Cisco VPN :: 5510 VPN Clients Can't Access DMZ Network
Mar 22, 2012
The title says VPN clients cannot access DMZ network, but that is not exactly the problem, the situation is this, a group of users are using an actual 10.x network where they have their servers and pretty much everything. The users must be relocated into a new network, the 172.16.x. In a point in time they will not have to use 10.x anymore, but meanwhile, they need access to that network.
I have an ASA 5510 as default gateway for the new network (172.16.x.x), one interface e0/0 connected to the outside (internet), interface e0/1 to the inside and other interface connected to the actual 10.x (which I call DMZ), so basically I am using the ASA as a bridge using NAT to grant access to the users in the network 172.16.x to the resources in the 10.x network while the migration is completed.
All the users must use the path to the internet thru the ASA using the NAT overload to the outside interface and I put in place a NAT policy to 10.x to allow access to the 10.x network only when the internal users 172.16.x try to reach that path and so far, everything is working just fine for the internal users.Now for some reason, when I do VPN, the VPN clients cannot reach the 10.x network, even when they are supposed to be in the internal network (because they are doing VPN right?) .
I have enabled split tunneling with NAT exempt the 172.16 network and I am not sure if that is causing the problem, because when I trace from my PC the 172.16.16.1 address using the VPN I get the proper route path, but when I try to reach 10.x, my PC is using its default gateway and not the VPN gateway which has a route to 10.x.
I’m not even sure if what I am trying to do is possible, I want VPN users to be able to access a 10.x network using NAT overload with the Interface of the ASA plugged to the 10.x network, just like the internal users are doing right now.
View 1 Replies
ADVERTISEMENT
Jun 26, 2012
We have 30 remote workers which we have recently acquired which are being set up with the AnyConnect client to connect to our head end ASA 5510. For security purposes, we have to allow them access to only 3 of our local internal servers, all on our 10.10.X.X/16 subnet. The remotes are being issued a 10.10.50.X/24 address via DHCP on the ASA when connecting. I thought this would be as simple as creating an access list but have not had any luck doing so. In addition, we need to allow them full access to servers in a datacenter connected to our same head end ASA via a site-to-site VPN while they are connected to us using AnyConnect.
View 1 Replies
View Related
Mar 19, 2012
We have 30 remote workers which we have recently acquired which are being set up with the AnyConnect client to connect to our head end ASA 5510. For security purposes, we have to allow them access to only 3 of our local internal servers, all on our 10.10.X.X/16 subnet. The remotes are being issued a 10.10.50.X/24 address via DHCP on the ASA when connecting. I thought this would be as simple as creating an access list but have not had any luck doing so. In addition, we need to allow them full access to servers in a datacenter connected to our same head end ASA via a site-to-site VPN while they are connected to us using AnyConnect.
View 4 Replies
View Related
Dec 12, 2011
I have 2 sites :
site A :
ASA 5510
VPN gateway for remote users
LAN 192.168.192.0/22
site B :
ASA 5505
LAN 192.168.208.0/22
Both sites are connected through a site to site VPN.Remote clients (AnyConnect/VPN client) can connect to Site A LAN and see machines on LAN A but cannot see Site B LAN.
Here is a part of my configuration :
On Site A (ASA 5510)
--------------------------------
name 192.168.192.0 SiteA_Internal_Network
name 192.168.208.0 SiteB_Internal_Network
name 192.168.133.0 VPNPool_AnyConnect
name 192.168.133.32 VPNPool_VpnClient
[code]....
View 9 Replies
View Related
Nov 5, 2012
We currently have an ASA 5520 communicating with 10 ASA 5510's, all on static outside addresses. I was asked to add 5 additional 5510's on dynamic address. All worked well in testing until it was decided that some of the dynamic clients needed to talk to each other.
My testing shows packets just dying in the 5520.
View 1 Replies
View Related
Jun 18, 2012
I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
Result of the command: "show running-config"
: Saved
:
ASA Version 7.2(4)
!
hostname ASA
domain-name default.domain.invalid
[code].....
what I need to add to get the vpn client to be able to ping the router and clients?
View 3 Replies
View Related
Mar 30, 2013
I've some strange problems with multiple ASA (NEM) VPN remote clients (v8.4.5). On the HQ I've an ASA5510 (v8.4.5) with multiple NEM's connected to it. The group policy used on the HQ is configured for split tunneling. Now here's the problem;
The remote ASA (NEM) constructs easily a VPN connection to the main location; it seems that everything works well. Traffic through most of the tunneled networks works perfectly. Traffic to certain subnets or hosts brings me into trouble, there is no traffic flowing through the tunnel at all!
