Cisco VPN :: ASA 5505 VPN Clients Can't Ping Router Or Other Clients On Network

Jun 18, 2012

I have a ASA5505 and it has a vpn set up. The VPN user connects using the Cisco VPN client. They can connect fine (the get an ip address from the ASA), but they can't ping the asa or any clients on the network. Here is the running config:
 
Result of the command: "show running-config"
 
: Saved
:
ASA Version 7.2(4)
!
hostname ASA
domain-name default.domain.invalid
 
[code].....

what I need to add to get the vpn client to be able to ping the router and clients?

View 3 Replies


ADVERTISEMENT

Cisco VPN :: ASA5510 Can't Ping VPN Clients But Clients Can Ping

Feb 29, 2012

I have a strange issue on my ASA 5510 (8.4). I can't ping or connect to the VPN clients but the VPN clients can ping/connect to any inside resources. I have checked all the NAT extemtion entries.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 8.2 - Clients Can't Ping External IP

Nov 4, 2011

I've configured a 5505 but internal clients can't ping external ip. To test I've connect a pc with the ip of the default router on the Outside int the ASA can ping the PC and the PC can ping the ASA, but internal clients can't ping the PC
 
PC config 195.12.23.241/28
 
Here's the ASA config, so far I've wiped the ASA and started with a blank sonfig and built it up but still not working.
 
 
ASA Version 8.2(5)
!
 
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
[Code] .....

View 2 Replies View Related

Cisco VPN :: ASA 5505 AnyConnect Can RDP To Clients But Can't Ping / ICMP

Feb 26, 2012

I setup and SSL anyconnect VPN on my Cisco ASA 5505. It works well and connects with out a problem. However, I can't ping any internal clients, but I can RDP to them. Most of the time people end up posting their config so I will as well.
  
MafSecASA# show run
: Saved
:
ASA Version 8.2(1)

[Code].....

View 3 Replies View Related

Routers / Switches :: Dlink DIR 615 Router - Wireless Clients Can't See Ethernet Clients

Feb 1, 2011

I have 4 desktops cat5 to Dlink DIR 615 router. All work fine. Any wireless clients, laptop or netbooks, see the desktop computers for a while then disconnect somehow. All machines can see the Internet through the router at all times. The desktops disappear from the laptop/netbooks but the wireless machines can be seen from the desktop computers but clicking on them gets 'Access Denied' message after a wait.3 desktops = XP, 1 98SE. All laptop/netbooks = XP

View 2 Replies View Related

Cisco VPN :: 5520 / 5510 - Can VPN Clients Communicate With Other Dynamic Clients

Nov 5, 2012

We currently have an ASA 5520 communicating with 10 ASA 5510's, all on static outside addresses.  I was asked to add 5 additional 5510's on dynamic address.  All worked well in testing until it was decided that some of the dynamic clients needed to talk to each other.

My testing shows packets just dying in the 5520.

View 1 Replies View Related

Netgear WNDR4500 - Clients Not Showing Up In Clients List

Jul 6, 2012

I have a Netgear WNDR4500 running the stock firmware, acting as a router for my home. I also have 2 routers that are flashed with DD-WRT (Linksys WRT54G and Asus WL-520GU) running as client bridges. The Netgear is 192.168.1.1 and the other 2 client bridges are 192.168.1.2 and 192.168.10.3. The Netgear router is performing DHCP giving addresses from 192.168.10.100 to 192.168.10.254. I have numerous machines connected to the Netgear, wirelessly and wired, and numerous machines wired to each client bridge. All machines have IP addresses that are 192.168.10.100, 192.168.10.101, 192.168.10.102, etc... Everything is working fine, but I have one question: When I access the Netgear router, it shows the client bridges as clients, machines that are wired and wireless to the Netgear router are listed as clients, but the client list does not show any clients that are connected to the client bridges. I assumed that since the router is performing DHCP that all clients would show up.

