configuring ASA 5505 to be able to ping remote host.Setup - We have a site-to-site (192.168.1.0/24 - 192.168.2.0/24) VPN setup with client VPN access (IP Pool, 172.16.50.0/24) on 192.168.1.0 ASA 5505.Issue - Not able to ping host on 192.168.2.0 from VPN client 172.16.50.0 but able to ping 192.168.1.0 host.
View 8 RepliesI have, what I believe to be, a simple issue - I must be missing something. Site to Site VPN with Cisco ASA's. VPN is up, and remote hosts can ping the inside int of ASA (10.51.253.209). There is a PC (10.51.253.210) plugged into e0/1.
I know the PC is configured correctly with Windows firewall tuned off. The PC cannot get to the ouside world, and the ASA cannot ping 10.51.253.210.
I have seen this before, and I deleted VLAN 1, recreated it, and I could ping the local host without issue. Basically, the VPN is up and running but PC 10.51.253.210 cannot get out
ASA Version 7.2(4)
!
hostname *****
domain-name *****
enable password N7FecZuSHJlVZC2P encrypted
[Code]...
I am just setting up a simple scenario with a 1841. Server @ 172.31.1.1 cannot ping 172.31.0.254 or 172.31.0.105. It can ping 172.31.1.250. The router can, on the other hand, ping devices on both networks. This is just for testing routing theory so I don't know why hosts on either side of the network cannot ping each other.
I am only using the FastEthernet interfaces on Router 1841.
I have a cisco 5505 and am trying to configure it with ASDM 6.4.
My vpn client connects ok to the network but I am unable to reach any of the servers.
I'm sure its a simple configuration issue as I don't have much experience with Cisco configuation.
I am struggling to get successfull pings beween asa and inside hosts but couldn't succeed. Done packet tracer result is acl-drop
Here is the running config
Prem-ASA(config)# sh run
: Saved
:
[Code].....
DNS resolution works and I can surf the web without fail. But if I try to ping any external hosts (I can ping inside interface of ASA fine) from the LAN I get timeouts. I can ping anything from the ASA without fail.
ASA Version 8.4(1)
!
hostname fw1-nat-ann
domain-name inmd.infoblox.com
enable password anWLNen9CTFp7B/X encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
I'm having an issue where internal hosts cannot access the internet but I am able to ping external hosts when I console into the router. The router is a 2800 series. [code]
View 3 Replies View RelatedI have recently bought two 1800 cisco routers and have tried to connect them over wan serial link, but I am having problems when trying to access resources on the other side. I am a newbie to cisco and I wonder if the problem is with the configuration or the new routers or the serial link between the sites. Below is the show-running config results I have done on both routers; I can ping the serial interfaces from both sides and remotely, but I can't ping hosts or FE from other side.
View 8 Replies View RelatedI've set up a simple lab network of two cisco routers 2611XM and to each router I've attached a computer (host). I have set up a dhcp ip addresses for each host. I've set up a correct routing as well on each router. There are 3 networks: 192.168.1.0/24 192.168.2.0/24 192.168.3.0/24 The first network between the first host and first router, second is between two routers and third is between the second router and second host. If I use first host (192.168.1.20) I can ping to any ip address (192.168.1.1 (router 1), 192.168.2.1 (router 1), 192.168.2.2 (router 2), 192.168.3.1 (router 2)) except the second host ip address which is 192.168.3.20. When I sit on the second host (192.168.3.20) i can ping to 192.168.1.1 (router 1), 192.168.2.1 (router 1), 192.168.2.2 (router 2), 192.168.3.1 (router 2) but i can't ping to the first host which is 192.168.1.20. I've even tried with attaching a switch to a router and assign it an ip address of 192.168.1.3 and the ping was echoing to it.
View 5 Replies View RelatedI purchased this router a few days after its release, and I was very impressed with its functions. I came from a DD-WRT flashed router with all the bells and whistles, and the E4200 lacked some features but I felt it was a fare trade off for the GHz & dual band.All was well with all my settings (quite a few to name QOS,forwarded, etc)I also updated the firmware when it came available and re entered same settings.