When using the command "show crypto ipsec sa | i caps|ident|spi” I can see all of the tunneled subnets. The subnets that works perfecly gives me the correct "local and remote ident" output. The subnets with problems gives me wrong values in the "remote ident". The remote ident should be the IP address of the inside LAN (of the remote NEM) and not the IP address of the ouside interface (of the remote NEM). How is this posible?
Here's is the crypto ipsec sa output:
Result of the command: "show crypto ipsec sa | i caps|ident|spi"
local ident (addr/mask/prot/port): (10.200.60.0/255.255.255.0/0/0) <-- this is the good subnet of the inside interface (NEM)
remote ident (addr/mask/prot/port): (10.100.2.2/255.255.255.255/0/0) <-- this is the good subnet (HQ)
#pkts encaps: 54712, #pkts encrypt: 54712, #pkts digest: 54712
#pkts decaps: 31893, #pkts decrypt: 31893, #pkts verify: 31893
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
current outbound spi: A4FA947A
[code]....
View 1 Replies
View Related
Jun 30, 2011
I'm trying to understand my options for assigning addresses to VPN clients on an ASA 5510. Under the ASDM, I have a field for DHCP servers, radio buttons: none, dhcp link, dhcp subnet, and field: client address pools. Cisco's VPN examples demonstrate setting up a client address pool, which I did, but the VPN client isn't assigned a gateway in the process so it can't connect to anything; I really don't understand the point of this. I'd like to create a DHCP pool on the ASA for VPN clients as this seems to be the standard configuration. However, I don't know where in the ASDM to configure this and how it's applied. The only DHCP options I found involved creating a DHCP server on an interface, which I don't want to do since VPN users aren't on a physical interface, right?
View 6 Replies
View Related
Dec 2, 2011
Can anyconnect clients and cisco vpn ikev1-2 clients use the same certificate on an ASA 5510 ?
View 4 Replies
View Related
Mar 21, 2012
We have remote VPN setup with Cisco ASA 5510. By using VPN filter, I can follow the guide and make client to use all necessary server services. (dns, ssh etc). However, is there any way that allow inside server access remote VPN client's services, ex. let inside server ssh to remote VPN client? Consider remote access VPN filter ACL's syntax, I have to always let source be the "remote VPN client PC", the dest is "inside firewall server", how can I let the other way traffice going?
View 1 Replies
View Related
Dec 6, 2011
Our customer is using multicast in their internal network for their IP video deployemnt. Internallt on the network everything is working great.
We have two folks in management who want to be able to view the live multicast video feeds of the cameras remotely. I have tried to accomplish this using the Cisco VPN client. Although VPN connectivity is good (we can ping the individual cameras) they are unable to view the live multicast feeds. I enabled multicast globally on the ASA and the inside interface and get the same results.
Is there a way for the ASA to support the remote IPSec VPN client to view the multicast strams?
View 1 Replies
View Related
Apr 16, 2012
I have an ASA 5510 which works great except I'm unable to connect to the remote access VPN from inside the network (behind the ASA). Is there a special NAT exemption required? [code]
View 6 Replies
View Related
Oct 20, 2012
i use ASA 5510 and i want to block some urls :
-192.168.2.70 to 79 allow every thing
-192.168.2.80 to 89 : block facebook , myspace, twiter,
-192.168.2.90 to 99 : block facebook , myspace, twiter, youtube , dailymotion
-192.168.2.100 to 199 deny everting
View 1 Replies
View Related
Sep 23, 2011
I am trying to configure remote access VPN to my network, i have a Cisco ASA 5510 IOS 7.0(7).
I configured the VPN using ASDM 5.0.9 and below is the configuration received:
access-list 90 extended permit ip 192.xxx.xxx.0 255.255.255.0 192.xxx.xxx.248 255.255.255.248
access-list ClientVPN_splitTunnelAcl standard permit 192.xxx.xxx.0 255.255.255.0
ip local pool VPNIpPool 192.xxx.xxx.250-192.xxx.xxx.252 mask 255.255.255.0[code].....