View 2 Replies View Related

Cisco VPN :: 1760 - Cannot Ping Clients

Oct 21, 2011

I have a Cisco 1760 configured as easy VPN server. Using the cisco VPN  client I can connect to the VPN server. The problem is that there is no  ping between clients. When I connect several clients to the VPN server  there is no ping between the clients. But when I login into the router I can ping the clients and make ssh  remote logins into the clients. It seems that there is no access between  the clients and they cannot communicate at all.
 
The cisco router is placed in DMZ zone. Remote clients can connect into the router.

Here is the configuration of the VPN server:
 
[code]
!
version 12.4
service timestamps debug datetime msec

[Code]....

View 4 Replies View Related

Cisco VPN :: ASA 5505 Cannot Connect Clients

Jun 3, 2012

 I configured the VPN on the ASA, I can not  get a client to connect to the ASA 
 
: Saved:ASA Version 7.2(2) !hostname domain-name enable passwordnamesddns update methodddns both!!interface Vlan1nameif insidesecurity-level 100ddns update hostname ddns update dhcp client update dnsip address 192.168.1.1

[Code].....

View 2 Replies View Related

Cisco Firewall :: Cannot Access To DMZ From Vpn Clients ASA 5505 V 9.1(1)

Dec 31, 2012

ASA Version 9.1(1)
!
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6

[Code]....

View 9 Replies View Related

Cisco VPN :: Some AnyConnect Clients Cannot Connect To ASA 5505

Jul 28, 2011

I have an ASA 5505 that has had a working configuration with several AnyConnect clients using dual authentication for weeks now. My normal process for adding new users has been to configure the user in both authentication databases and the onboard certificate authority, have the user connect to the outside IP of our firewall with IE, download the P12 cert after entering their OTP and then connecting once the cert's imported to download AnyConnect.
 
I had to add a new user a couple days ago and curiously IE (8) on their computer could not connect to the outside interface of our firewall, as if the laptop had no internet connectivity. I could telnet to port 443 from a command-line, and could even hit it with Firefox (which I ended up doing to download the P12 cert...). I can hit other SSL-enabled and standard websites from IE as well as Firefox. In addition, because AnyConnect seems to rely on the same mechanism to connect as IE does, AnyConnect can't connect either.
 
I then tested using a previously working laptop fully configured with AnyConnect and a certificate and now it can't connect. There are other previously working laptops that still work, which only makes the issue more clouded.
 
In watching the logs on the firewall, when one of these non-working computers attempts to connect they hit the firewall, a connection is opened and the SSL handshake is started, but it's never finished and the connection is torn down. Working computers complete the handshake as expected and a tunnel is opened.
 
I've checked IE forums for this issue and none of the fixes found therein seem to apply or work. Since this issue seems to only affect IE and AnyConnect's ability to connect to my firewall I have to assume the issue is there.

View 1 Replies View Related

Cisco Switching/Routing :: Cat 6509 Clients Could Ping Gateway / But Couldn't Route Through It

Feb 3, 2013

Last week we had some forwarding issues with our cat 6509e VSS pair, wherby clients could ping the gateway but couldnt route through it! we identified this as being core 2 in the vss pair, yesterday we rebooted the 2nd switch and now the issue has been resolved.

View 4 Replies View Related

Cisco Firewall :: Pix 515E Cannot Ping Or Assign DHCP Addresses To Inside Clients

May 6, 2011

I have a PIX 515E that I want to use to as a border between my internet connection and my Cisco AIR1131AG.  I have configured the PIX to have the outside interface as a dhcp client which gets its dynamic IP address from the cable modem. the AP is connected to the E1 inside interface. Now I could see the E1 interface from the arp table from the AP but I cannot ping it. From the firewall I don't see the ARP  table  from the firewall. and i cannot ping the AP. what is wrong with the configuration? side note, i am able to connect to the AIR1131AG from my laptop I was not able to retrieve an IP address. 
 