Approx 3 months after use I had 0 WAN connection via eth0 or WIFI, when I logged into router I was pulling a Public IP from my ISP. I could ping from inside the router but no connection on any hosts, very strange. Powercycling Modem/Router yielded same results.. I then backed up my vast amount of settings, and did a 30/30/30 reset.. With no configs I had no issue browsing on any host on my network. So I restored from backup and the issue was back again..So I did another 30/30/30 reset. Then went and reentered the exact same settings as before and the issue was gone.
I've got a new E4200 router, Everything works just fine, but I'm unable to ping any WiFi hosts from my LAN, I can ping LAN from any WiFi Host.If I disable NAT on the E4200 I'm able to ping WiFi hosts but then all WiFi Hosts are unable to talk to the LAN.
LAN - 192.9.209.0
WiFi - 172.16.1.0
Same config runs perfect on my WRTG54GL.
I've got a new E4200 router, Everything works just fine, but I'm unable to ping any WiFi hosts from my LAN, I can ping LAN from any WiFi Host.If I disable NAT on the E4200 I'm able to ping WiFi hosts but then all WiFi Hosts are unable to talk to the LAN.
LAN - 192.9.209.0
WiFi - 172.16.1.0
Same config runs perfect on my WRTG54GL.
cisco products and am struggling getting a VPN going between an ASA 5505 and 5510. I have a VPN created (using the VPN wizward on both) and it shows the VPN is up, but I can't ping the remote site (from either side).
View 11 Replies View RelatedI have configured the ASA in a very similar manner to how the PIX was set up but I'm having trouble with some hosts on the inside accessing the Internet. Any inside hosts which use DHCP work fine. Any inside hosts with a static IP (and configured on the ASA with a "static" rule) cannot access the Internet. For example, in the config below the server daviker-dialler cannot access the Internet. I've spent a few days working on this now and have started from scratch several times but I'm not getting anywhere. Apologies for all the X's everywhere, didn't like to post anything sensitive on the Internet.
View 2 Replies View RelatedI'm stuck at asa 5505 nat, port forwarding configuration Here is what i need:
host1: 192.168.1.1 service tcp/100 >>>>> public ip 1.1.1.1 service tcp/100
host2: 192.168.1.2 service tcp/200 >>>>> public ip 1.1.1.1 service tcp/200
host3: 192.168.1.3 service tcp/300 >>>>> public ip 1.1.1.1 service tcp/300
So people from remote just need to use 1.1.1.1 public ip to access all the ports on three different inside server.I can do this on my old ASA 5505 with 8.0(4). Looks like there're lots of change from 8.0 to 8.4.
At the end of the day I simply need to upgrade the license on my ASA 5505 v7.2.4 (upgrade will come later as part of a larger project) to allow for >10 Inside Hosts. From what I've read there seems to be a 50 license upgrade out there. Can this be purchased directly? From whom? Will it only affect the Inside Hosts number and not affect any other licenses, configurations, etc. Just being overly cautious since this is way outside of my normal realm. Below is the current activation-key information....
Result of the command: "show activation-key"
Serial Number: xxxxxxxxxxxxxx
Running Activation Key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 10
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 10
WebVPN Peers : 2
Dual ISPs : Disabled
VLAN Trunk Ports : 0
This platform has a Base license.
The flash activation key is the SAME as the running key.
I'm working on setting up a template configuration for the Cisco ASA 5505 device that we'll use to configure more routers for various client needs. One of the requirements requested of me is the following: Internal hosts assigned a DHCP address are blocked from the internet Internal hosts with a static IP are permitted access to internet All internal hosts can communicate regardless of state
Now, I'm fairly new to this and I'm certain my terminology isn't correct so googling the problem has been fruitless. I have followed basic configuration guides and have configured the device to hand out DHCP addresses to hosts plugged in ports 1-7. If I'm plugged in and specify my address manually in the OS I am blocked from any access so I can only assume there is an access policy or some rule preventing me from authenticating against the router despite having set up VLAN1 to be the entire class C subnet. What sort of steps would I need to do to configure this? New access lists. For the record, the dhcp addresses are in the range of 10.100.31.64-10.100.31.95. VPN users are assigned an address from 10.100.31.220-10.100.31.240 and there seems to be no issues with that configuraiton. I don't wish to constrain what addresses a user can use should they specify a static IP (10.100.31.5 should be just as valid as 10.100.31.100).