View 5 Replies
View Related
May 1, 2013
I'm setting up a Cisco ASA 5510.I did the setup for my public and private interface.From the management software I can ping any outside domain using my public interface, but when I try to do that from my private interface I cannot.Also for some reason my ip phone connected to the private interface work (I'm able to make and receive call), but any computer that I connect to the private interface I cannot access the internet.
View 1 Replies
View Related
Dec 9, 2011
I configured one ASA 5510 firewall with CSC-SSM-10 in one of my customer location.
Here i want configure my firewall to send email alerts to particular mail ID, if anybody any access my network from outside( Like VPN users).
View 1 Replies
View Related
Mar 14, 2011
I configured a remote-access vpn on an ASA 5510 version 8.3. This is the configuration [code]The vpn goes up and I get an ip address, but it's impossible to reach the internal network. [code]
View 9 Replies
View Related
Jan 2, 2013
I have a Cisco ASA 5510. I have configured Cisco Anyconnect to authenticate via Windows IAS. We had an outage of that server recently and I tried to remote in via anyconnect and could not. Once the IAS server came up I could get back into the network.
Is there a command that I'm missing that will let me use Anyconnect to connect into the network even if my AAA server is down?
View 2 Replies
View Related
Mar 14, 2013
I have a Cisco ASA 5510 I am using ASDM 6.1
I have a LAN and a DMZ and an internet connection. I am using one of the internet connection IPs to host a HTTP service on a server in my DMZ. (its the same interface as my internet connenction but a different IP to the one used for internet connectivity)
so say my LAN is 192.168.1.x
and my DMZ is 172.168.1.x
I can access DMZ from Lan and vice versa. when i try to access the public IP (or URL) from a pc in my LAN i get nothing.
I have enabled DNS rewrite (doctoring) but it is still not working. the HTTP service is available from other sites.
View 1 Replies
View Related
Jun 10, 2011
I configure for our office site to site VPN project. Now I configured already Site to site vpn between ASA 5510 and 1841 router.
HQ LAN
Branch LAN 10.2.1.0/24 >>> ASA 5510>>>>> 1841 >>> INTERNET <<<<<< 1841 <<<<<< 10.30.3.0/24 ^^^^ Call Manager 2851
Now can access from Branch LAN to HQ LAN each other. I face the problems that are
1) In branch LAN , they can access HQ LAN & resource , but cannot access internet. I didn't configure NAT on PH Router
2) Can I access internet from BRANCH LAN through HQ LAN to INTERNET. Or Can I access Internet from Branch LAN from PH Router directly while access to VPN to HQ LAN ?
3) In Branch Site , hard phone cannot work but soft phone on PC can call to HQ. Hard phone IP are same in Remote Network (172.16.1.0/24 ) . Is it problem ? how can I configure separately ?
View 2 Replies
View Related
Dec 18, 2012
I have the syntax correct and thought process down right on a solution to allowing guest wireless users access to an internal webserver. (DMZ discussion aside)
We have an ASA5510 with interfaces setup as:
outside - 65.x.x.x address
inside - 172.20.1.2
guest_inet - 10.2.1.1
Internally clients resolve our website to 192.168.40.40 and that part works as it should. Clients outside of our network resolve our website to the correct external address (lets just call it 1.1.1.1). We have a NAT statement static (inside, outside) 1.1.1.1 192.168.40.40 netmask 255.255.255.255 and an ACL to permit tcp any host 1.1.1.1 eq www
Clients on our guest_int use an external DNS server and hence resolve our website to 1.1.1.1. However it seems traffic goes out and back in our outside interface and this connection never occurs.
What I'm wondering is the correct NAT statement / ACL to add that would allow our internal clients on the 10.2.1.x network to access our internal website. Would that be: static (inside,guest_inet) 1.1.1.1 192.168.40.40 netmask 255.255.255.255 ? Since there is already an ACL permitting port 80 traffic to 1.1.1.1 we should be taken care of on the ACL side of things, right?
View 3 Replies
View Related
Sep 24, 2011
I am using two firewalls to connect two different offices. Firewall 5510 is running ASDM 6.3 and 5505 is running ASDM 6.2, Problem is that even after connecting two sites, i am unable to ping remote network from either side. I am mentioned static route as tunneled.
View 1 Replies
View Related
Apr 24, 2012
We were having a discussion of ios firewall vs. asa for smaller clients(less than 50). On using ios firewall(zbf or cbac)and an asa 5505/5510. One of the arguments brought up on using ios firewall on the router is that a router will do an ip sla failover. I have configured a number of isr's for this and i know it works good.