FW1 - CONFIGURATION
 
interface Ethernet0 description uplink towards the techsavvy modem speed 100 nameif outside security-level 0 ip address dhcp setroute !interface Ethernet1 description >>> WIFI LAN ACCESS <<< nameif inside security-level 100 ip address 10.0.0.1 255.255.255.0

[Code].....

View 3 Replies View Related

Cisco Wireless :: 4095 With 3560 Clients Cannot Ping Default Gateway When Connected To SSID

May 21, 2013

My controller is vWLC installed in ESXi which has to vNet Cards configured with all vlans(4095), then it is connected to a 3560 switch with trunk. The configuration of the switch interface is as belows: The SSID is BYOD and I can connect the SSID and get the IP address such as 10.10.10.118/24, but for now, i cannot ping 10.10.10.1, but i can ping 10.10.10.90.

View 3 Replies View Related

Cisco Firewall :: ASA 5505 Anyconnect Clients Cannot Access Slingbox

Mar 27, 2012

I'm trying to configure an ASA 5505 to view my Slingbox from my iPhone/iPad from an outside or 3G network.  I can't ping my internal networks while connected via AnyConnect.  I know that I need to free up port 5001, but I can't seem to get it to work. 

View 0 Replies View Related

Cisco VPN :: ASA 5505 - AnyConnect Clients Can't Access External Sites?

Jun 9, 2010

I'm looking to setup AnyConnect VPN with no split tunneling. ASA 5505 v8.2. It seems this should be really easy. I must be missing something.
 
I can get the AnyConnect users to connect fine and they can access sites internal and at other IPSec-tunneled sites. But no access to the internet.
 
Internal is 10.1.1.x, VPN pool is 10.1.1.251-253 (Temp list for testing). I issued the following tracer: packet-tracer input outside tcp 10.1.1.253 12345 69.147.125.65 80 detailed
 
The last reported point (where it fails) is:
  
Phase: 7
Type: WEBVPN-SVC
Subtype: in

[Code].....

View 10 Replies View Related

Cisco Switches :: SGE2010 Clients Need To Route Through ASA 5505 And 3750

May 17, 2011

I need to move the client machines off of the 3750 (and their DHCP dependency on it) to the SGE2010 and absolutely route their internet traffic out through the outside interface on the 5505. They must also be able to communicate back into the internal environment in order to communicate with the production servers.
 
The clients currently use .254 addressing through a dumb dell switch to the 3750 but I am trying to migrate them over slowly to the .253. I know that the 2010 will not do DHCP, so I am putting a DHCP server on that switch right now. The 5505 won't let me add an additional nameif statement onto one of the other eth0/x interfaces and I'm not sure if that has anything to do with it's capabilities to act as a DHCP server (it's not an option in the ASDM) or it's ability to serve as the internet gateway for the 2010 clients. (Side notes: The 5505 has a base license and is currently also connecting 1 site to site VPN. As is the 5520, so all of it's interfaces are used as well).
  
I statically assigned a moved client with a .253 address and plugged it into the 2010. I have tried giving the 2010 both a .4 address and a .253 address but neither will allow me to ping any of the addresses on the 5505. The 2010 shows automatic routes to the two subnets and I set it's default route to 253.1. The link between the 2010 and the 3750 works - clients receive a .254 address from the 3750 and can get out to the internet via the 5505 and reach the production servers as well.
 
Why won't the 2010 see the 5505 as a gateway and allow clients to get to the internet and also traverse the 3750 when they need access to the production network?
 
The reason why I dont' just connect the two swtiches and call it a day is because I also need the production servers to ALWAYS go out/receive web requests via  the 5520 outbound/outside interface. I'm having such a hard time wrapping my head around why i can't get my clients moved over to the new switch, I haven't even grasped how I'm going to do that yet.