Remote access VPN. Its configured on a Cisco PIX525 running ver 6.3(5) (old I know!) and I am running Cisco VPN client ver 5.06.0160 on the client end. Ok so here's the thing. The client connects ok, and it gets an IP address no problem. But I cannot ping anything on the remote LAN. So the client is coming across the internet, the VPN adapter has a 192.168.1.1 address assigned by the PIX and I am trying to ping the 192.168.0.4 address assigned to a switch on the inside of the firewall but with no joy. [code]
View 1 Replies View RelatedI have a ASA 5505.|I configured it for remote access VPN from cisco VPN client.the ASA receives a public ip address on outside interface via PPPoE.I can connect to public ip of outside interface and address 10.1.1.2 is assigned to my Cisco vpn client.the problem is that I Cannot ping or reach ASA internal IP address 172.16.29.1 in any way when I am in VPN from outside,while I Can ping other hosts on 172.16.29.0/24 when connected in VPN.this is a problem brcause when I am connected in VPN to ASA I Cannot configure it..Then I Wanted to ask if it is possible a configuration which gives addresses from network 172.16.29.0/24 (the same as inside network) to VPN clients instead of another network (10.1.1.0/24) [code]
View 1 Replies View RelatedWe have a VPN using 857 and 877 routers as remote connecting in to a 2800 EZVPN Server.
The VPN is working fine. However, the VPN connections sometimes (after a few hours/days) seem to "freeze". A "show crypt sess" shows the connections as Up/Active, but you can not ping antyhing from remote to server, or visa versa, nor does any traffic flow. I then added a "isakmp keep-alive" on the 2800, which improved the situation a bit, but not as much as I hoped.
On the 877 I then implemented a IP SLA, with Object Tracking and then use a Event Manager to just issue a "clear crypto session" . This solved the problem.
However, what do I do on the 857 ? It does not support Object Tracking or the Event Manager. Is there any other mechanism to monitor and reset these frozen/stale VPN connections automatically ?
I am having problem connecting to my work PC via VPN Cant ping and RDP. I sometimes need to log into my work PC to check out a problem. I connect via VPN and I can access servers (using Citrix and local intranet sites) that can only be accessed once connected to my work domain. So it looks like the VPN actually works fine.
But I cannot Remote Desktop Connection to it. I also tried to ping the PC using a command prompt. Using the command prompt, I ping MyWorkPC And I can see that it tries to ping MyWorkPC.domain.name.co.za. So it looks like it sees the MyWorkPC on the network. But all pings fail.
A work colleague tried to remote connects to MyWorkPC from his home PC and he can successfully connect. So I do believe that the work network and PC is setup correctly. I am running window 7 Ultimate SP1 (32bit) with a 3G dongle in a router. I also have Avast antivirus installed on my PC. I was not sure if the router or the antivirus was the issue so I tried:
1.Removing the 3G dongle and attach it to my USB port on my home PC directly. No luck
2.Some blogs said that the P2P or IM shield on Avast might be the problem so I disable it. No luck
3.Then I uninstalled Avast completely to see if it has any shield that might still block it. I restarted. No luck
I have 4 x 2960 switches in a remote site. These are managed by an NMS in our DC, the NMS IP ends in 35.100 with a /23 mask.
When they are first booted, the switches are visable to the NMS, but after a week or 2, 3 of them drop connection to it. If you reboot them again they are fine. You are able to log onto them form thier local router and use a Radius server which is in the same subnet as the NMS.
The odd thing is, whilst they can not ping the NMS, they are able to ping any other addresses in the 34.0/23 range.
The config on the one that does not lose connection is the same as the other 3 and I have also rebooted the NMS.
I can use PPTP and access all the PCs on a flat network at a remote site. I can ping the pcs and connect with netsupport manager. When I use QVPN I cannot do this. Why? I have added custom ports 5405 for NSM and applied ACL put no joy. I also added PING to ACL but it still doesn't work.
View 1 Replies View RelatedI've setup a CISCO 871 which receives DHCP IP address on WAN interface Fa4 and DHCP-assigned static IP Address on virtual-ppp1. The static address is used for site-to-site VPN's, while I've planned the DHCP address for standard web access and CISCO VPN Client dial-out.