View 1 Replies
View Related
Apr 30, 2013
I have an ASA 5510 8.2(5) in Site1 and a ASA 5505 8.2(1) Site2 they are setup with a site to site tunnel.Each site has VPN clients that connect and I would like to allow clients from both sides access to servers on the other side of the site-to-site tunnel.
I enabled same-security-traffic permit intra-interface I also added the remote networks to access-list that is doing the split tunneling. [code]
View 33 Replies
View Related
Feb 20, 2013
I have a situation where I need to have remote users vpn into my ASA 5510 and then turn around and hit a site to site tunnel. Now when I am in our office I can hit the site to site vpn fine. When I am at home and vpn to the asa I can not get to the site to site resources. Do you see where my config is incorrect? result of the command: "show run"
ASA Version 9.1(1)
!
hostname xxxxx
domain-name xxxx
enable password xxxxx
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
[ code]....
View 3 Replies
View Related
Apr 27, 2012
I have a Cisco 1841 router that is connected to a switch. I have WAN/LAN configured on the router and the switch is handing out internal IP's. The issus that none of the client machines can access the Internet. From within the router console, I am able to ping external domain names, my ISP DNS servers.
Once the client machines picks up an IP they are unable to ping any external domain names or IP's and not even the ISP DNS servers, but they can ping the Cisco router IP. As a note I have tried my ISP DNS servers and as a test Google's DNS servers, but neither will allow access to the Internet.
Below is the current running config:
Building configuration...
Current configuration : 1440 bytes
!
version 12.4
service timestamps debug datetime msec
[Code].....
View 26 Replies
View Related
Dec 31, 2012
ASA Version 9.1(1)
!
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
[Code]....
View 9 Replies
View Related
Dec 12, 2012
I have 2 site here:
site A
Cisco 891
external IP: 195.xxx.yyy.zzz
VPN Gateway for Remote users
[Code]....
View 1 Replies
View Related
May 10, 2010
We have a working configuration for L2TP-IPSec connection from a native Windows XP client to the ASA 5510. When trying to set up a connection from a Windows 7 client, the connection fails with the message that all SA proposals are unacceptable? Is this coexistence possible, and what parameters would I have to change to get this working. I have understood that the Windows 7 client requires som higher security proposals, but have not found what these are. And at the sam time we are concerned about not destroying the VPN connection for our existing XP clients.
View 8 Replies
View Related
Mar 18, 2011
Is there any chance to access files on 4400 with ssh (winscp etc.) clients ?
For example we upload webauth bundle and then we want to delete it and recopy another files..
View 4 Replies
View Related
Jan 9, 2011
I had an unusual circumstance come up on an older PIX 525 (6.3(5))
On a recent remote site visit we made a connection to our main office using ver 4.9 of the Cisco VPN Client for OS X. While we were working on a server, the macbook went to sleep shutting down the network interface the VPN Client was using.
From that point forward we were unable establish any layer 3 connectivity to the LAN in out main office using that PIX as a VPN head end. Any connections that were attempted to that firewall would complete and be assigned a client IP from the correct pool but without access to the LAN on the inside interface.
We tested this from multiple external locations using multiple systems, cleared SA's and even debugged IKE and IPSEC using an alternate connection method. There were no errors reported on the firewall but there was also no connectivity.
View 5 Replies
View Related
Feb 27, 2012
I have a problem with PIX 506E that meets the version 6.1, and in an simple computer network equipment seems to behave in strange ways because some web sites do not open or very open slow thereby its operation impracticable. On the other hand other web sites open normally.
Querying the web site of the Cisco, I found several documents discussing the same problem but in a later version ( 7.0 ), not in this version 6.1.
I've tried removing the pix from the network , not the error occurred, again insert pix however tested only with a machine, without the rest of the network and the problem persists
View 13 Replies
View Related
Apr 9, 2013
I have a AP1240 Cisco IOS Software, C1240 Software (C1240-K9W7-M), Version 12.4(10b)JDA3, RELEASE SOFTWARE (fc1), and want to configuration WPA2 without using Radius.But my clients can not connecto to AP. On AP always display messages "%DOT11-7-AUTH_FAILED: Station 0026.6609.e55d Authentication failed"
Here is my configuration:
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname AC1P1F08
[code]......
View 10 Replies
View Related