View 4 Replies View Related

Cisco Firewall :: 5505 Remote VPN Clients Cannot Access Inside LAN

Apr 15, 2012

I have been asked to set up remote access VPN on an ASA 5505 that I previously had no invlovement with.  I have set it up the VPN using the wizard, they way I normally do, but the clients have no access to anything in the inside subnet, not even the inside interface IP address of the ASA.  Thay can ping each other.  The remote access policy below that I am working on is labeled VPNPHONE, address pool 172.16.20.1-10.  I do not need split tunneling to be enabled.  The active WAN interface is the one labeled outside_cable. [code]

View 1 Replies View Related

Cisco Firewall :: ASA 5505 / ACL To Allow Email Traffic Only To DHCP Clients?

Nov 14, 2011

So here's what I think I should do to give email access only to a segment of addresses of my inside network.
 
1) Create a network object for 62 machines that will represent my dhcp clients.I plan to use 192.168.0.65-192.168.0.126. So I will use address 192.168.0.64 with netmask 255.255.255.192. Then set DHCP server to service this address range.
 
2) Create an ACL which will Permit Any to use tcp port 110 (pop3) to get to the outside. Which leads me to question #1:
 
How do I permit the source "Any" to communicate with "Any Less Secure Networks" like the implicit rule that gets zapped once I create new ACL? Is "Any Less Secure Network" implied by the "Any" destination?
 
3) Create an ACL which will Deny my DHCP range to talk to the outside.
 
4) Create an ACL which will Permit Any to talk to Any Less Secure Network(essentially recreating the implicit Permit ACL that got zapped).

View 1 Replies View Related

Cisco Firewall :: ASA 5505 Reach Local LAN And Internet From VPN Clients

Apr 11, 2011

I'm having trouble setting up local LAN (reach inside network when VPN connected) and Internet access (reach internet when VPN connected) for my VPN CLients when they are connected to my VPN, They can connect, no problem there, but I can't reach any resources when connected. My pings time out, both to my inside network and to public ip adresses, the only thing I'm able to ping is my ASA (172.16.30.1), and I don't se any routes under "Status/Statistics/Route Details" in my cisco VPN Client (when connected).
 
Here's my config
 
ASA Version 8.0(3) !hostname KardesASAdomain-name default.domain.invalidenable password XXXX encryptednames!interface Vlan1 nameif inside security-level 100 ip address 172.16.30.1 255.255.255.0 !interface Vlan10

[Code]....

View 14 Replies View Related

Cisco Firewall :: ASA 5505 - Get Clients To Talk To Active Directory Servers?

Nov 9, 2011

I'm trying to get a couple clients to talk to my Active Directory servers. I've created sub-interfaces on my ASA. So, my clients are on Gi0/1.139 and my two Active Directory servers are on Gi0/1.132. I've enabled traffic on TCP 53-5000 port range according to Microsoft. My clients still can't join the domain. What ports I need to open up? My AD servers are Windows 2003.

View 1 Replies View Related

Cisco Switching/Routing :: ASA 5505 Outside Access For Clients With Dynamically Assigned IPs

Feb 7, 2013

We have an ASA configured to access the internet, which works fine for clients who have an IP address assigned by DHCP, but not for clients with manually assigned IPs.
 
For instance, with the DHCP server configured to give IP addresses between 172.16.101.1 and 172.16.101.10, a device may get the IP address 172.16.101.1. This machine will have connectivity to the internet.
 
If we then configure DHCPd server range as 172.16.101.2 to 172.16.101.10 and statically assign the 172.16.101.1 IP to the client, it will not have internet access. It will, however have inside access and VPN access.
 
If I try to ping 8.8.8.8, the following is logged:
 
ASA 3  Feb 08 2013  15:51:01  8.8.8.8  xxx.xxx.xxx.100    Deny inbound icmp src    outside:8.8.8.8    dst    servers:xxx.xxx.xxx.100 (type 0, code 0)
 
Where 'servers' is the name of the inside interface the request is made from and 'xxx.xxx.xxx.100' is the external IP. It seems as DNAT is not working when the client IP is static assigned.