Internally, I've created 2 VLAN's, one for standard PC's with access to the remote sites via site-to-site and cisco client, and the other for a 'secured' area with only HTTP/S allowed out. [code]
Clients in the PCLAN should also be allowed to dial-out using CISCO VPN client to remote sites via the OUTSIDE interface. This is partially working because the client does log into a remote site, however I cannot ping or rdp remote stations once connected."ip inspect log drop-packets" does not reveal dropped packets when trying to ping or rdp. [code]
I'm configuring ASA 5510 Remote Access VPN, I can connect from Cisco VPN Client to the ASA VPN. I obtain from ASA some routes to inside networks, but I can't do any ping to those inside hosts. I have got those error in ASDM log file: [code]
View 1 Replies View RelatedI recently purchased a RV110W wireless router for a client. I am having issues with the VPN access. Here is the client's access log:
2012/04/17 10:59:41 [STATUS]Disconnecting...2012/04/17 10:59:47 [STATUS]Success to disconnect.2012/04/17 11:00:03 [STATUS]OS Version: Windows XP2012/04/17 11:00:03 [STATUS]Windows Firewall is OFF2012/04/17 11:00:04 [STATUS]One network interface
[Code].....
I've called Cisco tech support but the answer is disregard the log message and everything is working, and that I have a configuration issue on my end.
I have two computers side by side 192.168.1.7 and 192.168.1.8 both running xp pro sp3. On 8 I can RDC to the 7, but on 7 I cannot RDC to 8. I can see port 3389 listening on both using netstat -a. But 7 just can't RDC connect to 8. 7 cannot ping 8 either. I have the firewall turned off on 8, I had tried allowing RDC 3389 earlier with the firewall but that didn't work either.I don't have any extra firewalls running.Life will be like perfect, if I can just RDC to 8.Both are on the same wired belkin wireless router, 4' from itl.I tried taking the no ping no rdc computer to work and it didn't work there either.
View 19 Replies View RelatedI have a need to Remote Desktop connect to company’s employees for support then they are abroad and using Cisco AnyConnect client.Cisco AnyConnect client connection works fine, clients can reach company’s inside network without problems, but I cannot make revers connection, I cannot Remote Desktop connect or ping VPN clients from companies inside network. I cannot ping clients from ASA too.I am using ASA 5520, Cisco Adaptive Security Appliance Software Version 8.4(3) Device Manager Version 6.4(7), and Cisco AnyConnect VPN Client 2.2.0133. Protocol Encryption- AnyConnect-Parent SSL – Tunnel DTLS-RC4 RC4 AES 128.
View 0 Replies View RelatedI have setup a VPN connection on a 891 router. I can connect to the VP both but am unable to ping or access any resources on the remote network.
Here is my running configuration:
[code]...
I am in a test environment using an ASA 55005 and a Cisoc 2611xm router. ASA is running version 8.4 and router is running is ios12.4. My VPN tunnel comes up but I am unable to ping between remote hosts. I used the ASDM and SDM for the configuration. Attached is a copy of both configs.
View 8 Replies View RelatedI have an GRE Tunnel across my head office and remote site with multiple subnets using cisco 1841 routers.I can ping most of the devices on the remote side, but I can not ping certain devices.These devices respond to ping requests on the local LAN, but not through the WAN link. If I change the IP of device than it start responding. I am using same gateway and mask on these devices.The remote site is running classic STP on switches with distribution switch being the root bridge.
View 4 Replies View RelatedI have a RVS4000 with client VPNs setup and have created all 5 users......trouble I run into is that when one of the users attempts to connect to the VPN from a second device (ie the sixth device to connect to the VPN), the connection does not establish....cannot ping remote server (using QuickVPN). In looking at the logs, the device that isn't working is getting a different IP (172.16 vs 192.168). I know I'm limited to 5 users, but am I limited to 5 devices as well?
View 2 Replies View RelatedI am trying to set up a lan to lan vpn access with 2 asa5505's but I cannot ping, traceroute or connect from either side. I can connect to both ASA 5505's from the internet, and connect to the internet FROM both 5505's, just not one to the other. I can ping the network GATEWAYS to the routers, just not the routers themselves.
Both of these machines have been configured for previous VPNs but that configuration has been removed.