIPSERVICESK9-M), Version 12.4(23), RELEASE SOFTWARE (fc1)) with (I think) a 3900 (drawing from memory, I haven't actually seen the device yet).In an ideal world, I SHOULD be able to just set term length to "0", do a show run, copy that off to a text file, and then paste it into the new one...
View 19 Replies
View Related
Jul 19, 2011
how many NM-32A or NM-16A module can be installed on 3745 and 3640 routers?
View 1 Replies
View Related
Sep 28, 2011
One of my clients has an older 3745 running IOS 12.3 and we are looking at replacing it with a new 3945 that runs IOS 15.0. This router is also configured with CME. Is it possible to migrate the current 12.3 config to load on the new 15.0 IOS? This will be my first encounter with 15.0 so I don't know what I am up against at this time. I am just hoping I don't have to retype all the ephone config, dial-peers, etc
View 2 Replies
View Related