View 5 Replies View Related

Cisco Firewall :: ASA 5505 Not Giving Out DHCP To Clients / Only Discovery Packet?

May 3, 2012

My ASA 5505 has stopped giving out DHCP address to my machines.Everything was working fine and nothing has changed in the network. I've reloaded the firewall and clear all DHCP on the firewall I've even re-entered the cmd on the ASA.
 
I'm able to staticlly assigned address to the clients and all is way. When I do a DHCP debug on the ASA I don't see any events relating to the DHCP service apart from checking for lease expiry.
 
I've also tried to plug a machine straight into the ASA and no result. I finally did a packet capture and I am seeing the client machine sending out a DHCP discover packet and nothing else is responding.
 
My ASA config is:
 
dhcpd address 192.168.3.10-192.168.3.33 inside
dhcpd dns 8.8.4.4 interface inside
dhcpd option 3 ip 192.168.3.1 interface inside
dhcpd enable inside

View 7 Replies View Related

Cisco Switching/Routing :: ASA 5505 - Exchange Remote Clients Cannot Access

Sep 6, 2012

Just installed ASA -5505 replaced cisco 851
 
My exchange server hosts remote outlook clients and remote web access
 
no one on the remote side can access my exchange server
 
internal mail flows in bound and out bound.
 
My iphone can not access the exchange server either.
 
When the Cisco 851 was online all the above worked great. Nothing changed on the remote client side just put the ASA 5505 in service.
 
I am new to the ASSA 5505 family. Had a reseller configure the router but unable to get them at this hour. Called Cisco support but they are closed at this time also.

View 5 Replies View Related

Cisco Firewall :: 5505 Port Forward External Clients To 1 Address

May 4, 2011

I have a couple of ASA 5505's which work fine for what they are doing VPN and all that - we have 1 DLINK DFR-700 Firewall left and I need to get a new ASA to replace this since it is old.
 
All this box really does is port forward external clients to 1 address on the internal lan for client software updates. Any example configs?
 
So lets say we have client a with IP 1.1.1.1 and client b has 2.2.2.2 - at the moment this is what happens client a and b come in through http and get mapped to the internal http server 10.10.1.2
 
So I need to setup about 100 clients which can come in through http only - get mapped to the internal IP and also keeping the internal server to be able to access anything outside.

View 1 Replies View Related

Linksys Wireless Router :: WRT54g - WLAN Clients / Guest Network?

Feb 8, 2012

I have a wrt54g router and would like to separate the WLAN clients from accessing computers and servers on the LAN... in other words I would like to make it a "guest" network. I've put the router in "router" mode instead of "gateway". I just want to be sure if that is the best thing I can do in terms of turning the wireless network into an isolated one. 

View 4 Replies View Related

Linksys Wireless Router :: E4200v1 Get A List Of DHCP Clients On Guest Network

Jul 3, 2012

I've got an E4200v1 running 1.0.04 firmware with guest access enabled. I'd like to find out who is logged in using the guest access. Is there a way to get a list of the DHCP clients on the guest network? I'm able to do this for the non-guest access via the WEB interface's Status->Local Network->DHCP Clients Table page. But I can't find a similar table for the guest network.

View 3 Replies View Related

Wireless Network For Multiple Clients

Feb 8, 2012

On every floor there are 10 rooms which can have multiple clients (laptops, ipads, smart phones) so let's say 50 clients.how to set up whole thing so the users in every room have decent speed for surfing and watching videos online
[code]...

View 5 Replies View Related

Can't Connect To Other Clients On Local Network?

Jan 17, 2012

I have a computer (client) and I have connected to gateway and internet but I'm not connected to other clients.

View 3 Replies View Related

Cisco VPN :: 5510 VPN Clients Can't Access DMZ Network

Mar 22, 2012

The title says VPN clients cannot access DMZ network, but that is not exactly the problem, the situation is this, a group of users are using an actual 10.x network where they have their servers and pretty much everything. The users must be relocated into a new network, the 172.16.x.  In a point in time they will not have to use 10.x anymore, but meanwhile, they need access to that network.

I have an ASA 5510 as default gateway for the new network (172.16.x.x), one interface e0/0 connected to the outside (internet), interface e0/1 to the inside and other interface connected to the actual 10.x (which I call DMZ), so basically I am using the ASA as a bridge using NAT to grant access to the users in the network 172.16.x to the resources in the 10.x network while the migration is completed.

All the users must use the path to the internet thru the ASA using the NAT overload to the outside interface and I put in place a NAT policy to 10.x to allow access to the 10.x network only when the internal users 172.16.x try to reach that path and so far, everything is working just fine for the internal users.Now for some reason, when I do VPN, the VPN clients cannot reach the 10.x network, even when they are supposed to be in the internal network (because they are doing VPN right?) .

I have enabled split tunneling with NAT exempt the 172.16 network and I am not sure if that is causing the problem, because when I trace from my PC the 172.16.16.1 address using the VPN I get the proper route path, but when I try to reach 10.x, my PC is using its default gateway and not the VPN gateway which has a route to 10.x.

I’m not even sure if what I am trying to do is possible, I want VPN users to be able to access a 10.x network using NAT overload with the Interface of the ASA plugged to the 10.x network, just like the internal users are doing right now.

View 1 Replies View Related

Cisco Firewall :: IOS Firewall Versus ASA (5505 / 5510) For Smaller Clients (less Than 50)?

Apr 24, 2012

We were having a discussion of ios firewall vs. asa for smaller clients(less than 50). On using ios firewall(zbf or cbac)and an asa 5505/5510.  One of the arguments brought up on using ios firewall on the router is that a router will do an ip sla failover.  I have configured a number of isr's for this and i know it works good. 

View 1 Replies View Related

Cisco Firewall :: Max Number Of Clients And Site To Site VPN Tunnels On ASA 5505

Aug 15, 2012

I wanted to know the maximum VPN client sessions (using the Cisco VPN  client) and Site-to-Site VPN tunnels that I can connect to my ASA 5505  simultaneously.
 
In other words, if I have x VPN clients and y Site-to-Site  tunnels, at any time, does x + y have to be <= 10 (Total VPN Peers)?  If yes, can I upgrade to the security plus license to increase the Total VPN Peers to 25?

Licensed features for this platform:
Maximum Physical Interfaces    : 8
VLANs                          : 3, DMZ Restricted
Inside Hosts                   : Unlimited
Failover                       : Disabled
VPN-DES                        : Enabled
[Code]...

View 3 Replies View Related

Cisco Wireless :: WLC 5508 - Get Clients Connecting On Network 192.168.3.0/24?

Aug 6, 2012

question in regards to the deployment of a new WLC and new LAPs,I have configured and connected a 5508 WLC and 3500 series LAP.LAG is enabled in the WLC and successfully connected to the neighboring switch (using etherchannel) and to the network.

The port-channel port is set to trunk mode obviously and certain vlan ids are currently allowed (3-5)

The management interface has this IP address 192.168.5.250/24

I created a WLAN with WLAN ID 3, Interface set to Management and say SSID test1

I have connected a new LAP to the network, which switchport interface is set to access mode and assigned with vlan id 3. The LAP is able to join the WLC successfully with an IP address, such as, 192.168.3.100 (assigned via DHCP).

When I try connecting a mobile client to the wireless LAN, it can successfully detect and connect to the WLAN, created in the WLC (test1) however it gets an IP address by DHCP, in the 192.168.5.0/24 network, which is the IP range of the management interface's IP address.

What can I do to get the clients connecting on network 192.168.3.0/24? I thought this would be the case since I allocated the WLAN Id of 3 in the WLAN test1 configuration and since the LAP switchport is set to access mode with vlan ID 3.

View 3 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved